2025-04-29 12:17:49 +02:00
447 changed files with 42676 additions and 76756 deletions
--- a/.dir-locals.el
+++ b/.dir-locals.el
@ -1,2 +0,0 @@
-((c++-mode . ((indent-tabs-mode . t)))
- (c-mode . ((mode . c++))))
--- a/.editorconfig
+++ b/.editorconfig
@ -1,39 +0,0 @@
-# editorconfig.org
-
-root = true
-
-[*]
-# Unix style files
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[Makefile,Makefile.*]
-indent_style = tab
-indent_size = 4
-
-[*.cmd]
-indent_style = space
-indent_size = 2
-end_of_line = crlf
-
-[*.{h,cpp}]
-indent_style = tab
-indent_size = 4
-
-[*.rc]
-indent_style = space
-indent_size = 4
-
-[*.{md,markdown}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = false
-
-[*.yml]
-indent_style = space
-indent_size = 2
-
-[*.patch]
-trim_trailing_whitespace = false
--- a/.gitattributes
+++ b/.gitattributes
@ -1 +0,0 @@
-/build/build_mingw.cmd eol=crlf
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@ -1,61 +0,0 @@
-name: Build Debian packages
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build-deb.yml
-    - contrib/**
-    - daemon/**
-    - debian/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Makefile
-    - Makefile.linux
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-jobs:
-  build:
-    name: ${{ matrix.dist }}
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        dist: ['buster', 'bullseye', 'bookworm']
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Commit Hash
-      id: commit
-      uses: prompt/actions-commit-hash@v3.0.0
-
-    - name: Build package
-      uses: jtdor/build-deb-action@v1
-      with:
-        docker-image: debian:${{ matrix.dist }}-slim
-        buildpackage-opts: --build=binary --no-sign
-        before-build-hook: debchange --controlmaint --local "+${{ steps.commit.outputs.short }}~${{ matrix.dist }}" -b --distribution ${{ matrix.dist }} "CI build"
-        extra-build-deps: devscripts git
-
-    - name: Upload package
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd_${{ matrix.dist }}
-        path: debian/artifacts/i2pd_*.deb
-
-    - name: Upload debugging symbols
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-dbgsym_${{ matrix.dist }}
-        path: debian/artifacts/i2pd-dbgsym_*.deb
--- a/.github/workflows/build-freebsd.yml
+++ b/.github/workflows/build-freebsd.yml
@ -1,50 +0,0 @@
-name: Build on FreeBSD
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build-freebsd.yml
-    - build/CMakeLists.txt
-    - build/cmake_modules/**
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Makefile
-    - Makefile.bsd
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    name: with UPnP
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Test in FreeBSD
-      id: test
-      uses: vmactions/freebsd-vm@v1
-      with:
-        usesh: true
-        mem: 2048
-        sync: rsync
-        copyback: true
-        prepare: pkg install -y devel/cmake devel/gmake devel/boost-libs security/openssl net/miniupnpc
-        run: |
-          cd build
-          cmake -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release .
-          gmake -j2
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-freebsd
-        path: build/i2pd
--- a/.github/workflows/build-osx.yml
+++ b/.github/workflows/build-osx.yml
@ -1,45 +0,0 @@
-name: Build on OSX
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build-osx.yml
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Makefile
-    - Makefile.homebrew
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-jobs:
-  build:
-    name: With USE_UPNP=${{ matrix.with_upnp }}
-    runs-on: macOS-latest
-
-    strategy:
-      fail-fast: true
-      matrix:
-        with_upnp: ['yes', 'no']
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Install required formulae
-      run: |
-        find /usr/local/bin -lname '*/Library/Frameworks/Python.framework/*' -delete
-        brew update
-        brew install boost miniupnpc openssl@1.1
-
-    - name: List installed formulae
-      run: brew list
-
-    - name: Build application
-      run: make HOMEBREW=1 USE_UPNP=${{ matrix.with_upnp }} PREFIX=$GITHUB_WORKSPACE/output -j3
--- a/.github/workflows/build-windows-msvc.yml-disabled
+++ b/.github/workflows/build-windows-msvc.yml-disabled
@ -1,80 +0,0 @@
-name: Build on Windows with MSVC
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build-windows-msvc.yml
-    - build/CMakeLists.txt
-    - build/cmake_modules/**
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Win32/**
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-jobs:
-  build:
-    name: Build
-    runs-on: windows-latest
-    env:
-      boost_path: ${{ github.workspace }}\boost_1_83_0
-      openssl_path: ${{ github.workspace }}\openssl_3_2_1
-
-    strategy:
-      fail-fast: false
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Build and install zlib
-      run: |
-        powershell -Command "(Invoke-WebRequest -Uri https://raw.githubusercontent.com/r4sas/zlib.install/master/install.bat -OutFile install_zlib.bat)"
-        powershell -Command "(Get-Content install_zlib.bat) | Set-Content install_zlib.bat" # fixing line endings
-        set BUILD_TYPE=Debug
-        ./install_zlib.bat
-        set BUILD_TYPE=Release
-        ./install_zlib.bat
-        del install_zlib.bat
-
-    - name: Install Boost
-      run: |
-        powershell -Command "(Start-BitsTransfer -Source https://sourceforge.net/projects/boost/files/boost-binaries/1.83.0/boost_1_83_0-msvc-14.3-64.exe/download -Destination boost_1_83_0-msvc-14.3-64.exe)"
-        ./boost_1_83_0-msvc-14.3-64.exe /DIR="${{env.boost_path}}" /VERYSILENT /SUPPRESSMSGBOXES /SP-
-
-    - name: Install OpenSSL
-      run: |
-        powershell -Command "(Start-BitsTransfer -Source https://slproweb.com/download/Win64OpenSSL-3_2_1.exe -Destination Win64OpenSSL-3_2_1.exe)"
-        ./Win64OpenSSL-3_2_1.exe /DIR="${{env.openssl_path}}" /TASKS="copytobin" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
-
-    - name: Make copy of the OpenSSL libraries for CMake
-      run: |
-        dir ${{ github.workspace }}
-        dir ${{env.openssl_path}}\lib\VC
-        dir ${{env.openssl_path}}\lib\VC\x64\
-        dir ${{env.openssl_path}}\lib\VC\x64\MTd\
-        xcopy /s /y "${{env.openssl_path}}\lib\VC\x64\MTd" "${{env.openssl_path}}\lib"
-
-    - name: Configure
-      working-directory: build
-      run: cmake -DBoost_ROOT="${{env.boost_path}}" -DOPENSSL_ROOT_DIR="${{env.openssl_path}}" -DWITH_STATIC=ON .
-
-    - name: Build
-      working-directory: build
-      run: cmake --build . --config Debug -- -m
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-msvc
-        path: build/Debug/i2pd.*
-
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@ -1,250 +0,0 @@
-name: Build on Windows
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build-windows.yml
-    - build/CMakeLists.txt
-    - build/cmake_modules/**
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Win32/**
-    - Makefile
-    - Makefile.mingw
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-defaults:
-  run:
-    shell: msys2 {0}
-
-jobs:
-  build:
-    name: ${{ matrix.arch }}
-    runs-on: windows-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
-        ]
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Setup MSYS2
-      uses: msys2/setup-msys2@v2
-      with:
-        msystem: ${{ matrix.msystem }}
-        install: base-devel git mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-boost mingw-w64-${{ matrix.arch }}-openssl mingw-w64-${{ matrix.arch }}-miniupnpc
-        update: true
-
-    - name: Install additional clang packages
-      if: ${{ matrix.msystem == 'CLANG64' }}
-      run: pacman --noconfirm -S mingw-w64-${{ matrix.arch }}-gcc-compat
-
-    - name: Build application
-      run: |
-        mkdir -p obj/Win32 obj/libi2pd obj/libi2pd_client obj/daemon
-        make USE_UPNP=yes DEBUG=no USE_GIT_VERSION=yes -j3
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-${{ matrix.arch_short }}.exe
-        path: i2pd.exe
-
-  build-cmake:
-    name: CMake ${{ matrix.arch }}
-    runs-on: windows-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
-        ]
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Setup MSYS2
-      uses: msys2/setup-msys2@v2
-      with:
-        msystem: ${{ matrix.msystem }}
-        install: base-devel git mingw-w64-${{ matrix.arch }}-cmake mingw-w64-${{ matrix.arch }}-ninja mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-boost mingw-w64-${{ matrix.arch }}-openssl mingw-w64-${{ matrix.arch }}-miniupnpc
-        update: true
-
-    - name: Build application
-      run: |
-        cd build
-        cmake -DWITH_GIT_VERSION=ON -DWITH_STATIC=ON -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release .
-        cmake --build . -- -j3
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-cmake-${{ matrix.arch_short }}.exe
-        path: build/i2pd.exe
-
-  build-xp:
-    name: XP
-    runs-on: windows-latest
-
-    strategy:
-        fail-fast: false
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Setup MSYS2
-      uses: msys2/setup-msys2@v2
-      with:
-        msystem: MINGW32
-        install: base-devel git mingw-w64-i686-gcc mingw-w64-i686-boost mingw-w64-i686-openssl mingw-w64-i686-miniupnpc
-        cache: true
-        update: true
-
-    - name: Clone MinGW packages repository and revert boost to 1.85.0
-      run: |
-        git clone https://github.com/msys2/MINGW-packages
-        cd MINGW-packages
-        git checkout 4cbb366edf2f268ac3146174b40ce38604646fc5 mingw-w64-boost
-        cd mingw-w64-boost
-        sed -i 's/boostorg.jfrog.io\/artifactory\/main/archives.boost.io/' PKGBUILD
-
-    # headers
-    - name: Get headers package version
-      id:  version-headers
-      run: |
-        echo "version=$(pacman -Si mingw-w64-i686-headers-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache headers package
-      uses: actions/cache@v4
-      id: cache-headers
-      with:
-        path: MINGW-packages/mingw-w64-headers-git/*.zst
-        key: winxp-headers-${{ steps.version-headers.outputs.version }}
-    - name: Build WinXP-capable headers package
-      if: steps.cache-headers.outputs.cache-hit != 'true'
-      run: |
-        cd MINGW-packages/mingw-w64-headers-git
-        sed -i 's/0x601/0x501/' PKGBUILD
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Install headers package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-headers-git/mingw-w64-i686-*-any.pkg.tar.zst
-
-    # CRT
-    - name: Get crt package version
-      id:  version-crt
-      run: |
-        echo "version=$(pacman -Si mingw-w64-i686-crt-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache crt package
-      uses: actions/cache@v4
-      id: cache-crt
-      with:
-        path: MINGW-packages/mingw-w64-crt-git/*.zst
-        key: winxp-crt-${{ steps.version-crt.outputs.version }}
-    - name: Build WinXP-capable crt package
-      if: steps.cache-crt.outputs.cache-hit != 'true'
-      run: |
-        cd MINGW-packages/mingw-w64-crt-git
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Install crt package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-crt-git/mingw-w64-i686-*-any.pkg.tar.zst
-
-    # winpthreads
-    - name: Get winpthreads package version
-      id:  version-winpthreads
-      run: |
-        echo "version=$(pacman -Si mingw-w64-i686-winpthreads-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache winpthreads package
-      uses: actions/cache@v4
-      id: cache-winpthreads
-      with:
-        path: MINGW-packages/mingw-w64-winpthreads-git/*.zst
-        key: winxp-winpthreads-${{ steps.version-winpthreads.outputs.version }}
-    - name: Build WinXP-capable winpthreads package
-      if: steps.cache-winpthreads.outputs.cache-hit != 'true'
-      run: |
-        cd MINGW-packages/mingw-w64-winpthreads-git
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Install winpthreads package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-winpthreads-git/mingw-w64-i686-*-any.pkg.tar.zst
-
-    # OpenSSL
-    - name: Get openssl package version
-      id:  version-openssl
-      run: |
-        echo "version=$(pacman -Si mingw-w64-i686-openssl | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache openssl package
-      uses: actions/cache@v4
-      id: cache-openssl
-      with:
-        path: MINGW-packages/mingw-w64-openssl/*.zst
-        key: winxp-openssl-${{ steps.version-openssl.outputs.version }}
-    - name: Build WinXP-capable openssl package
-      if: steps.cache-openssl.outputs.cache-hit != 'true'
-      run: |
-        cd MINGW-packages/mingw-w64-openssl
-        gpg --recv-keys D894E2CE8B3D79F5
-        gpg --recv-keys 216094DFD0CB81EF
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Install openssl package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-openssl/mingw-w64-i686-*-any.pkg.tar.zst
-
-    # Boost
-    #- name: Get boost package version
-    #  id:  version-boost
-    #  run: |
-    #    echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache boost package
-      uses: actions/cache@v4
-      id: cache-boost
-      with:
-        path: MINGW-packages/mingw-w64-boost/*.zst
-        key: winxp-boost-1.85.0+crt-${{ steps.version-headers.outputs.version }}+ossl-${{ steps.version-openssl.outputs.version }}
-    # Rebuild package if packages above has changed
-    - name: Build WinXP-capable boost package
-      if: steps.cache-boost.outputs.cache-hit != 'true'
-      run: |
-        cd MINGW-packages/mingw-w64-boost
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Remove boost packages
-      run: pacman --noconfirm -R mingw-w64-i686-boost mingw-w64-i686-boost-libs
-    - name: Install boost package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-boost/mingw-w64-i686-*-any.pkg.tar.zst
-
-    # Building i2pd
-    - name: Build application
-      run: |
-        mkdir -p obj/Win32 obj/libi2pd obj/libi2pd_client obj/daemon
-        make USE_UPNP=yes DEBUG=no USE_GIT_VERSION=yes USE_WINXP_FLAGS=yes -j3
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: i2pd-xp.exe
-        path: i2pd.exe
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -1,67 +0,0 @@
-name: Build on Ubuntu
-
-on:
-  push:
-    branches:
-    - '*'
-    paths:
-    - .github/workflows/build.yml
-    - build/CMakeLists.txt
-    - build/cmake_modules/**
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Makefile
-    - Makefile.linux
-    tags:
-    - '*'
-  pull_request:
-    branches:
-    - '*'
-
-jobs:
-  build-make:
-    name: Make with USE_UPNP=${{ matrix.with_upnp }}
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: true
-      matrix:
-        with_upnp: ['yes', 'no']
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: install packages
-      run: |
-        sudo apt-get update
-        sudo apt-get install build-essential libboost-all-dev libminiupnpc-dev libssl-dev zlib1g-dev
-
-    - name: build application
-      run: make USE_UPNP=${{ matrix.with_upnp }} -j3
-
-  build-cmake:
-    name: CMake with -DWITH_UPNP=${{ matrix.with_upnp }}
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: true
-      matrix:
-        with_upnp: ['ON', 'OFF']
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: install packages
-      run: |
-        sudo apt-get update
-        sudo apt-get install build-essential cmake libboost-all-dev libminiupnpc-dev libssl-dev zlib1g-dev
-
-    - name: build application
-      run: |
-        cd build
-        cmake -DWITH_UPNP=${{ matrix.with_upnp }} .
-        make -j3
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -1,140 +0,0 @@
-name: Build containers
-
-on:
-  push:
-    branches:
-    - openssl
-    - docker
-    paths:
-    - .github/workflows/docker.yml
-    - contrib/docker/**
-    - contrib/certificates/**
-    - daemon/**
-    - i18n/**
-    - libi2pd/**
-    - libi2pd_client/**
-    - Makefile
-    - Makefile.linux
-    tags:
-    - '*'
-
-jobs:
-  build:
-    name: Building container for ${{ matrix.platform }}
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
-
-    strategy:
-      matrix:
-        include: [
-          { platform: 'linux/amd64', archname: 'amd64' },
-          { platform: 'linux/386', archname: 'i386' },
-          { platform: 'linux/arm64', archname: 'arm64' },
-          { platform: 'linux/arm/v7', archname: 'armv7' },
-        ]
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Login to DockerHub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-    - name: Login to GitHub Container registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Build container for ${{ matrix.archname }}
-      uses: docker/build-push-action@v5
-      with:
-        context: ./contrib/docker
-        file: ./contrib/docker/Dockerfile
-        platforms: ${{ matrix.platform }}
-        push: true
-        tags: |
-          purplei2p/i2pd:latest-${{ matrix.archname }}
-          ghcr.io/purplei2p/i2pd:latest-${{ matrix.archname }}
-        provenance: false
-
-  push:
-    name: Pushing merged manifest
-    runs-on: ubuntu-latest
-
-    permissions:
-      packages: write
-      contents: read
-
-    needs: build
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Login to DockerHub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-    - name: Login to GitHub Container registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Create and push latest manifest image to Docker Hub
-      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-      uses: Noelware/docker-manifest-action@master
-      with:
-        inputs: purplei2p/i2pd:latest
-        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
-        push: true
-
-    - name: Create and push latest manifest image to GHCR
-      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-      uses: Noelware/docker-manifest-action@master
-      with:
-        inputs: ghcr.io/purplei2p/i2pd:latest
-        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
-        push: true
-
-    - name: Store release version to env
-      if: ${{ startsWith(github.ref, 'refs/tags/') }}
-      run: echo "RELEASE_VERSION=${GITHUB_REF:10}" >> $GITHUB_ENV
-
-    - name: Create and push release manifest to Docker Hub
-      if: ${{ startsWith(github.ref, 'refs/tags/') }}
-      uses: Noelware/docker-manifest-action@master
-      with:
-        inputs: purplei2p/i2pd:latest,purplei2p/i2pd:latest-release,purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
-        push: true
-
-    - name: Create and push release manifest to GHCR
-      if: ${{ startsWith(github.ref, 'refs/tags/') }}
-      uses: Noelware/docker-manifest-action@master
-      with:
-        inputs: ghcr.io/purplei2p/i2pd:latest,ghcr.io/purplei2p/i2pd:latest-release,ghcr.io/purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
-        push: true
--- a/.gitignore
+++ b/.gitignore
@ -1,27 +1,15 @@
 # i2pd
-*.o
+obj/*.o
 router.info
 router.keys
 i2p
 netDb
-/i2pd
-/libi2pd.a
-/libi2pdclient.a
-/libi2pdlang.a
-/libi2pd.so
-/libi2pdclient.so
-/libi2pdlang.so
-/libi2pd.dll
-/libi2pdclient.dll
-/libi2pdlang.dll
-*.exe
-

 # Autotools
 autom4te.cache
 .deps
 stamp-h1
-#Makefile
+Makefile
 config.h
 config.h.in~
 config.log
@ -241,39 +229,3 @@ pip-log.txt

 #Mr Developer
 .mr.developer.cfg
-
-# Sphinx
-docs/_build
-/androidIdea/
-
-# Doxygen
-docs/generated
-
-# emacs files
-*~
-*\#*
-
-# gdb files
-.gdb_history
-
-# cmake makefile
-build/Makefile
-
-# debian stuff
-debian/i2pd.1.gz
-.pc/
-
-# qt 
-
-qt/i2pd_qt/*.autosave
-qt/i2pd_qt/*.ui.bk*
-qt/i2pd_qt/*.ui_*
-
-#unknown android stuff
-android/libs/
-
-#various logs
-*LOGS/
-
-qt/build-*.sh*
-
--- a/AddressBook.cpp
+++ b/AddressBook.cpp
@ -0,0 +1,547 @@
+#include <string.h>
+#include <inttypes.h>
+#include <string>
+#include <map>
+#include <fstream>
+#include <chrono>
+#include <condition_variable>
+#include <boost/filesystem.hpp>
+#include <boost/lexical_cast.hpp>
+#include <cryptopp/osrng.h>
+#include "base64.h"
+#include "util.h"
+#include "Identity.h"
+#include "Log.h"
+#include "NetDb.h"
+#include "ClientContext.h"
+#include "AddressBook.h"
+
+namespace i2p
+{
+namespace client
+{
+
+	class AddressBookFilesystemStorage: public AddressBookStorage
+	{
+		public:
+
+			AddressBookFilesystemStorage ();
+			bool GetAddress (const i2p::data::IdentHash& ident, i2p::data::IdentityEx& address) const;
+			void AddAddress (const i2p::data::IdentityEx& address);
+			void RemoveAddress (const i2p::data::IdentHash& ident);
+
+			int Load (std::map<std::string, i2p::data::IdentHash>& addresses);
+			int Save (const std::map<std::string, i2p::data::IdentHash>& addresses);
+
+		private:	
+			
+			boost::filesystem::path GetPath () const { return i2p::util::filesystem::GetDefaultDataDir() / "addressbook"; };
+
+	};
+
+	AddressBookFilesystemStorage::AddressBookFilesystemStorage ()
+	{
+		auto path = GetPath ();
+		if (!boost::filesystem::exists (path))
+		{
+			// Create directory is necessary
+			if (!boost::filesystem::create_directory (path))
+				LogPrint (eLogError, "Failed to create addressbook directory");
+		}
+	}
+
+	bool AddressBookFilesystemStorage::GetAddress (const i2p::data::IdentHash& ident, i2p::data::IdentityEx& address) const
+	{
+		auto filename = GetPath () / (ident.ToBase32() + ".b32");
+		std::ifstream f(filename.c_str (), std::ifstream::binary);
+		if (f.is_open ())	
+		{
+			f.seekg (0,std::ios::end);
+			size_t len = f.tellg ();
+			if (len < i2p::data::DEFAULT_IDENTITY_SIZE)
+			{
+				LogPrint (eLogError, "File ", filename, " is too short. ", len);
+				return false;
+			}
+			f.seekg(0, std::ios::beg);
+			uint8_t * buf = new uint8_t[len];
+			f.read((char *)buf, len);
+			address.FromBuffer (buf, len);
+			delete[] buf;
+			return true;
+		}
+		else
+			return false;
+	}
+
+	void AddressBookFilesystemStorage::AddAddress (const i2p::data::IdentityEx& address)
+	{
+		auto filename = GetPath () / (address.GetIdentHash ().ToBase32() + ".b32");
+		std::ofstream f (filename.c_str (), std::ofstream::binary | std::ofstream::out);
+		if (f.is_open ())	
+		{
+			size_t len = address.GetFullLen ();
+			uint8_t * buf = new uint8_t[len];
+			address.ToBuffer (buf, len);
+			f.write ((char *)buf, len);
+			delete[] buf;
+		}
+		else
+			LogPrint (eLogError, "Can't open file ", filename);	
+	}	
+
+	void AddressBookFilesystemStorage::RemoveAddress (const i2p::data::IdentHash& ident)
+	{
+		auto filename = GetPath () / (ident.ToBase32() + ".b32");
+		if (boost::filesystem::exists (filename))  
+			boost::filesystem::remove (filename);
+	}
+
+	int AddressBookFilesystemStorage::Load (std::map<std::string, i2p::data::IdentHash>& addresses)
+	{
+		int num = 0;	
+		auto filename = GetPath () / "addresses.csv";
+		std::ifstream f (filename.c_str (), std::ofstream::in); // in text mode
+		if (f.is_open ())	
+		{
+			addresses.clear ();
+			while (!f.eof ())
+			{
+				std::string s;
+				getline(f, s);
+				if (!s.length())
+					continue; // skip empty line
+
+				size_t pos = s.find(',');
+				if (pos != std::string::npos)
+				{
+					std::string name = s.substr(0, pos++);
+					std::string addr = s.substr(pos);
+
+					i2p::data::IdentHash ident;
+					ident.FromBase32 (addr);
+					addresses[name] = ident;
+					num++;
+				}		
+			}
+			LogPrint (eLogInfo, num, " addresses loaded");
+		}
+		else
+			LogPrint (eLogWarning, filename, " not found");
+		return num;
+	}
+
+	int AddressBookFilesystemStorage::Save (const std::map<std::string, i2p::data::IdentHash>& addresses)
+	{
+		int num = 0;
+		auto filename = GetPath () / "addresses.csv";
+		std::ofstream f (filename.c_str (), std::ofstream::out); // in text mode
+		if (f.is_open ())	
+		{
+			for (auto it: addresses)
+			{
+				f << it.first << "," << it.second.ToBase32 () << std::endl;
+				num++;
+			}
+			LogPrint (eLogInfo, num, " addresses saved");
+		}
+		else	
+			LogPrint (eLogError, "Can't open file ", filename);	
+		return num;	
+	}	
+
+//---------------------------------------------------------------------
+	AddressBook::AddressBook (): m_IsLoaded (false), m_IsDownloading (false), 
+		m_DefaultSubscription (nullptr), m_SubscriptionsUpdateTimer (nullptr)
+	{
+	}
+
+	AddressBook::~AddressBook ()
+	{	
+		if (m_IsDownloading)
+		{
+			LogPrint (eLogInfo, "Subscription is downloading. Waiting for temination...");
+			for (int i = 0; i < 30; i++)
+			{
+				if (!m_IsDownloading)
+				{
+					LogPrint (eLogInfo, "Subscription download complete");
+					break;
+				}	
+				std::this_thread::sleep_for (std::chrono::seconds (1)); // wait for 1 seconds
+			}	
+			LogPrint (eLogError, "Subscription download hangs");
+		}	
+		if (m_Storage)
+		{
+			m_Storage->Save (m_Addresses);
+			delete m_Storage;
+		}
+		delete m_DefaultSubscription;
+		for (auto it: m_Subscriptions)
+			delete it;
+		delete m_SubscriptionsUpdateTimer;		
+	}
+
+	AddressBookStorage * AddressBook::CreateStorage ()
+	{
+		return new AddressBookFilesystemStorage ();
+	}	
+
+	bool AddressBook::GetIdentHash (const std::string& address, i2p::data::IdentHash& ident)
+	{
+		auto pos = address.find(".b32.i2p");
+		if (pos != std::string::npos)
+		{
+			Base32ToByteStream (address.c_str(), pos, ident, 32);
+			return true;
+		}
+		else
+		{	
+			pos = address.find (".i2p");
+			if (pos != std::string::npos)
+			{
+				auto identHash = FindAddress (address);	
+				if (identHash)
+				{
+					ident = *identHash;
+					return true;
+				}
+				else
+					return false;
+			}
+		}	
+		// if not .b32 we assume full base64 address
+		i2p::data::IdentityEx dest;
+		if (!dest.FromBase64 (address))
+			return false;
+		ident = dest.GetIdentHash ();
+		return true;
+	}
+	
+	const i2p::data::IdentHash * AddressBook::FindAddress (const std::string& address)
+	{
+		if (!m_IsLoaded)
+			LoadHosts ();
+		if (m_IsLoaded)
+		{
+			auto it = m_Addresses.find (address);
+			if (it != m_Addresses.end ())
+				return &it->second;
+		}
+		return nullptr;	
+	}
+
+	void AddressBook::InsertAddress (const std::string& address, const std::string& base64)
+	{
+		i2p::data::IdentityEx ident;
+		ident.FromBase64 (base64);
+		if (!m_Storage)
+			 m_Storage = CreateStorage ();
+		m_Storage->AddAddress (ident);
+		m_Addresses[address] = ident.GetIdentHash ();
+		LogPrint (address,"->", ToAddress(ident.GetIdentHash ()), " added");
+	}
+
+	void AddressBook::InsertAddress (const i2p::data::IdentityEx& address)
+	{
+		if (!m_Storage) 
+			m_Storage = CreateStorage ();
+		m_Storage->AddAddress (address);
+	}
+
+	bool AddressBook::GetAddress (const std::string& address, i2p::data::IdentityEx& identity)
+	{
+		if (!m_Storage) 
+			m_Storage = CreateStorage ();
+		i2p::data::IdentHash ident;
+		if (!GetIdentHash (address, ident)) return false;
+		return m_Storage->GetAddress (ident, identity);
+	}	
+
+	void AddressBook::LoadHosts ()
+	{
+		if (!m_Storage)
+			 m_Storage = CreateStorage ();
+		if (m_Storage->Load (m_Addresses) > 0)
+		{
+			m_IsLoaded = true;
+			return;
+		}
+	
+		// try hosts.txt first
+		std::ifstream f (i2p::util::filesystem::GetFullPath ("hosts.txt").c_str (), std::ofstream::in); // in text mode
+		if (f.is_open ())	
+		{
+			LoadHostsFromStream (f);
+			m_IsLoaded = true;
+		}
+		else
+		{
+			// if not found download it from http://i2p-projekt.i2p/hosts.txt 
+			LogPrint (eLogInfo, "hosts.txt not found. Try to download it from default subscription...");
+			if (!m_IsDownloading)
+			{
+				m_IsDownloading = true;
+				if (!m_DefaultSubscription)
+					m_DefaultSubscription = new AddressBookSubscription (*this, DEFAULT_SUBSCRIPTION_ADDRESS);
+				m_DefaultSubscription->CheckSubscription ();
+			}
+		}	
+		
+	}
+
+	void AddressBook::LoadHostsFromStream (std::istream& f)
+	{
+		std::unique_lock<std::mutex> l(m_AddressBookMutex);
+		int numAddresses = 0;
+		std::string s;
+		while (!f.eof ())
+		{
+			getline(f, s);
+
+			if (!s.length())
+				continue; // skip empty line
+
+			size_t pos = s.find('=');
+
+			if (pos != std::string::npos)
+			{
+				std::string name = s.substr(0, pos++);
+				std::string addr = s.substr(pos);
+
+				i2p::data::IdentityEx ident;
+				if (ident.FromBase64(addr))
+				{	
+					m_Addresses[name] = ident.GetIdentHash ();
+					m_Storage->AddAddress (ident);
+					numAddresses++;
+				}	
+				else
+					LogPrint (eLogError, "Malformed address ", addr, " for ", name);
+			}		
+		}
+		LogPrint (eLogInfo, numAddresses, " addresses processed");
+		if (numAddresses > 0)
+		{	
+			m_IsLoaded = true;
+			m_Storage->Save (m_Addresses);
+		}	
+	}	
+	
+	void AddressBook::LoadSubscriptions ()
+	{
+		if (!m_Subscriptions.size ())
+		{
+			std::ifstream f (i2p::util::filesystem::GetFullPath ("subscriptions.txt").c_str (), std::ofstream::in); // in text mode
+			if (f.is_open ())
+			{
+				std::string s;
+				while (!f.eof ())
+				{
+					getline(f, s);
+					if (!s.length()) continue; // skip empty line
+					m_Subscriptions.push_back (new AddressBookSubscription (*this, s));
+				}
+				LogPrint (eLogInfo, m_Subscriptions.size (), " subscriptions loaded");
+			}
+			else
+				LogPrint (eLogWarning, "subscriptions.txt not found");
+		}
+		else
+			LogPrint (eLogError, "Subscriptions already loaded");
+	}
+
+	void AddressBook::DownloadComplete (bool success)
+	{
+		m_IsDownloading = false;
+		m_SubscriptionsUpdateTimer->expires_from_now (boost::posix_time::minutes(
+			success ? CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT : CONTINIOUS_SUBSCRIPTION_RETRY_TIMEOUT));
+		m_SubscriptionsUpdateTimer->async_wait (std::bind (&AddressBook::HandleSubscriptionsUpdateTimer,
+			this, std::placeholders::_1));
+	}
+
+	void AddressBook::StartSubscriptions ()
+	{
+		LoadSubscriptions ();
+		if (!m_Subscriptions.size ()) return;	
+
+		auto dest = i2p::client::context.GetSharedLocalDestination ();
+		if (dest)
+		{
+			m_SubscriptionsUpdateTimer = new boost::asio::deadline_timer (dest->GetService ());
+			m_SubscriptionsUpdateTimer->expires_from_now (boost::posix_time::minutes(INITIAL_SUBSCRIPTION_UPDATE_TIMEOUT));
+			m_SubscriptionsUpdateTimer->async_wait (std::bind (&AddressBook::HandleSubscriptionsUpdateTimer,
+				this, std::placeholders::_1));
+		}
+		else
+			LogPrint (eLogError, "Can't start subscriptions: missing shared local destination");
+	}
+
+	void AddressBook::StopSubscriptions ()
+	{
+		if (m_SubscriptionsUpdateTimer)
+			m_SubscriptionsUpdateTimer->cancel ();
+	}
+
+	void AddressBook::HandleSubscriptionsUpdateTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{
+			auto dest = i2p::client::context.GetSharedLocalDestination ();
+			if (!dest) return;
+			if (m_IsLoaded && !m_IsDownloading && dest->IsReady ())
+			{
+				// pick random subscription
+				CryptoPP::AutoSeededRandomPool rnd;
+				auto ind = rnd.GenerateWord32 (0, m_Subscriptions.size() - 1);	
+				m_IsDownloading = true;	
+				m_Subscriptions[ind]->CheckSubscription ();		
+			}
+			else
+			{
+				if (!m_IsLoaded)
+					LoadHosts ();
+				// try it again later
+				m_SubscriptionsUpdateTimer->expires_from_now (boost::posix_time::minutes(INITIAL_SUBSCRIPTION_RETRY_TIMEOUT));
+				m_SubscriptionsUpdateTimer->async_wait (std::bind (&AddressBook::HandleSubscriptionsUpdateTimer,
+					this, std::placeholders::_1));
+			}
+		}
+	}
+
+	AddressBookSubscription::AddressBookSubscription (AddressBook& book, const std::string& link):
+		m_Book (book), m_Link (link)
+	{
+	}
+
+	void AddressBookSubscription::CheckSubscription ()
+	{
+		std::thread load_hosts(&AddressBookSubscription::Request, this);
+		load_hosts.detach(); // TODO: use join
+	}
+
+	void AddressBookSubscription::Request ()
+	{
+		// must be run in separate thread	
+		LogPrint (eLogInfo, "Downloading hosts from ", m_Link, " ETag: ", m_Etag, " Last-Modified: ", m_LastModified);
+		bool success = false;	
+		i2p::util::http::url u (m_Link);
+		i2p::data::IdentHash ident;
+		if (m_Book.GetIdentHash (u.host_, ident))
+		{
+			std::condition_variable newDataReceived;
+			std::mutex newDataReceivedMutex;
+			const i2p::data::LeaseSet * leaseSet = i2p::data::netdb.FindLeaseSet (ident);
+			if (!leaseSet)
+			{
+				bool found = false;
+				std::unique_lock<std::mutex> l(newDataReceivedMutex);
+				i2p::client::context.GetSharedLocalDestination ()->RequestDestination (ident,
+					[&newDataReceived, &found](bool success)
+				    {
+						found = success;
+						newDataReceived.notify_all ();
+					});
+				if (newDataReceived.wait_for (l, std::chrono::seconds (SUBSCRIPTION_REQUEST_TIMEOUT)) == std::cv_status::timeout)
+					LogPrint (eLogError, "Subscription LeseseSet request timeout expired");
+				if (found)
+					leaseSet = i2p::client::context.GetSharedLocalDestination ()->FindLeaseSet (ident);	
+			}
+			if (leaseSet)
+			{
+				std::stringstream request, response;
+				// standard header
+				request << "GET " << u.path_ << " HTTP/1.1\r\nHost: " << u.host_
+				<< "\r\nAccept: */*\r\n" << "User-Agent: Wget/1.11.4\r\n" << "Connection: close\r\n";
+				if (m_Etag.length () > 0) // etag
+					request << i2p::util::http::IF_NONE_MATCH << ": \"" << m_Etag << "\"\r\n";
+				if (m_LastModified.length () > 0) // if-modfief-since
+					request << i2p::util::http::IF_MODIFIED_SINCE << ": " << m_LastModified << "\r\n";
+				request << "\r\n"; // end of header
+				auto stream = i2p::client::context.GetSharedLocalDestination ()->CreateStream (*leaseSet, u.port_);
+				stream->Send ((uint8_t *)request.str ().c_str (), request.str ().length ());
+				
+				uint8_t buf[4095];
+				bool end = false;
+				while (!end)
+				{
+					stream->AsyncReceive (boost::asio::buffer (buf, 4096), 
+						[&](const boost::system::error_code& ecode, std::size_t bytes_transferred)
+						{
+							if (bytes_transferred)
+								response.write ((char *)buf, bytes_transferred);
+							if (ecode == boost::asio::error::timed_out || !stream->IsOpen ())
+								end = true;	
+							newDataReceived.notify_all ();
+						},
+						30); // wait for 30 seconds
+					std::unique_lock<std::mutex> l(newDataReceivedMutex);
+					if (newDataReceived.wait_for (l, std::chrono::seconds (SUBSCRIPTION_REQUEST_TIMEOUT)) == std::cv_status::timeout)
+						LogPrint (eLogError, "Subscription timeout expired");
+				}
+				// process remaining buffer
+				while (size_t len = stream->ReadSome (buf, 4096))
+					response.write ((char *)buf, len);
+				
+				// parse response
+				std::string version;
+				response >> version; // HTTP version
+				int status = 0;
+				response >> status; // status
+				if (status == 200) // OK
+				{
+					bool isChunked = false;
+					std::string header, statusMessage;
+					std::getline (response, statusMessage);
+					// read until new line meaning end of header
+					while (!response.eof () && header != "\r")
+					{
+						std::getline (response, header);
+						auto colon = header.find (':');
+						if (colon != std::string::npos)
+						{
+							std::string field = header.substr (0, colon);
+							header.resize (header.length () - 1); // delete \r	
+							if (field == i2p::util::http::ETAG)
+								m_Etag = header.substr (colon + 1);
+							else if (field == i2p::util::http::LAST_MODIFIED)
+								m_LastModified = header.substr (colon + 1);
+							else if (field == i2p::util::http::TRANSFER_ENCODING)
+								isChunked = !header.compare (colon + 1, std::string::npos, "chunked");
+						}	
+					}
+					LogPrint (eLogInfo, m_Link, " ETag: ", m_Etag, " Last-Modified: ", m_LastModified);
+					if (!response.eof ())	
+					{
+						success = true;
+						if (!isChunked)
+							m_Book.LoadHostsFromStream (response);
+						else
+						{
+							// merge chunks
+							std::stringstream merged;
+							i2p::util::http::MergeChunkedResponse (response, merged);
+							m_Book.LoadHostsFromStream (merged);
+						}	
+					}	
+				}
+				else if (status == 304)
+				{	
+					success = true;
+					LogPrint (eLogInfo, "No updates from ", m_Link);
+				}	
+				else
+					LogPrint (eLogWarning, "Adressbook HTTP response ", status);
+			}
+			else
+				LogPrint (eLogError, "Address ", u.host_, " not found");
+		}
+		else
+			LogPrint (eLogError, "Can't resolve ", u.host_);
+		LogPrint (eLogInfo, "Download complete ", success ? "Success" : "Failed");
+		m_Book.DownloadComplete (success);
+	}
+}
+}
+
--- a/AddressBook.h
+++ b/AddressBook.h
@ -0,0 +1,100 @@
+#ifndef ADDRESS_BOOK_H__
+#define ADDRESS_BOOK_H__
+
+#include <string.h>
+#include <string>
+#include <map>
+#include <vector>
+#include <iostream>
+#include <mutex>
+#include <boost/asio.hpp>
+#include "base64.h"
+#include "util.h"
+#include "Identity.h"
+#include "Log.h"
+
+namespace i2p
+{
+namespace client
+{
+	const char DEFAULT_SUBSCRIPTION_ADDRESS[] = "http://udhdrtrcetjm5sxzskjyr5ztpeszydbh4dpl3pl4utgqqw2v4jna.b32.i2p/hosts.txt";
+	const int INITIAL_SUBSCRIPTION_UPDATE_TIMEOUT = 3; // in minutes	
+	const int INITIAL_SUBSCRIPTION_RETRY_TIMEOUT = 1; // in minutes			
+	const int CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT = 240; // in minutes			
+	const int CONTINIOUS_SUBSCRIPTION_RETRY_TIMEOUT = 5; // in minutes	
+	const int SUBSCRIPTION_REQUEST_TIMEOUT = 60; //in second
+
+	class AddressBookStorage // interface for storage
+	{
+		public:
+
+			virtual ~AddressBookStorage () {};
+			virtual bool GetAddress (const i2p::data::IdentHash& ident, i2p::data::IdentityEx& address) const = 0;	
+			virtual void AddAddress (const i2p::data::IdentityEx& address) = 0;
+			virtual void RemoveAddress (const i2p::data::IdentHash& ident) = 0;
+		
+			virtual int Load (std::map<std::string, i2p::data::IdentHash>& addresses) = 0;
+			virtual int Save (const std::map<std::string, i2p::data::IdentHash>& addresses) = 0;
+	};			
+
+	class AddressBookSubscription;
+	class AddressBook
+	{
+		public:
+
+			AddressBook ();
+			~AddressBook ();
+			bool GetIdentHash (const std::string& address, i2p::data::IdentHash& ident);
+			bool GetAddress (const std::string& address, i2p::data::IdentityEx& identity);
+			const i2p::data::IdentHash * FindAddress (const std::string& address);
+			void InsertAddress (const std::string& address, const std::string& base64); // for jump service
+			void InsertAddress (const i2p::data::IdentityEx& address);
+
+			void StartSubscriptions ();
+			void StopSubscriptions ();
+			void LoadHostsFromStream (std::istream& f);
+			void DownloadComplete (bool success);
+			//This method returns the ".b32.i2p" address
+			std::string ToAddress(const i2p::data::IdentHash& ident) { return ident.ToBase32().append(".b32.i2p"); }
+			std::string ToAddress(const i2p::data::IdentityEx& ident) { return ToAddress(ident.GetIdentHash ()); }
+		private:
+
+			AddressBookStorage * CreateStorage ();	
+			void LoadHosts ();
+			void LoadSubscriptions ();
+
+			void HandleSubscriptionsUpdateTimer (const boost::system::error_code& ecode);
+
+		private:	
+
+			std::mutex m_AddressBookMutex;
+			std::map<std::string, i2p::data::IdentHash>  m_Addresses;
+			AddressBookStorage * m_Storage;
+			volatile bool m_IsLoaded, m_IsDownloading;
+			std::vector<AddressBookSubscription *> m_Subscriptions;
+			AddressBookSubscription * m_DefaultSubscription; // in case if we don't know any addresses yet
+			boost::asio::deadline_timer * m_SubscriptionsUpdateTimer;
+	};
+
+	class AddressBookSubscription
+	{
+		public:
+
+			AddressBookSubscription (AddressBook& book, const std::string& link);
+			void CheckSubscription ();
+
+		private:
+
+			void Request ();
+		
+		private:
+
+			AddressBook& m_Book;
+			std::string m_Link, m_Etag, m_LastModified;
+	};
+}
+}
+
+#endif
+
+
--- a/BOB.cpp
+++ b/BOB.cpp
@ -0,0 +1,655 @@
+#include <string.h>
+#include <boost/lexical_cast.hpp>
+#include "Log.h"
+#include "ClientContext.h"
+#include "BOB.h"
+
+namespace i2p
+{
+namespace client
+{
+	BOBI2PInboundTunnel::BOBI2PInboundTunnel (int port, ClientDestination * localDestination): 
+		BOBI2PTunnel (localDestination), 
+		m_Acceptor (localDestination->GetService (), boost::asio::ip::tcp::endpoint (boost::asio::ip::tcp::v4(), port)), m_Timer (localDestination->GetService ())
+	{
+	}
+
+	BOBI2PInboundTunnel::~BOBI2PInboundTunnel ()
+	{
+		Stop ();
+	}
+
+	void BOBI2PInboundTunnel::Start ()
+	{
+		m_Acceptor.listen ();
+		Accept ();
+	}
+
+	void BOBI2PInboundTunnel::Stop ()
+	{
+		m_Acceptor.close();
+		ClearConnections ();
+	}
+
+	void BOBI2PInboundTunnel::Accept ()
+	{
+		auto receiver = new AddressReceiver ();
+		receiver->socket = new boost::asio::ip::tcp::socket (GetService ());
+		m_Acceptor.async_accept (*receiver->socket, std::bind (&BOBI2PInboundTunnel::HandleAccept, this,
+			std::placeholders::_1, receiver));
+	}	
+
+	void BOBI2PInboundTunnel::HandleAccept (const boost::system::error_code& ecode, AddressReceiver * receiver)
+	{
+		if (!ecode)
+		{
+			Accept ();	
+			ReceiveAddress (receiver);
+		}
+		else
+		{	
+			delete receiver->socket;
+			delete receiver;
+		}	
+	}
+
+	void BOBI2PInboundTunnel::ReceiveAddress (AddressReceiver * receiver)
+	{
+		receiver->socket->async_read_some (boost::asio::buffer(
+		        receiver->buffer + receiver->bufferOffset, 
+				BOB_COMMAND_BUFFER_SIZE - receiver->bufferOffset),                
+			std::bind(&BOBI2PInboundTunnel::HandleReceivedAddress, this, 
+				std::placeholders::_1, std::placeholders::_2, receiver));
+	}
+	
+	void BOBI2PInboundTunnel::HandleReceivedAddress (const boost::system::error_code& ecode, std::size_t bytes_transferred,
+		AddressReceiver * receiver)
+	{
+		if (ecode)
+		{
+			LogPrint ("BOB inbound tunnel read error: ", ecode.message ());
+			delete receiver->socket;
+			delete receiver;
+		}	
+		else
+		{
+			receiver->bufferOffset += bytes_transferred;
+			receiver->buffer[receiver->bufferOffset] = 0;
+			char * eol = strchr (receiver->buffer, '\n');
+			if (eol)
+			{
+				*eol = 0;
+				
+				receiver->data = (uint8_t *)eol + 1;
+				receiver->dataLen = receiver->bufferOffset - (eol - receiver->buffer + 1);
+				i2p::data::IdentHash ident;
+				if (!context.GetAddressBook ().GetIdentHash (receiver->buffer, ident)) 
+				{
+					LogPrint (eLogError, "BOB address ", receiver->buffer, " not found");
+					delete receiver->socket;
+					delete receiver;
+					return;
+				}
+				auto leaseSet = GetLocalDestination ()->FindLeaseSet (ident);
+				if (leaseSet)
+					CreateConnection (receiver, leaseSet);
+				else
+				{
+					GetLocalDestination ()->RequestDestination (ident);
+					m_Timer.expires_from_now (boost::posix_time::seconds (I2P_TUNNEL_DESTINATION_REQUEST_TIMEOUT));
+					m_Timer.async_wait (std::bind (&BOBI2PInboundTunnel::HandleDestinationRequestTimer,
+						this, std::placeholders::_1, receiver, ident));
+				}
+			}
+			else
+			{
+				if (receiver->bufferOffset < BOB_COMMAND_BUFFER_SIZE)
+					ReceiveAddress (receiver);
+				else
+				{	
+					LogPrint ("BOB missing inbound address ");
+					delete receiver->socket;
+					delete receiver;
+				}	
+			}			
+		}
+	}
+
+	void BOBI2PInboundTunnel::HandleDestinationRequestTimer (const boost::system::error_code& ecode, AddressReceiver * receiver, i2p::data::IdentHash ident)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{
+			auto leaseSet = GetLocalDestination ()->FindLeaseSet (ident);
+			if (leaseSet)
+			{
+				CreateConnection (receiver, leaseSet);
+				return;
+			}
+			else
+				LogPrint ("LeaseSet for BOB inbound destination not found");
+		}
+		delete receiver->socket;
+		delete receiver;
+	}	
+
+	void BOBI2PInboundTunnel::CreateConnection (AddressReceiver * receiver, const i2p::data::LeaseSet * leaseSet)
+	{
+		LogPrint ("New BOB inbound connection");
+		auto connection = std::make_shared<I2PTunnelConnection>(this, receiver->socket, leaseSet);
+		AddConnection (connection);
+		connection->I2PConnect (receiver->data, receiver->dataLen);
+		delete receiver;
+	}
+
+	BOBI2POutboundTunnel::BOBI2POutboundTunnel (const std::string& address, int port, 
+		ClientDestination * localDestination, bool quiet): BOBI2PTunnel (localDestination),
+		m_Endpoint (boost::asio::ip::address::from_string (address), port), m_IsQuiet (quiet)
+	{
+	}
+	
+	void BOBI2POutboundTunnel::Start ()
+	{
+		Accept ();
+	}
+
+	void BOBI2POutboundTunnel::Stop ()
+	{
+		ClearConnections ();
+	}	
+
+	void BOBI2POutboundTunnel::Accept ()
+	{
+		auto localDestination = GetLocalDestination ();	
+		if (localDestination)
+			localDestination->AcceptStreams (std::bind (&BOBI2POutboundTunnel::HandleAccept, this, std::placeholders::_1));
+		else
+			LogPrint ("Local destination not set for server tunnel");
+	}
+
+	void BOBI2POutboundTunnel::HandleAccept (std::shared_ptr<i2p::stream::Stream> stream)
+	{
+		if (stream)
+		{	
+			auto conn = std::make_shared<I2PTunnelConnection> (this, stream, new boost::asio::ip::tcp::socket (GetService ()), m_Endpoint, m_IsQuiet);
+			AddConnection (conn);
+			conn->Connect ();
+		}	
+	}
+
+	BOBDestination::BOBDestination (ClientDestination& localDestination):
+		m_LocalDestination (localDestination), 
+		m_OutboundTunnel (nullptr), m_InboundTunnel (nullptr)
+	{
+	}
+		
+	BOBDestination::~BOBDestination ()
+	{
+		delete m_OutboundTunnel;
+		delete m_InboundTunnel;
+		i2p::client::context.DeleteLocalDestination (&m_LocalDestination);
+	}	
+
+	void BOBDestination::Start ()
+	{
+		if (m_OutboundTunnel) m_OutboundTunnel->Start ();
+		if (m_InboundTunnel) m_InboundTunnel->Start ();
+	}
+		
+	void BOBDestination::Stop ()
+	{		
+		StopTunnels ();
+		m_LocalDestination.Stop ();
+	}	
+
+	void BOBDestination::StopTunnels ()
+	{
+		if (m_OutboundTunnel)
+		{	
+			m_OutboundTunnel->Stop ();
+			delete m_OutboundTunnel;
+			m_OutboundTunnel = nullptr;
+		}	
+		if (m_InboundTunnel)
+		{	
+			m_InboundTunnel->Stop ();
+			delete m_InboundTunnel;
+			m_InboundTunnel = nullptr;
+		}	
+	}	
+		
+	void BOBDestination::CreateInboundTunnel (int port)
+	{
+		if (!m_InboundTunnel)
+			m_InboundTunnel = new BOBI2PInboundTunnel (port, &m_LocalDestination);
+	}
+		
+	void BOBDestination::CreateOutboundTunnel (const std::string& address, int port, bool quiet)
+	{
+		if (!m_OutboundTunnel)
+			m_OutboundTunnel = new BOBI2POutboundTunnel (address, port, &m_LocalDestination, quiet);
+	}	
+		
+	BOBCommandSession::BOBCommandSession (BOBCommandChannel& owner): 
+		m_Owner (owner), m_Socket (m_Owner.GetService ()), m_ReceiveBufferOffset (0),
+		m_IsOpen (true), m_IsQuiet (false), m_InPort (0), m_OutPort (0),
+		m_CurrentDestination (nullptr)
+	{
+	}
+
+	BOBCommandSession::~BOBCommandSession ()
+	{
+	}
+
+	void BOBCommandSession::Terminate ()
+	{
+		m_Socket.close ();
+		m_IsOpen = false;	
+	}
+
+	void BOBCommandSession::Receive ()
+	{
+		m_Socket.async_read_some (boost::asio::buffer(m_ReceiveBuffer + m_ReceiveBufferOffset, BOB_COMMAND_BUFFER_SIZE - m_ReceiveBufferOffset),                
+			std::bind(&BOBCommandSession::HandleReceived, shared_from_this (), 
+			std::placeholders::_1, std::placeholders::_2));
+	}
+
+	void BOBCommandSession::HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+		{
+			LogPrint ("BOB command channel read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}	
+		else
+		{	
+			size_t size = m_ReceiveBufferOffset + bytes_transferred; 
+			m_ReceiveBuffer[size] = 0;
+			char * eol = strchr (m_ReceiveBuffer, '\n');
+			if (eol)
+			{
+				*eol = 0;
+				char * operand =  strchr (m_ReceiveBuffer, ' ');
+				if (operand)  
+				{	
+					*operand = 0;
+					operand++;
+				}	
+				else 
+					operand = eol;
+				// process command
+				auto& handlers = m_Owner.GetCommandHandlers ();
+				auto it = handlers.find (m_ReceiveBuffer);
+				if (it != handlers.end ())
+					(this->*(it->second))(operand, eol - operand);
+				else	
+				{
+					LogPrint (eLogError, "BOB unknown command ", m_ReceiveBuffer);
+					SendReplyError ("unknown command");
+				}
+
+				m_ReceiveBufferOffset = size - (eol - m_ReceiveBuffer) - 1;
+				memmove (m_ReceiveBuffer, eol + 1, m_ReceiveBufferOffset);
+			}
+			else
+			{
+				if (size < BOB_COMMAND_BUFFER_SIZE)
+					m_ReceiveBufferOffset = size;
+				else
+				{
+					LogPrint (eLogError, "Malformed input of the BOB command channel");
+					Terminate ();
+				}
+			}	
+		}
+	}
+
+	void BOBCommandSession::Send (size_t len)
+	{
+		boost::asio::async_write (m_Socket, boost::asio::buffer (m_SendBuffer, len), 
+			boost::asio::transfer_all (),
+			std::bind(&BOBCommandSession::HandleSent, shared_from_this (), 
+				std::placeholders::_1, std::placeholders::_2));
+	}
+
+	void BOBCommandSession::HandleSent (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("BOB command channel send error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			if (m_IsOpen)
+				Receive ();
+			else
+				Terminate ();	
+		}
+	}
+
+	void BOBCommandSession::SendReplyOK (const char * msg)
+	{
+#ifdef _MSC_VER
+		size_t len = sprintf_s (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_REPLY_OK, msg);
+#else		
+		size_t len = snprintf (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_REPLY_OK, msg);
+#endif
+		Send (len);
+	}
+
+	void BOBCommandSession::SendReplyError (const char * msg)
+	{
+#ifdef _MSC_VER
+		size_t len = sprintf_s (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_REPLY_ERROR, msg);
+#else		
+		size_t len = snprintf (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_REPLY_ERROR, msg);
+#endif
+		Send (len);	
+	}
+		
+	void BOBCommandSession::SendVersion ()
+	{
+		size_t len = strlen (BOB_VERSION);
+		memcpy (m_SendBuffer, BOB_VERSION, len);
+		Send (len);
+	}
+
+	void BOBCommandSession::SendData (const char * nickname)
+	{
+#ifdef _MSC_VER
+		size_t len = sprintf_s (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_DATA, nickname);
+#else		
+		size_t len = snprintf (m_SendBuffer, BOB_COMMAND_BUFFER_SIZE, BOB_DATA, nickname);
+#endif
+		Send (len);			
+	}
+		
+	void BOBCommandSession::ZapCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: zap");
+		Terminate ();
+	}
+
+	void BOBCommandSession::QuitCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: quit");
+		m_IsOpen = false;
+		SendReplyOK ("Bye!");
+	}
+
+	void BOBCommandSession::StartCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: start ", m_Nickname);
+		if (!m_CurrentDestination)
+		{	
+			m_CurrentDestination = new BOBDestination (*i2p::client::context.CreateNewLocalDestination (m_Keys, true, &m_Options));
+			m_Owner.AddDestination (m_Nickname, m_CurrentDestination);
+		}	
+		if (m_InPort)
+			m_CurrentDestination->CreateInboundTunnel (m_InPort);
+		if (m_OutPort && !m_Address.empty ())
+			m_CurrentDestination->CreateOutboundTunnel (m_Address, m_OutPort, m_IsQuiet);
+		m_CurrentDestination->Start ();	
+		SendReplyOK ("tunnel starting");	
+	}	
+	
+	void BOBCommandSession::StopCommandHandler (const char * operand, size_t len)
+	{
+		auto dest = m_Owner.FindDestination (m_Nickname);
+		if (dest)
+		{
+			dest->StopTunnels ();
+			SendReplyOK ("tunnel stopping");
+		}
+		else
+			SendReplyError ("tunnel not found");
+	}	
+	
+	void BOBCommandSession::SetNickCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: setnick ", operand);
+		m_Nickname = operand;
+		std::string msg ("Nickname set to ");
+		msg += operand;
+		SendReplyOK (msg.c_str ());
+	}	
+
+	void BOBCommandSession::GetNickCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: getnick ", operand);
+		m_CurrentDestination = m_Owner.FindDestination (operand); 
+		if (m_CurrentDestination)
+		{
+			m_Keys = m_CurrentDestination->GetKeys ();
+			m_Nickname = operand;
+			std::string msg ("Nickname set to ");
+			msg += operand;
+			SendReplyOK (msg.c_str ());
+		}
+		else
+			SendReplyError ("tunnel not found");	
+	}	
+
+	void BOBCommandSession::NewkeysCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: newkeys");
+		m_Keys = i2p::data::PrivateKeys::CreateRandomKeys ();
+		SendReplyOK (m_Keys.GetPublic ().ToBase64 ().c_str ());
+	}	
+
+	void BOBCommandSession::SetkeysCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: setkeys ", operand);
+		m_Keys.FromBase64 (operand);
+		SendReplyOK (m_Keys.GetPublic ().ToBase64 ().c_str ());
+	}
+		
+	void BOBCommandSession::GetkeysCommandHandler (const char * operand, size_t len)
+	{		
+		LogPrint (eLogDebug, "BOB: getkeys");
+		SendReplyOK (m_Keys.ToBase64 ().c_str ());
+	}	
+
+	void BOBCommandSession::GetdestCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: getdest");
+		SendReplyOK (m_Keys.GetPublic ().ToBase64 ().c_str ());
+	}	
+		
+	void BOBCommandSession::OuthostCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: outhost ", operand);
+		m_Address = operand;
+		SendReplyOK ("outhost set");
+	}
+		
+	void BOBCommandSession::OutportCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: outport ", operand);
+		m_OutPort = boost::lexical_cast<int>(operand);
+		SendReplyOK ("outbound port set");
+	}	
+
+	void BOBCommandSession::InhostCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: inhost ", operand);
+		m_Address = operand;
+		SendReplyOK ("inhost set");
+	}
+		
+	void BOBCommandSession::InportCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: inport ", operand);
+		m_InPort = boost::lexical_cast<int>(operand);
+		SendReplyOK ("inbound port set");
+	}		
+
+	void BOBCommandSession::QuietCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: quiet");
+		m_IsQuiet = true;
+		SendReplyOK ("quiet");
+	}	
+	
+	void BOBCommandSession::LookupCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: lookup ", operand);
+		i2p::data::IdentityEx addr;
+		if (!context.GetAddressBook ().GetAddress (operand, addr)) 
+		{
+			SendReplyError ("Address Not found");
+			return;
+		}		
+		SendReplyOK (addr.ToBase64 ().c_str ());
+	}
+
+	void BOBCommandSession::ClearCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: clear");
+		m_Owner.DeleteDestination (m_Nickname);
+		SendReplyOK ("cleared");
+	}	
+
+	void BOBCommandSession::ListCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: list");
+		auto& destinations = m_Owner.GetDestinations ();
+		for (auto it: destinations)
+			SendData (it.first.c_str ());
+		SendReplyOK ("Listing done");
+	}	
+
+	void BOBCommandSession::OptionCommandHandler (const char * operand, size_t len)
+	{
+		LogPrint (eLogDebug, "BOB: option ", operand);
+		const char * value = strchr (operand, '=');
+		if (value)
+		{	
+			*(const_cast<char *>(value)) = 0;
+			m_Options[operand] = value + 1; 
+			*(const_cast<char *>(value)) = '=';
+			SendReplyOK ("option");
+		}	
+		else
+			SendReplyError ("malformed");
+	}	
+		
+	BOBCommandChannel::BOBCommandChannel (int port):
+		m_IsRunning (false), m_Thread (nullptr),
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v4(), port))
+	{
+		// command -> handler
+		m_CommandHandlers[BOB_COMMAND_ZAP] = &BOBCommandSession::ZapCommandHandler; 
+		m_CommandHandlers[BOB_COMMAND_QUIT] = &BOBCommandSession::QuitCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_START] = &BOBCommandSession::StartCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_STOP] = &BOBCommandSession::StopCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_SETNICK] = &BOBCommandSession::SetNickCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_GETNICK] = &BOBCommandSession::GetNickCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_NEWKEYS] = &BOBCommandSession::NewkeysCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_GETKEYS] = &BOBCommandSession::GetkeysCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_SETKEYS] = &BOBCommandSession::SetkeysCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_GETDEST] = &BOBCommandSession::GetdestCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_OUTHOST] = &BOBCommandSession::OuthostCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_OUTPORT] = &BOBCommandSession::OutportCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_INHOST] = &BOBCommandSession::InhostCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_INPORT] = &BOBCommandSession::InportCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_QUIET] = &BOBCommandSession::QuietCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_LOOKUP] = &BOBCommandSession::LookupCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_CLEAR] = &BOBCommandSession::ClearCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_LIST] = &BOBCommandSession::ListCommandHandler;
+		m_CommandHandlers[BOB_COMMAND_OPTION] = &BOBCommandSession::OptionCommandHandler;
+	}
+
+	BOBCommandChannel::~BOBCommandChannel ()
+	{
+		Stop ();
+		for (auto it: m_Destinations)
+			delete it.second;
+	}
+
+	void BOBCommandChannel::Start ()
+	{
+		Accept ();
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&BOBCommandChannel::Run, this));
+	}
+
+	void BOBCommandChannel::Stop ()
+	{
+		m_IsRunning = false;
+		for (auto it: m_Destinations)
+			it.second->Stop ();
+		m_Acceptor.cancel ();	
+		m_Service.stop ();
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = nullptr;
+		}	
+	}
+		
+	void BOBCommandChannel::Run () 
+	{ 
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_Service.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint (eLogError, "BOB: ", ex.what ());
+			}	
+		}	
+	}
+
+	void BOBCommandChannel::AddDestination (const std::string& name, BOBDestination * dest)
+	{
+		m_Destinations[name] = dest;
+	}	
+
+	void BOBCommandChannel::DeleteDestination (const std::string& name)
+	{
+		auto it = m_Destinations.find (name);
+		if (it != m_Destinations.end ())
+		{
+			it->second->Stop ();
+			delete it->second;
+			m_Destinations.erase (it);
+		}	
+	}	
+		
+	BOBDestination * BOBCommandChannel::FindDestination (const std::string& name)
+	{
+		auto it = m_Destinations.find (name);
+		if (it != m_Destinations.end ())
+			return it->second;
+		return nullptr;	
+	}
+		
+	void BOBCommandChannel::Accept ()
+	{
+		auto newSession = std::make_shared<BOBCommandSession> (*this);
+		m_Acceptor.async_accept (newSession->GetSocket (), std::bind (&BOBCommandChannel::HandleAccept, this,
+			std::placeholders::_1, newSession));
+	}
+
+	void BOBCommandChannel::HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<BOBCommandSession> session)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+			Accept ();
+
+		if (!ecode)
+		{
+			LogPrint (eLogInfo, "New BOB command connection from ", session->GetSocket ().remote_endpoint ());
+			session->SendVersion ();	
+		}
+		else
+			LogPrint (eLogError, "BOB accept error: ",  ecode.message ());
+	}
+}
+}
+
--- a/BOB.h
+++ b/BOB.h
@ -0,0 +1,236 @@
+#ifndef BOB_H__
+#define BOB_H__
+
+#include <inttypes.h>
+#include <thread>
+#include <memory>
+#include <map>
+#include <string>
+#include <boost/asio.hpp>
+#include "I2PTunnel.h"
+#include "Identity.h"
+#include "LeaseSet.h"
+
+namespace i2p
+{
+namespace client
+{
+	const size_t BOB_COMMAND_BUFFER_SIZE = 1024;
+	const char BOB_COMMAND_ZAP[] = "zap";
+	const char BOB_COMMAND_QUIT[] = "quit";
+	const char BOB_COMMAND_START[] = "start";
+	const char BOB_COMMAND_STOP[] = "stop";	
+	const char BOB_COMMAND_SETNICK[] = "setnick";
+	const char BOB_COMMAND_GETNICK[] = "getnick";		
+	const char BOB_COMMAND_NEWKEYS[] = "newkeys";
+	const char BOB_COMMAND_GETKEYS[] = "getkeys";
+	const char BOB_COMMAND_SETKEYS[] = "setkeys";
+	const char BOB_COMMAND_GETDEST[] = "getdest";
+	const char BOB_COMMAND_OUTHOST[] = "outhost";	
+	const char BOB_COMMAND_OUTPORT[] = "outport";
+	const char BOB_COMMAND_INHOST[] = "inhost";	
+	const char BOB_COMMAND_INPORT[] = "inport";
+	const char BOB_COMMAND_QUIET[] = "quiet";
+	const char BOB_COMMAND_LOOKUP[] = "lookup";	
+	const char BOB_COMMAND_CLEAR[] = "clear";
+	const char BOB_COMMAND_LIST[] = "list";
+	const char BOB_COMMAND_OPTION[] = "option";
+	
+	const char BOB_VERSION[] = "BOB 00.00.10\nOK\n";	
+	const char BOB_REPLY_OK[] = "OK %s\n";
+	const char BOB_REPLY_ERROR[] = "ERROR %s\n";
+	const char BOB_DATA[] = "NICKNAME %s\n";
+
+	class BOBI2PTunnel: public I2PTunnel
+	{
+		public:
+
+			BOBI2PTunnel (ClientDestination * localDestination): 
+				I2PTunnel (localDestination) {};
+
+			virtual void Start () {};
+			virtual void Stop () {};				
+	};	
+	
+	class BOBI2PInboundTunnel: public BOBI2PTunnel
+	{
+			struct AddressReceiver
+			{
+				boost::asio::ip::tcp::socket * socket;
+				char buffer[BOB_COMMAND_BUFFER_SIZE + 1]; // for destination base64 address
+				uint8_t * data; 
+				size_t dataLen, bufferOffset; 
+
+				AddressReceiver (): data (nullptr), dataLen (0), bufferOffset (0) {};
+			};	
+		
+		public:
+
+			BOBI2PInboundTunnel (int port, ClientDestination * localDestination);
+			~BOBI2PInboundTunnel ();
+
+			void Start ();
+			void Stop ();
+
+		private:
+
+			void Accept ();
+			void HandleAccept (const boost::system::error_code& ecode, AddressReceiver * receiver);
+
+			void ReceiveAddress (AddressReceiver * receiver);
+			void HandleReceivedAddress (const boost::system::error_code& ecode, std::size_t bytes_transferred,
+				AddressReceiver * receiver);
+
+			void HandleDestinationRequestTimer (const boost::system::error_code& ecode, AddressReceiver * receiver, i2p::data::IdentHash ident);
+
+			void CreateConnection (AddressReceiver * receiver, const i2p::data::LeaseSet * leaseSet);
+
+		private:
+
+			boost::asio::ip::tcp::acceptor m_Acceptor;	
+			boost::asio::deadline_timer m_Timer;
+	};
+
+	class BOBI2POutboundTunnel: public BOBI2PTunnel
+	{
+		public:
+
+			 BOBI2POutboundTunnel (const std::string& address, int port, ClientDestination * localDestination, bool quiet);	
+
+			void Start ();
+			void Stop ();
+
+			void SetQuiet () { m_IsQuiet = true; };
+
+		private:
+
+			void Accept ();
+			void HandleAccept (std::shared_ptr<i2p::stream::Stream> stream);
+
+		private:
+
+			boost::asio::ip::tcp::endpoint m_Endpoint;	
+			bool m_IsQuiet;	
+	};
+
+
+	class BOBDestination
+	{
+		public:
+
+			BOBDestination (ClientDestination& localDestination);
+			~BOBDestination ();
+
+			void Start ();
+			void Stop ();
+			void StopTunnels ();
+			void CreateInboundTunnel (int port);
+			void CreateOutboundTunnel (const std::string& address, int port, bool quiet);
+			const i2p::data::PrivateKeys& GetKeys () const { return m_LocalDestination.GetPrivateKeys (); };
+			
+		private:	
+
+			ClientDestination& m_LocalDestination;
+			BOBI2POutboundTunnel * m_OutboundTunnel;
+			BOBI2PInboundTunnel * m_InboundTunnel;
+	};	
+	
+	class BOBCommandChannel;
+	class BOBCommandSession: public std::enable_shared_from_this<BOBCommandSession>
+	{
+		public:
+
+			BOBCommandSession (BOBCommandChannel& owner);
+			~BOBCommandSession ();	
+			void Terminate ();
+
+			boost::asio::ip::tcp::socket& GetSocket () { return m_Socket; };
+			void SendVersion ();
+
+			// command handlers
+			void ZapCommandHandler (const char * operand, size_t len);
+			void QuitCommandHandler (const char * operand, size_t len);
+			void StartCommandHandler (const char * operand, size_t len);
+			void StopCommandHandler (const char * operand, size_t len);
+			void SetNickCommandHandler (const char * operand, size_t len);
+			void GetNickCommandHandler (const char * operand, size_t len);
+			void NewkeysCommandHandler (const char * operand, size_t len);
+			void SetkeysCommandHandler (const char * operand, size_t len);
+			void GetkeysCommandHandler (const char * operand, size_t len);
+			void GetdestCommandHandler (const char * operand, size_t len);
+			void OuthostCommandHandler (const char * operand, size_t len);
+			void OutportCommandHandler (const char * operand, size_t len);
+			void InhostCommandHandler (const char * operand, size_t len);
+			void InportCommandHandler (const char * operand, size_t len);			
+			void QuietCommandHandler (const char * operand, size_t len);	
+			void LookupCommandHandler (const char * operand, size_t len);
+			void ClearCommandHandler (const char * operand, size_t len);
+			void ListCommandHandler (const char * operand, size_t len);
+			void OptionCommandHandler (const char * operand, size_t len);
+			
+		private:
+
+			void Receive ();
+			void HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+
+			void Send (size_t len);
+			void HandleSent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void SendReplyOK (const char * msg);
+			void SendReplyError (const char * msg);
+			void SendData (const char * nickname);
+
+		private:
+
+			BOBCommandChannel& m_Owner;
+			boost::asio::ip::tcp::socket m_Socket;
+			char m_ReceiveBuffer[BOB_COMMAND_BUFFER_SIZE + 1], m_SendBuffer[BOB_COMMAND_BUFFER_SIZE + 1];
+			size_t m_ReceiveBufferOffset;
+			bool m_IsOpen, m_IsQuiet;
+			std::string m_Nickname, m_Address;
+			int m_InPort, m_OutPort;
+			i2p::data::PrivateKeys m_Keys;
+			std::map<std::string, std::string> m_Options; 
+			BOBDestination * m_CurrentDestination;
+	};
+	typedef void (BOBCommandSession::*BOBCommandHandler)(const char * operand, size_t len);
+
+	class BOBCommandChannel
+	{
+		public:
+
+			BOBCommandChannel (int port);
+			~BOBCommandChannel ();
+
+			void Start ();
+			void Stop ();
+
+			boost::asio::io_service& GetService () { return m_Service; };
+			void AddDestination (const std::string& name, BOBDestination * dest);
+			void DeleteDestination (const std::string& name);
+			BOBDestination * FindDestination (const std::string& name);
+			
+		private:
+
+			void Run ();
+			void Accept ();
+			void HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<BOBCommandSession> session);
+
+		private:
+
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			boost::asio::io_service m_Service;
+			boost::asio::ip::tcp::acceptor m_Acceptor;
+			std::map<std::string, BOBDestination *> m_Destinations;
+			std::map<std::string, BOBCommandHandler> m_CommandHandlers;
+
+		public:
+
+			const decltype(m_CommandHandlers)& GetCommandHandlers () const { return m_CommandHandlers; };
+			const decltype(m_Destinations)& GetDestinations () const { return m_Destinations; };
+	};	
+}
+}
+
+#endif
+
--- a/1255
+++ b/1255
--- a/ClientContext.cpp
+++ b/ClientContext.cpp
@ -0,0 +1,223 @@
+#include <fstream>
+#include "util.h"
+#include "Log.h"
+#include "Identity.h"
+#include "ClientContext.h"
+
+namespace i2p
+{
+namespace client
+{
+	ClientContext context;	
+
+	ClientContext::ClientContext (): m_SharedLocalDestination (nullptr),
+		m_HttpProxy (nullptr), m_SocksProxy (nullptr), m_IrcTunnel (nullptr),
+		m_ServerTunnel (nullptr), m_SamBridge (nullptr), m_BOBCommandChannel (nullptr)
+	{
+	}
+	
+	ClientContext::~ClientContext () 
+	{
+		delete m_HttpProxy;
+		delete m_SocksProxy;
+		delete m_IrcTunnel;
+		delete m_ServerTunnel;
+		delete m_SamBridge;
+		delete m_BOBCommandChannel;
+	}
+	
+	void ClientContext::Start ()
+	{
+		if (!m_SharedLocalDestination)
+		{	
+			m_SharedLocalDestination = CreateNewLocalDestination (); // non-public, DSA
+			m_Destinations[m_SharedLocalDestination->GetIdentity ().GetIdentHash ()] = m_SharedLocalDestination;
+			m_SharedLocalDestination->Start ();
+		}
+
+		m_HttpProxy = new i2p::proxy::HTTPProxy(i2p::util::config::GetArg("-httpproxyport", 4446));
+		m_HttpProxy->Start();
+		LogPrint("HTTP Proxy started");
+		m_SocksProxy = new i2p::proxy::SOCKSProxy(i2p::util::config::GetArg("-socksproxyport", 4447));
+		m_SocksProxy->Start();
+		LogPrint("SOCKS Proxy Started");
+		std::string ircDestination = i2p::util::config::GetArg("-ircdest", "");
+		if (ircDestination.length () > 0) // ircdest is presented
+		{
+			ClientDestination * localDestination = nullptr;
+			std::string ircKeys = i2p::util::config::GetArg("-irckeys", "");	
+			if (ircKeys.length () > 0)
+				localDestination = LoadLocalDestination (ircKeys, false);
+			m_IrcTunnel = new I2PClientTunnel (ircDestination, i2p::util::config::GetArg("-ircport", 6668), localDestination);
+			m_IrcTunnel->Start ();
+			LogPrint("IRC tunnel started");
+		}	
+		std::string eepKeys = i2p::util::config::GetArg("-eepkeys", "");
+		if (eepKeys.length () > 0) // eepkeys file is presented
+		{
+			auto localDestination = LoadLocalDestination (eepKeys, true);
+			m_ServerTunnel = new I2PServerTunnel (i2p::util::config::GetArg("-eephost", "127.0.0.1"),
+ 				i2p::util::config::GetArg("-eepport", 80), localDestination);
+			m_ServerTunnel->Start ();
+			LogPrint("Server tunnel started");
+		}
+		int samPort = i2p::util::config::GetArg("-samport", 0);
+		if (samPort)
+		{
+			m_SamBridge = new SAMBridge (samPort);
+			m_SamBridge->Start ();
+			LogPrint("SAM bridge started");
+		} 
+		int bobPort = i2p::util::config::GetArg("-bobport", 0);
+		if (bobPort)
+		{
+			m_BOBCommandChannel = new BOBCommandChannel (bobPort);
+			m_BOBCommandChannel->Start ();
+			LogPrint("BOB command channel started");
+		} 
+		m_AddressBook.StartSubscriptions ();
+	}
+		
+	void ClientContext::Stop ()
+	{
+		m_AddressBook.StopSubscriptions ();	
+		m_HttpProxy->Stop();
+		delete m_HttpProxy;
+		m_HttpProxy = nullptr;
+		LogPrint("HTTP Proxy stoped");
+		m_SocksProxy->Stop();
+		delete m_SocksProxy;
+		m_SocksProxy = nullptr;
+		LogPrint("SOCKS Proxy stoped");
+		if (m_IrcTunnel)
+		{
+			m_IrcTunnel->Stop ();
+			delete m_IrcTunnel; 
+			m_IrcTunnel = nullptr;
+			LogPrint("IRC tunnel stoped");	
+		}
+		if (m_ServerTunnel)
+		{
+			m_ServerTunnel->Stop ();
+			delete m_ServerTunnel; 
+			m_ServerTunnel = nullptr;
+			LogPrint("Server tunnel stoped");	
+		}			
+		if (m_SamBridge)
+		{
+			m_SamBridge->Stop ();
+			delete m_SamBridge; 
+			m_SamBridge = nullptr;
+			LogPrint("SAM brdige stoped");	
+		}		
+		if (m_BOBCommandChannel)
+		{
+			m_BOBCommandChannel->Stop ();
+			delete m_BOBCommandChannel; 
+			m_BOBCommandChannel = nullptr;
+			LogPrint("BOB command channel stoped");	
+		}			
+
+		for (auto it: m_Destinations)
+		{	
+			it.second->Stop ();
+			delete it.second;
+		}		
+		m_Destinations.clear ();
+		m_SharedLocalDestination = 0; // deleted through m_Destination
+	}	
+	
+	ClientDestination * ClientContext::LoadLocalDestination (const std::string& filename, bool isPublic)
+	{
+		i2p::data::PrivateKeys keys;
+		std::string fullPath = i2p::util::filesystem::GetFullPath (filename);
+		std::ifstream s(fullPath.c_str (), std::ifstream::binary);
+		if (s.is_open ())	
+		{	
+			s.seekg (0, std::ios::end);
+			size_t len = s.tellg();
+			s.seekg (0, std::ios::beg);
+			uint8_t * buf = new uint8_t[len];
+			s.read ((char *)buf, len);
+			keys.FromBuffer (buf, len);
+			delete[] buf;
+			LogPrint ("Local address ", m_AddressBook.ToAddress(keys.GetPublic ().GetIdentHash ()), " loaded");
+		}	
+		else
+		{
+			LogPrint ("Can't open file ", fullPath, " Creating new one");
+			keys = i2p::data::PrivateKeys::CreateRandomKeys (i2p::data::SIGNING_KEY_TYPE_DSA_SHA1); 
+			std::ofstream f (fullPath, std::ofstream::binary | std::ofstream::out);
+			size_t len = keys.GetFullLen ();
+			uint8_t * buf = new uint8_t[len];
+			len = keys.ToBuffer (buf, len);
+			f.write ((char *)buf, len);
+			delete[] buf;
+			
+			LogPrint ("New private keys file ", fullPath, " for ", m_AddressBook.ToAddress(keys.GetPublic ().GetIdentHash ()), " created");
+		}	
+
+		auto localDestination = new ClientDestination (keys, isPublic);
+		std::unique_lock<std::mutex> l(m_DestinationsMutex);	
+		m_Destinations[localDestination->GetIdentHash ()] = localDestination;
+		localDestination->Start ();
+		return localDestination;
+	}
+
+	ClientDestination * ClientContext::CreateNewLocalDestination (bool isPublic, i2p::data::SigningKeyType sigType,
+		const std::map<std::string, std::string> * params)
+	{
+		i2p::data::PrivateKeys keys = i2p::data::PrivateKeys::CreateRandomKeys (sigType);
+		auto localDestination = new ClientDestination (keys, isPublic, params);
+		std::unique_lock<std::mutex> l(m_DestinationsMutex);
+		m_Destinations[localDestination->GetIdentHash ()] = localDestination;
+		localDestination->Start ();
+		return localDestination;
+	}
+
+	void ClientContext::DeleteLocalDestination (ClientDestination * destination)
+	{
+		if (!destination) return;
+		auto it = m_Destinations.find (destination->GetIdentHash ());
+		if (it != m_Destinations.end ())
+		{
+			auto d = it->second;
+			{
+				std::unique_lock<std::mutex> l(m_DestinationsMutex);
+				m_Destinations.erase (it);
+			}	
+			d->Stop ();
+			delete d;
+		}
+	}
+
+	ClientDestination * ClientContext::CreateNewLocalDestination (const i2p::data::PrivateKeys& keys, bool isPublic,
+		const std::map<std::string, std::string> * params)
+	{
+		auto it = m_Destinations.find (keys.GetPublic ().GetIdentHash ());
+		if (it != m_Destinations.end ())
+		{
+			LogPrint ("Local destination ", m_AddressBook.ToAddress(keys.GetPublic ().GetIdentHash ()), " exists");
+			if (!it->second->IsRunning ())
+			{	
+				it->second->Start ();
+				return it->second;
+			}	
+			return nullptr;
+		}	
+		auto localDestination = new ClientDestination (keys, isPublic, params);
+		std::unique_lock<std::mutex> l(m_DestinationsMutex);
+		m_Destinations[keys.GetPublic ().GetIdentHash ()] = localDestination;
+		localDestination->Start ();
+		return localDestination;
+	}
+	
+	ClientDestination * ClientContext::FindLocalDestination (const i2p::data::IdentHash& destination) const
+	{
+		auto it = m_Destinations.find (destination);
+		if (it != m_Destinations.end ())
+			return it->second;
+		return nullptr;
+	}	
+}		
+}	
--- a/ClientContext.h
+++ b/ClientContext.h
@ -0,0 +1,62 @@
+#ifndef CLIENT_CONTEXT_H__
+#define CLIENT_CONTEXT_H__
+
+#include <mutex>
+#include "Destination.h"
+#include "HTTPProxy.h"
+#include "SOCKS.h"
+#include "I2PTunnel.h"
+#include "SAM.h"
+#include "BOB.h"
+#include "AddressBook.h"
+
+namespace i2p
+{
+namespace client
+{
+	class ClientContext
+	{
+		public:
+
+			ClientContext ();
+			~ClientContext ();
+
+			void Start ();
+			void Stop ();
+
+			ClientDestination * GetSharedLocalDestination () const { return m_SharedLocalDestination; };
+			ClientDestination * CreateNewLocalDestination (bool isPublic = false, i2p::data::SigningKeyType sigType = i2p::data::SIGNING_KEY_TYPE_DSA_SHA1,
+			    const std::map<std::string, std::string> * params = nullptr); // transient
+			ClientDestination * CreateNewLocalDestination (const i2p::data::PrivateKeys& keys, bool isPublic = true, 
+				const std::map<std::string, std::string> * params = nullptr);
+			void DeleteLocalDestination (ClientDestination * destination);
+			ClientDestination * FindLocalDestination (const i2p::data::IdentHash& destination) const;		
+			ClientDestination * LoadLocalDestination (const std::string& filename, bool isPublic);
+
+			AddressBook& GetAddressBook () { return m_AddressBook; };
+			
+		private:
+
+			std::mutex m_DestinationsMutex;
+			std::map<i2p::data::IdentHash, ClientDestination *> m_Destinations;
+			ClientDestination * m_SharedLocalDestination;	
+
+			AddressBook m_AddressBook;
+
+			i2p::proxy::HTTPProxy * m_HttpProxy;
+			i2p::proxy::SOCKSProxy * m_SocksProxy;
+			I2PClientTunnel * m_IrcTunnel;
+			I2PServerTunnel * m_ServerTunnel;
+			SAMBridge * m_SamBridge;
+			BOBCommandChannel * m_BOBCommandChannel;
+
+		public:
+			// for HTTP
+			const decltype(m_Destinations)& GetDestinations () const { return m_Destinations; };
+	};
+	
+	extern ClientContext context;	
+}		
+}	
+
+#endif
--- a/CryptoConst.cpp
+++ b/CryptoConst.cpp
@ -0,0 +1,73 @@
+#include <inttypes.h>
+#include "CryptoConst.h"
+
+namespace i2p
+{
+namespace crypto
+{
+	const uint8_t elgp_[256]=
+	{
+		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, 
+		0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 
+		0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
+		0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
+		0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
+ 		0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
+		0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
+		0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, 
+		0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
+		0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
+		0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, 
+		0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
+		0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
+		0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
+		0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
+		0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+	};
+	
+	const uint8_t dsap_[128]=
+	{
+		0x9c, 0x05, 0xb2, 0xaa, 0x96, 0x0d, 0x9b, 0x97, 0xb8, 0x93, 0x19, 0x63, 0xc9, 0xcc, 0x9e, 0x8c,
+		0x30, 0x26, 0xe9, 0xb8, 0xed, 0x92, 0xfa, 0xd0, 0xa6, 0x9c, 0xc8, 0x86, 0xd5, 0xbf, 0x80, 0x15,
+		0xfc, 0xad, 0xae, 0x31, 0xa0, 0xad, 0x18, 0xfa, 0xb3, 0xf0, 0x1b, 0x00, 0xa3, 0x58, 0xde, 0x23,
+		0x76, 0x55, 0xc4, 0x96, 0x4a, 0xfa, 0xa2, 0xb3, 0x37, 0xe9, 0x6a, 0xd3, 0x16, 0xb9, 0xfb, 0x1c,
+		0xc5, 0x64, 0xb5, 0xae, 0xc5, 0xb6, 0x9a, 0x9f, 0xf6, 0xc3, 0xe4, 0x54, 0x87, 0x07, 0xfe, 0xf8,
+		0x50, 0x3d, 0x91, 0xdd, 0x86, 0x02, 0xe8, 0x67, 0xe6, 0xd3, 0x5d, 0x22, 0x35, 0xc1, 0x86, 0x9c,
+		0xe2, 0x47, 0x9c, 0x3b, 0x9d, 0x54, 0x01, 0xde, 0x04, 0xe0, 0x72, 0x7f, 0xb3, 0x3d, 0x65, 0x11, 
+		0x28, 0x5d, 0x4c, 0xf2, 0x95, 0x38, 0xd9, 0xe3, 0xb6, 0x05, 0x1f, 0x5b, 0x22, 0xcc, 0x1c, 0x93
+	};
+
+	const uint8_t dsaq_[20]=
+	{
+		0xa5, 0xdf, 0xc2, 0x8f, 0xef, 0x4c, 0xa1, 0xe2, 0x86, 0x74, 0x4c, 0xd8, 0xee, 0xd9, 0xd2, 0x9d,
+		0x68, 0x40, 0x46, 0xb7
+	};
+
+	const uint8_t dsag_[128]=
+	{
+		0x0c, 0x1f, 0x4d, 0x27, 0xd4, 0x00, 0x93, 0xb4, 0x29, 0xe9, 0x62, 0xd7, 0x22, 0x38, 0x24, 0xe0,
+		0xbb, 0xc4, 0x7e, 0x7c, 0x83, 0x2a, 0x39, 0x23, 0x6f, 0xc6, 0x83, 0xaf, 0x84, 0x88, 0x95, 0x81,
+		0x07, 0x5f, 0xf9, 0x08, 0x2e, 0xd3, 0x23, 0x53, 0xd4, 0x37, 0x4d, 0x73, 0x01, 0xcd, 0xa1, 0xd2,
+		0x3c, 0x43, 0x1f, 0x46, 0x98, 0x59, 0x9d, 0xda, 0x02, 0x45, 0x18, 0x24, 0xff, 0x36, 0x97, 0x52,
+		0x59, 0x36, 0x47, 0xcc, 0x3d, 0xdc, 0x19, 0x7d, 0xe9, 0x85, 0xe4, 0x3d, 0x13, 0x6c, 0xdc, 0xfc,
+		0x6b, 0xd5, 0x40, 0x9c, 0xd2, 0xf4, 0x50, 0x82, 0x11, 0x42, 0xa5, 0xe6, 0xf8, 0xeb, 0x1c, 0x3a,
+		0xb5, 0xd0, 0x48, 0x4b, 0x81, 0x29, 0xfc, 0xf1, 0x7b, 0xce, 0x4f, 0x7f, 0x33, 0x32, 0x1c, 0x3c, 
+		0xb3, 0xdb, 0xb1, 0x4a, 0x90, 0x5e, 0x7b, 0x2b, 0x3e, 0x93, 0xbe, 0x47, 0x08, 0xcb, 0xcc, 0x82  
+	};
+
+	const CryptoConstants& GetCryptoConstants ()
+	{
+		static CryptoConstants cryptoConstants = 
+		{
+			{elgp_, 256},	// elgp
+			{2},			// elgg	
+			{dsap_, 128},	// dsap
+			{dsaq_, 20},	// dsaq
+			{dsag_, 128}	// dsag
+		};	
+		return cryptoConstants;
+	}	
+	
+}
+}
+
--- a/CryptoConst.h
+++ b/CryptoConst.h
@ -0,0 +1,38 @@
+#ifndef CRYPTO_CONST_H__
+#define CRYPTO_CONST_H__
+
+#include <cryptopp/integer.h>
+
+namespace i2p
+{
+namespace crypto
+{
+	struct CryptoConstants
+	{
+		// DH/ElGamal
+		const CryptoPP::Integer elgp;
+		const CryptoPP::Integer elgg; 
+
+		// DSA
+		const CryptoPP::Integer dsap;		
+		const CryptoPP::Integer dsaq;
+		const CryptoPP::Integer dsag;			
+	};	
+	
+	const CryptoConstants& GetCryptoConstants ();
+	
+	// DH/ElGamal	
+	#define elgp GetCryptoConstants ().elgp
+	#define elgg GetCryptoConstants ().elgg
+
+	// DSA
+	#define dsap GetCryptoConstants ().dsap	
+	#define dsaq GetCryptoConstants ().dsaq
+	#define dsag GetCryptoConstants ().dsag	
+
+	// RSA
+	const int rsae = 65537;	
+}		
+}	
+
+#endif
--- a/Daemon.cpp
+++ b/Daemon.cpp
@ -0,0 +1,149 @@
+#include <thread>
+
+#include "Daemon.h"
+
+#include "Log.h"
+#include "base64.h"
+#include "version.h"
+#include "Transports.h"
+#include "NTCPSession.h"
+#include "RouterInfo.h"
+#include "RouterContext.h"
+#include "Tunnel.h"
+#include "NetDb.h"
+#include "Garlic.h"
+#include "util.h"
+#include "Streaming.h"
+#include "Destination.h"
+#include "HTTPServer.h"
+#include "ClientContext.h"
+
+#ifdef USE_UPNP
+#include "UPnP.h"
+#endif
+
+
+namespace i2p
+{
+	namespace util
+	{
+		class Daemon_Singleton::Daemon_Singleton_Private
+		{
+		public:
+			Daemon_Singleton_Private() : httpServer(nullptr)
+			{};
+			~Daemon_Singleton_Private() 
+			{
+				delete httpServer;
+			};
+
+			i2p::util::HTTPServer *httpServer;
+		};
+
+		Daemon_Singleton::Daemon_Singleton() : running(1), d(*new Daemon_Singleton_Private()) {};
+		Daemon_Singleton::~Daemon_Singleton() {
+			delete &d;
+		};
+
+		bool Daemon_Singleton::IsService () const
+		{
+#ifndef _WIN32
+			return i2p::util::config::GetArg("-service", 0);
+#else
+			return false;
+#endif
+		}
+
+		bool Daemon_Singleton::init(int argc, char* argv[])
+		{
+			i2p::util::config::OptionParser(argc, argv);
+			i2p::context.Init ();
+
+			LogPrint("\n\n\n\ni2pd starting\n");
+			LogPrint("Version ", VERSION);
+			LogPrint("data directory: ", i2p::util::filesystem::GetDataDir().string());
+			i2p::util::filesystem::ReadConfigFile(i2p::util::config::mapArgs, i2p::util::config::mapMultiArgs);
+
+			isDaemon = i2p::util::config::GetArg("-daemon", 0);
+			isLogging = i2p::util::config::GetArg("-log", 1);
+
+			int port = i2p::util::config::GetArg("-port", 0);
+			if (port)
+				i2p::context.UpdatePort (port);					
+			const char * host = i2p::util::config::GetCharArg("-host", "");
+			if (host && host[0])
+				i2p::context.UpdateAddress (boost::asio::ip::address::from_string (host));	
+
+			if (i2p::util::config::GetArg("-unreachable", 0))
+				i2p::context.SetUnreachable ();
+
+			i2p::context.SetSupportsV6 (i2p::util::config::GetArg("-v6", 0));
+			
+			LogPrint("CMD parameters:");
+			for (int i = 0; i < argc; ++i)
+				LogPrint(i, "  ", argv[i]);
+
+			return true;
+		}
+			
+		bool Daemon_Singleton::start()
+		{
+			// initialize log			
+			if (isLogging)
+			{
+				if (isDaemon)
+				{
+					std::string logfile_path = IsService () ? "/var/log" : i2p::util::filesystem::GetDataDir().string();
+#ifndef _WIN32
+					logfile_path.append("/i2pd.log");
+#else
+					logfile_path.append("\\i2pd.log");
+#endif
+					StartLog (logfile_path);
+				}
+				else
+					StartLog (""); // write to stdout
+			}
+
+			d.httpServer = new i2p::util::HTTPServer(i2p::util::config::GetArg("-httpport", 7070));
+			d.httpServer->Start();
+			LogPrint("HTTP Server started");
+			i2p::data::netdb.Start();
+			LogPrint("NetDB started");
+			i2p::transport::transports.Start();
+			LogPrint("Transports started");
+			i2p::tunnel::tunnels.Start();
+			LogPrint("Tunnels started");
+			i2p::client::context.Start ();
+			LogPrint("Client started");
+#ifdef USE_UPNP
+            i2p::UPnP::upnpc.Start();
+            LogPrint("UPnP module loaded");
+#endif
+			return true;
+		}
+
+		bool Daemon_Singleton::stop()
+		{
+			LogPrint("Shutdown started.");
+			i2p::client::context.Stop();
+			LogPrint("Client stoped");
+			i2p::tunnel::tunnels.Stop();
+			LogPrint("Tunnels stoped");
+			i2p::transport::transports.Stop();
+			LogPrint("Transports stoped");
+			i2p::data::netdb.Stop();
+			LogPrint("NetDB stoped");
+			d.httpServer->Stop();
+			LogPrint("HTTP Server stoped");
+#ifdef USE_UPNP
+			i2p::UPnP::upnpc.Stop();
+#endif
+			StopLog ();
+
+			delete d.httpServer; d.httpServer = nullptr;
+
+			return true;
+		}
+	}
+}
--- a/Daemon.h
+++ b/Daemon.h
@ -0,0 +1,71 @@
+#pragma once
+#include <string>
+
+#ifdef _WIN32
+#define Daemon i2p::util::DaemonWin32::Instance()
+#else
+#define Daemon i2p::util::DaemonLinux::Instance()
+#endif
+
+namespace i2p
+{
+	namespace util
+	{
+		class Daemon_Singleton_Private;
+		class Daemon_Singleton
+		{
+		public:
+			virtual bool init(int argc, char* argv[]);
+			virtual bool start();
+			virtual bool stop();
+
+			int isLogging;
+			int isDaemon;
+			
+			int running;
+
+		protected:
+			Daemon_Singleton();
+			virtual ~Daemon_Singleton();
+
+			bool IsService () const;				
+
+			// d-pointer for httpServer, httpProxy, etc.
+			class Daemon_Singleton_Private;
+			Daemon_Singleton_Private &d;
+		};
+
+#ifdef _WIN32
+		class DaemonWin32 : public Daemon_Singleton
+		{
+		public:
+			static DaemonWin32& Instance()
+			{
+				static DaemonWin32 instance;
+				return instance;
+			}
+
+			virtual bool init(int argc, char* argv[]);
+			virtual bool start();
+			virtual bool stop();
+		};
+#else
+		class DaemonLinux : public Daemon_Singleton
+		{
+		public:
+			static DaemonLinux& Instance()
+			{
+				static DaemonLinux instance;
+				return instance;
+			}
+
+			virtual bool start();
+			virtual bool stop();
+                private:
+                       std::string pidfile;
+                       int pidFilehandle;
+
+		};
+#endif
+	}
+}
--- a/DaemonLinux.cpp
+++ b/DaemonLinux.cpp
@ -0,0 +1,118 @@
+#include "Daemon.h"
+
+#ifndef _WIN32
+
+#include <signal.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#include "Log.h"
+#include "util.h"
+
+
+void handle_signal(int sig)
+{
+	switch (sig)
+	{
+	case SIGHUP:
+		if (i2p::util::config::GetArg("daemon", 0) == 1)
+		{
+			static bool first=true;
+			if (first)
+			{
+				first=false;
+				return;
+			}
+		}
+		LogPrint("Reloading config.");
+		i2p::util::filesystem::ReadConfigFile(i2p::util::config::mapArgs, i2p::util::config::mapMultiArgs);
+		break;
+	case SIGABRT:
+	case SIGTERM:
+	case SIGINT:
+		Daemon.running = 0; // Exit loop
+		break;
+	}
+}
+
+
+namespace i2p
+{
+	namespace util
+	{
+		bool DaemonLinux::start()
+		{
+			if (isDaemon == 1)
+			{
+				pid_t pid;
+				pid = fork();
+				if (pid > 0) // parent
+					::exit (EXIT_SUCCESS);
+
+				if (pid < 0) // error
+					return false;
+
+				// child
+				umask(0);
+				int sid = setsid();
+				if (sid < 0)
+				{
+					LogPrint("Error, could not create process group.");
+					return false;
+				}
+				chdir(i2p::util::filesystem::GetDataDir().string().c_str());
+
+				// close stdin/stdout/stderr descriptors
+				::close (0);
+				::open ("/dev/null", O_RDWR);
+				::close (1);
+				::open ("/dev/null", O_RDWR);	
+				::close (2);
+				::open ("/dev/null", O_RDWR);
+			}
+
+			// Pidfile
+			pidfile = IsService () ? "/var/run" : i2p::util::filesystem::GetDataDir().string();
+			pidfile.append("/i2pd.pid");
+			pidFilehandle = open(pidfile.c_str(), O_RDWR | O_CREAT, 0600);
+			if (pidFilehandle == -1)
+			{
+				LogPrint("Error, could not create pid file (", pidfile, ")\nIs an instance already running?");
+				return false;
+			}
+			if (lockf(pidFilehandle, F_TLOCK, 0) == -1)
+			{
+				LogPrint("Error, could not lock pid file (", pidfile, ")\nIs an instance already running?");
+				return false;
+			}
+			char pid[10];
+			sprintf(pid, "%d\n", getpid());
+			write(pidFilehandle, pid, strlen(pid));
+
+			// Signal handler
+			struct sigaction sa;
+			sa.sa_handler = handle_signal;
+			sigemptyset(&sa.sa_mask);
+			sa.sa_flags = SA_RESTART;
+			sigaction(SIGHUP, &sa, 0);
+			sigaction(SIGABRT, &sa, 0);
+			sigaction(SIGTERM, &sa, 0);
+			sigaction(SIGINT, &sa, 0);
+
+			return Daemon_Singleton::start();
+		}
+
+		bool DaemonLinux::stop()
+		{
+			close(pidFilehandle);
+			unlink(pidfile.c_str());
+
+			return Daemon_Singleton::stop();			
+		}
+
+	}
+}
+
+#endif
--- a/DaemonWin32.cpp
+++ b/DaemonWin32.cpp
@ -0,0 +1,83 @@
+#include "Daemon.h"
+#include "util.h"
+#include "Log.h"
+
+#ifdef _WIN32
+
+#include "./Win32/Win32Service.h"
+
+namespace i2p
+{
+	namespace util
+	{
+		bool DaemonWin32::init(int argc, char* argv[])
+		{
+			setlocale(LC_CTYPE, "");
+			SetConsoleCP(1251);
+			SetConsoleOutputCP(1251);
+			setlocale(LC_ALL, "Russian");
+
+			if (!Daemon_Singleton::init(argc, argv)) return false;
+			if (I2PService::isService())
+				isDaemon = 1;
+			else
+				isDaemon = 0;
+
+			std::string serviceControl = i2p::util::config::GetArg("-service", "none");
+			if (serviceControl == "install")
+			{
+				InstallService(
+					SERVICE_NAME,               // Name of service
+					SERVICE_DISPLAY_NAME,       // Name to display
+					SERVICE_START_TYPE,         // Service start type
+					SERVICE_DEPENDENCIES,       // Dependencies
+					SERVICE_ACCOUNT,            // Service running account
+					SERVICE_PASSWORD            // Password of the account
+					);
+				exit(0);
+			}
+			else if (serviceControl == "remove")
+			{
+				UninstallService(SERVICE_NAME);
+				exit(0);
+			}
+			else if (serviceControl != "none")
+			{
+				printf(" --service=install  to install the service.\n");
+				printf(" --service=remove   to remove the service.\n");
+			}
+			
+			if (isDaemon == 1)
+			{
+				LogPrint("Service session");
+				I2PService service(SERVICE_NAME);
+				if (!I2PService::Run(service))
+				{
+					LogPrint("Service failed to run w/err 0x%08lx\n", GetLastError());
+					exit(EXIT_FAILURE);
+				}
+				exit(EXIT_SUCCESS);
+			}
+			else
+				LogPrint("User session");
+
+			return true;
+		}
+		bool DaemonWin32::start()
+		{
+			setlocale(LC_CTYPE, "");
+			SetConsoleCP(1251);
+			SetConsoleOutputCP(1251);
+			setlocale(LC_ALL, "Russian");
+
+			return Daemon_Singleton::start();
+		}
+
+		bool DaemonWin32::stop()
+		{
+			return Daemon_Singleton::stop();
+		}
+	}
+}
+
+#endif
--- a/Datagram.cpp
+++ b/Datagram.cpp
@ -0,0 +1,131 @@
+#include <string.h>
+#include <vector>
+#include <cryptopp/sha.h>
+#include <cryptopp/gzip.h>
+#include "Log.h"
+#include "TunnelBase.h"
+#include "RouterContext.h"
+#include "Destination.h"
+#include "Datagram.h"
+
+namespace i2p
+{
+namespace datagram
+{
+	DatagramDestination::DatagramDestination (i2p::client::ClientDestination& owner): 
+		m_Owner (owner), m_Receiver (nullptr)
+	{
+	}
+
+	void DatagramDestination::SendDatagramTo (const uint8_t * payload, size_t len, const i2p::data::LeaseSet& remote)
+	{
+		uint8_t buf[MAX_DATAGRAM_SIZE];
+		auto identityLen = m_Owner.GetIdentity ().ToBuffer (buf, MAX_DATAGRAM_SIZE);
+		uint8_t * signature = buf + identityLen;
+		auto signatureLen = m_Owner.GetIdentity ().GetSignatureLen ();
+		uint8_t * buf1 = signature + signatureLen;
+		size_t headerLen = identityLen + signatureLen;
+		
+		memcpy (buf1, payload, len);	
+		if (m_Owner.GetIdentity ().GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+		{
+			uint8_t hash[32];	
+			CryptoPP::SHA256().CalculateDigest (hash, buf1, len);
+			m_Owner.Sign (hash, 32, signature);
+		}
+		else
+			m_Owner.Sign (buf1, len, signature);
+		
+		m_Owner.GetService ().post (std::bind (&DatagramDestination::SendMsg, this, 
+			CreateDataMessage (buf, len + headerLen), remote));
+	}
+
+	void DatagramDestination::SendMsg (I2NPMessage * msg, const i2p::data::LeaseSet& remote)
+	{
+		auto outboundTunnel = m_Owner.GetTunnelPool ()->GetNextOutboundTunnel ();
+		auto leases = remote.GetNonExpiredLeases ();
+		if (!leases.empty () && outboundTunnel)
+		{
+			std::vector<i2p::tunnel::TunnelMessageBlock> msgs;			
+			uint32_t i = i2p::context.GetRandomNumberGenerator ().GenerateWord32 (0, leases.size () - 1);
+			auto garlic = m_Owner.WrapMessage (remote, msg, true);
+			msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+				{ 
+					i2p::tunnel::eDeliveryTypeTunnel,
+					leases[i].tunnelGateway, leases[i].tunnelID,
+					garlic
+				});
+			outboundTunnel->SendTunnelDataMsg (msgs);
+		}
+		else
+		{
+			if (outboundTunnel)
+				LogPrint (eLogWarning, "Failed to send datagram. All leases expired");
+			else
+				LogPrint (eLogWarning, "Failed to send datagram. No outbound tunnels");
+			DeleteI2NPMessage (msg);	
+		}	
+	}
+
+	void DatagramDestination::HandleDatagram (const uint8_t * buf, size_t len)
+	{
+		i2p::data::IdentityEx identity;
+		size_t identityLen = identity.FromBuffer (buf, len);
+		const uint8_t * signature = buf + identityLen;
+		size_t headerLen = identityLen + identity.GetSignatureLen ();
+
+		bool verified = false;
+		if (identity.GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+			verified = CryptoPP::SHA256().VerifyDigest (signature, buf + headerLen, len - headerLen);
+		else	
+			verified = identity.Verify (buf + headerLen, len - headerLen, signature);
+				
+		if (verified)
+		{
+			if (m_Receiver != nullptr)
+				m_Receiver (identity, buf + headerLen, len -headerLen);
+			else
+				LogPrint (eLogWarning, "Receiver for datagram is not set");	
+		}
+		else
+			LogPrint (eLogWarning, "Datagram signature verification failed");	
+	}
+
+	void DatagramDestination::HandleDataMessagePayload (const uint8_t * buf, size_t len)
+	{
+		// unzip it
+		CryptoPP::Gunzip decompressor;
+		decompressor.Put (buf, len);
+		decompressor.MessageEnd();
+		uint8_t uncompressed[MAX_DATAGRAM_SIZE];
+		auto uncompressedLen = decompressor.MaxRetrievable ();
+		if (uncompressedLen <= MAX_DATAGRAM_SIZE)
+		{
+			decompressor.Get (uncompressed, uncompressedLen);
+			HandleDatagram (uncompressed, uncompressedLen); 
+		}
+		else
+			LogPrint ("Received datagram size ", uncompressedLen,  " exceeds max size");
+
+	}
+
+	I2NPMessage * DatagramDestination::CreateDataMessage (const uint8_t * payload, size_t len)
+	{
+		I2NPMessage * msg = NewI2NPMessage ();
+		CryptoPP::Gzip compressor; // default level
+		compressor.Put (payload, len);
+		compressor.MessageEnd();
+		int size = compressor.MaxRetrievable ();
+		uint8_t * buf = msg->GetPayload ();
+		htobe32buf (buf, size); // length
+		buf += 4;
+		compressor.Get (buf, size);
+		memset (buf + 4, 0, 4); // source and destination are zeroes
+		buf[9] = i2p::client::PROTOCOL_TYPE_DATAGRAM; // datagram protocol
+		msg->len += size + 4; 
+		FillI2NPMessageHeader (msg, eI2NPData);
+		return msg;
+	}	
+}
+}
+
--- a/Datagram.h
+++ b/Datagram.h
@ -0,0 +1,49 @@
+#ifndef DATAGRAM_H__
+#define DATAGRAM_H__
+
+#include <inttypes.h>
+#include <functional>
+#include "Identity.h"
+#include "LeaseSet.h"
+#include "I2NPProtocol.h"
+
+namespace i2p
+{
+namespace client
+{
+	class ClientDestination;
+}
+namespace datagram
+{
+	const size_t MAX_DATAGRAM_SIZE = 32768;
+	class DatagramDestination
+	{
+		typedef std::function<void (const i2p::data::IdentityEx& ident, const uint8_t *, size_t)> Receiver;
+
+		public:
+
+			DatagramDestination (i2p::client::ClientDestination& owner);
+			~DatagramDestination () {};				
+
+			void SendDatagramTo (const uint8_t * payload, size_t len, const i2p::data::LeaseSet& remote);
+			void HandleDataMessagePayload (const uint8_t * buf, size_t len);
+
+			void SetReceiver (const Receiver& receiver) { m_Receiver = receiver; };
+			void ResetReceiver () { m_Receiver = nullptr; };
+
+		private:
+
+			I2NPMessage * CreateDataMessage (const uint8_t * payload, size_t len);
+			void SendMsg (I2NPMessage * msg, const i2p::data::LeaseSet& remote);
+			void HandleDatagram (const uint8_t * buf, size_t len);
+
+		private:
+
+			i2p::client::ClientDestination& m_Owner;
+			Receiver m_Receiver;
+	};		
+}
+}
+
+#endif
+
--- a/Destination.cpp
+++ b/Destination.cpp
@ -0,0 +1,566 @@
+#include <algorithm>
+#include <cassert>
+#include <boost/lexical_cast.hpp>
+#include "Log.h"
+#include "util.h"
+#include "ElGamal.h"
+#include "Timestamp.h"
+#include "NetDb.h"
+#include "ClientContext.h"
+#include "Destination.h"
+
+namespace i2p
+{
+namespace client
+{
+	ClientDestination::ClientDestination (const i2p::data::PrivateKeys& keys, bool isPublic, 
+			const std::map<std::string, std::string> * params):
+		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service),	
+		m_Keys (keys), m_LeaseSet (nullptr), m_IsPublic (isPublic), m_PublishReplyToken (0),
+		m_DatagramDestination (nullptr), m_PublishConfirmationTimer (m_Service)
+	{
+		i2p::crypto::GenerateElGamalKeyPair(i2p::context.GetRandomNumberGenerator (), m_EncryptionPrivateKey, m_EncryptionPublicKey);
+		int inboundTunnelLen = DEFAULT_INBOUND_TUNNEL_LENGTH;
+		int outboundTunnelLen = DEFAULT_OUTBOUND_TUNNEL_LENGTH;
+		if (params)
+		{
+			auto it = params->find (I2CP_PARAM_INBOUND_TUNNEL_LENGTH);
+			if (it != params->end ())
+			{	
+				int len = boost::lexical_cast<int>(it->second);
+				if (len > 0)
+				{
+					inboundTunnelLen = len;
+					LogPrint (eLogInfo, "Inbound tunnel length set to ", len);
+				}
+			}	
+			it = params->find (I2CP_PARAM_OUTBOUND_TUNNEL_LENGTH);
+			if (it != params->end ())
+			{
+				int len = boost::lexical_cast<int>(it->second);
+				if (len > 0)
+				{
+					outboundTunnelLen = len;
+					LogPrint (eLogInfo, "Outbound tunnel length set to ", len);
+				}
+			}	
+		}	
+		m_Pool = i2p::tunnel::tunnels.CreateTunnelPool (this, inboundTunnelLen, outboundTunnelLen);  
+		if (m_IsPublic)
+			LogPrint (eLogInfo, "Local address ", i2p::client::context.GetAddressBook ().ToAddress(GetIdentHash()), " created");
+		m_StreamingDestination = new i2p::stream::StreamingDestination (*this); // TODO:
+	}
+
+	ClientDestination::~ClientDestination ()
+	{
+		if (m_IsRunning)	
+			Stop ();
+		for (auto it: m_LeaseSetRequests)
+			delete it.second;
+		for (auto it: m_RemoteLeaseSets)
+			delete it.second;
+		if (m_Pool)
+			i2p::tunnel::tunnels.DeleteTunnelPool (m_Pool);		
+		if (m_StreamingDestination)
+			delete m_StreamingDestination;
+		if (m_DatagramDestination)
+			delete m_DatagramDestination;
+	}	
+
+	void ClientDestination::Run ()
+	{
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_Service.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint ("Destination: ", ex.what ());
+			}	
+		}	
+	}	
+
+	void ClientDestination::Start ()
+	{	
+		if (!m_IsRunning)
+		{	
+			m_IsRunning = true;
+			m_Pool->SetLocalDestination (this);
+			m_Pool->SetActive (true);
+			m_Thread = new std::thread (std::bind (&ClientDestination::Run, this));
+			m_StreamingDestination->Start ();	
+		}	
+	}
+		
+	void ClientDestination::Stop ()
+	{	
+		if (m_IsRunning)
+		{	
+			m_IsRunning = false;
+			m_StreamingDestination->Stop ();	
+			if (m_DatagramDestination)
+			{
+				auto d = m_DatagramDestination;
+				m_DatagramDestination = nullptr;
+				delete d;
+			}	
+			if (m_Pool)
+			{	
+				m_Pool->SetLocalDestination (nullptr);
+				i2p::tunnel::tunnels.StopTunnelPool (m_Pool);
+			}	
+			m_Service.stop ();
+			if (m_Thread)
+			{	
+				m_Thread->join (); 
+				delete m_Thread;
+				m_Thread = 0;
+			}	
+		}	
+	}	
+
+	const i2p::data::LeaseSet * ClientDestination::FindLeaseSet (const i2p::data::IdentHash& ident)
+	{
+		auto it = m_RemoteLeaseSets.find (ident);
+		if (it != m_RemoteLeaseSets.end ())
+		{	
+			if (it->second->HasNonExpiredLeases ())
+				return it->second;
+			else
+			{
+				LogPrint ("All leases of remote LeaseSet expired. Request it");
+				RequestDestination (ident);
+			}	
+		}	
+		else
+		{	
+			auto ls = i2p::data::netdb.FindLeaseSet (ident);
+			if (ls)
+			{
+				ls = new i2p::data::LeaseSet (*ls);
+				m_RemoteLeaseSets[ident] = ls;			
+				return ls;
+			}	
+		}
+		return nullptr;
+	}	
+
+	const i2p::data::LeaseSet * ClientDestination::GetLeaseSet ()
+	{
+		if (!m_Pool) return nullptr;
+		if (!m_LeaseSet)
+			UpdateLeaseSet ();
+		return m_LeaseSet;
+	}	
+
+	void ClientDestination::UpdateLeaseSet ()
+	{
+		auto newLeaseSet = new i2p::data::LeaseSet (*m_Pool);
+		if (!m_LeaseSet)
+			m_LeaseSet = newLeaseSet;
+		else
+		{	
+			// TODO: implement it better
+			*m_LeaseSet = *newLeaseSet;
+			delete newLeaseSet;
+		}	
+	}	
+
+	bool ClientDestination::SubmitSessionKey (const uint8_t * key, const uint8_t * tag)
+	{
+		struct
+		{
+			uint8_t k[32], t[32];
+		} data;	
+		memcpy (data.k, key, 32);
+		memcpy (data.t, tag, 32);
+		m_Service.post ([this,data](void)
+			{
+				this->AddSessionKey (data.k, data.t);
+			});
+		return true;
+	}
+
+	void ClientDestination::ProcessGarlicMessage (I2NPMessage * msg)
+	{
+		m_Service.post (std::bind (&ClientDestination::HandleGarlicMessage, this, msg)); 
+	}
+
+	void ClientDestination::ProcessDeliveryStatusMessage (I2NPMessage * msg)
+	{
+		m_Service.post (std::bind (&ClientDestination::HandleDeliveryStatusMessage, this, msg)); 
+	}
+
+	void ClientDestination::HandleI2NPMessage (const uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from)
+	{
+		uint8_t typeID = buf[I2NP_HEADER_TYPEID_OFFSET];
+		switch (typeID)
+		{	
+			case eI2NPData:
+				HandleDataMessage (buf + I2NP_HEADER_SIZE, bufbe16toh (buf + I2NP_HEADER_SIZE_OFFSET));
+			break;
+			case eI2NPDatabaseStore:
+				HandleDatabaseStoreMessage (buf + I2NP_HEADER_SIZE, bufbe16toh (buf + I2NP_HEADER_SIZE_OFFSET));
+			break;
+			case eI2NPDatabaseSearchReply:
+				HandleDatabaseSearchReplyMessage (buf + I2NP_HEADER_SIZE, bufbe16toh (buf + I2NP_HEADER_SIZE_OFFSET));
+			break;	
+			default:
+				i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from));
+		}		
+	}	
+
+	void ClientDestination::HandleDatabaseStoreMessage (const uint8_t * buf, size_t len)
+	{
+		uint32_t replyToken = bufbe32toh (buf + DATABASE_STORE_REPLY_TOKEN_OFFSET);
+		size_t offset = DATABASE_STORE_HEADER_SIZE;
+		if (replyToken) // TODO:
+			offset += 36;
+		if (buf[DATABASE_STORE_TYPE_OFFSET] == 1) // LeaseSet
+		{
+			LogPrint (eLogDebug, "Remote LeaseSet");
+			auto it = m_RemoteLeaseSets.find (buf + DATABASE_STORE_KEY_OFFSET);
+			if (it != m_RemoteLeaseSets.end ())
+			{
+				it->second->Update (buf + offset, len - offset); 
+				LogPrint (eLogDebug, "Remote LeaseSet updated");
+			}
+			else
+			{	
+				LogPrint (eLogDebug, "New remote LeaseSet added");
+				m_RemoteLeaseSets[buf + DATABASE_STORE_KEY_OFFSET] = new i2p::data::LeaseSet (buf + offset, len - offset);
+			}	
+		}	
+		else
+			LogPrint (eLogError, "Unexpected client's DatabaseStore type ", buf[DATABASE_STORE_TYPE_OFFSET], ". Dropped");
+		
+		auto it1 = m_LeaseSetRequests.find (buf + DATABASE_STORE_KEY_OFFSET);
+		if (it1 != m_LeaseSetRequests.end ())
+		{
+			it1->second->requestTimeoutTimer.cancel ();
+			if (it1->second->requestComplete) it1->second->requestComplete (true);
+			delete it1->second;
+			m_LeaseSetRequests.erase (it1);
+		}	
+	}
+
+	void ClientDestination::HandleDatabaseSearchReplyMessage (const uint8_t * buf, size_t len)
+	{
+		i2p::data::IdentHash key (buf);
+		int num = buf[32]; // num
+		LogPrint ("DatabaseSearchReply for ", key.ToBase64 (), " num=", num);
+		auto it = m_LeaseSetRequests.find (key);
+		if (it != m_LeaseSetRequests.end ())
+		{
+			LeaseSetRequest * request = it->second;
+			bool found = false;
+			if (request->excluded.size () < MAX_NUM_FLOODFILLS_PER_REQUEST)
+			{	
+				for (int i = 0; i < num; i++)
+				{
+					i2p::data::IdentHash peerHash (buf + 33 + i*32);
+					auto floodfill = i2p::data::netdb.FindRouter (peerHash);
+					if (floodfill)
+					{
+						LogPrint (eLogInfo, "Requesting ", key.ToBase64 (), " at ", peerHash.ToBase64 ());
+						if (SendLeaseSetRequest (key, floodfill, request))
+							found = true;
+					}	
+					else
+					{	
+						LogPrint (eLogInfo, "Found new floodfill. Request it");
+						i2p::data::netdb.RequestDestination (peerHash);
+					}	
+				}
+				if (!found)
+					LogPrint (eLogError, "Suggested floodfills are not presented in netDb"); 
+			}	
+			else
+				LogPrint (eLogInfo, key.ToBase64 (), " was not found on ",  MAX_NUM_FLOODFILLS_PER_REQUEST," floodfills");
+			if (!found)
+			{
+				if (request->requestComplete) request->requestComplete (false);
+				delete request;
+				m_LeaseSetRequests.erase (key);
+			}	
+		}	
+		else	
+			LogPrint ("Request for ", key.ToBase64 (), " not found");
+	}	
+		
+	void ClientDestination::HandleDeliveryStatusMessage (I2NPMessage * msg)
+	{
+		uint32_t msgID = bufbe32toh (msg->GetPayload () + DELIVERY_STATUS_MSGID_OFFSET);
+		if (msgID == m_PublishReplyToken)
+		{
+			LogPrint (eLogDebug, "Publishing confirmed");
+			m_ExcludedFloodfills.clear ();
+			m_PublishReplyToken = 0;
+			i2p::DeleteI2NPMessage (msg);
+		}
+		else
+			i2p::garlic::GarlicDestination::HandleDeliveryStatusMessage (msg);
+	}	
+
+	void ClientDestination::SetLeaseSetUpdated ()
+	{
+		i2p::garlic::GarlicDestination::SetLeaseSetUpdated ();	
+		UpdateLeaseSet ();
+		if (m_IsPublic)
+			Publish ();
+	}
+		
+	void ClientDestination::Publish ()
+	{	
+		if (!m_LeaseSet || !m_Pool) 
+		{
+			LogPrint (eLogError, "Can't publish non-existing LeaseSet");
+			return;
+		}
+		if (m_PublishReplyToken)
+		{
+			LogPrint (eLogInfo, "Publishing is pending");
+			return;
+		}
+		auto outbound = m_Pool->GetNextOutboundTunnel ();
+		if (!outbound)
+		{
+			LogPrint ("Can't publish LeaseSet. No outbound tunnels");
+			return;
+		}
+		std::set<i2p::data::IdentHash> excluded; 
+		auto floodfill = i2p::data::netdb.GetClosestFloodfill (m_LeaseSet->GetIdentHash (), m_ExcludedFloodfills);	
+		if (!floodfill)
+		{
+			LogPrint ("Can't publish LeaseSet. No more floodfills found");
+			m_ExcludedFloodfills.clear ();
+			return;
+		}	
+		m_ExcludedFloodfills.insert (floodfill->GetIdentHash ());
+		LogPrint (eLogDebug, "Publish LeaseSet of ", GetIdentHash ().ToBase32 ());
+		m_PublishReplyToken = i2p::context.GetRandomNumberGenerator ().GenerateWord32 ();
+		auto msg = WrapMessage (*floodfill, i2p::CreateDatabaseStoreMsg (m_LeaseSet, m_PublishReplyToken));			
+		m_PublishConfirmationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_CONFIRMATION_TIMEOUT));
+		m_PublishConfirmationTimer.async_wait (std::bind (&ClientDestination::HandlePublishConfirmationTimer,
+			this, std::placeholders::_1));	
+		outbound->SendTunnelDataMsg (floodfill->GetIdentHash (), 0, msg);	
+	}
+
+	void ClientDestination::HandlePublishConfirmationTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{	
+			if (m_PublishReplyToken)
+			{
+				LogPrint (eLogWarning, "Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT,  "seconds. Try again");
+				m_PublishReplyToken = 0;
+				Publish ();
+			}
+		}
+	}
+
+	void ClientDestination::HandleDataMessage (const uint8_t * buf, size_t len)
+	{
+		uint32_t length = bufbe32toh (buf);
+		buf += 4;
+		// we assume I2CP payload
+		switch (buf[9])
+		{
+			case PROTOCOL_TYPE_STREAMING:
+				// streaming protocol
+				if (m_StreamingDestination)
+					m_StreamingDestination->HandleDataMessagePayload (buf, length);
+				else
+					LogPrint ("Missing streaming destination");
+			break;
+			case PROTOCOL_TYPE_DATAGRAM:
+				// datagram protocol
+				if (m_DatagramDestination)
+					m_DatagramDestination->HandleDataMessagePayload (buf, length);
+				else
+					LogPrint ("Missing streaming destination");
+			break;
+			default:
+				LogPrint ("Data: unexpected protocol ", buf[9]);
+		}
+	}	
+
+	void ClientDestination::CreateStream (StreamRequestComplete streamRequestComplete, const std::string& dest, int port) {
+		assert(streamRequestComplete);
+		i2p::data::IdentHash identHash;
+		if (i2p::client::context.GetAddressBook ().GetIdentHash (dest, identHash))
+			CreateStream (streamRequestComplete, identHash, port);
+		else
+		{
+			LogPrint (eLogWarning, "Remote destination ", dest, " not found");
+			streamRequestComplete (nullptr);
+		}
+	}
+
+	void ClientDestination::CreateStream (StreamRequestComplete streamRequestComplete, const i2p::data::IdentHash& dest, int port) {
+		assert(streamRequestComplete);
+		const i2p::data::LeaseSet * leaseSet = FindLeaseSet (dest);
+		if (leaseSet)
+			streamRequestComplete(CreateStream (*leaseSet, port));
+		else
+		{
+			RequestDestination (dest,
+				[this, streamRequestComplete, dest, port](bool success)
+				{
+					if (!success)
+						streamRequestComplete (nullptr);
+					else
+					{
+						const i2p::data::LeaseSet * leaseSet = FindLeaseSet (dest);
+						if (leaseSet)
+							streamRequestComplete(CreateStream (*leaseSet, port));
+						else
+							streamRequestComplete (nullptr);
+					}
+				});
+		}
+	}
+
+	std::shared_ptr<i2p::stream::Stream> ClientDestination::CreateStream (const i2p::data::LeaseSet& remote, int port)
+	{
+		if (m_StreamingDestination)
+			return m_StreamingDestination->CreateNewOutgoingStream (remote, port);
+		else
+			return nullptr;
+	}
+
+	void ClientDestination::AcceptStreams (const i2p::stream::StreamingDestination::Acceptor& acceptor)
+	{
+		if (m_StreamingDestination)
+			m_StreamingDestination->SetAcceptor (acceptor);
+	}
+
+	void ClientDestination::StopAcceptingStreams ()
+	{
+		if (m_StreamingDestination)
+			m_StreamingDestination->ResetAcceptor ();
+	}
+
+	bool ClientDestination::IsAcceptingStreams () const
+	{
+		if (m_StreamingDestination)
+			return m_StreamingDestination->IsAcceptorSet ();
+		return false;
+	}	
+
+	i2p::datagram::DatagramDestination * ClientDestination::CreateDatagramDestination ()
+	{
+		if (!m_DatagramDestination)
+			m_DatagramDestination = new i2p::datagram::DatagramDestination (*this);
+		return m_DatagramDestination;	
+	}
+
+	bool ClientDestination::RequestDestination (const i2p::data::IdentHash& dest, RequestComplete requestComplete)
+	{
+		if (!m_Pool || !IsReady ()) 
+		{	
+			if (requestComplete) requestComplete (false);
+			return false;
+		}	
+		m_Service.post (std::bind (&ClientDestination::RequestLeaseSet, this, dest, requestComplete));
+		return true;
+	}
+
+	void ClientDestination::RequestLeaseSet (const i2p::data::IdentHash& dest, RequestComplete requestComplete)
+	{
+		std::set<i2p::data::IdentHash> excluded;
+		auto floodfill = i2p::data::netdb.GetClosestFloodfill (dest, excluded);
+		if (floodfill)
+		{
+			LeaseSetRequest * request = new LeaseSetRequest (m_Service);
+			request->requestComplete = requestComplete;
+			m_LeaseSetRequests[dest] = request;
+			if (!SendLeaseSetRequest (dest, floodfill, request))
+			{
+				// request failed
+				if (request->requestComplete) request->requestComplete (false);
+				delete request;
+				m_LeaseSetRequests.erase (dest);
+			}		
+		}	
+		else
+			LogPrint (eLogError, "No floodfills found");	
+	}	
+		
+	bool ClientDestination::SendLeaseSetRequest (const i2p::data::IdentHash& dest, 
+		std::shared_ptr<const i2p::data::RouterInfo>  nextFloodfill, LeaseSetRequest * request)
+	{
+		auto replyTunnel = m_Pool->GetNextInboundTunnel ();
+		if (!replyTunnel) LogPrint (eLogError, "No inbound tunnels found");	
+		
+		auto outboundTunnel = m_Pool->GetNextOutboundTunnel ();
+		if (!outboundTunnel) LogPrint (eLogError, "No outbound tunnels found");		
+			
+		if (replyTunnel && outboundTunnel)
+		{	
+			request->excluded.insert (nextFloodfill->GetIdentHash ());
+			request->requestTime = i2p::util::GetSecondsSinceEpoch ();
+			request->requestTimeoutTimer.cancel ();
+
+			CryptoPP::AutoSeededRandomPool rnd;
+			uint8_t replyKey[32], replyTag[32];
+			rnd.GenerateBlock (replyKey, 32); // random session key 
+			rnd.GenerateBlock (replyTag, 32); // random session tag
+			AddSessionKey (replyKey, replyTag);
+
+			I2NPMessage * msg = WrapMessage (*nextFloodfill,
+				CreateLeaseSetDatabaseLookupMsg (dest, request->excluded, 
+					replyTunnel, replyKey, replyTag));
+			outboundTunnel->SendTunnelDataMsg (
+				{
+					i2p::tunnel::TunnelMessageBlock 
+					{ 
+						i2p::tunnel::eDeliveryTypeRouter,
+						nextFloodfill->GetIdentHash (), 0, msg
+					}
+				});	
+			request->requestTimeoutTimer.expires_from_now (boost::posix_time::seconds(LEASESET_REQUEST_TIMEOUT));
+			request->requestTimeoutTimer.async_wait (std::bind (&ClientDestination::HandleRequestTimoutTimer,
+				this, std::placeholders::_1, dest));
+		}	
+		else
+			return false;
+		return true;
+	}	
+
+	void ClientDestination::HandleRequestTimoutTimer (const boost::system::error_code& ecode, const i2p::data::IdentHash& dest)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{
+			auto it = m_LeaseSetRequests.find (dest);
+			if (it != m_LeaseSetRequests.end ())
+			{
+				bool done = false;
+				uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+				if (ts < it->second->requestTime + MAX_LEASESET_REQUEST_TIMEOUT)
+				{
+					auto floodfill = i2p::data::netdb.GetClosestFloodfill (dest, it->second->excluded);
+					if (floodfill)
+						 SendLeaseSetRequest (dest, floodfill, it->second);
+					else
+						done = true;
+				}
+				else
+				{	
+					LogPrint (eLogInfo, dest.ToBase64 (), " was not found within ",  MAX_LEASESET_REQUEST_TIMEOUT, " seconds");
+					done = true;
+				}
+				
+				if (done)
+				{
+					if (it->second->requestComplete) it->second->requestComplete (false);
+					delete it->second;
+					m_LeaseSetRequests.erase (it);
+				}	
+			}	
+		}	
+	}	
+}
+}
--- a/Destination.h
+++ b/Destination.h
@ -0,0 +1,143 @@
+#ifndef DESTINATION_H__
+#define DESTINATION_H__
+
+#include <thread>
+#include <mutex>
+#include <memory>
+#include <map>
+#include <set>
+#include <string>
+#include <functional>
+#include <boost/asio.hpp>
+#include "Identity.h"
+#include "TunnelPool.h"
+#include "CryptoConst.h"
+#include "LeaseSet.h"
+#include "Garlic.h"
+#include "NetDb.h"
+#include "Streaming.h"
+#include "Datagram.h"
+
+namespace i2p
+{
+namespace client
+{
+	const uint8_t PROTOCOL_TYPE_STREAMING = 6;
+	const uint8_t PROTOCOL_TYPE_DATAGRAM = 17;
+	const uint8_t PROTOCOL_TYPE_RAW = 18;	
+	const int PUBLISH_CONFIRMATION_TIMEOUT = 5; // in seconds
+	const int LEASESET_REQUEST_TIMEOUT = 5; // in seconds
+	const int MAX_LEASESET_REQUEST_TIMEOUT = 40; // in seconds
+	const int MAX_NUM_FLOODFILLS_PER_REQUEST = 7;
+	
+	// I2CP
+	const char I2CP_PARAM_INBOUND_TUNNEL_LENGTH[] = "inbound.length";
+	const int DEFAULT_INBOUND_TUNNEL_LENGTH = 3;
+	const char I2CP_PARAM_OUTBOUND_TUNNEL_LENGTH[] = "outbound.length";
+	const int DEFAULT_OUTBOUND_TUNNEL_LENGTH = 3;
+	const int STREAM_REQUEST_TIMEOUT = 60; //in seconds
+	
+	class ClientDestination: public i2p::garlic::GarlicDestination
+	{
+		typedef std::function<void (bool success)> RequestComplete;
+		struct LeaseSetRequest
+		{
+			LeaseSetRequest (boost::asio::io_service& service): requestTime (0), requestTimeoutTimer (service) {};
+			std::set<i2p::data::IdentHash> excluded;
+			uint64_t requestTime;
+			boost::asio::deadline_timer requestTimeoutTimer;
+			RequestComplete requestComplete;
+		};	
+		
+		typedef std::function<void (std::shared_ptr<i2p::stream::Stream> stream)> StreamRequestComplete;
+		
+		public:
+
+			ClientDestination (const i2p::data::PrivateKeys& keys, bool isPublic, const std::map<std::string, std::string> * params = nullptr);
+			~ClientDestination ();	
+
+			virtual void Start ();
+			virtual void Stop ();
+			bool IsRunning () const { return m_IsRunning; };
+			boost::asio::io_service& GetService () { return m_Service; };
+			i2p::tunnel::TunnelPool * GetTunnelPool () { return m_Pool; }; 
+			bool IsReady () const { return m_LeaseSet && m_LeaseSet->HasNonExpiredLeases (); };
+			const i2p::data::LeaseSet * FindLeaseSet (const i2p::data::IdentHash& ident);
+			bool RequestDestination (const i2p::data::IdentHash& dest, RequestComplete requestComplete = nullptr);
+			
+			// streaming
+			i2p::stream::StreamingDestination * GetStreamingDestination () const { return m_StreamingDestination; };
+			void CreateStream (StreamRequestComplete streamRequestComplete, const std::string& dest, int port = 0);
+			void CreateStream (StreamRequestComplete streamRequestComplete, const i2p::data::IdentHash& dest, int port = 0);
+			std::shared_ptr<i2p::stream::Stream> CreateStream (const i2p::data::LeaseSet& remote, int port = 0);
+			void AcceptStreams (const i2p::stream::StreamingDestination::Acceptor& acceptor);
+			void StopAcceptingStreams ();
+			bool IsAcceptingStreams () const;
+
+			// datagram
+			i2p::datagram::DatagramDestination * GetDatagramDestination () const { return m_DatagramDestination; };
+			i2p::datagram::DatagramDestination * CreateDatagramDestination ();
+
+			// implements LocalDestination
+			const i2p::data::PrivateKeys& GetPrivateKeys () const { return m_Keys; };
+			const uint8_t * GetEncryptionPrivateKey () const { return m_EncryptionPrivateKey; };
+			const uint8_t * GetEncryptionPublicKey () const { return m_EncryptionPublicKey; };
+			
+			// implements GarlicDestination
+			const i2p::data::LeaseSet * GetLeaseSet ();
+			void HandleI2NPMessage (const uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from);
+
+			// override GarlicDestination
+			bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag);
+			void ProcessGarlicMessage (I2NPMessage * msg);
+			void ProcessDeliveryStatusMessage (I2NPMessage * msg);	
+			void SetLeaseSetUpdated ();
+
+			// I2CP
+			void HandleDataMessage (const uint8_t * buf, size_t len);
+
+		private:
+				
+			void Run ();			
+			void UpdateLeaseSet ();
+			void Publish ();
+			void HandlePublishConfirmationTimer (const boost::system::error_code& ecode);
+			void HandleDatabaseStoreMessage (const uint8_t * buf, size_t len);
+			void HandleDatabaseSearchReplyMessage (const uint8_t * buf, size_t len);
+			void HandleDeliveryStatusMessage (I2NPMessage * msg);		
+
+			void RequestLeaseSet (const i2p::data::IdentHash& dest, RequestComplete requestComplete);
+			bool SendLeaseSetRequest (const i2p::data::IdentHash& dest, std::shared_ptr<const i2p::data::RouterInfo>  nextFloodfill, LeaseSetRequest * request);	
+			void HandleRequestTimoutTimer (const boost::system::error_code& ecode, const i2p::data::IdentHash& dest);
+			
+		private:
+
+			volatile bool m_IsRunning;
+			std::thread * m_Thread;	
+			boost::asio::io_service m_Service;
+			boost::asio::io_service::work m_Work;
+			i2p::data::PrivateKeys m_Keys;
+			uint8_t m_EncryptionPublicKey[256], m_EncryptionPrivateKey[256];
+			std::map<i2p::data::IdentHash, i2p::data::LeaseSet *> m_RemoteLeaseSets;
+			std::map<i2p::data::IdentHash, LeaseSetRequest *> m_LeaseSetRequests;
+
+			i2p::tunnel::TunnelPool * m_Pool;
+			i2p::data::LeaseSet * m_LeaseSet;
+			bool m_IsPublic;
+			uint32_t m_PublishReplyToken;
+			std::set<i2p::data::IdentHash> m_ExcludedFloodfills; // for publishing
+			
+			i2p::stream::StreamingDestination * m_StreamingDestination;
+			i2p::datagram::DatagramDestination * m_DatagramDestination;
+	
+			boost::asio::deadline_timer m_PublishConfirmationTimer;
+
+		public:
+			
+			// for HTTP only
+			int GetNumRemoteLeaseSets () const { return m_RemoteLeaseSets.size (); };
+	};	
+}	
+}	
+
+#endif
--- a/ElGamal.h
+++ b/ElGamal.h
@ -0,0 +1,88 @@
+#ifndef EL_GAMAL_H__
+#define EL_GAMAL_H__
+
+#include <inttypes.h>
+#include <cryptopp/integer.h>
+#include <cryptopp/osrng.h>
+#include <cryptopp/dh.h>
+#include <cryptopp/sha.h>
+#include "CryptoConst.h"
+#include "Log.h"
+
+namespace i2p
+{
+namespace crypto
+{
+
+	class ElGamalEncryption
+	{
+		public:
+
+			ElGamalEncryption (const uint8_t * key):
+				y (key, 256), k (rnd, CryptoPP::Integer::One(), elgp-1),
+				a (a_exp_b_mod_c (elgg, k, elgp)), b1 (a_exp_b_mod_c (y, k, elgp))
+			{
+			}
+
+			void Encrypt (const uint8_t * data, int len, uint8_t * encrypted, bool zeroPadding = false)
+			{
+				// calculate b = b1*m mod p
+				uint8_t m[255];
+				m[0] = 0xFF;
+				memcpy (m+33, data, len);
+				CryptoPP::SHA256().CalculateDigest(m+1, m+33, 222);
+				CryptoPP::Integer b (a_times_b_mod_c (b1, CryptoPP::Integer (m, 255), elgp));
+
+				// copy a and b
+				if (zeroPadding)
+				{
+					encrypted[0] = 0;
+					a.Encode (encrypted + 1, 256);
+					encrypted[257] = 0;
+					b.Encode (encrypted + 258, 256);
+				}	
+				else
+				{
+					a.Encode (encrypted, 256);	
+					b.Encode (encrypted + 256, 256);
+				}	
+			}
+
+		private:
+
+			CryptoPP::AutoSeededRandomPool rnd;	
+			CryptoPP::Integer y, k, a, b1;	
+	};
+
+	inline bool ElGamalDecrypt (const uint8_t * key, const uint8_t * encrypted, 
+		uint8_t * data, bool zeroPadding = false)
+	{
+		CryptoPP::Integer x(key, 256), a(zeroPadding? encrypted +1 : encrypted, 256), 
+			b(zeroPadding? encrypted + 258 :encrypted + 256, 256);
+		uint8_t m[255], hash[32];
+		a_times_b_mod_c (b, a_exp_b_mod_c (a, elgp - x - 1, elgp), elgp).Encode (m, 255);
+		CryptoPP::SHA256().CalculateDigest(hash, m+33, 222);
+		for (int i = 0; i < 32; i++)
+			if (hash[i] != m[i+1])
+			{
+				LogPrint ("ElGamal decrypt hash doesn't match");
+				return false;
+			}
+		memcpy (data, m + 33, 222);
+		return true;
+	}	
+
+	inline void GenerateElGamalKeyPair (CryptoPP::RandomNumberGenerator& rnd, uint8_t * priv, uint8_t * pub)
+	{
+#if defined(__x86_64__) || defined(__i386__) || defined(_MSC_VER)	
+		rnd.GenerateBlock (priv, 256);
+		a_exp_b_mod_c (elgg, CryptoPP::Integer (priv, 256), elgp).Encode (pub, 256);
+#else
+		CryptoPP::DH dh (elgp, elgg);
+		dh.GenerateKeyPair(rnd, priv, pub);	
+#endif		
+	}	
+}
+}	
+
+#endif
--- a/Garlic.cpp
+++ b/Garlic.cpp
@ -0,0 +1,560 @@
+#include <inttypes.h>
+#include "I2PEndian.h"
+#include <map>
+#include <string>
+#include "RouterContext.h"
+#include "I2NPProtocol.h"
+#include "Tunnel.h"
+#include "TunnelPool.h"
+#include "Timestamp.h"
+#include "Destination.h"
+#include "Garlic.h"
+
+namespace i2p
+{
+namespace garlic
+{
+	GarlicRoutingSession::GarlicRoutingSession (GarlicDestination * owner, 
+	    const i2p::data::RoutingDestination * destination, int numTags):
+		m_Owner (owner), m_Destination (destination), m_NumTags (numTags), 
+		m_LeaseSetUpdated (numTags > 0)
+	{
+		// create new session tags and session key
+		m_Rnd.GenerateBlock (m_SessionKey, 32);
+		m_Encryption.SetKey (m_SessionKey);
+	}	
+
+	GarlicRoutingSession::GarlicRoutingSession (const uint8_t * sessionKey, const SessionTag& sessionTag):
+		m_Owner (nullptr), m_Destination (nullptr), m_NumTags (1), m_LeaseSetUpdated (false)
+	{
+		memcpy (m_SessionKey, sessionKey, 32);
+		m_Encryption.SetKey (m_SessionKey);
+		m_SessionTags.push_back (sessionTag);
+		m_SessionTags.back ().creationTime = i2p::util::GetSecondsSinceEpoch ();
+	}	
+
+	GarlicRoutingSession::~GarlicRoutingSession	()
+	{	
+		for (auto it: m_UnconfirmedTagsMsgs)	
+			delete it.second;
+		m_UnconfirmedTagsMsgs.clear ();
+	}
+	
+	GarlicRoutingSession::UnconfirmedTags * GarlicRoutingSession::GenerateSessionTags ()
+	{
+		auto tags = new UnconfirmedTags (m_NumTags);
+		tags->tagsCreationTime = i2p::util::GetSecondsSinceEpoch ();		
+		for (int i = 0; i < m_NumTags; i++)
+		{
+			m_Rnd.GenerateBlock (tags->sessionTags[i], 32);
+			tags->sessionTags[i].creationTime = tags->tagsCreationTime;
+		}			
+		return tags;	
+	}
+	
+	void GarlicRoutingSession::TagsConfirmed (uint32_t msgID) 
+	{ 
+		uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+		auto it = m_UnconfirmedTagsMsgs.find (msgID);	
+		if (it != m_UnconfirmedTagsMsgs.end ())
+		{
+			UnconfirmedTags * tags = it->second;
+			if (ts < tags->tagsCreationTime + OUTGOING_TAGS_EXPIRATION_TIMEOUT)
+			{	
+				for (int i = 0; i < tags->numTags; i++)
+					m_SessionTags.push_back (tags->sessionTags[i]);
+			}	
+			m_UnconfirmedTagsMsgs.erase (it);
+			delete tags;
+		}
+		// delete expired unconfirmed tags
+		for (auto it = m_UnconfirmedTagsMsgs.begin (); it != m_UnconfirmedTagsMsgs.end ();)
+		{
+			if (ts >= it->second->tagsCreationTime + OUTGOING_TAGS_EXPIRATION_TIMEOUT)
+			{
+				delete it->second;
+				it = m_UnconfirmedTagsMsgs.erase (it);
+			}	
+			else
+				it++;
+		}	
+	}
+
+	I2NPMessage * GarlicRoutingSession::WrapSingleMessage (I2NPMessage * msg)
+	{
+		I2NPMessage * m = NewI2NPMessage ();
+		m->Align (12); // in order to get buf aligned to 16 (12 + 4)
+		size_t len = 0;
+		uint8_t * buf = m->GetPayload () + 4; // 4 bytes for length
+
+		// find non-expired tag
+		bool tagFound = false;	
+		SessionTag tag; 
+		if (m_NumTags > 0)
+		{	
+			uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+			while (!m_SessionTags.empty ())
+			{
+				if (ts < m_SessionTags.front ().creationTime + OUTGOING_TAGS_EXPIRATION_TIMEOUT)
+				{
+					tag = m_SessionTags.front ();
+					m_SessionTags.pop_front (); // use same tag only once
+					tagFound = true;
+					break;
+				}	
+				else
+					m_SessionTags.pop_front (); // remove expired tag
+			}
+		}	
+		// create message
+		if (!tagFound) // new session
+		{
+			LogPrint ("No garlic tags available. Use ElGamal");
+			if (!m_Destination)
+			{
+				LogPrint ("Can't use ElGamal for unknown destination");
+				return nullptr;
+			}
+			// create ElGamal block
+			ElGamalBlock elGamal;
+			memcpy (elGamal.sessionKey, m_SessionKey, 32); 
+			m_Rnd.GenerateBlock (elGamal.preIV, 32); // Pre-IV
+			uint8_t iv[32]; // IV is first 16 bytes
+			CryptoPP::SHA256().CalculateDigest(iv, elGamal.preIV, 32); 
+			m_Destination->GetElGamalEncryption ()->Encrypt ((uint8_t *)&elGamal, sizeof(elGamal), buf, true);			
+			m_Encryption.SetIV (iv);
+			buf += 514;
+			len += 514;	
+		}
+		else // existing session
+		{	
+			// session tag
+			memcpy (buf, tag, 32);	
+			uint8_t iv[32]; // IV is first 16 bytes
+			CryptoPP::SHA256().CalculateDigest(iv, tag, 32);
+			m_Encryption.SetIV (iv);
+			buf += 32;
+			len += 32;		
+		}	
+		// AES block
+		len += CreateAESBlock (buf, msg);
+		htobe32buf (m->GetPayload (), len);
+		m->len += len + 4;
+		FillI2NPMessageHeader (m, eI2NPGarlic);
+		if (msg)
+			DeleteI2NPMessage (msg);
+		return m;
+	}	
+
+	size_t GarlicRoutingSession::CreateAESBlock (uint8_t * buf, const I2NPMessage * msg)
+	{
+		size_t blockSize = 0;
+		bool createNewTags = m_Owner && m_NumTags && ((int)m_SessionTags.size () <= m_NumTags/2);
+		UnconfirmedTags * newTags = createNewTags ? GenerateSessionTags () : nullptr;
+		htobuf16 (buf, newTags ? htobe16 (newTags->numTags) : 0); // tag count
+		blockSize += 2;
+		if (newTags) // session tags recreated
+		{	
+			for (int i = 0; i < newTags->numTags; i++)
+			{
+				memcpy (buf + blockSize, newTags->sessionTags[i], 32); // tags
+				blockSize += 32;
+			}
+		}	
+		uint32_t * payloadSize = (uint32_t *)(buf + blockSize);
+		blockSize += 4;
+		uint8_t * payloadHash = buf + blockSize;
+		blockSize += 32;
+		buf[blockSize] = 0; // flag
+		blockSize++;
+		size_t len = CreateGarlicPayload (buf + blockSize, msg, newTags);
+		htobe32buf (payloadSize, len);
+		CryptoPP::SHA256().CalculateDigest(payloadHash, buf + blockSize, len);
+		blockSize += len;
+		size_t rem = blockSize % 16;
+		if (rem)
+			blockSize += (16-rem); //padding
+		m_Encryption.Encrypt(buf, blockSize, buf);
+		return blockSize;
+	}	
+
+	size_t GarlicRoutingSession::CreateGarlicPayload (uint8_t * payload, const I2NPMessage * msg, UnconfirmedTags * newTags)
+	{
+		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch () + 5000; // 5 sec
+		uint32_t msgID = m_Rnd.GenerateWord32 ();	
+		size_t size = 0;
+		uint8_t * numCloves = payload + size;
+		*numCloves = 0;
+		size++;
+
+		if (m_Owner)
+		{	
+			if (newTags) // new session
+			{
+				// clove is DeliveryStatus 
+				size += CreateDeliveryStatusClove (payload + size, msgID);
+				if (size > 0) // successive?
+				{
+					(*numCloves)++;
+					m_UnconfirmedTagsMsgs[msgID] = newTags;
+					m_Owner->DeliveryStatusSent (this, msgID);
+				}
+				else
+					LogPrint ("DeliveryStatus clove was not created");
+			}	
+			if (m_LeaseSetUpdated) 
+			{
+				m_LeaseSetUpdated = false;
+				// clove if our leaseSet must be attached
+				auto leaseSet = CreateDatabaseStoreMsg (m_Owner->GetLeaseSet ());
+				size += CreateGarlicClove (payload + size, leaseSet, false);
+				DeleteI2NPMessage (leaseSet);
+				(*numCloves)++;
+			}
+		}	
+		if (msg) // clove message ifself if presented
+		{	
+			size += CreateGarlicClove (payload + size, msg, m_Destination ? m_Destination->IsDestination () : false);
+			(*numCloves)++;
+		}	
+		
+		memset (payload + size, 0, 3); // certificate of message
+		size += 3;
+		htobe32buf (payload + size, msgID); // MessageID
+		size += 4;
+		htobe64buf (payload + size, ts); // Expiration of message
+		size += 8;
+		return size;
+	}	
+
+	size_t GarlicRoutingSession::CreateGarlicClove (uint8_t * buf, const I2NPMessage * msg, bool isDestination)
+	{
+		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch () + 5000; // 5 sec
+		size_t size = 0;
+		if (isDestination && m_Destination)
+		{
+			buf[size] = eGarlicDeliveryTypeDestination << 5;//  delivery instructions flag destination
+			size++;
+			memcpy (buf + size, m_Destination->GetIdentHash (), 32);
+			size += 32;
+		}	
+		else	
+		{	
+			buf[size] = 0;//  delivery instructions flag local
+			size++;
+		}
+		
+		memcpy (buf + size, msg->GetBuffer (), msg->GetLength ());
+		size += msg->GetLength ();
+		htobe32buf (buf + size, m_Rnd.GenerateWord32 ()); // CloveID
+		size += 4;
+		htobe64buf (buf + size, ts); // Expiration of clove
+		size += 8;
+		memset (buf + size, 0, 3); // certificate of clove
+		size += 3;
+		return size;
+	}	
+
+	size_t GarlicRoutingSession::CreateDeliveryStatusClove (uint8_t * buf, uint32_t msgID)
+	{		
+		size_t size = 0;
+		if (m_Owner)
+		{
+			auto leases = m_Owner->GetLeaseSet ()->GetNonExpiredLeases ();
+			if (!leases.empty ())
+			{	
+				buf[size] = eGarlicDeliveryTypeTunnel << 5; // delivery instructions flag tunnel
+				size++;
+				uint32_t i = m_Rnd.GenerateWord32 (0, leases.size () - 1);
+				// hash and tunnelID sequence is reversed for Garlic 
+				memcpy (buf + size, leases[i].tunnelGateway, 32); // To Hash
+				size += 32;
+				htobe32buf (buf + size, leases[i].tunnelID); // tunnelID
+				size += 4; 	
+				// create msg 
+				I2NPMessage * msg = CreateDeliveryStatusMsg (msgID);
+				if (m_Owner)
+				{
+					//encrypt 
+					uint8_t key[32], tag[32];
+					m_Rnd.GenerateBlock (key, 32); // random session key 
+					m_Rnd.GenerateBlock (tag, 32); // random session tag
+					m_Owner->SubmitSessionKey (key, tag);
+					GarlicRoutingSession garlic (key, tag);
+					msg = garlic.WrapSingleMessage (msg);		
+				}
+				memcpy (buf + size, msg->GetBuffer (), msg->GetLength ());
+				size += msg->GetLength ();
+				DeleteI2NPMessage (msg);
+				// fill clove
+				uint64_t ts = i2p::util::GetMillisecondsSinceEpoch () + 5000; // 5 sec
+				htobe32buf (buf + size, m_Rnd.GenerateWord32 ()); // CloveID
+				size += 4;
+				htobe64buf (buf + size, ts); // Expiration of clove
+				size += 8;
+				memset (buf + size, 0, 3); // certificate of clove
+				size += 3;
+			}
+			else	
+				LogPrint ("All tunnels of local LeaseSet expired");	
+		}
+		else
+			LogPrint ("Missing local LeaseSet");
+
+		return size;
+	}
+	
+	GarlicDestination::~GarlicDestination ()
+	{
+		for (auto it: m_Sessions)
+			delete it.second;
+		m_Sessions.clear ();
+	}
+
+	void GarlicDestination::AddSessionKey (const uint8_t * key, const uint8_t * tag)
+	{
+		if (key)
+		{
+			uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+			auto decryption = std::make_shared<i2p::crypto::CBCDecryption>();
+			decryption->SetKey (key);
+			m_Tags[SessionTag(tag, ts)] = decryption;
+		}
+	}
+
+	bool GarlicDestination::SubmitSessionKey (const uint8_t * key, const uint8_t * tag) 
+	{
+		AddSessionKey (key, tag);
+		return true;
+	}
+
+	void GarlicDestination::HandleGarlicMessage (I2NPMessage * msg)
+	{
+		uint8_t * buf = msg->GetPayload ();
+		uint32_t length = bufbe32toh (buf);
+		buf += 4; // length
+		auto it = m_Tags.find (SessionTag(buf));
+		if (it != m_Tags.end ())
+		{
+			// tag found. Use AES
+			uint8_t iv[32]; // IV is first 16 bytes
+			CryptoPP::SHA256().CalculateDigest(iv, buf, 32);
+			it->second->SetIV (iv);
+			it->second->Decrypt (buf + 32, length - 32, buf + 32);
+			HandleAESBlock (buf + 32, length - 32, it->second, msg->from);
+			m_Tags.erase (it); // tag might be used only once
+		}
+		else
+		{
+			// tag not found. Use ElGamal
+			ElGamalBlock elGamal;
+			if (i2p::crypto::ElGamalDecrypt (GetEncryptionPrivateKey (), buf, (uint8_t *)&elGamal, true))
+			{	
+				auto decryption = std::make_shared<i2p::crypto::CBCDecryption>();
+				decryption->SetKey (elGamal.sessionKey);
+				uint8_t iv[32]; // IV is first 16 bytes
+				CryptoPP::SHA256().CalculateDigest(iv, elGamal.preIV, 32); 
+				decryption->SetIV (iv);
+				decryption->Decrypt(buf + 514, length - 514, buf + 514);
+				HandleAESBlock (buf + 514, length - 514, decryption, msg->from);
+			}	
+			else
+				LogPrint ("Failed to decrypt garlic");
+		}
+		DeleteI2NPMessage (msg);
+
+		// cleanup expired tags
+		uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+		if (ts > m_LastTagsCleanupTime + INCOMING_TAGS_EXPIRATION_TIMEOUT)
+		{
+			if (m_LastTagsCleanupTime)
+			{
+				int numExpiredTags = 0;
+				for (auto it = m_Tags.begin (); it != m_Tags.end ();)
+				{
+					if (ts > it->first.creationTime + INCOMING_TAGS_EXPIRATION_TIMEOUT)
+					{
+						numExpiredTags++;
+						it = m_Tags.erase (it);
+					}	
+					else
+						it++;
+				}
+				LogPrint (numExpiredTags, " tags expired for ", GetIdentHash().ToBase64 ());
+			}	
+			m_LastTagsCleanupTime = ts;
+		}	
+	}	
+
+	void GarlicDestination::HandleAESBlock (uint8_t * buf, size_t len, std::shared_ptr<i2p::crypto::CBCDecryption> decryption,
+		i2p::tunnel::InboundTunnel * from)
+	{
+		uint16_t tagCount = bufbe16toh (buf);
+		buf += 2; len -= 2;	
+		if (tagCount > 0)
+		{	
+			if (tagCount*32 > len) 
+			{
+				LogPrint (eLogError, "Tag count ", tagCount, " exceeds length ", len);
+				return ;
+			}	
+			uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+			for (int i = 0; i < tagCount; i++)
+				m_Tags[SessionTag(buf + i*32, ts)] = decryption;	
+		}	
+		buf += tagCount*32;
+		len -= tagCount*32;
+		uint32_t payloadSize = bufbe32toh (buf);
+		if (payloadSize > len)
+		{
+			LogPrint (eLogError, "Unexpected payload size ", payloadSize);
+			return;
+		}	
+		buf += 4;
+		uint8_t * payloadHash = buf;
+		buf += 32;// payload hash. 
+		if (*buf) // session key?
+			buf += 32; // new session key
+		buf++; // flag
+
+		// payload
+		if (!CryptoPP::SHA256().VerifyDigest (payloadHash, buf, payloadSize)) // payload hash doesn't match
+		{
+			LogPrint ("Wrong payload hash");
+			return;
+		}		    
+		HandleGarlicPayload (buf, payloadSize, from);
+	}	
+
+	void GarlicDestination::HandleGarlicPayload (uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from)
+	{
+		int numCloves = buf[0];
+		LogPrint (numCloves," cloves");
+		buf++;
+		for (int i = 0; i < numCloves; i++)
+		{
+			// delivery instructions
+			uint8_t flag = buf[0];
+			buf++; // flag
+			if (flag & 0x80) // encrypted?
+			{
+				// TODO: implement
+				LogPrint ("Clove encrypted");
+				buf += 32; 
+			}	
+			GarlicDeliveryType deliveryType = (GarlicDeliveryType)((flag >> 5) & 0x03);
+			switch (deliveryType)
+			{
+				case eGarlicDeliveryTypeLocal:
+					LogPrint ("Garlic type local");
+					HandleI2NPMessage (buf, len, from);
+				break;	
+				case eGarlicDeliveryTypeDestination:	
+					LogPrint ("Garlic type destination");
+					buf += 32; // destination. check it later or for multiple destinations
+					HandleI2NPMessage (buf, len, from);
+				break;
+				case eGarlicDeliveryTypeTunnel:
+				{	
+					LogPrint ("Garlic type tunnel");
+					// gwHash and gwTunnel sequence is reverted
+					uint8_t * gwHash = buf;
+					buf += 32;
+					uint32_t gwTunnel = bufbe32toh (buf);
+					buf += 4;
+					i2p::tunnel::OutboundTunnel * tunnel = nullptr;
+					if (from && from->GetTunnelPool ())
+						tunnel = from->GetTunnelPool ()->GetNextOutboundTunnel ();
+					if (tunnel) // we have send it through an outbound tunnel
+					{	
+						I2NPMessage * msg = CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from);
+						tunnel->SendTunnelDataMsg (gwHash, gwTunnel, msg);
+					}	
+					else
+						LogPrint ("No outbound tunnels available for garlic clove");
+					break;
+				}
+				case eGarlicDeliveryTypeRouter:
+					LogPrint ("Garlic type router not supported");
+					buf += 32;
+				break;	
+				default:
+					LogPrint ("Unknow garlic delivery type ", (int)deliveryType);
+			}
+			buf += GetI2NPMessageLength (buf); //  I2NP
+			buf += 4; // CloveID
+			buf += 8; // Date
+			buf += 3; // Certificate
+		}	
+	}	
+	
+	I2NPMessage * GarlicDestination::WrapMessage (const i2p::data::RoutingDestination& destination, 
+		I2NPMessage * msg, bool attachLeaseSet)	
+	{
+		if (attachLeaseSet) // we should maintain this session
+		{	
+			auto session = GetRoutingSession (destination, 32);  // 32 tags by default
+			return session->WrapSingleMessage (msg);	
+		}
+		else // one time session
+		{
+			GarlicRoutingSession session (this, &destination, 0); // don't use tag if no LeaseSet
+			return session.WrapSingleMessage (msg);
+		}	
+	}
+
+	GarlicRoutingSession * GarlicDestination::GetRoutingSession (
+		const i2p::data::RoutingDestination& destination, int numTags)
+	{
+		auto it = m_Sessions.find (destination.GetIdentHash ());
+		GarlicRoutingSession * session = nullptr;
+		if (it != m_Sessions.end ())
+			session = it->second;
+		if (!session)
+		{
+			session = new GarlicRoutingSession (this, &destination, numTags); 
+			std::unique_lock<std::mutex> l(m_SessionsMutex);
+			m_Sessions[destination.GetIdentHash ()] = session;
+		}	
+		return session;
+	}	
+		
+	void GarlicDestination::DeliveryStatusSent (GarlicRoutingSession * session, uint32_t msgID)
+	{
+		m_CreatedSessions[msgID] = session;
+	}		
+
+	void GarlicDestination::HandleDeliveryStatusMessage (I2NPMessage * msg)
+	{
+		uint32_t msgID = bufbe32toh (msg->GetPayload ());
+		{
+			auto it = m_CreatedSessions.find (msgID);
+			if (it != m_CreatedSessions.end ())			
+			{
+				it->second->TagsConfirmed (msgID);
+				m_CreatedSessions.erase (it);
+				LogPrint ("Garlic message ", msgID, " acknowledged");
+			}	
+		}
+		DeleteI2NPMessage (msg);	
+	}
+
+	void GarlicDestination::SetLeaseSetUpdated ()
+	{
+		std::unique_lock<std::mutex> l(m_SessionsMutex);	
+		for (auto it: m_Sessions)
+			it.second->SetLeaseSetUpdated ();
+	}
+
+	void GarlicDestination::ProcessGarlicMessage (I2NPMessage * msg)
+	{
+		HandleGarlicMessage (msg);
+	}
+
+	void GarlicDestination::ProcessDeliveryStatusMessage (I2NPMessage * msg)
+	{
+		HandleDeliveryStatusMessage (msg);
+	}
+
+}	
+}
--- a/Garlic.h
+++ b/Garlic.h
@ -0,0 +1,148 @@
+#ifndef GARLIC_H__
+#define GARLIC_H__
+
+#include <inttypes.h>
+#include <map>
+#include <list>
+#include <string>
+#include <thread>
+#include <mutex>
+#include <memory>
+#include <cryptopp/osrng.h>
+#include "aes.h"
+#include "I2NPProtocol.h"
+#include "LeaseSet.h"
+#include "Queue.h"
+#include "Identity.h"
+
+namespace i2p
+{	
+namespace garlic
+{
+	
+	enum GarlicDeliveryType 
+	{ 
+		eGarlicDeliveryTypeLocal = 0, 
+		eGarlicDeliveryTypeDestination = 1,
+		eGarlicDeliveryTypeRouter = 2,	
+		eGarlicDeliveryTypeTunnel = 3
+	};	
+
+#pragma pack(1)
+	struct ElGamalBlock
+	{
+		uint8_t sessionKey[32];
+		uint8_t preIV[32];
+		uint8_t padding[158];
+	};		
+#pragma pack()	
+
+	const int INCOMING_TAGS_EXPIRATION_TIMEOUT = 960; // 16 minutes			
+	const int OUTGOING_TAGS_EXPIRATION_TIMEOUT = 720; // 12 minutes
+	
+	struct SessionTag: public i2p::data::Tag<32> 
+	{
+		SessionTag (const uint8_t * buf, uint32_t ts = 0): Tag<32>(buf), creationTime (ts) {};
+		SessionTag () = default;
+		SessionTag (const SessionTag& ) = default;
+		SessionTag& operator= (const SessionTag& ) = default;
+#ifndef _WIN32
+		SessionTag (SessionTag&& ) = default; 
+		SessionTag& operator= (SessionTag&& ) = default;	
+#endif
+		uint32_t creationTime; // seconds since epoch	
+	};
+		
+	class GarlicDestination;
+	class GarlicRoutingSession
+	{
+			struct UnconfirmedTags
+			{
+				UnconfirmedTags (int n): numTags (n), tagsCreationTime (0) { sessionTags = new SessionTag[numTags]; };
+				~UnconfirmedTags () { delete[] sessionTags; };
+				int numTags;
+				SessionTag * sessionTags;
+				uint32_t tagsCreationTime;
+			};
+
+		public:
+
+			GarlicRoutingSession (GarlicDestination * owner, const i2p::data::RoutingDestination * destination, int numTags);
+			GarlicRoutingSession (const uint8_t * sessionKey, const SessionTag& sessionTag); // one time encryption
+			~GarlicRoutingSession ();
+			I2NPMessage * WrapSingleMessage (I2NPMessage * msg);
+			void TagsConfirmed (uint32_t msgID);
+
+			void SetLeaseSetUpdated () { m_LeaseSetUpdated = true; };
+			
+		private:
+
+			size_t CreateAESBlock (uint8_t * buf, const I2NPMessage * msg);
+			size_t CreateGarlicPayload (uint8_t * payload, const I2NPMessage * msg, UnconfirmedTags * newTags);
+			size_t CreateGarlicClove (uint8_t * buf, const I2NPMessage * msg, bool isDestination);
+			size_t CreateDeliveryStatusClove (uint8_t * buf, uint32_t msgID);
+			
+			UnconfirmedTags * GenerateSessionTags ();
+
+		private:
+
+			GarlicDestination * m_Owner;
+			const i2p::data::RoutingDestination * m_Destination;
+			i2p::crypto::AESKey m_SessionKey;
+			std::list<SessionTag> m_SessionTags;
+			int m_NumTags;
+			std::map<uint32_t, UnconfirmedTags *> m_UnconfirmedTagsMsgs;	
+			bool m_LeaseSetUpdated;
+
+			i2p::crypto::CBCEncryption m_Encryption;
+			CryptoPP::AutoSeededRandomPool m_Rnd;
+	};	
+
+	class GarlicDestination: public i2p::data::LocalDestination
+	{
+		public:
+
+			GarlicDestination (): m_LastTagsCleanupTime (0) {};
+			~GarlicDestination ();
+
+			GarlicRoutingSession * GetRoutingSession (const i2p::data::RoutingDestination& destination, int numTags);	
+			I2NPMessage * WrapMessage (const i2p::data::RoutingDestination& destination, 
+			    I2NPMessage * msg, bool attachLeaseSet = false);
+
+			void AddSessionKey (const uint8_t * key, const uint8_t * tag); // one tag
+			virtual bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag); // from different thread
+			void DeliveryStatusSent (GarlicRoutingSession * session, uint32_t msgID);
+			
+			virtual void ProcessGarlicMessage (I2NPMessage * msg);
+			virtual void ProcessDeliveryStatusMessage (I2NPMessage * msg);			
+			virtual void SetLeaseSetUpdated ();
+			
+			virtual const i2p::data::LeaseSet * GetLeaseSet () = 0; // TODO
+			virtual void HandleI2NPMessage (const uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from) = 0;
+			
+		protected:
+
+			void HandleGarlicMessage (I2NPMessage * msg);
+			void HandleDeliveryStatusMessage (I2NPMessage * msg);			
+	
+		private:
+
+			void HandleAESBlock (uint8_t * buf, size_t len, std::shared_ptr<i2p::crypto::CBCDecryption> decryption, 
+				i2p::tunnel::InboundTunnel * from);
+			void HandleGarlicPayload (uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from);
+
+		private:
+			
+			// outgoing sessions
+			std::mutex m_SessionsMutex;
+			std::map<i2p::data::IdentHash, GarlicRoutingSession *> m_Sessions;
+			// incoming
+			std::map<SessionTag, std::shared_ptr<i2p::crypto::CBCDecryption>> m_Tags;
+			uint32_t m_LastTagsCleanupTime;
+			// DeliveryStatus
+			std::map<uint32_t, GarlicRoutingSession *> m_CreatedSessions; // msgID -> session
+	};	
+}	
+}
+
+#endif
--- a/HTTPProxy.cpp
+++ b/HTTPProxy.cpp
@ -0,0 +1,87 @@
+#include <boost/lexical_cast.hpp>
+#include <boost/regex.hpp>
+
+#include "ClientContext.h"
+#include "HTTPProxy.h"
+
+namespace i2p
+{
+namespace proxy
+{
+	void HTTPProxyConnection::parseHeaders(const std::string& h, std::vector<header>& hm) {
+		std::string str (h);
+		std::string::size_type idx;
+		std::string t;
+		int i = 0;
+		while( (idx=str.find ("\r\n")) != std::string::npos) {
+			t=str.substr (0,idx);
+			str.erase (0,idx+2);
+			if (t == "")
+				break;
+			idx=t.find(": ");
+			if (idx == std::string::npos)
+			{
+				std::cout << "Bad header line: " << t << std::endl;
+				break;
+			}
+			LogPrint ("Name: ", t.substr (0,idx), " Value: ", t.substr (idx+2));
+			hm[i].name = t.substr (0,idx);
+			hm[i].value = t.substr (idx+2);
+			i++;
+		}
+	}
+
+	void HTTPProxyConnection::ExtractRequest(request& r)
+	{
+		std::string requestString = m_Buffer;
+		int idx=requestString.find(" ");
+		std::string method = requestString.substr(0,idx);
+		requestString = requestString.substr(idx+1);
+		idx=requestString.find(" ");
+		std::string requestUrl = requestString.substr(0,idx);
+		LogPrint("method is: ", method, "\nRequest is: ", requestUrl);
+		std::string server="";
+		std::string port="80";
+		boost::regex rHTTP("http://(.*?)(:(\\d+))?(/.*)");
+		boost::smatch m;
+		std::string path;
+		if(boost::regex_search(requestUrl, m, rHTTP, boost::match_extra)) {
+			server=m[1].str();
+			if(m[2].str() != "") {
+				port=m[3].str();
+			}
+			path=m[4].str();
+		}
+		LogPrint("server is: ",server, " port is: ", port, "\n path is: ",path);
+		r.uri = path;
+		r.method = method;
+		r.host = server;
+		r.port = boost::lexical_cast<int>(port);
+	}
+
+
+	void HTTPProxyConnection::RunRequest()
+	{
+		request r;
+		ExtractRequest(r);
+		parseHeaders(m_Buffer, r.headers);
+		size_t addressHelperPos = r.uri.find ("i2paddresshelper");
+		if (addressHelperPos != std::string::npos)
+		{
+			// jump service
+			size_t addressPos = r.uri.find ("=", addressHelperPos);
+			if (addressPos != std::string::npos)
+			{
+				LogPrint ("Jump service for ", r.host, " found. Inserting to address book");
+				auto base64 = r.uri.substr (addressPos + 1);
+				i2p::client::context.GetAddressBook ().InsertAddress (r.host, base64);
+			}
+		}			
+	
+		LogPrint("Requesting ", r.host, ":", r.port, " with path ", r.uri, " and method ", r.method);
+		SendToAddress (r.host, r.port,  m_Buffer, m_BufferLen);
+	}
+
+}
+}
+
--- a/HTTPProxy.h
+++ b/HTTPProxy.h
@ -0,0 +1,42 @@
+#ifndef HTTP_PROXY_H__
+#define HTTP_PROXY_H__
+
+#include <sstream>
+#include <thread>
+#include <boost/asio.hpp>
+#include <boost/array.hpp>
+
+#include "HTTPServer.h"
+
+namespace i2p
+{
+namespace proxy
+{
+	class HTTPProxyConnection : public i2p::util::HTTPConnection
+	{
+		public:
+			HTTPProxyConnection (boost::asio::ip::tcp::socket * socket): HTTPConnection(socket) { };
+
+		protected:
+			void RunRequest();
+			void parseHeaders(const std::string& h, std::vector<header>& hm);
+			void ExtractRequest(request& r);
+	};
+
+	class HTTPProxy : public i2p::util::HTTPServer
+	{
+		public:
+			HTTPProxy (int port): HTTPServer(port) {};
+
+		private:
+			void CreateConnection(boost::asio::ip::tcp::socket * m_NewSocket)
+			{
+				new HTTPProxyConnection(m_NewSocket);
+			}
+	};
+}
+}
+
+#endif
+
+
--- a/HTTPServer.cpp
+++ b/HTTPServer.cpp
--- a/HTTPServer.h
+++ b/HTTPServer.h
@ -0,0 +1,136 @@
+#ifndef HTTP_SERVER_H__
+#define HTTP_SERVER_H__
+
+#include <sstream>
+#include <thread>
+#include <memory>
+#include <boost/asio.hpp>
+#include <boost/array.hpp>
+#include "LeaseSet.h"
+#include "Streaming.h"
+
+namespace i2p
+{
+namespace util
+{
+	const size_t HTTP_CONNECTION_BUFFER_SIZE = 8192;	
+	const int HTTP_DESTINATION_REQUEST_TIMEOUT = 10; // in seconds
+	class HTTPConnection
+	{
+		protected:
+
+			struct header
+			{
+			  std::string name;
+			  std::string value;
+			};
+
+			struct request
+			{
+			  std::string method;
+			  std::string uri;
+			  std::string host;
+		      int port;	
+			  int http_version_major;
+			  int http_version_minor;
+			  std::vector<header> headers;
+			};
+
+			struct reply
+			{
+				std::vector<header> headers;
+				std::string content;
+
+				std::vector<boost::asio::const_buffer> to_buffers (int status);
+			};
+
+		public:
+
+			HTTPConnection (boost::asio::ip::tcp::socket * socket): 
+				m_Socket (socket), m_Timer (socket->get_io_service ()), 
+				m_Stream (nullptr), m_BufferLen (0) { Receive (); };
+			virtual ~HTTPConnection() { delete m_Socket; }
+
+		private:
+
+			void Terminate ();
+			void Receive ();
+			void HandleReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void AsyncStreamReceive ();
+			void HandleStreamReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleWriteReply(const boost::system::error_code& ecode);
+			void HandleWrite (const boost::system::error_code& ecode);
+			void SendReply (const std::string& content, int status = 200);
+
+			void HandleRequest (const std::string& address);
+			void HandleCommand (const std::string& command, std::stringstream& s);
+			void ShowTransports (std::stringstream& s);
+			void ShowTunnels (std::stringstream& s);
+			void ShowTransitTunnels (std::stringstream& s);
+			void ShowLocalDestinations (std::stringstream& s);
+			void ShowLocalDestination (const std::string& b32, std::stringstream& s);
+			void StartAcceptingTunnels (std::stringstream& s);
+			void StopAcceptingTunnels (std::stringstream& s);
+			void FillContent (std::stringstream& s);
+			std::string ExtractAddress ();
+			void ExtractParams (const std::string& str, std::map<std::string, std::string>& params);
+			
+			
+		protected:
+
+			boost::asio::ip::tcp::socket * m_Socket;
+			boost::asio::deadline_timer m_Timer;
+			std::shared_ptr<i2p::stream::Stream> m_Stream;
+			char m_Buffer[HTTP_CONNECTION_BUFFER_SIZE + 1], m_StreamBuffer[HTTP_CONNECTION_BUFFER_SIZE + 1];
+			size_t m_BufferLen;
+			request m_Request;
+			reply m_Reply;
+
+		protected:
+	
+			virtual void RunRequest ();
+			void HandleDestinationRequest(const std::string& address, const std::string& uri);
+			void SendToAddress (const std::string& address, int port, const char * buf, size_t len);
+			void HandleDestinationRequestTimeout (const boost::system::error_code& ecode, 
+				i2p::data::IdentHash destination, int port, const char * buf, size_t len);
+			void SendToDestination (const i2p::data::LeaseSet * remote, int port, const char * buf, size_t len);
+
+		public:
+
+			static const std::string itoopieImage;
+			static const std::string itoopieFavicon;
+	};
+
+	class HTTPServer
+	{
+		public:
+
+			HTTPServer (int port);
+			virtual ~HTTPServer ();
+
+			void Start ();
+			void Stop ();
+
+		private:
+
+			void Run ();
+ 			void Accept ();
+			void HandleAccept(const boost::system::error_code& ecode);
+			
+		private:
+
+			std::thread * m_Thread;
+			boost::asio::io_service m_Service;
+			boost::asio::io_service::work m_Work;
+			boost::asio::ip::tcp::acceptor m_Acceptor;
+			boost::asio::ip::tcp::socket * m_NewSocket;
+
+		protected:
+			virtual void CreateConnection(boost::asio::ip::tcp::socket * m_NewSocket);
+	};
+}
+}
+
+#endif
+
+
--- a/I2NPProtocol.cpp
+++ b/I2NPProtocol.cpp
@ -0,0 +1,582 @@
+#include <string.h>
+#include <atomic>
+#include "I2PEndian.h"
+#include <cryptopp/gzip.h>
+#include "ElGamal.h"
+#include "Timestamp.h"
+#include "RouterContext.h"
+#include "NetDb.h"
+#include "Tunnel.h"
+#include "base64.h"
+#include "Transports.h"
+#include "Garlic.h"
+#include "I2NPProtocol.h"
+
+using namespace i2p::transport;
+
+namespace i2p
+{
+	I2NPMessage * NewI2NPMessage ()
+	{
+		return new I2NPMessageBuffer<I2NP_MAX_MESSAGE_SIZE>();
+	}
+	
+	I2NPMessage * NewI2NPShortMessage ()
+	{
+		return new I2NPMessageBuffer<I2NP_MAX_SHORT_MESSAGE_SIZE>();
+	}
+
+	I2NPMessage * NewI2NPMessage (size_t len)
+	{
+		return (len < I2NP_MAX_SHORT_MESSAGE_SIZE/2) ? NewI2NPShortMessage () : NewI2NPMessage ();
+	}	
+	
+	void DeleteI2NPMessage (I2NPMessage * msg)
+	{
+		delete msg;
+	}	
+
+	static std::atomic<uint32_t> I2NPmsgID(0); // TODO: create class
+	void FillI2NPMessageHeader (I2NPMessage * msg, I2NPMessageType msgType, uint32_t replyMsgID)
+	{
+		msg->SetTypeID (msgType);
+		if (replyMsgID) // for tunnel creation
+			msg->SetMsgID (replyMsgID); 
+		else
+		{	
+			msg->SetMsgID (I2NPmsgID);
+			I2NPmsgID++;
+		}	
+		msg->SetExpiration (i2p::util::GetMillisecondsSinceEpoch () + 5000); // TODO: 5 secs is a magic number
+		msg->UpdateSize ();
+		msg->UpdateChks ();
+	}		
+	
+	void RenewI2NPMessageHeader (I2NPMessage * msg)
+	{
+		if (msg)
+		{
+			msg->SetMsgID (I2NPmsgID);
+			I2NPmsgID++;
+			msg->SetExpiration (i2p::util::GetMillisecondsSinceEpoch () + 5000); 		
+		}
+	}
+
+	I2NPMessage * CreateI2NPMessage (I2NPMessageType msgType, const uint8_t * buf, int len, uint32_t replyMsgID)
+	{
+		I2NPMessage * msg = NewI2NPMessage (len);
+		memcpy (msg->GetPayload (), buf, len);
+		msg->len += len;
+		FillI2NPMessageHeader (msg, msgType, replyMsgID);
+		return msg;
+	}	
+
+	I2NPMessage * CreateI2NPMessage (const uint8_t * buf, int len, i2p::tunnel::InboundTunnel * from)
+	{
+		I2NPMessage * msg = NewI2NPMessage ();
+		memcpy (msg->GetBuffer (), buf, len);
+		msg->len = msg->offset + len;
+		msg->from = from;
+		return msg;
+	}	
+	
+	I2NPMessage * CreateDeliveryStatusMsg (uint32_t msgID)
+	{
+		I2NPMessage * m = NewI2NPMessage ();
+		uint8_t * buf = m->GetPayload ();
+		if (msgID)
+		{
+			htobe32buf (buf + DELIVERY_STATUS_MSGID_OFFSET, msgID);
+			htobe64buf (buf + DELIVERY_STATUS_TIMESTAMP_OFFSET, i2p::util::GetMillisecondsSinceEpoch ());
+		}
+		else // for SSU establishment
+		{
+			htobe32buf (buf + DELIVERY_STATUS_MSGID_OFFSET, i2p::context.GetRandomNumberGenerator ().GenerateWord32 ());
+			htobe64buf (buf + DELIVERY_STATUS_TIMESTAMP_OFFSET, 2); // netID = 2
+		}	
+		m->len += DELIVERY_STATUS_SIZE;
+		FillI2NPMessageHeader (m, eI2NPDeliveryStatus);
+		return m;
+	}
+
+	I2NPMessage * CreateRouterInfoDatabaseLookupMsg (const uint8_t * key, const uint8_t * from, 
+		uint32_t replyTunnelID, bool exploratory, std::set<i2p::data::IdentHash> * excludedPeers)
+	{
+		I2NPMessage * m = NewI2NPMessage ();
+		uint8_t * buf = m->GetPayload ();
+		memcpy (buf, key, 32); // key
+		buf += 32;
+		memcpy (buf, from, 32); // from
+		buf += 32;
+		uint8_t flag = exploratory ? 0x0C : 0x08; // 1000 - RI, 1100 -exporatory	
+		if (replyTunnelID)
+		{
+			*buf = flag | 0x01; // set delivery flag
+			htobe32buf (buf+1, replyTunnelID);
+			buf += 5;
+		}
+		else
+		{	
+			*buf = flag; // flag
+			buf++;
+		}	
+				
+		if (excludedPeers)
+		{
+			int cnt = excludedPeers->size ();
+			htobe16buf (buf, cnt);
+			buf += 2;
+			for (auto& it: *excludedPeers)
+			{
+				memcpy (buf, it, 32);
+				buf += 32;
+			}	
+		}
+		else
+		{	
+			// nothing to exclude
+			htobuf16 (buf, 0);
+			buf += 2;
+		}		
+		
+		m->len += (buf - m->GetPayload ()); 
+		FillI2NPMessageHeader (m, eI2NPDatabaseLookup);
+		return m; 
+	}	
+
+	I2NPMessage * CreateLeaseSetDatabaseLookupMsg (const i2p::data::IdentHash& dest, 
+		const std::set<i2p::data::IdentHash>& excludedFloodfills,
+		const i2p::tunnel::InboundTunnel * replyTunnel, const uint8_t * replyKey, const uint8_t * replyTag)
+	{
+		I2NPMessage * m = NewI2NPMessage ();
+		uint8_t * buf = m->GetPayload ();
+		memcpy (buf, dest, 32); // key
+		buf += 32;
+		memcpy (buf, replyTunnel->GetNextIdentHash (), 32); // reply tunnel GW
+		buf += 32;
+		*buf = 7; // flags (01 - tunnel, 10 - encrypted, 0100 - LS lookup
+		htobe32buf (buf + 1, replyTunnel->GetNextTunnelID ()); // reply tunnel ID
+		buf += 5;
+		
+		// excluded
+		int cnt = excludedFloodfills.size ();
+		htobe16buf (buf, cnt);
+		buf += 2;
+		if (cnt > 0)
+		{
+			for (auto& it: excludedFloodfills)
+			{
+				memcpy (buf, it, 32);
+				buf += 32;
+			}
+		}	
+		// encryption
+		memcpy (buf, replyKey, 32);
+		buf[32] = 1; // 1 tag
+		memcpy (buf + 33, replyTag, 32);
+		buf += 65;
+
+		m->len += (buf - m->GetPayload ()); 
+		FillI2NPMessageHeader (m, eI2NPDatabaseLookup);
+		return m; 		  			
+	}		
+			
+	
+
+	I2NPMessage * CreateDatabaseSearchReply (const i2p::data::IdentHash& ident, 
+		const i2p::data::RouterInfo * floodfill)
+	{
+		I2NPMessage * m = NewI2NPShortMessage ();
+		uint8_t * buf = m->GetPayload ();
+		size_t len = 0;
+		memcpy (buf, ident, 32);
+		len += 32;
+		buf[len] = floodfill ? 1 : 0; // 1 router for now
+		len++;
+		if (floodfill)
+		{
+			memcpy (buf + len, floodfill->GetIdentHash (), 32);
+			len += 32;
+		}	
+		memcpy (buf + len, i2p::context.GetRouterInfo ().GetIdentHash (), 32);
+		len += 32;	
+		m->len += len;
+		FillI2NPMessageHeader (m, eI2NPDatabaseSearchReply);
+		return m; 
+	}	
+	
+	I2NPMessage * CreateDatabaseStoreMsg (const i2p::data::RouterInfo * router)
+	{
+		if (!router) // we send own RouterInfo
+			router = &context.GetRouterInfo ();
+
+		I2NPMessage * m = NewI2NPShortMessage ();
+		uint8_t * payload = m->GetPayload ();		
+
+		memcpy (payload + DATABASE_STORE_KEY_OFFSET, router->GetIdentHash (), 32);
+		payload[DATABASE_STORE_TYPE_OFFSET] = 0;
+		htobe32buf (payload + DATABASE_STORE_REPLY_TOKEN_OFFSET, 0);
+		
+		CryptoPP::Gzip compressor;
+		compressor.Put (router->GetBuffer (), router->GetBufferLen ());
+		compressor.MessageEnd();
+		auto size = compressor.MaxRetrievable ();
+		uint8_t * buf = payload + DATABASE_STORE_HEADER_SIZE;
+		htobe16buf (buf, size); // size
+		buf += 2;
+		// TODO: check if size doesn't exceed buffer
+		compressor.Get (buf, size); 
+		m->len += DATABASE_STORE_HEADER_SIZE + 2 + size; // payload size
+		FillI2NPMessageHeader (m, eI2NPDatabaseStore);
+		
+		return m;
+	}	
+
+	I2NPMessage * CreateDatabaseStoreMsg (const i2p::data::LeaseSet * leaseSet,  uint32_t replyToken)
+	{
+		if (!leaseSet) return nullptr;
+		I2NPMessage * m = NewI2NPShortMessage ();
+		uint8_t * payload = m->GetPayload ();	
+		memcpy (payload + DATABASE_STORE_KEY_OFFSET, leaseSet->GetIdentHash (), 32);
+		payload[DATABASE_STORE_TYPE_OFFSET] = 1; // LeaseSet
+		htobe32buf (payload + DATABASE_STORE_REPLY_TOKEN_OFFSET, replyToken);
+		size_t size = DATABASE_STORE_HEADER_SIZE;
+		if (replyToken)
+		{
+			auto leases = leaseSet->GetNonExpiredLeases ();
+			if (leases.size () > 0)
+			{
+				htobe32buf (payload + size, leases[0].tunnelID);
+				size += 4; // reply tunnelID
+				memcpy (payload + size, leases[0].tunnelGateway, 32);
+				size += 32; // reply tunnel gateway
+			}
+			else
+				htobe32buf (payload + DATABASE_STORE_REPLY_TOKEN_OFFSET, 0);
+		}
+		memcpy (payload + size, leaseSet->GetBuffer (), leaseSet->GetBufferLen ());
+		size += leaseSet->GetBufferLen ();
+		m->len += size;
+		FillI2NPMessageHeader (m, eI2NPDatabaseStore);
+		return m;
+	}
+	
+	bool HandleBuildRequestRecords (int num, uint8_t * records, uint8_t * clearText)
+	{
+		for (int i = 0; i < num; i++)
+		{	
+			uint8_t * record = records + i*TUNNEL_BUILD_RECORD_SIZE;
+			if (!memcmp (record + BUILD_REQUEST_RECORD_TO_PEER_OFFSET, (const uint8_t *)i2p::context.GetRouterInfo ().GetIdentHash (), 16))
+			{	
+				LogPrint ("Record ",i," is ours");	
+			
+				i2p::crypto::ElGamalDecrypt (i2p::context.GetEncryptionPrivateKey (), record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText);
+				// replace record to reply			
+				if (i2p::context.AcceptsTunnels ())
+				{	
+					i2p::tunnel::TransitTunnel * transitTunnel = 
+						i2p::tunnel::CreateTransitTunnel (
+							bufbe32toh (clearText + BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET), 
+							clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 
+						    bufbe32toh (clearText + BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+							clearText + BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET, 
+						    clearText + BUILD_REQUEST_RECORD_IV_KEY_OFFSET, 
+							clearText[BUILD_REQUEST_RECORD_FLAG_OFFSET] & 0x80, 
+						    clearText[BUILD_REQUEST_RECORD_FLAG_OFFSET ] & 0x40);
+					i2p::tunnel::tunnels.AddTransitTunnel (transitTunnel);
+					record[BUILD_RESPONSE_RECORD_RET_OFFSET] = 0;
+				}
+				else
+					record[BUILD_RESPONSE_RECORD_RET_OFFSET] = 30; // always reject with bandwidth reason (30)
+				
+				//TODO: fill filler
+				CryptoPP::SHA256().CalculateDigest(record + BUILD_RESPONSE_RECORD_HASH_OFFSET, 
+					record + BUILD_RESPONSE_RECORD_PADDING_OFFSET, BUILD_RESPONSE_RECORD_PADDING_SIZE + 1); // + 1 byte of ret
+				// encrypt reply
+				i2p::crypto::CBCEncryption encryption;
+				for (int j = 0; j < num; j++)
+				{
+					encryption.SetKey (clearText + BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET);
+					encryption.SetIV (clearText + BUILD_REQUEST_RECORD_REPLY_IV_OFFSET);
+					uint8_t * reply = records + j*TUNNEL_BUILD_RECORD_SIZE;
+					encryption.Encrypt(reply, TUNNEL_BUILD_RECORD_SIZE, reply); 
+				}
+				return true;
+			}	
+		}	
+		return false;
+	}
+
+	void HandleVariableTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
+	{	
+		int num = buf[0];
+		LogPrint ("VariableTunnelBuild ", num, " records");
+
+		i2p::tunnel::Tunnel * tunnel =  i2p::tunnel::tunnels.GetPendingTunnel (replyMsgID);
+		if (tunnel)
+		{
+			// endpoint of inbound tunnel
+			LogPrint ("VariableTunnelBuild reply for tunnel ", tunnel->GetTunnelID ());
+			if (tunnel->HandleTunnelBuildResponse (buf, len))
+			{
+				LogPrint ("Inbound tunnel ", tunnel->GetTunnelID (), " has been created");
+				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);	
+				i2p::tunnel::tunnels.AddInboundTunnel (static_cast<i2p::tunnel::InboundTunnel *>(tunnel));
+			}
+			else
+			{
+				LogPrint ("Inbound tunnel ", tunnel->GetTunnelID (), " has been declined");
+				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);	
+			}
+		}
+		else
+		{
+			uint8_t clearText[BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE];	
+			if (HandleBuildRequestRecords (num, buf + 1, clearText))
+			{
+				if (clearText[BUILD_REQUEST_RECORD_FLAG_OFFSET] & 0x40) // we are endpoint of outboud tunnel
+				{
+					// so we send it to reply tunnel 
+					transports.SendMessage (clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 
+						CreateTunnelGatewayMsg (bufbe32toh (clearText + BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+							eI2NPVariableTunnelBuildReply, buf, len, 
+						    bufbe32toh (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));                         
+				}	
+				else	
+					transports.SendMessage (clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 
+						CreateI2NPMessage (eI2NPVariableTunnelBuild, buf, len, 
+							bufbe32toh (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
+			}	
+		}	
+	}
+
+	void HandleTunnelBuildMsg (uint8_t * buf, size_t len)
+	{
+		uint8_t clearText[BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE];	
+		if (HandleBuildRequestRecords (NUM_TUNNEL_BUILD_RECORDS, buf, clearText))
+		{
+			if (clearText[BUILD_REQUEST_RECORD_FLAG_OFFSET] & 0x40) // we are endpoint of outbound tunnel
+			{
+				// so we send it to reply tunnel 
+				transports.SendMessage (clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 
+					CreateTunnelGatewayMsg (bufbe32toh (clearText + BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+						eI2NPTunnelBuildReply, buf, len, 
+					    bufbe32toh (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));                         
+			}	
+			else	
+				transports.SendMessage (clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 
+					CreateI2NPMessage (eI2NPTunnelBuild, buf, len, 
+						bufbe32toh (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
+		} 
+	}
+
+	void HandleVariableTunnelBuildReplyMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
+	{	
+		LogPrint ("VariableTunnelBuildReplyMsg replyMsgID=", replyMsgID);
+		i2p::tunnel::Tunnel * tunnel = i2p::tunnel::tunnels.GetPendingTunnel (replyMsgID);
+		if (tunnel)
+		{	
+			// reply for outbound tunnel
+			if (tunnel->HandleTunnelBuildResponse (buf, len))
+			{	
+				LogPrint ("Outbound tunnel ", tunnel->GetTunnelID (), " has been created");
+				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);	
+				i2p::tunnel::tunnels.AddOutboundTunnel (static_cast<i2p::tunnel::OutboundTunnel *>(tunnel));
+			}	
+			else
+			{
+				LogPrint ("Outbound tunnel ", tunnel->GetTunnelID (), " has been declined");
+				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);	
+			}
+		}	
+		else
+			LogPrint ("Pending tunnel for message ", replyMsgID, " not found");
+	}
+
+
+	I2NPMessage * CreateTunnelDataMsg (const uint8_t * buf)
+	{
+		I2NPMessage * msg = NewI2NPMessage ();
+		memcpy (msg->GetPayload (), buf, i2p::tunnel::TUNNEL_DATA_MSG_SIZE);
+		msg->len += i2p::tunnel::TUNNEL_DATA_MSG_SIZE; 
+		FillI2NPMessageHeader (msg, eI2NPTunnelData);
+		return msg;
+	}	
+
+	I2NPMessage * CreateTunnelDataMsg (uint32_t tunnelID, const uint8_t * payload)	
+	{
+		I2NPMessage * msg = NewI2NPMessage ();
+		memcpy (msg->GetPayload () + 4, payload, i2p::tunnel::TUNNEL_DATA_MSG_SIZE - 4);
+		htobe32buf (msg->GetPayload (), tunnelID);
+		msg->len += i2p::tunnel::TUNNEL_DATA_MSG_SIZE; 
+		FillI2NPMessageHeader (msg, eI2NPTunnelData);
+		return msg;
+	}	
+	
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, const uint8_t * buf, size_t len)
+	{
+		I2NPMessage * msg = NewI2NPMessage (len);
+		uint8_t * payload = msg->GetPayload ();
+		htobe32buf (payload + TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET, tunnelID);
+		htobe16buf (payload + TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET, len);
+		memcpy (payload + TUNNEL_GATEWAY_HEADER_SIZE, buf, len);
+		msg->len += TUNNEL_GATEWAY_HEADER_SIZE + len;
+		FillI2NPMessageHeader (msg, eI2NPTunnelGateway);
+		return msg;
+	}	
+
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, I2NPMessage * msg)
+	{
+		if (msg->offset >= I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE)
+		{
+			// message is capable to be used without copying
+			uint8_t * payload = msg->GetBuffer () - TUNNEL_GATEWAY_HEADER_SIZE;
+			htobe32buf (payload + TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET, tunnelID);
+			int len = msg->GetLength ();
+			htobe16buf (payload + TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET, len);
+			msg->offset -= (I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE);
+			msg->len = msg->offset + I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE +len;
+			FillI2NPMessageHeader (msg, eI2NPTunnelGateway);
+			return msg;
+		}
+		else
+		{	
+			I2NPMessage * msg1 = CreateTunnelGatewayMsg (tunnelID, msg->GetBuffer (), msg->GetLength ());
+			DeleteI2NPMessage (msg);
+			return msg1;
+		}	                               
+	}
+
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, I2NPMessageType msgType, 
+		const uint8_t * buf, size_t len, uint32_t replyMsgID)
+	{
+		I2NPMessage * msg = NewI2NPMessage (len);
+		size_t gatewayMsgOffset = I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE;
+		msg->offset += gatewayMsgOffset;
+		msg->len += gatewayMsgOffset;
+		memcpy (msg->GetPayload (), buf, len);
+		msg->len += len;
+		FillI2NPMessageHeader (msg, msgType, replyMsgID); // create content message
+		len = msg->GetLength ();
+		msg->offset -= gatewayMsgOffset;
+		uint8_t * payload = msg->GetPayload ();
+		htobe32buf (payload + TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET, tunnelID);
+		htobe16buf (payload + TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET, len);
+		FillI2NPMessageHeader (msg, eI2NPTunnelGateway); // gateway message
+		return msg;
+	}	
+	
+	void HandleTunnelGatewayMsg (I2NPMessage * msg)
+	{		
+		const uint8_t * payload = msg->GetPayload ();
+		uint32_t tunnelID = bufbe32toh(payload + TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET);
+		uint16_t len = bufbe16toh(payload + TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET);
+		// we make payload as new I2NP message to send
+		msg->offset += I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE;
+		msg->len = msg->offset + len;
+		auto typeID = msg->GetTypeID ();
+		LogPrint ("TunnelGateway of ", (int)len, " bytes for tunnel ", (unsigned int)tunnelID, ". Msg type ", (int)typeID);
+			
+		if (typeID == eI2NPDatabaseStore || typeID == eI2NPDatabaseSearchReply)
+		{
+			// transit DatabaseStore my contain new/updated RI 
+			// or DatabaseSearchReply with new routers
+			auto ds = NewI2NPMessage ();
+			*ds = *msg;
+			i2p::data::netdb.PostI2NPMsg (ds);
+		}	
+		i2p::tunnel::TransitTunnel * tunnel =  i2p::tunnel::tunnels.GetTransitTunnel (tunnelID);
+		if (tunnel)
+			tunnel->SendTunnelDataMsg (msg);
+		else
+		{	
+			LogPrint ("Tunnel ", (unsigned int)tunnelID, " not found");
+			i2p::DeleteI2NPMessage (msg);
+		}	
+	}	
+
+	size_t GetI2NPMessageLength (const uint8_t * msg)
+	{
+		return bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET) + I2NP_HEADER_SIZE;
+	}	
+	
+	void HandleI2NPMessage (uint8_t * msg, size_t len)
+	{
+		uint8_t typeID = msg[I2NP_HEADER_TYPEID_OFFSET];
+		uint32_t msgID = bufbe32toh (msg + I2NP_HEADER_MSGID_OFFSET);	
+		LogPrint ("I2NP msg received len=", len,", type=", (int)typeID, ", msgID=", (unsigned int)msgID);
+
+		uint8_t * buf = msg + I2NP_HEADER_SIZE;
+		int size = bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET);
+		switch (typeID)
+		{	
+			case eI2NPVariableTunnelBuild:
+				LogPrint ("VariableTunnelBuild");
+				HandleVariableTunnelBuildMsg  (msgID, buf, size);
+			break;	
+			case eI2NPVariableTunnelBuildReply:
+				LogPrint ("VariableTunnelBuildReply");
+				HandleVariableTunnelBuildReplyMsg (msgID, buf, size);
+			break;	
+			case eI2NPTunnelBuild:
+				LogPrint ("TunnelBuild");
+				HandleTunnelBuildMsg  (buf, size);
+			break;	
+			case eI2NPTunnelBuildReply:
+				LogPrint ("TunnelBuildReply");
+				// TODO:
+			break;	
+			default:
+				LogPrint ("Unexpected message ", (int)typeID);
+		}	
+	}
+
+	void HandleI2NPMessage (I2NPMessage * msg)
+	{
+		if (msg)
+		{	
+			switch (msg->GetTypeID ())
+			{	
+				case eI2NPTunnelData:
+					LogPrint ("TunnelData");
+					i2p::tunnel::tunnels.PostTunnelData (msg);
+				break;	
+				case eI2NPTunnelGateway:
+					LogPrint ("TunnelGateway");
+					HandleTunnelGatewayMsg (msg);
+				break;
+				case eI2NPGarlic:
+					LogPrint ("Garlic");
+					if (msg->from)
+					{
+						if (msg->from->GetTunnelPool ())
+							msg->from->GetTunnelPool ()->ProcessGarlicMessage (msg);
+						else
+						{
+							LogPrint (eLogInfo, "Local destination for garlic doesn't exist anymore");
+							DeleteI2NPMessage (msg);
+						}	
+					}
+					else
+						i2p::context.ProcessGarlicMessage (msg); 
+				break;
+				case eI2NPDatabaseStore:
+				case eI2NPDatabaseSearchReply:
+				case eI2NPDatabaseLookup:
+					// forward to netDb
+					i2p::data::netdb.PostI2NPMsg (msg);
+				break;
+				case eI2NPDeliveryStatus:
+					LogPrint ("DeliveryStatus");
+					if (msg->from && msg->from->GetTunnelPool ())
+						msg->from->GetTunnelPool ()->ProcessDeliveryStatus (msg);
+					else
+						i2p::context.ProcessDeliveryStatusMessage (msg);
+				break;	
+				default:
+					HandleI2NPMessage (msg->GetBuffer (), msg->GetLength ());
+					DeleteI2NPMessage (msg);
+			}	
+		}	
+	}	
+}
--- a/I2NPProtocol.h
+++ b/I2NPProtocol.h
@ -0,0 +1,221 @@
+#ifndef I2NP_PROTOCOL_H__
+#define I2NP_PROTOCOL_H__
+
+#include <inttypes.h>
+#include <set>
+#include <cryptopp/sha.h>
+#include <string.h>
+#include "I2PEndian.h"
+#include "Identity.h"
+#include "RouterInfo.h"
+#include "LeaseSet.h"
+
+namespace i2p
+{	
+	// I2NP header
+	const size_t I2NP_HEADER_TYPEID_OFFSET = 0;
+	const size_t I2NP_HEADER_MSGID_OFFSET = I2NP_HEADER_TYPEID_OFFSET + 1;
+	const size_t I2NP_HEADER_EXPIRATION_OFFSET = I2NP_HEADER_MSGID_OFFSET + 4;
+	const size_t I2NP_HEADER_SIZE_OFFSET = I2NP_HEADER_EXPIRATION_OFFSET + 8;
+	const size_t I2NP_HEADER_CHKS_OFFSET = I2NP_HEADER_SIZE_OFFSET + 2;
+	const size_t I2NP_HEADER_SIZE = I2NP_HEADER_CHKS_OFFSET + 1;
+
+	// I2NP short header
+	const size_t I2NP_SHORT_HEADER_TYPEID_OFFSET = 0;
+	const size_t I2NP_SHORT_HEADER_EXPIRATION_OFFSET = I2NP_SHORT_HEADER_TYPEID_OFFSET + 1;
+	const size_t I2NP_SHORT_HEADER_SIZE = I2NP_SHORT_HEADER_EXPIRATION_OFFSET + 4;
+	
+	// Tunnel Gateway header
+	const size_t TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET = 0;
+	const size_t TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET = TUNNEL_GATEWAY_HEADER_TUNNELID_OFFSET + 4;
+	const size_t TUNNEL_GATEWAY_HEADER_SIZE = TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET + 2;
+
+	// DeliveryStatus	
+	const size_t DELIVERY_STATUS_MSGID_OFFSET = 0;
+	const size_t DELIVERY_STATUS_TIMESTAMP_OFFSET = DELIVERY_STATUS_MSGID_OFFSET + 4;
+	const size_t DELIVERY_STATUS_SIZE = DELIVERY_STATUS_TIMESTAMP_OFFSET + 8;
+
+	// DatabaseStore
+	const size_t DATABASE_STORE_KEY_OFFSET = 0;
+	const size_t DATABASE_STORE_TYPE_OFFSET = DATABASE_STORE_KEY_OFFSET + 32;
+	const size_t DATABASE_STORE_REPLY_TOKEN_OFFSET = DATABASE_STORE_TYPE_OFFSET + 1;
+	const size_t DATABASE_STORE_HEADER_SIZE = DATABASE_STORE_REPLY_TOKEN_OFFSET + 4;
+
+	// TunnelBuild	
+	const size_t TUNNEL_BUILD_RECORD_SIZE = 528;
+
+	//BuildRequestRecordClearText
+	const size_t BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET = 0;
+	const size_t BUILD_REQUEST_RECORD_OUR_IDENT_OFFSET = BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET + 4;
+	const size_t BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET = BUILD_REQUEST_RECORD_OUR_IDENT_OFFSET + 32;
+	const size_t BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET = BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET + 4;
+	const size_t BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET = BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET + 32;
+	const size_t BUILD_REQUEST_RECORD_IV_KEY_OFFSET = BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET + 32;
+	const size_t BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET = BUILD_REQUEST_RECORD_IV_KEY_OFFSET + 32;
+	const size_t BUILD_REQUEST_RECORD_REPLY_IV_OFFSET = BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET + 32;
+	const size_t BUILD_REQUEST_RECORD_FLAG_OFFSET = BUILD_REQUEST_RECORD_REPLY_IV_OFFSET + 16;
+	const size_t BUILD_REQUEST_RECORD_REQUEST_TIME_OFFSET = BUILD_REQUEST_RECORD_FLAG_OFFSET + 1;
+	const size_t BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET = BUILD_REQUEST_RECORD_REQUEST_TIME_OFFSET + 4;
+	const size_t BUILD_REQUEST_RECORD_PADDING_OFFSET = BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET + 4;
+	const size_t BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE = 222;
+	
+	// BuildRequestRecordEncrypted	
+	const size_t BUILD_REQUEST_RECORD_TO_PEER_OFFSET = 0;
+	const size_t BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET = BUILD_REQUEST_RECORD_TO_PEER_OFFSET + 16;
+	
+	// BuildResponseRecord
+	const size_t BUILD_RESPONSE_RECORD_HASH_OFFSET = 0;
+	const size_t BUILD_RESPONSE_RECORD_PADDING_OFFSET = 32;
+	const size_t BUILD_RESPONSE_RECORD_PADDING_SIZE = 495;
+	const size_t BUILD_RESPONSE_RECORD_RET_OFFSET = BUILD_RESPONSE_RECORD_PADDING_OFFSET + BUILD_RESPONSE_RECORD_PADDING_SIZE;
+
+	enum I2NPMessageType
+	{
+		eI2NPDatabaseStore = 1,
+		eI2NPDatabaseLookup = 2,
+		eI2NPDatabaseSearchReply = 3,
+		eI2NPDeliveryStatus = 10,
+		eI2NPGarlic = 11,
+		eI2NPTunnelData = 18,
+		eI2NPTunnelGateway = 19,
+		eI2NPData = 20,
+		eI2NPTunnelBuild = 21,
+		eI2NPTunnelBuildReply = 22,
+		eI2NPVariableTunnelBuild = 23,
+		eI2NPVariableTunnelBuildReply = 24	
+	};	
+
+	const int NUM_TUNNEL_BUILD_RECORDS = 8;	
+
+namespace tunnel
+{		
+	class InboundTunnel;
+	class TunnelPool;
+}
+
+	const size_t I2NP_MAX_MESSAGE_SIZE = 32768; 
+	const size_t I2NP_MAX_SHORT_MESSAGE_SIZE = 2400; 
+	struct I2NPMessage
+	{	
+		uint8_t * buf;	
+		size_t len, offset, maxLen;
+		i2p::tunnel::InboundTunnel * from;
+		
+		I2NPMessage (): buf (nullptr),len (I2NP_HEADER_SIZE + 2), 
+			offset(2), maxLen (0), from (nullptr) {};  // reserve 2 bytes for NTCP header
+	
+		// header accessors
+		uint8_t * GetHeader () { return GetBuffer (); };
+		const uint8_t * GetHeader () const { return GetBuffer (); };
+		void SetTypeID (uint8_t typeID) { GetHeader ()[I2NP_HEADER_TYPEID_OFFSET] = typeID; };
+		uint8_t GetTypeID () const { return GetHeader ()[I2NP_HEADER_TYPEID_OFFSET]; };
+		void SetMsgID (uint32_t msgID) { htobe32buf (GetHeader () + I2NP_HEADER_MSGID_OFFSET, msgID); };
+		uint32_t GetMsgID () const { return bufbe32toh (GetHeader () + I2NP_HEADER_MSGID_OFFSET); };
+		void SetExpiration (uint64_t expiration) { htobe64buf (GetHeader () + I2NP_HEADER_EXPIRATION_OFFSET, expiration); };
+		uint64_t GetExpiration () const { return bufbe64toh (GetHeader () + I2NP_HEADER_EXPIRATION_OFFSET); };
+		void SetSize (uint16_t size) { htobe16buf (GetHeader () + I2NP_HEADER_SIZE_OFFSET, size); };
+		uint16_t GetSize () const { return bufbe16toh (GetHeader () + I2NP_HEADER_SIZE_OFFSET); };
+		void UpdateSize () { SetSize (GetPayloadLength ()); };	
+		void SetChks (uint8_t chks) { GetHeader ()[I2NP_HEADER_CHKS_OFFSET] = chks; };
+		void UpdateChks () 
+		{
+			uint8_t hash[32];
+			CryptoPP::SHA256().CalculateDigest(hash, GetPayload (), GetPayloadLength ());
+			GetHeader ()[I2NP_HEADER_CHKS_OFFSET] = hash[0];
+		}	
+		
+		// payload
+		uint8_t * GetPayload () { return GetBuffer () + I2NP_HEADER_SIZE; };
+		uint8_t * GetBuffer () { return buf + offset; };
+		const uint8_t * GetBuffer () const { return buf + offset; };
+		size_t GetLength () const { return len - offset; };	
+		size_t GetPayloadLength () const { return GetLength () - I2NP_HEADER_SIZE; };	
+			
+		void Align (size_t alignment) 
+		{
+			size_t rem = ((size_t)GetBuffer ()) % alignment;
+			if (rem)
+			{
+				offset += (alignment - rem);
+				len += (alignment - rem);
+			}	
+		}
+
+		I2NPMessage& operator=(const I2NPMessage& other)
+		{
+			memcpy (buf + offset, other.buf + other.offset, other.GetLength ());
+			len = offset + other.GetLength ();
+			from = other.from;
+			return *this;
+		}	
+
+		// for SSU only
+		uint8_t * GetSSUHeader () { return buf + offset + I2NP_HEADER_SIZE - I2NP_SHORT_HEADER_SIZE; };	
+		void FromSSU (uint32_t msgID) // we have received SSU message and convert it to regular
+		{
+			const uint8_t * ssu = GetSSUHeader ();
+			GetHeader ()[I2NP_HEADER_TYPEID_OFFSET] = ssu[I2NP_SHORT_HEADER_TYPEID_OFFSET]; // typeid
+			SetMsgID (msgID);
+			SetExpiration (bufbe32toh (ssu + I2NP_SHORT_HEADER_EXPIRATION_OFFSET)*1000LL);
+			SetSize (len - offset - I2NP_HEADER_SIZE);
+			SetChks (0);
+		}
+		uint32_t ToSSU () // return msgID
+		{
+			uint8_t header[I2NP_HEADER_SIZE];
+			memcpy (header, GetHeader (), I2NP_HEADER_SIZE);
+			uint8_t * ssu = GetSSUHeader ();
+			ssu[I2NP_SHORT_HEADER_TYPEID_OFFSET] = header[I2NP_HEADER_TYPEID_OFFSET]; // typeid
+			htobe32buf (ssu + I2NP_SHORT_HEADER_EXPIRATION_OFFSET, bufbe64toh (header + I2NP_HEADER_EXPIRATION_OFFSET)/1000LL);
+			len = offset + I2NP_SHORT_HEADER_SIZE + bufbe16toh (header + I2NP_HEADER_SIZE_OFFSET);
+			return bufbe32toh (header + I2NP_HEADER_MSGID_OFFSET);
+		}	
+	};	
+
+	template<int sz>
+	struct I2NPMessageBuffer: public I2NPMessage
+	{
+		I2NPMessageBuffer () { buf = m_Buffer; maxLen = sz; };
+		uint8_t m_Buffer[sz];
+	};
+
+	I2NPMessage * NewI2NPMessage ();
+	I2NPMessage * NewI2NPShortMessage ();
+	I2NPMessage * NewI2NPMessage (size_t len);
+	void DeleteI2NPMessage (I2NPMessage * msg);
+	void FillI2NPMessageHeader (I2NPMessage * msg, I2NPMessageType msgType, uint32_t replyMsgID = 0);
+	void RenewI2NPMessageHeader (I2NPMessage * msg);
+	I2NPMessage * CreateI2NPMessage (I2NPMessageType msgType, const uint8_t * buf, int len, uint32_t replyMsgID = 0);	
+	I2NPMessage * CreateI2NPMessage (const uint8_t * buf, int len, i2p::tunnel::InboundTunnel * from = nullptr);
+	
+	I2NPMessage * CreateDeliveryStatusMsg (uint32_t msgID);
+	I2NPMessage * CreateRouterInfoDatabaseLookupMsg (const uint8_t * key, const uint8_t * from, 
+		uint32_t replyTunnelID, bool exploratory = false, std::set<i2p::data::IdentHash> * excludedPeers = nullptr);
+	I2NPMessage * CreateLeaseSetDatabaseLookupMsg (const i2p::data::IdentHash& dest, 
+		const std::set<i2p::data::IdentHash>& excludedFloodfills,
+		const i2p::tunnel::InboundTunnel * replyTunnel, const uint8_t * replyKey, const uint8_t * replyTag);
+	I2NPMessage * CreateDatabaseSearchReply (const i2p::data::IdentHash& ident, const i2p::data::RouterInfo * floodfill);
+	
+	I2NPMessage * CreateDatabaseStoreMsg (const i2p::data::RouterInfo * router = nullptr);
+	I2NPMessage * CreateDatabaseStoreMsg (const i2p::data::LeaseSet * leaseSet, uint32_t replyToken = 0);		
+		
+	bool HandleBuildRequestRecords (int num, uint8_t * records, uint8_t * clearText);
+	void HandleVariableTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len);
+	void HandleVariableTunnelBuildReplyMsg (uint32_t replyMsgID, uint8_t * buf, size_t len);
+	void HandleTunnelBuildMsg (uint8_t * buf, size_t len);	
+
+	I2NPMessage * CreateTunnelDataMsg (const uint8_t * buf);	
+	I2NPMessage * CreateTunnelDataMsg (uint32_t tunnelID, const uint8_t * payload);		
+	
+	void HandleTunnelGatewayMsg (I2NPMessage * msg);
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, const uint8_t * buf, size_t len);
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, I2NPMessageType msgType, 
+		const uint8_t * buf, size_t len, uint32_t replyMsgID = 0);
+	I2NPMessage * CreateTunnelGatewayMsg (uint32_t tunnelID, I2NPMessage * msg);
+
+	size_t GetI2NPMessageLength (const uint8_t * msg);
+	void HandleI2NPMessage (uint8_t * msg, size_t len);
+	void HandleI2NPMessage (I2NPMessage * msg);
+}	
+
+#endif
--- a/libi2pd/I2PEndian.cpp
+++ b/libi2pd/I2PEndian.cpp
@ -1,11 +1,3 @@
-/*
-* Copyright (c) 2013-2022, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
 #include "I2PEndian.h"

 // http://habrahabr.ru/post/121811/
@ -50,3 +42,42 @@ uint64_t be64toh(uint64_t big64)
 	return u64.raw_value;
 }
 #endif
+
+/* it can be used in Windows 8
+#include <Winsock2.h>
+
+uint16_t htobe16(uint16_t int16)
+{
+	return htons(int16);
+}
+
+uint32_t htobe32(uint32_t int32)
+{
+	return htonl(int32);
+}
+
+uint64_t htobe64(uint64_t int64)
+{
+	// http://msdn.microsoft.com/en-us/library/windows/desktop/jj710199%28v=vs.85%29.aspx
+	//return htonll(int64);
+	return 0;
+}
+
+
+uint16_t be16toh(uint16_t big16)
+{
+	return ntohs(big16);
+}
+
+uint32_t be32toh(uint32_t big32)
+{
+	return ntohl(big32);
+}
+
+uint64_t be64toh(uint64_t big64)
+{
+	// http://msdn.microsoft.com/en-us/library/windows/desktop/jj710199%28v=vs.85%29.aspx
+	//return ntohll(big64);
+	return 0;
+}
+*/
--- a/libi2pd/I2PEndian.h
+++ b/libi2pd/I2PEndian.h
@ -1,23 +1,14 @@
-/*
-* Copyright (c) 2013-2022, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
 #ifndef I2PENDIAN_H__
 #define I2PENDIAN_H__
 #include <inttypes.h>
 #include <string.h>

-#if defined(__FreeBSD__) || defined(__NetBSD__)
-#include <sys/endian.h>
-
-#elif defined(__linux__) || defined(__FreeBSD_kernel__) || defined(__OpenBSD__) || defined(__GLIBC__) || defined(__HAIKU__)
+#if defined(__linux__) || defined(__FreeBSD_kernel__)
 #include <endian.h>
-
+#elif __FreeBSD__
+#include <sys/endian.h>
 #elif defined(__APPLE__) && defined(__MACH__)
+
 #include <libkern/OSByteOrder.h>

 #define htobe16(x) OSSwapHostToBigInt16(x)
@ -35,40 +26,6 @@
 #define be64toh(x) OSSwapBigToHostInt64(x)
 #define le64toh(x) OSSwapLittleToHostInt64(x)

-#elif defined(_WIN32)
-#if defined(_MSC_VER)
-#include <stdlib.h>
-#define htobe16(x) _byteswap_ushort(x)
-#define htole16(x) (x)
-#define be16toh(x) _byteswap_ushort(x)
-#define le16toh(x) (x)
-
-#define htobe32(x) _byteswap_ulong(x)
-#define htole32(x) (x)
-#define be32toh(x) _byteswap_ulong(x)
-#define le32toh(x) (x)
-
-#define htobe64(x) _byteswap_uint64(x)
-#define htole64(x) (x)
-#define be64toh(x) _byteswap_uint64(x)
-#define le64toh(x) (x)
-#else
-#define htobe16(x) __builtin_bswap16(x)
-#define htole16(x) (x)
-#define be16toh(x) __builtin_bswap16(x)
-#define le16toh(x) (x)
-
-#define htobe32(x) __builtin_bswap32(x)
-#define htole32(x) (x)
-#define be32toh(x) __builtin_bswap32(x)
-#define le32toh(x) (x)
-
-#define htobe64(x) __builtin_bswap64(x)
-#define htole64(x) (x)
-#define be64toh(x) __builtin_bswap64(x)
-#define le64toh(x) (x)
-#endif
-
 #else
 #define NEEDS_LOCAL_ENDIAN
 #include <cstdint>
@ -156,35 +113,7 @@ inline void htobe64buf(void *buf, uint64_t big64)
 	htobuf64(buf, htobe64(big64));
 }

-inline void htole16buf(void *buf, uint16_t big16)
-{
-	htobuf16(buf, htole16(big16));
-}

-inline void htole32buf(void *buf, uint32_t big32)
-{
-	htobuf32(buf, htole32(big32));
-}
-
-inline void htole64buf(void *buf, uint64_t big64)
-{
-	htobuf64(buf, htole64(big64));
-}
-
-inline uint16_t bufle16toh(const void *buf)
-{
-	return le16toh(buf16toh(buf));
-}
-
-inline uint32_t bufle32toh(const void *buf)
-{
-	return le32toh(buf32toh(buf));
-}
-
-inline uint64_t bufle64toh(const void *buf)
-{
-	return le64toh(buf64toh(buf));
-}

 #endif // I2PENDIAN_H__

--- a/I2PTunnel.cpp
+++ b/I2PTunnel.cpp
@ -0,0 +1,293 @@
+#include "base64.h"
+#include "Log.h"
+#include "Destination.h"
+#include "ClientContext.h"
+#include "I2PTunnel.h"
+
+namespace i2p
+{
+namespace client
+{
+	I2PTunnelConnection::I2PTunnelConnection (I2PTunnel * owner, 
+	    boost::asio::ip::tcp::socket * socket, const i2p::data::LeaseSet * leaseSet): 
+		m_Socket (socket), m_Owner (owner), m_RemoteEndpoint (socket->remote_endpoint ()),
+		m_IsQuiet (true)
+	{
+		m_Stream = m_Owner->GetLocalDestination ()->CreateStream (*leaseSet);
+	}	
+
+	I2PTunnelConnection::I2PTunnelConnection (I2PTunnel * owner,
+	    boost::asio::ip::tcp::socket * socket, std::shared_ptr<i2p::stream::Stream> stream):
+		m_Socket (socket), m_Stream (stream), m_Owner (owner),
+		m_RemoteEndpoint (socket->remote_endpoint ()), m_IsQuiet (true)
+	{
+	}
+
+	I2PTunnelConnection::I2PTunnelConnection (I2PTunnel * owner, std::shared_ptr<i2p::stream::Stream> stream,  
+	    boost::asio::ip::tcp::socket * socket, const boost::asio::ip::tcp::endpoint& target, bool quiet):
+		m_Socket (socket), m_Stream (stream), m_Owner (owner), m_RemoteEndpoint (target), m_IsQuiet (quiet)
+	{
+	}
+
+	I2PTunnelConnection::~I2PTunnelConnection ()
+	{
+		delete m_Socket;
+	}	
+
+	void I2PTunnelConnection::I2PConnect (const uint8_t * msg, size_t len)
+	{
+		if (msg)
+			m_Stream->Send (msg, len); // connect and send
+		else	
+			m_Stream->Send (m_Buffer, 0); // connect
+		StreamReceive ();
+		Receive ();
+	}
+		
+	void I2PTunnelConnection::Connect ()
+	{
+		if (m_Socket)
+			m_Socket->async_connect (m_RemoteEndpoint, std::bind (&I2PTunnelConnection::HandleConnect,
+				shared_from_this (), std::placeholders::_1));
+	}	
+		
+	void I2PTunnelConnection::Terminate ()
+	{	
+		if (m_Stream)
+		{
+			m_Stream->Close ();
+			m_Stream.reset ();
+		}	
+		m_Socket->close ();
+		if (m_Owner)
+			m_Owner->RemoveConnection (shared_from_this ());
+	}			
+
+	void I2PTunnelConnection::Receive ()
+	{
+		m_Socket->async_read_some (boost::asio::buffer(m_Buffer, I2P_TUNNEL_CONNECTION_BUFFER_SIZE),                
+			std::bind(&I2PTunnelConnection::HandleReceived, shared_from_this (), 
+			std::placeholders::_1, std::placeholders::_2));
+	}	
+	
+	void I2PTunnelConnection::HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+		{
+			LogPrint ("I2PTunnel read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			if (m_Stream)
+				m_Stream->Send (m_Buffer, bytes_transferred);
+			Receive ();
+		}
+	}	
+
+	void I2PTunnelConnection::HandleWrite (const boost::system::error_code& ecode)
+	{
+		if (ecode)
+		{
+			LogPrint ("I2PTunnel write error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+			StreamReceive ();
+	}
+
+	void I2PTunnelConnection::StreamReceive ()
+	{
+		if (m_Stream)
+			m_Stream->AsyncReceive (boost::asio::buffer (m_StreamBuffer, I2P_TUNNEL_CONNECTION_BUFFER_SIZE),
+				std::bind (&I2PTunnelConnection::HandleStreamReceive, shared_from_this (),
+					std::placeholders::_1, std::placeholders::_2),
+				I2P_TUNNEL_CONNECTION_MAX_IDLE);
+	}	
+
+	void I2PTunnelConnection::HandleStreamReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+		{
+			LogPrint ("I2PTunnel stream read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			boost::asio::async_write (*m_Socket, boost::asio::buffer (m_StreamBuffer, bytes_transferred),
+        		std::bind (&I2PTunnelConnection::HandleWrite, shared_from_this (), std::placeholders::_1));
+		}
+	}
+
+	void I2PTunnelConnection::HandleConnect (const boost::system::error_code& ecode)
+	{
+		if (ecode)
+		{
+			LogPrint ("I2PTunnel connect error: ", ecode.message ());
+			Terminate ();
+		}
+		else
+		{
+			LogPrint ("I2PTunnel connected");
+			if (m_IsQuiet)
+				StreamReceive ();
+			else
+			{
+				// send destination first like received from I2P
+				std::string dest = m_Stream->GetRemoteIdentity ().ToBase64 ();
+				dest += "\n";
+				memcpy (m_StreamBuffer, dest.c_str (), dest.size ());
+				HandleStreamReceive (boost::system::error_code (), dest.size ());
+			}	
+			Receive ();	
+		}
+	}
+
+	I2PTunnel::I2PTunnel (ClientDestination * localDestination) :
+		m_LocalDestination (localDestination ? localDestination :
+			i2p::client::context.CreateNewLocalDestination (false, I2P_TUNNEL_DEFAULT_KEY_TYPE))
+	{
+	}
+	void I2PTunnel::AddConnection (std::shared_ptr<I2PTunnelConnection> conn)
+	{
+		m_Connections.insert (conn);
+	}
+		
+	void I2PTunnel::RemoveConnection (std::shared_ptr<I2PTunnelConnection> conn)
+	{
+		m_Connections.erase (conn);
+	}	
+	
+	void I2PTunnel::ClearConnections ()
+	{
+		m_Connections.clear ();
+	}	
+		
+	I2PClientTunnel::I2PClientTunnel (const std::string& destination, int port, ClientDestination * localDestination): 
+		I2PTunnel (localDestination),
+		m_Acceptor (GetService (), boost::asio::ip::tcp::endpoint (boost::asio::ip::tcp::v4(), port)),
+		m_Timer (GetService ()), m_Destination (destination), m_DestinationIdentHash (nullptr)
+	{
+	}	
+
+	I2PClientTunnel::~I2PClientTunnel ()
+	{
+		Stop ();
+	}
+	
+	void I2PClientTunnel::Start ()
+	{
+		GetIdentHash();
+		m_Acceptor.listen ();
+		Accept ();
+	}
+
+	void I2PClientTunnel::Stop ()
+	{
+		m_Acceptor.close();
+		m_Timer.cancel ();
+		ClearConnections ();
+		auto *originalIdentHash = m_DestinationIdentHash;
+		m_DestinationIdentHash = nullptr;
+		delete originalIdentHash;
+	}
+
+	/* HACK: maybe we should create a caching IdentHash provider in AddressBook */
+	const i2p::data::IdentHash * I2PClientTunnel::GetIdentHash ()
+	{
+		if (!m_DestinationIdentHash)
+		{
+			i2p::data::IdentHash identHash;
+			if (i2p::client::context.GetAddressBook ().GetIdentHash (m_Destination, identHash))
+				m_DestinationIdentHash = new i2p::data::IdentHash (identHash);
+			else
+				LogPrint (eLogWarning,"Remote destination ", m_Destination, " not found");
+		}
+		return m_DestinationIdentHash;
+	}
+
+	
+	void I2PClientTunnel::Accept ()
+	{
+		auto newSocket = new boost::asio::ip::tcp::socket (GetService ());
+		m_Acceptor.async_accept (*newSocket, std::bind (&I2PClientTunnel::HandleAccept, this,
+			std::placeholders::_1, newSocket));
+	}	
+
+	void I2PClientTunnel::HandleAccept (const boost::system::error_code& ecode, boost::asio::ip::tcp::socket * socket)
+	{
+		if (!ecode)
+		{
+			const i2p::data::IdentHash *identHash = GetIdentHash();
+			if (identHash)
+				GetLocalDestination ()->CreateStream (
+					std::bind (&I2PClientTunnel::HandleStreamRequestComplete,
+					this, std::placeholders::_1, socket), *identHash);
+			else
+			{
+				LogPrint (eLogError,"Closing socket");
+				delete socket;
+			}
+			Accept ();
+		}
+		else
+		{
+			LogPrint (eLogError,"Closing socket on accept because: ", ecode.message ());
+			delete socket;
+		}
+	}
+
+	void I2PClientTunnel::HandleStreamRequestComplete (std::shared_ptr<i2p::stream::Stream> stream, boost::asio::ip::tcp::socket * socket)
+	{
+		if (stream)
+		{
+			LogPrint (eLogInfo,"New I2PTunnel connection");
+			auto connection = std::make_shared<I2PTunnelConnection>(this, socket, stream);
+			AddConnection (connection);
+			connection->I2PConnect ();
+		}
+		else
+		{
+			LogPrint (eLogError,"Issue when creating the stream, check the previous warnings for more info.");
+			delete socket;
+		}
+	}
+
+	I2PServerTunnel::I2PServerTunnel (const std::string& address, int port, ClientDestination * localDestination): 
+		I2PTunnel (localDestination), m_Endpoint (boost::asio::ip::address::from_string (address), port)
+	{
+	}
+	
+	void I2PServerTunnel::Start ()
+	{
+		Accept ();
+	}
+
+	void I2PServerTunnel::Stop ()
+	{
+		ClearConnections ();
+	}	
+
+	void I2PServerTunnel::Accept ()
+	{
+		auto localDestination = GetLocalDestination ();	
+		if (localDestination)
+			localDestination->AcceptStreams (std::bind (&I2PServerTunnel::HandleAccept, this, std::placeholders::_1));
+		else
+			LogPrint ("Local destination not set for server tunnel");
+	}
+
+	void I2PServerTunnel::HandleAccept (std::shared_ptr<i2p::stream::Stream> stream)
+	{
+		if (stream)
+		{	
+			auto conn = std::make_shared<I2PTunnelConnection> (this, stream, new boost::asio::ip::tcp::socket (GetService ()), m_Endpoint);
+			AddConnection (conn);
+			conn->Connect ();
+		}	
+	}
+}		
+}	
--- a/I2PTunnel.h
+++ b/I2PTunnel.h
@ -0,0 +1,127 @@
+#ifndef I2PTUNNEL_H__
+#define I2PTUNNEL_H__
+
+#include <inttypes.h>
+#include <string>
+#include <set>
+#include <memory>
+#include <boost/asio.hpp>
+#include "Identity.h"
+#include "Destination.h"
+#include "Streaming.h"
+
+namespace i2p
+{
+namespace client
+{
+	const size_t I2P_TUNNEL_CONNECTION_BUFFER_SIZE = 8192;
+	const int I2P_TUNNEL_CONNECTION_MAX_IDLE = 3600; // in seconds	
+	const int I2P_TUNNEL_DESTINATION_REQUEST_TIMEOUT = 10; // in seconds
+	const i2p::data::SigningKeyType I2P_TUNNEL_DEFAULT_KEY_TYPE = i2p::data::SIGNING_KEY_TYPE_ECDSA_SHA256_P256;
+
+	class I2PTunnel;
+	class I2PTunnelConnection: public std::enable_shared_from_this<I2PTunnelConnection>
+	{
+		public:
+
+			I2PTunnelConnection (I2PTunnel * owner, boost::asio::ip::tcp::socket * socket,
+				const i2p::data::LeaseSet * leaseSet); // to I2P
+			I2PTunnelConnection (I2PTunnel * owner, boost::asio::ip::tcp::socket * socket,
+				std::shared_ptr<i2p::stream::Stream> stream); // to I2P using simplified API :)
+			I2PTunnelConnection (I2PTunnel * owner, std::shared_ptr<i2p::stream::Stream> stream,  boost::asio::ip::tcp::socket * socket, 
+				const boost::asio::ip::tcp::endpoint& target, bool quiet = true); // from I2P
+			~I2PTunnelConnection ();
+
+			void I2PConnect (const uint8_t * msg = nullptr, size_t len = 0);
+			void Connect ();
+			
+		private:
+
+			void Terminate ();	
+
+			void Receive ();
+			void HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);	
+			void HandleWrite (const boost::system::error_code& ecode);	
+
+			void StreamReceive ();
+			void HandleStreamReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleConnect (const boost::system::error_code& ecode);
+
+		private:
+
+			uint8_t m_Buffer[I2P_TUNNEL_CONNECTION_BUFFER_SIZE], m_StreamBuffer[I2P_TUNNEL_CONNECTION_BUFFER_SIZE];
+			boost::asio::ip::tcp::socket * m_Socket;
+			std::shared_ptr<i2p::stream::Stream> m_Stream;
+			I2PTunnel * m_Owner;
+			boost::asio::ip::tcp::endpoint m_RemoteEndpoint;
+			bool m_IsQuiet; // don't send destination
+	};	
+
+	class I2PTunnel
+	{
+		public:
+
+			I2PTunnel (ClientDestination * localDestination  = nullptr);
+			virtual ~I2PTunnel () { ClearConnections (); }; 
+
+			void AddConnection (std::shared_ptr<I2PTunnelConnection> conn);
+			void RemoveConnection (std::shared_ptr<I2PTunnelConnection> conn);	
+			void ClearConnections ();
+			ClientDestination * GetLocalDestination () { return m_LocalDestination; };
+			void SetLocalDestination (ClientDestination * dest) { m_LocalDestination = dest; }; 			
+
+			boost::asio::io_service& GetService () { return m_LocalDestination->GetService (); };
+			
+		private:
+
+			ClientDestination * m_LocalDestination;
+			std::set<std::shared_ptr<I2PTunnelConnection> > m_Connections;
+	};	
+	
+	class I2PClientTunnel: public I2PTunnel
+	{
+		public:
+
+			I2PClientTunnel (const std::string& destination, int port, ClientDestination * localDestination = nullptr);
+			~I2PClientTunnel ();				
+	
+			void Start ();
+			void Stop ();
+
+		private:
+
+			const i2p::data::IdentHash * GetIdentHash ();
+			void Accept ();
+			void HandleAccept (const boost::system::error_code& ecode, boost::asio::ip::tcp::socket * socket);
+			void HandleStreamRequestComplete (std::shared_ptr<i2p::stream::Stream> stream, boost::asio::ip::tcp::socket * socket);
+
+		private:
+
+			boost::asio::ip::tcp::acceptor m_Acceptor;
+			boost::asio::deadline_timer m_Timer;
+			std::string m_Destination;
+			const i2p::data::IdentHash * m_DestinationIdentHash;
+	};	
+
+	class I2PServerTunnel: public I2PTunnel
+	{
+		public:
+
+			I2PServerTunnel (const std::string& address, int port, ClientDestination * localDestination);	
+
+			void Start ();
+			void Stop ();
+
+		private:
+
+			void Accept ();
+			void HandleAccept (std::shared_ptr<i2p::stream::Stream> stream);
+
+		private:
+
+			boost::asio::ip::tcp::endpoint m_Endpoint;		
+	};
+}		
+}	
+
+#endif
--- a/Identity.cpp
+++ b/Identity.cpp
@ -0,0 +1,548 @@
+#include <time.h>
+#include <stdio.h>
+#include <cryptopp/sha.h>
+#include <cryptopp/osrng.h>
+#include <cryptopp/dsa.h>
+#include "base64.h"
+#include "CryptoConst.h"
+#include "ElGamal.h"
+#include "RouterContext.h"
+#include "Identity.h"
+#include "I2PEndian.h"
+
+namespace i2p
+{
+namespace data
+{
+	Identity& Identity::operator=(const Keys& keys)
+	{
+		// copy public and signing keys together
+		memcpy (publicKey, keys.publicKey, sizeof (publicKey) + sizeof (signingKey));
+		memset (&certificate, 0, sizeof (certificate));		
+		return *this;
+	}
+
+	size_t Identity::FromBuffer (const uint8_t * buf, size_t len)
+	{
+		memcpy (publicKey, buf, DEFAULT_IDENTITY_SIZE);
+		return DEFAULT_IDENTITY_SIZE;
+	}
+
+	IdentHash Identity::Hash () const
+	{
+		IdentHash hash;
+		CryptoPP::SHA256().CalculateDigest(hash, publicKey, DEFAULT_IDENTITY_SIZE);
+		return hash;
+	}	
+	
+	IdentityEx::IdentityEx ():
+		m_Verifier (nullptr), m_ExtendedLen (0), m_ExtendedBuffer (nullptr)
+	{
+	}
+
+	IdentityEx::IdentityEx(const uint8_t * publicKey, const uint8_t * signingKey, SigningKeyType type)
+	{	
+		memcpy (m_StandardIdentity.publicKey, publicKey, sizeof (m_StandardIdentity.publicKey));
+		if (type != SIGNING_KEY_TYPE_DSA_SHA1)
+		{
+			size_t excessLen = 0;
+			uint8_t * excessBuf = nullptr;
+			switch (type)
+			{
+				case SIGNING_KEY_TYPE_ECDSA_SHA256_P256:
+				{	
+					size_t padding =  128 - i2p::crypto::ECDSAP256_KEY_LENGTH; // 64 = 128 - 64
+					memcpy (m_StandardIdentity.signingKey + padding, signingKey, i2p::crypto::ECDSAP256_KEY_LENGTH);
+					break;
+				}
+				case SIGNING_KEY_TYPE_ECDSA_SHA384_P384:
+				{	
+					size_t padding = 128 - i2p::crypto::ECDSAP384_KEY_LENGTH; // 32 = 128 - 96
+					memcpy (m_StandardIdentity.signingKey + padding, signingKey, i2p::crypto::ECDSAP384_KEY_LENGTH);
+					break;
+				}	
+				case SIGNING_KEY_TYPE_ECDSA_SHA512_P521:
+				{
+					memcpy (m_StandardIdentity.signingKey, signingKey, 128);
+					excessLen = i2p::crypto::ECDSAP521_KEY_LENGTH - 128; // 4 = 132 - 128
+					excessBuf = new uint8_t[excessLen];
+					memcpy (excessBuf, signingKey + 128, excessLen);
+					break;
+				}	
+				case SIGNING_KEY_TYPE_RSA_SHA256_2048:
+				{
+					memcpy (m_StandardIdentity.signingKey, signingKey, 128);
+					excessLen = i2p::crypto::RSASHA2562048_KEY_LENGTH - 128; // 128 = 256 - 128
+					excessBuf = new uint8_t[excessLen];
+					memcpy (excessBuf, signingKey + 128, excessLen);
+					break;
+				}	
+				case SIGNING_KEY_TYPE_RSA_SHA384_3072:
+				{
+					memcpy (m_StandardIdentity.signingKey, signingKey, 128);
+					excessLen = i2p::crypto::RSASHA3843072_KEY_LENGTH - 128; // 256 = 384 - 128
+					excessBuf = new uint8_t[excessLen];
+					memcpy (excessBuf, signingKey + 128, excessLen);
+					break;
+				}	
+				case SIGNING_KEY_TYPE_RSA_SHA512_4096:
+				{
+					memcpy (m_StandardIdentity.signingKey, signingKey, 128);
+					excessLen = i2p::crypto::RSASHA5124096_KEY_LENGTH - 128; // 384 = 512 - 128
+					excessBuf = new uint8_t[excessLen];
+					memcpy (excessBuf, signingKey + 128, excessLen);
+					break;
+				}		
+				default:
+					LogPrint ("Signing key type ", (int)type, " is not supported");
+			}	
+			m_ExtendedLen = 4 + excessLen; // 4 bytes extra + excess length
+			// fill certificate
+			m_StandardIdentity.certificate.type = CERTIFICATE_TYPE_KEY;
+			m_StandardIdentity.certificate.length = htobe16 (m_ExtendedLen); 
+			// fill extended buffer
+			m_ExtendedBuffer = new uint8_t[m_ExtendedLen];
+			htobe16buf (m_ExtendedBuffer, type);
+			htobe16buf (m_ExtendedBuffer + 2, CRYPTO_KEY_TYPE_ELGAMAL);
+			if (excessLen && excessBuf)
+			{
+				memcpy (m_ExtendedBuffer + 4, excessBuf, excessLen);
+				delete[] excessBuf;
+			}	
+			// calculate ident hash
+			uint8_t * buf = new uint8_t[GetFullLen ()];
+			ToBuffer (buf, GetFullLen ());
+			CryptoPP::SHA256().CalculateDigest(m_IdentHash, buf, GetFullLen ());
+			delete[] buf;
+		}
+		else // DSA-SHA1
+		{
+			memcpy (m_StandardIdentity.signingKey, signingKey, sizeof (m_StandardIdentity.signingKey));
+			memset (&m_StandardIdentity.certificate, 0, sizeof (m_StandardIdentity.certificate));
+			m_IdentHash = m_StandardIdentity.Hash ();
+			m_ExtendedLen = 0;
+			m_ExtendedBuffer = nullptr;
+		}	
+		CreateVerifier ();
+	}	
+		
+	IdentityEx::IdentityEx (const uint8_t * buf, size_t len):
+		m_Verifier (nullptr), m_ExtendedLen (0), m_ExtendedBuffer (nullptr)
+	{
+		FromBuffer (buf, len);
+	}
+
+	IdentityEx::IdentityEx (const IdentityEx& other):
+		m_Verifier (nullptr), m_ExtendedBuffer (nullptr)
+	{
+		*this = other;
+	}	
+		
+	IdentityEx::~IdentityEx ()
+	{
+		delete m_Verifier;
+		delete[] m_ExtendedBuffer;
+	}	
+
+	IdentityEx& IdentityEx::operator=(const IdentityEx& other)
+	{
+		memcpy (&m_StandardIdentity, &other.m_StandardIdentity, DEFAULT_IDENTITY_SIZE);
+		m_IdentHash = other.m_IdentHash;
+		
+		delete[] m_ExtendedBuffer;
+		m_ExtendedLen = other.m_ExtendedLen;
+		if (m_ExtendedLen > 0)
+		{	
+			m_ExtendedBuffer = new uint8_t[m_ExtendedLen];
+			memcpy (m_ExtendedBuffer, other.m_ExtendedBuffer, m_ExtendedLen);
+		}	        
+		else
+			m_ExtendedBuffer = nullptr;
+		
+		delete m_Verifier;
+		m_Verifier = nullptr;
+		
+		return *this;
+	}	
+
+	IdentityEx& IdentityEx::operator=(const Identity& standard)
+	{
+		m_StandardIdentity = standard;
+		m_IdentHash = m_StandardIdentity.Hash ();
+		
+		delete[] m_ExtendedBuffer;
+		m_ExtendedBuffer = nullptr;
+		m_ExtendedLen = 0;
+
+		delete m_Verifier;
+		m_Verifier = nullptr;
+		
+		return *this;
+	}	
+		
+	size_t IdentityEx::FromBuffer (const uint8_t * buf, size_t len)
+	{
+		if (len < DEFAULT_IDENTITY_SIZE)
+		{
+			LogPrint (eLogError, "Identity buffer length ", len, " is too small");
+			return 0;
+		}	
+		memcpy (&m_StandardIdentity, buf, DEFAULT_IDENTITY_SIZE);
+
+		delete[] m_ExtendedBuffer;
+		if (m_StandardIdentity.certificate.length)
+		{
+			m_ExtendedLen = be16toh (m_StandardIdentity.certificate.length);
+			if (m_ExtendedLen + DEFAULT_IDENTITY_SIZE <= len)
+			{	
+				m_ExtendedBuffer = new uint8_t[m_ExtendedLen];
+				memcpy (m_ExtendedBuffer, buf + DEFAULT_IDENTITY_SIZE, m_ExtendedLen);
+			}	
+			else
+			{
+				LogPrint (eLogError, "Certificate length ", m_ExtendedLen, " exceeds buffer length ", len - DEFAULT_IDENTITY_SIZE);
+				return 0;
+			}	
+		}		
+		else
+		{
+			m_ExtendedLen = 0;
+			m_ExtendedBuffer = nullptr;
+		}	
+		CryptoPP::SHA256().CalculateDigest(m_IdentHash, buf, GetFullLen ());
+		
+		delete m_Verifier;
+		m_Verifier = nullptr;
+		
+		return GetFullLen ();
+	}	
+
+	size_t IdentityEx::ToBuffer (uint8_t * buf, size_t len) const
+	{		
+		memcpy (buf, &m_StandardIdentity, DEFAULT_IDENTITY_SIZE);
+		if (m_ExtendedLen > 0 && m_ExtendedBuffer)
+			memcpy (buf + DEFAULT_IDENTITY_SIZE, m_ExtendedBuffer, m_ExtendedLen);
+		return GetFullLen ();
+	}
+
+	size_t IdentityEx::FromBase64(const std::string& s)
+	{
+		uint8_t buf[1024];
+		auto len = Base64ToByteStream (s.c_str(), s.length(), buf, 1024);
+		return FromBuffer (buf, len);
+	}	
+	
+	std::string IdentityEx::ToBase64 () const
+	{
+		uint8_t buf[1024];
+		char str[1536];
+		size_t l = ToBuffer (buf, 1024);
+		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, 1536);
+		str[l1] = 0;
+		return std::string (str);
+	}
+	
+	size_t IdentityEx::GetSigningPublicKeyLen () const
+	{
+		if (!m_Verifier) CreateVerifier ();
+		if (m_Verifier)	
+			return m_Verifier->GetPublicKeyLen ();
+		return 128;
+	}	
+
+	size_t IdentityEx::GetSigningPrivateKeyLen () const
+	{
+		if (!m_Verifier) CreateVerifier ();
+		if (m_Verifier)	
+			return m_Verifier->GetPrivateKeyLen ();
+		return GetSignatureLen ()/2;
+	}	
+		
+	size_t IdentityEx::GetSignatureLen () const
+	{	
+		if (!m_Verifier) CreateVerifier ();	
+		if (m_Verifier)
+			return m_Verifier->GetSignatureLen ();
+		return 40;
+	}	
+	bool IdentityEx::Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const 
+	{
+		if (!m_Verifier) CreateVerifier ();
+		if (m_Verifier)
+			return m_Verifier->Verify (buf, len, signature);
+		return false;
+	}	
+
+	SigningKeyType IdentityEx::GetSigningKeyType () const
+	{
+		if (m_StandardIdentity.certificate.type == CERTIFICATE_TYPE_KEY && m_ExtendedBuffer)				
+			return bufbe16toh (m_ExtendedBuffer); // signing key
+		return SIGNING_KEY_TYPE_DSA_SHA1;
+	}	
+
+	CryptoKeyType IdentityEx::GetCryptoKeyType () const
+	{
+		if (m_StandardIdentity.certificate.type == CERTIFICATE_TYPE_KEY && m_ExtendedBuffer)				
+			return bufbe16toh (m_ExtendedBuffer + 2); // crypto key
+		return CRYPTO_KEY_TYPE_ELGAMAL;
+	}	
+		
+	void IdentityEx::CreateVerifier () const 
+	{
+		auto keyType = GetSigningKeyType ();
+		switch (keyType)
+		{
+			case SIGNING_KEY_TYPE_DSA_SHA1:
+				m_Verifier = new i2p::crypto::DSAVerifier (m_StandardIdentity.signingKey);
+			break;
+			case SIGNING_KEY_TYPE_ECDSA_SHA256_P256:
+			{	
+				size_t padding =  128 - i2p::crypto::ECDSAP256_KEY_LENGTH; // 64 = 128 - 64
+				m_Verifier = new i2p::crypto::ECDSAP256Verifier (m_StandardIdentity.signingKey + padding);
+				break;
+			}	
+			case SIGNING_KEY_TYPE_ECDSA_SHA384_P384:
+			{	
+				size_t padding = 128 - i2p::crypto::ECDSAP384_KEY_LENGTH; // 32 = 128 - 96
+				m_Verifier = new i2p::crypto::ECDSAP384Verifier (m_StandardIdentity.signingKey + padding);
+				break;
+			}	
+			case SIGNING_KEY_TYPE_ECDSA_SHA512_P521:
+			{	
+				uint8_t signingKey[i2p::crypto::ECDSAP521_KEY_LENGTH];
+				memcpy (signingKey, m_StandardIdentity.signingKey, 128);
+				size_t excessLen = i2p::crypto::ECDSAP521_KEY_LENGTH - 128; // 4 = 132- 128
+				memcpy (signingKey + 128, m_ExtendedBuffer + 4, excessLen); // right after signing and crypto key types
+				m_Verifier = new i2p::crypto::ECDSAP521Verifier (signingKey);
+				break;
+			}		
+			case SIGNING_KEY_TYPE_RSA_SHA256_2048:
+			{	
+				uint8_t signingKey[i2p::crypto::RSASHA2562048_KEY_LENGTH];
+				memcpy (signingKey, m_StandardIdentity.signingKey, 128);
+				size_t excessLen = i2p::crypto::RSASHA2562048_KEY_LENGTH - 128; // 128 = 256- 128
+				memcpy (signingKey + 128, m_ExtendedBuffer + 4, excessLen); // right after signing and crypto key types
+				m_Verifier = new i2p::crypto:: RSASHA2562048Verifier (signingKey);
+				break;
+			}	
+			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
+			{	
+				uint8_t signingKey[i2p::crypto::RSASHA3843072_KEY_LENGTH];
+				memcpy (signingKey, m_StandardIdentity.signingKey, 128);
+				size_t excessLen = i2p::crypto::RSASHA3843072_KEY_LENGTH - 128; // 256 = 384- 128
+				memcpy (signingKey + 128, m_ExtendedBuffer + 4, excessLen); // right after signing and crypto key types
+				m_Verifier = new i2p::crypto:: RSASHA3843072Verifier (signingKey);
+				break;
+			}	
+			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
+			{	
+				uint8_t signingKey[i2p::crypto::RSASHA5124096_KEY_LENGTH];
+				memcpy (signingKey, m_StandardIdentity.signingKey, 128);
+				size_t excessLen = i2p::crypto::RSASHA5124096_KEY_LENGTH - 128; // 384 = 512- 128
+				memcpy (signingKey + 128, m_ExtendedBuffer + 4, excessLen); // right after signing and crypto key types
+				m_Verifier = new i2p::crypto:: RSASHA5124096Verifier (signingKey);
+				break;
+			}		
+			default:
+				LogPrint ("Signing key type ", (int)keyType, " is not supported");
+		}			
+	}	
+	
+	void IdentityEx::DropVerifier ()
+	{
+		auto verifier = m_Verifier;
+		m_Verifier = nullptr; // TODO: make this atomic
+		delete verifier;
+	}
+
+	PrivateKeys& PrivateKeys::operator=(const Keys& keys)
+	{
+		m_Public = Identity (keys);
+		memcpy (m_PrivateKey, keys.privateKey, 256); // 256 
+		memcpy (m_SigningPrivateKey, keys.signingPrivateKey, m_Public.GetSigningPrivateKeyLen ());
+		delete m_Signer;
+		m_Signer = nullptr;
+		CreateSigner ();
+		return *this;
+	}
+
+	PrivateKeys& PrivateKeys::operator=(const PrivateKeys& other)
+	{		
+		m_Public = other.m_Public;
+		memcpy (m_PrivateKey, other.m_PrivateKey, 256); // 256 
+		memcpy (m_SigningPrivateKey, other.m_SigningPrivateKey, m_Public.GetSigningPrivateKeyLen ()); 
+		delete m_Signer;
+		m_Signer = nullptr;
+		CreateSigner ();
+		return *this;
+	}	
+		
+	size_t PrivateKeys::FromBuffer (const uint8_t * buf, size_t len)
+	{
+		size_t ret = m_Public.FromBuffer (buf, len);
+		memcpy (m_PrivateKey, buf + ret, 256); // private key always 256
+		ret += 256;
+		size_t signingPrivateKeySize = m_Public.GetSigningPrivateKeyLen ();
+		memcpy (m_SigningPrivateKey, buf + ret, signingPrivateKeySize); 
+		ret += signingPrivateKeySize;
+		delete m_Signer;
+		m_Signer = nullptr;
+		CreateSigner ();
+		return ret;
+	}
+		
+	size_t PrivateKeys::ToBuffer (uint8_t * buf, size_t len) const
+	{
+		size_t ret = m_Public.ToBuffer (buf, len);
+		memcpy (buf + ret, m_PrivateKey, 256); // private key always 256
+		ret += 256;
+		size_t signingPrivateKeySize = m_Public.GetSigningPrivateKeyLen (); 
+		memcpy (buf + ret, m_SigningPrivateKey, signingPrivateKeySize); 
+		ret += signingPrivateKeySize;
+		return ret;
+	}	
+
+	size_t PrivateKeys::FromBase64(const std::string& s)
+	{
+		uint8_t * buf = new uint8_t[s.length ()];
+		size_t l = i2p::data::Base64ToByteStream (s.c_str (), s.length (), buf, s.length ());
+		size_t ret = FromBuffer (buf, l);
+		delete[] buf;
+		return ret;
+	}	
+	
+	std::string PrivateKeys::ToBase64 () const
+	{
+		uint8_t * buf = new uint8_t[GetFullLen ()];
+		char * str = new char[GetFullLen ()*2];
+		size_t l = ToBuffer (buf, GetFullLen ());
+		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, GetFullLen ()*2);
+		str[l1] = 0;
+		delete[] buf;
+		std::string ret(str);
+		delete[] str;
+		return ret;
+	}
+
+	void PrivateKeys::Sign (const uint8_t * buf, int len, uint8_t * signature) const
+	{
+		if (m_Signer)
+			m_Signer->Sign (i2p::context.GetRandomNumberGenerator (), buf, len, signature);
+	}			
+
+	void PrivateKeys::CreateSigner ()
+	{
+		switch (m_Public.GetSigningKeyType ())
+		{	
+			case SIGNING_KEY_TYPE_DSA_SHA1:
+				m_Signer = new i2p::crypto::DSASigner (m_SigningPrivateKey);
+			break;	
+			case SIGNING_KEY_TYPE_ECDSA_SHA256_P256:
+				m_Signer = new i2p::crypto::ECDSAP256Signer (m_SigningPrivateKey);
+			break;
+			case SIGNING_KEY_TYPE_ECDSA_SHA384_P384:
+				m_Signer = new i2p::crypto::ECDSAP384Signer (m_SigningPrivateKey);
+			break;	
+			case SIGNING_KEY_TYPE_ECDSA_SHA512_P521:
+				m_Signer = new i2p::crypto::ECDSAP521Signer (m_SigningPrivateKey);
+			break;	
+			case SIGNING_KEY_TYPE_RSA_SHA256_2048:
+				m_Signer = new i2p::crypto::RSASHA2562048Signer (m_SigningPrivateKey);
+			break;
+			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
+				m_Signer = new i2p::crypto::RSASHA3843072Signer (m_SigningPrivateKey);
+			break;
+			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
+				m_Signer = new i2p::crypto::RSASHA5124096Signer (m_SigningPrivateKey);
+			break;	
+			default:
+				LogPrint ("Signing key type ", (int)m_Public.GetSigningKeyType (), " is not supported");
+		}
+	}	
+		
+	PrivateKeys PrivateKeys::CreateRandomKeys (SigningKeyType type)
+	{
+		if (type != SIGNING_KEY_TYPE_DSA_SHA1)
+		{
+			PrivateKeys keys;
+			auto& rnd = i2p::context.GetRandomNumberGenerator ();
+			// signature
+			uint8_t signingPublicKey[512]; // signing public key is 512 bytes max 
+			switch (type)
+			{	
+				case SIGNING_KEY_TYPE_ECDSA_SHA256_P256:
+					i2p::crypto::CreateECDSAP256RandomKeys (rnd, keys.m_SigningPrivateKey, signingPublicKey);
+				break;	
+				case SIGNING_KEY_TYPE_ECDSA_SHA384_P384:
+					i2p::crypto::CreateECDSAP384RandomKeys (rnd, keys.m_SigningPrivateKey, signingPublicKey);	
+				break;
+				case SIGNING_KEY_TYPE_ECDSA_SHA512_P521:
+					i2p::crypto::CreateECDSAP521RandomKeys (rnd, keys.m_SigningPrivateKey, signingPublicKey);	
+				break;	
+				case SIGNING_KEY_TYPE_RSA_SHA256_2048:
+					i2p::crypto::CreateRSARandomKeys (rnd, i2p::crypto::RSASHA2562048_KEY_LENGTH, keys.m_SigningPrivateKey, signingPublicKey);	
+				break;
+				case SIGNING_KEY_TYPE_RSA_SHA384_3072:
+					i2p::crypto::CreateRSARandomKeys (rnd, i2p::crypto::RSASHA3843072_KEY_LENGTH, keys.m_SigningPrivateKey, signingPublicKey);	
+				break;
+				case SIGNING_KEY_TYPE_RSA_SHA512_4096:
+					i2p::crypto::CreateRSARandomKeys (rnd, i2p::crypto::RSASHA5124096_KEY_LENGTH, keys.m_SigningPrivateKey, signingPublicKey);	
+				break;	
+				default:
+					LogPrint ("Signing key type ", (int)type, " is not supported. Create DSA-SHA1");
+					return PrivateKeys (i2p::data::CreateRandomKeys ()); // DSA-SHA1
+			}	
+			// encryption
+			uint8_t publicKey[256];
+			CryptoPP::DH dh (i2p::crypto::elgp, i2p::crypto::elgg);
+			dh.GenerateKeyPair(rnd, keys.m_PrivateKey, publicKey);
+			// identity
+			keys.m_Public = IdentityEx (publicKey, signingPublicKey, type);
+
+			keys.CreateSigner ();
+			return keys;
+		}	
+		return PrivateKeys (i2p::data::CreateRandomKeys ()); // DSA-SHA1
+	}	
+		
+	Keys CreateRandomKeys ()
+	{
+		Keys keys;		
+		auto& rnd = i2p::context.GetRandomNumberGenerator ();
+		// encryption
+		i2p::crypto::GenerateElGamalKeyPair(rnd, keys.privateKey, keys.publicKey);
+		// signing
+		i2p::crypto::CreateDSARandomKeys (rnd, keys.signingPrivateKey, keys.signingKey);	
+		return keys;
+	}	
+
+	IdentHash CreateRoutingKey (const IdentHash& ident)
+	{
+		uint8_t buf[41]; // ident + yyyymmdd
+		memcpy (buf, (const uint8_t *)ident, 32);
+		time_t t = time (nullptr);
+		struct tm tm;
+#ifdef _WIN32
+		gmtime_s(&tm, &t);
+		sprintf_s((char *)(buf + 32), 9, "%04i%02i%02i", tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday);
+#else
+		gmtime_r(&t, &tm);
+		sprintf((char *)(buf + 32), "%04i%02i%02i", tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday);
+#endif		
+		IdentHash key;
+		CryptoPP::SHA256().CalculateDigest((uint8_t *)key, buf, 40);
+		return key;
+	}	
+	
+	XORMetric operator^(const IdentHash& key1, const IdentHash& key2)
+	{
+		XORMetric m;
+		const uint64_t * hash1 = key1.GetLL (), * hash2 = key2.GetLL ();
+		m.metric_ll[0] = hash1[0] ^ hash2[0];
+		m.metric_ll[1] = hash1[1] ^ hash2[1];
+		m.metric_ll[2] = hash1[2] ^ hash2[2];
+		m.metric_ll[3] = hash1[3] ^ hash2[3];
+		return m;
+	}	
+}
+}
--- a/Identity.h
+++ b/Identity.h
@ -0,0 +1,261 @@
+#ifndef IDENTITY_H__
+#define IDENTITY_H__
+
+#include <inttypes.h>
+#include <string.h>
+#include <string>
+#include "base64.h"
+#include "ElGamal.h"
+#include "Signature.h"
+
+namespace i2p
+{
+namespace data
+{
+	template<int sz>
+	class Tag
+	{
+		public:
+
+			Tag (const uint8_t * buf) { memcpy (m_Buf, buf, sz); };
+			Tag (const Tag<sz>& ) = default;
+#ifndef _WIN32 // FIXME!!! msvs 2013 can't compile it
+			Tag (Tag<sz>&& ) = default;
+#endif
+			Tag () = default;
+			
+			Tag<sz>& operator= (const Tag<sz>& ) = default;
+#ifndef _WIN32
+			Tag<sz>& operator= (Tag<sz>&& ) = default;
+#endif
+			
+			uint8_t * operator()() { return m_Buf; };
+			const uint8_t * operator()() const { return m_Buf; };
+
+			operator uint8_t * () { return m_Buf; };
+			operator const uint8_t * () const { return m_Buf; };
+			
+			const uint64_t * GetLL () const { return ll; };
+
+			bool operator== (const Tag<sz>& other) const { return !memcmp (m_Buf, other.m_Buf, sz); };
+			bool operator< (const Tag<sz>& other) const { return memcmp (m_Buf, other.m_Buf, sz) < 0; };
+
+			std::string ToBase64 () const
+			{
+				char str[sz*2];
+				int l = i2p::data::ByteStreamToBase64 (m_Buf, sz, str, sz*2);
+				str[l] = 0;
+				return std::string (str);
+			}
+
+			std::string ToBase32 () const
+			{
+				char str[sz*2];
+				int l = i2p::data::ByteStreamToBase32 (m_Buf, sz, str, sz*2);
+				str[l] = 0;
+				return std::string (str);
+			}	
+
+			void FromBase32 (const std::string& s)
+			{
+				i2p::data::Base32ToByteStream (s.c_str (), s.length (), m_Buf, sz);
+			}
+
+		private:
+
+			union // 8 bytes alignment
+			{	
+				uint8_t m_Buf[sz];
+				uint64_t ll[sz/8];
+			};		
+	};	
+	typedef Tag<32> IdentHash;
+
+#pragma pack(1)
+	struct Keys
+	{
+		uint8_t privateKey[256];
+		uint8_t signingPrivateKey[20];
+		uint8_t publicKey[256];
+		uint8_t signingKey[128];
+	};
+	
+	const uint8_t CERTIFICATE_TYPE_NULL = 0;
+	const uint8_t CERTIFICATE_TYPE_HASHCASH = 1;
+	const uint8_t CERTIFICATE_TYPE_HIDDEN = 2;
+	const uint8_t CERTIFICATE_TYPE_SIGNED = 3;	
+	const uint8_t CERTIFICATE_TYPE_MULTIPLE = 4;	
+	const uint8_t CERTIFICATE_TYPE_KEY = 5;
+
+	struct Identity
+	{
+		uint8_t publicKey[256];
+		uint8_t signingKey[128];
+		struct
+		{
+			uint8_t type;
+			uint16_t length;
+		} certificate;	
+
+		Identity () = default;
+		Identity (const Keys& keys) { *this = keys; };
+		Identity& operator=(const Keys& keys);
+		size_t FromBuffer (const uint8_t * buf, size_t len);
+		IdentHash Hash () const;
+	};
+#pragma pack()
+	Keys CreateRandomKeys ();
+	
+	const size_t DEFAULT_IDENTITY_SIZE = sizeof (Identity); // 387 bytes
+	
+	const uint16_t CRYPTO_KEY_TYPE_ELGAMAL = 0;
+	const uint16_t SIGNING_KEY_TYPE_DSA_SHA1 = 0;
+	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA256_P256 = 1;
+	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA384_P384 = 2;
+	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA512_P521 = 3;
+	const uint16_t SIGNING_KEY_TYPE_RSA_SHA256_2048 = 4;
+	const uint16_t SIGNING_KEY_TYPE_RSA_SHA384_3072 = 5;
+	const uint16_t SIGNING_KEY_TYPE_RSA_SHA512_4096 = 6;
+	typedef uint16_t SigningKeyType;
+	typedef uint16_t CryptoKeyType;	
+	
+	class IdentityEx
+	{
+		public:
+
+			IdentityEx ();
+			IdentityEx (const uint8_t * publicKey, const uint8_t * signingKey,
+				SigningKeyType type = SIGNING_KEY_TYPE_DSA_SHA1);
+			IdentityEx (const uint8_t * buf, size_t len);
+			IdentityEx (const IdentityEx& other);
+			~IdentityEx ();
+			IdentityEx& operator=(const IdentityEx& other);
+			IdentityEx& operator=(const Identity& standard);
+
+			size_t FromBuffer (const uint8_t * buf, size_t len);
+			size_t ToBuffer (uint8_t * buf, size_t len) const;
+			size_t FromBase64(const std::string& s);
+			std::string ToBase64 () const;
+			const Identity& GetStandardIdentity () const { return m_StandardIdentity; };
+			const IdentHash& GetIdentHash () const { return m_IdentHash; };
+			size_t GetFullLen () const { return m_ExtendedLen + DEFAULT_IDENTITY_SIZE; };
+			size_t GetSigningPublicKeyLen () const;
+			size_t GetSigningPrivateKeyLen () const;
+			size_t GetSignatureLen () const;
+			bool Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const;
+			SigningKeyType GetSigningKeyType () const;
+			CryptoKeyType GetCryptoKeyType () const;
+			void DropVerifier (); // to save memory			
+
+		private:
+
+			void CreateVerifier () const;
+			
+		private:
+
+			Identity m_StandardIdentity;
+			IdentHash m_IdentHash;
+			mutable i2p::crypto::Verifier * m_Verifier; 
+			size_t m_ExtendedLen;
+			uint8_t * m_ExtendedBuffer;
+	};	
+	
+	class PrivateKeys // for eepsites
+	{
+		public:
+			
+			PrivateKeys (): m_Signer (nullptr) {};
+			PrivateKeys (const PrivateKeys& other): m_Signer (nullptr) { *this = other; };
+			PrivateKeys (const Keys& keys): m_Signer (nullptr) { *this = keys; };
+			PrivateKeys& operator=(const Keys& keys);
+			PrivateKeys& operator=(const PrivateKeys& other);
+			~PrivateKeys () { delete m_Signer; };
+			
+			const IdentityEx& GetPublic () const { return m_Public; };
+			const uint8_t * GetPrivateKey () const { return m_PrivateKey; };
+			const uint8_t * GetSigningPrivateKey () const { return m_SigningPrivateKey; };
+			void Sign (const uint8_t * buf, int len, uint8_t * signature) const;
+
+			size_t GetFullLen () const { return m_Public.GetFullLen () + 256 + m_Public.GetSigningPrivateKeyLen (); }; 		
+			size_t FromBuffer (const uint8_t * buf, size_t len);
+			size_t ToBuffer (uint8_t * buf, size_t len) const;
+
+			size_t FromBase64(const std::string& s);
+			std::string ToBase64 () const;
+
+			static PrivateKeys CreateRandomKeys (SigningKeyType type = SIGNING_KEY_TYPE_DSA_SHA1);
+	
+		private:
+
+			void CreateSigner ();
+			
+		private:
+
+			IdentityEx m_Public;
+			uint8_t m_PrivateKey[256];
+			uint8_t m_SigningPrivateKey[1024]; // assume private key doesn't exceed 1024 bytes
+			i2p::crypto::Signer * m_Signer;
+	};
+
+	// kademlia
+	struct XORMetric
+	{
+		union
+		{	
+			uint8_t metric[32];
+			uint64_t metric_ll[4];	
+		};	
+
+		void SetMin () { memset (metric, 0, 32); };
+		void SetMax () { memset (metric, 0xFF, 32); };
+		bool operator< (const XORMetric& other) const { return memcmp (metric, other.metric, 32) < 0; };
+	};	
+
+	IdentHash CreateRoutingKey (const IdentHash& ident);
+	XORMetric operator^(const IdentHash& key1, const IdentHash& key2); 	
+	
+	// destination for delivery instuctions
+	class RoutingDestination
+	{
+		public:
+
+			RoutingDestination (): m_ElGamalEncryption (nullptr) {};
+			virtual ~RoutingDestination () { delete m_ElGamalEncryption; };
+			
+			virtual const IdentHash& GetIdentHash () const = 0;
+			virtual const uint8_t * GetEncryptionPublicKey () const = 0;
+			virtual bool IsDestination () const = 0; // for garlic 
+
+			i2p::crypto::ElGamalEncryption * GetElGamalEncryption () const
+			{
+				if (!m_ElGamalEncryption)
+					m_ElGamalEncryption = new i2p::crypto::ElGamalEncryption (GetEncryptionPublicKey ());
+				return m_ElGamalEncryption;
+			}
+			
+		private:
+
+			mutable i2p::crypto::ElGamalEncryption * m_ElGamalEncryption; // use lazy initialization
+	};	
+
+	class LocalDestination 
+	{
+		public:
+
+			virtual ~LocalDestination() {};
+			virtual const PrivateKeys& GetPrivateKeys () const = 0;
+			virtual const uint8_t * GetEncryptionPrivateKey () const = 0; 
+			virtual const uint8_t * GetEncryptionPublicKey () const = 0; 
+
+			const IdentityEx& GetIdentity () const { return GetPrivateKeys ().GetPublic (); };
+			const IdentHash& GetIdentHash () const { return GetIdentity ().GetIdentHash (); };  
+			void Sign (const uint8_t * buf, int len, uint8_t * signature) const 
+			{ 
+				GetPrivateKeys ().Sign (buf, len, signature); 
+			};
+	};	
+}
+}
+
+
+#endif
--- a/354
+++ b/354
@ -1,27 +1,339 @@
-Copyright (c) 2013-2025, The PurpleI2P Project
+GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991

-All rights reserved.
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.

-Redistribution and use in source and binary forms, with or without modification, are
-permitted provided that the following conditions are met:
+                            Preamble

-1. Redistributions of source code must retain the above copyright notice, this list of
-conditions and the following disclaimer.
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.

-2. Redistributions in binary form must reproduce the above copyright notice, this list of
-conditions and the following disclaimer in the documentation and/or other materials
-provided with the distribution.
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.

-3. Neither the name of the copyright holder nor the names of its contributors may be used
-to endorse or promote products derived from this software without specific prior written
-permission.
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.

-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
-EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    i2p router for Linux written on C++
+    Copyright (C) 2013  orignal
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  {signature of Ty Coon}, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
--- a/LeaseSet.cpp
+++ b/LeaseSet.cpp
@ -0,0 +1,131 @@
+#include <string.h>
+#include "I2PEndian.h"
+#include <cryptopp/dsa.h>
+#include "CryptoConst.h"
+#include "Log.h"
+#include "Timestamp.h"
+#include "NetDb.h"
+#include "TunnelPool.h"
+#include "LeaseSet.h"
+
+namespace i2p
+{
+namespace data
+{
+	
+	LeaseSet::LeaseSet (const uint8_t * buf, int len)
+	{
+		memcpy (m_Buffer, buf, len);
+		m_BufferLen = len;
+		ReadFromBuffer ();
+	}
+
+	LeaseSet::LeaseSet (const i2p::tunnel::TunnelPool& pool)
+	{	
+		// header
+		const i2p::data::LocalDestination * localDestination = pool.GetLocalDestination ();
+		if (!localDestination)
+		{
+			m_BufferLen = 0;
+			LogPrint (eLogError, "Destination for local LeaseSet doesn't exist");
+			return;
+		}	
+		m_BufferLen = localDestination->GetIdentity ().ToBuffer (m_Buffer, MAX_LS_BUFFER_SIZE);
+		memcpy (m_Buffer + m_BufferLen, localDestination->GetEncryptionPublicKey (), 256);
+		m_BufferLen += 256;
+		auto signingKeyLen = localDestination->GetIdentity ().GetSigningPublicKeyLen ();
+		memset (m_Buffer + m_BufferLen, 0, signingKeyLen);
+		m_BufferLen += signingKeyLen;
+		auto tunnels = pool.GetInboundTunnels (5); // 5 tunnels maximum
+		m_Buffer[m_BufferLen] = tunnels.size (); // num leases
+		m_BufferLen++;
+		// leases
+		for (auto it: tunnels)
+		{	
+			Lease lease;
+			memcpy (lease.tunnelGateway, it->GetNextIdentHash (), 32);
+			lease.tunnelID = htobe32 (it->GetNextTunnelID ());
+			uint64_t ts = it->GetCreationTime () + i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT - 60; // 1 minute before expiration
+			ts *= 1000; // in milliseconds
+			lease.endDate = htobe64 (ts);
+			memcpy(m_Buffer + m_BufferLen, &lease, sizeof(Lease));
+			m_BufferLen += sizeof (Lease);
+		}
+		// signature
+		localDestination->Sign (m_Buffer, m_BufferLen, m_Buffer + m_BufferLen);
+		m_BufferLen += localDestination->GetIdentity ().GetSignatureLen (); 
+		LogPrint ("Local LeaseSet of ", tunnels.size (), " leases created");
+
+		ReadFromBuffer ();
+	}
+
+	void LeaseSet::Update (const uint8_t * buf, int len)
+	{	
+		m_Leases.clear ();
+		memcpy (m_Buffer, buf, len);
+		m_BufferLen = len;
+		ReadFromBuffer ();
+	}
+	
+	void LeaseSet::ReadFromBuffer ()	
+	{	
+		size_t size = m_Identity.FromBuffer (m_Buffer, m_BufferLen);
+		memcpy (m_EncryptionKey, m_Buffer + size, 256);
+		size += 256; // encryption key
+		size += m_Identity.GetSigningPublicKeyLen (); // unused signing key
+		uint8_t num = m_Buffer[size];
+		size++; // num
+		LogPrint ("LeaseSet num=", (int)num);
+
+		// process leases
+		const uint8_t * leases = m_Buffer + size;
+		for (int i = 0; i < num; i++)
+		{
+			Lease lease;
+			memcpy (&lease, leases, sizeof(Lease));
+			lease.tunnelID = be32toh (lease.tunnelID);
+			lease.endDate = be64toh (lease.endDate);
+			m_Leases.push_back (lease);
+			leases += sizeof (Lease);
+
+			// check if lease's gateway is in our netDb
+			if (!netdb.FindRouter (lease.tunnelGateway))
+			{
+				// if not found request it
+				LogPrint ("Lease's tunnel gateway not found. Requested");
+				netdb.RequestDestination (lease.tunnelGateway);
+			}	
+		}	
+		
+		// verify
+		if (!m_Identity.Verify (m_Buffer, leases - m_Buffer, leases))
+			LogPrint ("LeaseSet verification failed");
+	}				
+	
+	const std::vector<Lease> LeaseSet::GetNonExpiredLeases () const
+	{
+		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+		std::vector<Lease> leases;
+		for (auto& it: m_Leases)
+			if (ts < it.endDate)
+				leases.push_back (it);
+		return leases;	
+	}	
+
+	bool LeaseSet::HasExpiredLeases () const
+	{
+		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+		for (auto& it: m_Leases)
+			if (ts >= it.endDate) return true;
+		return false;
+	}	
+
+	bool LeaseSet::HasNonExpiredLeases () const
+	{
+		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+		for (auto& it: m_Leases)
+			if (ts < it.endDate) return true;
+		return false;
+	}	
+}		
+}	
--- a/LeaseSet.h
+++ b/LeaseSet.h
@ -0,0 +1,78 @@
+#ifndef LEASE_SET_H__
+#define LEASE_SET_H__
+
+#include <inttypes.h>
+#include <string.h>
+#include <vector>
+#include "Identity.h"
+
+namespace i2p
+{
+
+namespace tunnel
+{
+	class TunnelPool;
+}
+
+namespace data
+{	
+	
+#pragma pack(1)
+
+	struct Lease
+	{
+		uint8_t tunnelGateway[32];
+		uint32_t tunnelID;
+		uint64_t endDate;
+
+		bool operator< (const Lease& other) const 
+		{
+			if (endDate != other.endDate)
+				return endDate > other.endDate;
+			else
+				return tunnelID < other.tunnelID; 
+		}	
+	};	
+	
+#pragma pack()	
+
+	const int MAX_LS_BUFFER_SIZE = 3072;	
+	class LeaseSet: public RoutingDestination
+	{
+		public:
+
+			LeaseSet (const uint8_t * buf, int len);
+			LeaseSet (const LeaseSet& ) = default;
+			LeaseSet (const i2p::tunnel::TunnelPool& pool);
+			LeaseSet& operator=(const LeaseSet& ) = default;
+			void Update (const uint8_t * buf, int len);
+			const IdentityEx& GetIdentity () const { return m_Identity; };			
+
+			const uint8_t * GetBuffer () const { return m_Buffer; };
+			size_t GetBufferLen () const { return m_BufferLen; };	
+
+			// implements RoutingDestination
+			const IdentHash& GetIdentHash () const { return m_Identity.GetIdentHash (); };
+			const std::vector<Lease>& GetLeases () const { return m_Leases; };
+			const std::vector<Lease> GetNonExpiredLeases () const;
+			bool HasExpiredLeases () const;
+			bool HasNonExpiredLeases () const;
+			const uint8_t * GetEncryptionPublicKey () const { return m_EncryptionKey; };
+			bool IsDestination () const { return true; };
+
+		private:
+
+			void ReadFromBuffer ();
+			
+		private:
+
+			std::vector<Lease> m_Leases;
+			IdentityEx m_Identity;
+			uint8_t m_EncryptionKey[256];
+			uint8_t m_Buffer[MAX_LS_BUFFER_SIZE];
+			size_t m_BufferLen;
+	};	
+}		
+}	
+
+#endif
--- a/LittleBigEndian.h
+++ b/LittleBigEndian.h
@ -0,0 +1,242 @@
+// LittleBigEndian.h fixed for 64-bits added union
+//
+
+#ifndef LITTLEBIGENDIAN_H
+#define LITTLEBIGENDIAN_H
+
+// Determine Little-Endian or Big-Endian
+
+#define CURRENT_BYTE_ORDER       (*(int *)"\x01\x02\x03\x04")
+#define LITTLE_ENDIAN_BYTE_ORDER 0x04030201
+#define BIG_ENDIAN_BYTE_ORDER    0x01020304
+#define PDP_ENDIAN_BYTE_ORDER    0x02010403
+
+#define IS_LITTLE_ENDIAN (CURRENT_BYTE_ORDER == LITTLE_ENDIAN_BYTE_ORDER)
+#define IS_BIG_ENDIAN    (CURRENT_BYTE_ORDER == BIG_ENDIAN_BYTE_ORDER)
+#define IS_PDP_ENDIAN    (CURRENT_BYTE_ORDER == PDP_ENDIAN_BYTE_ORDER)
+
+// Forward declaration
+
+template<typename T>
+struct LittleEndian;
+
+template<typename T>
+struct BigEndian;
+
+// Little-Endian template
+
+#pragma pack(push,1)
+template<typename T>
+struct LittleEndian
+{
+    union
+    {
+        unsigned char bytes[sizeof(T)];
+        T raw_value;
+    };
+
+    LittleEndian(T t = T())
+    {
+        operator =(t);
+    }
+
+    LittleEndian(const LittleEndian<T> & t)
+    {
+        raw_value = t.raw_value;
+    }
+
+    LittleEndian(const BigEndian<T> & t)
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+            bytes[i] = t.bytes[sizeof(T)-1-i];
+    }
+
+    operator const T() const
+    {
+        T t = T();
+        for (unsigned i = 0; i < sizeof(T); i++)
+            t |= T(bytes[i]) << (i << 3);
+        return t;
+    }
+
+	const T operator = (const T t)
+	{
+		for (unsigned i = 0; i < sizeof(T); i++)
+			bytes[sizeof(T)-1 - i] = static_cast<unsigned char>(t >> (i << 3));
+		return t;
+	}
+
+    // operators
+
+    const T operator += (const T t)
+    {
+        return (*this = *this + t);
+    }
+
+    const T operator -= (const T t)
+    {
+        return (*this = *this - t);
+    }
+
+    const T operator *= (const T t)
+    {
+        return (*this = *this * t);
+    }
+
+    const T operator /= (const T t)
+    {
+        return (*this = *this / t);
+    }
+
+    const T operator %= (const T t)
+    {
+        return (*this = *this % t);
+    }
+
+    LittleEndian<T> operator ++ (int)
+    {
+        LittleEndian<T> tmp(*this);
+        operator ++ ();
+        return tmp;
+    }
+
+    LittleEndian<T> & operator ++ ()
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+        {
+            ++bytes[i];
+            if (bytes[i] != 0)
+                break;
+        }
+        return (*this);
+    }
+
+    LittleEndian<T> operator -- (int)
+    {
+        LittleEndian<T> tmp(*this);
+        operator -- ();
+        return tmp;
+    }
+
+    LittleEndian<T> & operator -- ()
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+        {
+            --bytes[i];
+            if (bytes[i] != (T)(-1))
+                break;
+        }
+        return (*this);
+    }
+};
+#pragma pack(pop)
+
+// Big-Endian template
+
+#pragma pack(push,1)
+template<typename T>
+struct BigEndian
+{
+    union
+    {
+        unsigned char bytes[sizeof(T)];
+        T raw_value;
+    };
+
+    BigEndian(T t = T())
+    {
+        operator =(t);
+    }
+
+    BigEndian(const BigEndian<T> & t)
+    {
+        raw_value = t.raw_value;
+    }
+
+    BigEndian(const LittleEndian<T> & t)
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+            bytes[i] = t.bytes[sizeof(T)-1-i];
+    }
+
+    operator const T() const
+    {
+        T t = T();
+        for (unsigned i = 0; i < sizeof(T); i++)
+            t |= T(bytes[sizeof(T) - 1 - i]) << (i << 3);
+        return t;
+    }
+
+    const T operator = (const T t)
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+            bytes[sizeof(T) - 1 - i] = t >> (i << 3);
+        return t;
+    }
+
+    // operators
+
+    const T operator += (const T t)
+    {
+        return (*this = *this + t);
+    }
+
+    const T operator -= (const T t)
+    {
+        return (*this = *this - t);
+    }
+
+    const T operator *= (const T t)
+    {
+        return (*this = *this * t);
+    }
+
+    const T operator /= (const T t)
+    {
+        return (*this = *this / t);
+    }
+
+    const T operator %= (const T t)
+    {
+        return (*this = *this % t);
+    }
+
+    BigEndian<T> operator ++ (int)
+    {
+        BigEndian<T> tmp(*this);
+        operator ++ ();
+        return tmp;
+    }
+
+    BigEndian<T> & operator ++ ()
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+        {
+            ++bytes[sizeof(T) - 1 - i];
+            if (bytes[sizeof(T) - 1 - i] != 0)
+                break;
+        }
+        return (*this);
+    }
+
+    BigEndian<T> operator -- (int)
+    {
+        BigEndian<T> tmp(*this);
+        operator -- ();
+        return tmp;
+    }
+
+    BigEndian<T> & operator -- ()
+    {
+        for (unsigned i = 0; i < sizeof(T); i++)
+        {
+            --bytes[sizeof(T) - 1 - i];
+            if (bytes[sizeof(T) - 1 - i] != (T)(-1))
+                break;
+        }
+        return (*this);
+    }
+};
+#pragma pack(pop)
+
+#endif // LITTLEBIGENDIAN_H
--- a/Log.cpp
+++ b/Log.cpp
@ -0,0 +1,43 @@
+#include "Log.h"
+#include <boost/date_time/posix_time/posix_time.hpp>
+
+Log * g_Log = nullptr;
+
+static const char * g_LogLevelStr[eNumLogLevels] =
+{
+	"error", // eLogError
+	"warn",  // eLogWarning
+	"info",  // eLogInfo
+	"debug"	 // eLogDebug 
+};
+
+void LogMsg::Process()
+{
+	output << boost::posix_time::second_clock::local_time().time_of_day () <<  
+		"/" << g_LogLevelStr[level] << " - ";
+	output << s.str();
+}
+
+void Log::Flush ()
+{
+	if (m_LogStream)
+		m_LogStream->flush();
+}
+
+void Log::SetLogFile (const std::string& fullFilePath)
+{
+	auto logFile = new std::ofstream (fullFilePath, std::ofstream::out | std::ofstream::binary | std::ofstream::trunc);
+	if (logFile->is_open ())
+	{
+		SetLogStream (logFile);
+		LogPrint("Logging to file ",  fullFilePath, " enabled.");
+	}	
+	else
+		delete logFile;
+}
+
+void Log::SetLogStream (std::ostream * logStream)
+{
+	if (m_LogStream) delete m_LogStream;	
+	m_LogStream = logStream;
+}
--- a/Log.h
+++ b/Log.h
@ -0,0 +1,117 @@
+#ifndef LOG_H__
+#define LOG_H__
+
+#include <string>
+#include <iostream>
+#include <sstream>
+#include <fstream>
+#include <functional>
+#include "Queue.h"
+
+enum LogLevel
+{
+	eLogError = 0,
+	eLogWarning,
+	eLogInfo,
+	eLogDebug,	
+	eNumLogLevels
+};
+
+struct LogMsg
+{
+	std::stringstream s;
+	std::ostream& output;	
+	LogLevel level;
+
+	LogMsg (std::ostream& o = std::cout, LogLevel l = eLogInfo): output (o), level (l) {};
+	
+	void Process();
+};
+
+class Log: public i2p::util::MsgQueue<LogMsg>
+{
+	public:
+
+		Log (): m_LogStream (nullptr) { SetOnEmpty (std::bind (&Log::Flush, this)); };
+		~Log () { delete m_LogStream; };
+
+		void SetLogFile (const std::string& fullFilePath);
+		void SetLogStream (std::ostream * logStream);
+		std::ostream * GetLogStream () const { return m_LogStream; };	
+
+	private:
+
+		void Flush ();
+
+	private:
+		
+		std::ostream * m_LogStream;
+};
+
+extern Log * g_Log;
+
+inline void StartLog (const std::string& fullFilePath)
+{
+	if (!g_Log)
+	{	
+		g_Log = new Log ();
+		if (fullFilePath.length () > 0)
+			g_Log->SetLogFile (fullFilePath);
+	}	
+}
+
+inline void StartLog (std::ostream * s)
+{
+	if (!g_Log)
+	{	
+		g_Log = new Log ();
+		if (s)
+			g_Log->SetLogStream (s);
+	}	
+}
+
+inline void StopLog ()
+{
+	if (g_Log)
+	{
+		delete g_Log;
+		g_Log = nullptr;
+	}		
+}
+
+template<typename TValue>
+void LogPrint (std::stringstream& s, TValue arg) 
+{
+	s << arg;
+}
+ 
+template<typename TValue, typename... TArgs>
+void LogPrint (std::stringstream& s, TValue arg, TArgs... args) 
+{
+	LogPrint (s, arg);
+	LogPrint (s, args...);
+}
+
+template<typename... TArgs>
+void LogPrint (LogLevel level, TArgs... args) 
+{
+	LogMsg * msg = (g_Log && g_Log->GetLogStream ()) ? new LogMsg (*g_Log->GetLogStream (), level) : 
+		new LogMsg (std::cout, level);
+	LogPrint (msg->s, args...);
+	msg->s << std::endl;
+	if (g_Log)	
+		g_Log->Put (msg);
+	else
+	{
+		msg->Process ();
+		delete msg;
+	}
+}
+
+template<typename... TArgs>
+void LogPrint (TArgs... args) 
+{
+	LogPrint (eLogInfo, args...);
+}	
+
+#endif
--- a/193
+++ b/193
@ -1,113 +1,33 @@
-.DEFAULT_GOAL := all
+UNAME := $(shell uname -s)
+SHLIB := libi2pd.so
+I2PD  := i2p
+GREP := fgrep
+DEPS := obj/make.dep

-SYS := $(shell $(CXX) -dumpmachine)
-
-ifneq (, $(findstring darwin, $(SYS)))
-	SHARED_SUFFIX = dylib
-else ifneq (, $(findstring mingw, $(SYS))$(findstring windows-gnu, $(SYS))$(findstring cygwin, $(SYS)))
-	SHARED_SUFFIX = dll
-else
-	SHARED_SUFFIX = so
-endif
-
-SHLIB := libi2pd.$(SHARED_SUFFIX)
-ARLIB := libi2pd.a
-SHLIB_LANG := libi2pdlang.$(SHARED_SUFFIX)
-ARLIB_LANG := libi2pdlang.a
-SHLIB_CLIENT := libi2pdclient.$(SHARED_SUFFIX)
-ARLIB_CLIENT := libi2pdclient.a
-SHLIB_WRAP := libi2pdwrapper.$(SHARED_SUFFIX)
-ARLIB_WRAP := libi2pdwrapper.a
-I2PD := i2pd
-
-LIB_SRC_DIR := libi2pd
-LIB_CLIENT_SRC_DIR := libi2pd_client
-WRAP_SRC_DIR := libi2pd_wrapper
-LANG_SRC_DIR := i18n
-DAEMON_SRC_DIR := daemon
-
-# import source files lists
 include filelist.mk

-USE_STATIC      := $(or $(USE_STATIC),no)
-USE_UPNP        := $(or $(USE_UPNP),no)
-DEBUG           := $(or $(DEBUG),yes)
+USE_AESNI  := yes
+USE_STATIC := no

-# for debugging purposes only, when commit hash needed in trunk builds in i2pd version string
-USE_GIT_VERSION := $(or $(USE_GIT_VERSION),no)
-
-# for MacOS only, waiting for "1", not "yes"
-HOMEBREW        := $(or $(HOMEBREW),0)
-
-ifeq ($(DEBUG),yes)
-	CXX_DEBUG = -g
-else
-	CXX_DEBUG = -Os
-	LD_DEBUG = -s
-endif
-
-ifneq (, $(DESTDIR))
-	PREFIX = $(DESTDIR)
-endif
-
-ifneq (, $(findstring darwin, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	ifeq ($(HOMEBREW),1)
-		include Makefile.homebrew
-	else
+ifeq ($(UNAME),Darwin)
+	DAEMON_SRC += DaemonLinux.cpp
 	include Makefile.osx
-	endif
-else ifneq (, $(findstring mingw, $(SYS))$(findstring windows-gnu, $(SYS))$(findstring cygwin, $(SYS)))
-	DAEMON_SRC += Win32/DaemonWin32.cpp Win32/Win32App.cpp Win32/Win32Service.cpp Win32/Win32NetState.cpp
-	include Makefile.mingw
-else ifneq (, $(findstring linux, $(SYS))$(findstring gnu, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	include Makefile.linux
-else ifneq (, $(findstring freebsd, $(SYS))$(findstring openbsd, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
+else ifeq ($(shell echo $(UNAME) | $(GREP) -c FreeBSD),1)
+	DAEMON_SRC += DaemonLinux.cpp
 	include Makefile.bsd
-else ifneq (, $(findstring haiku, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	include Makefile.haiku
-else ifneq (, $(findstring solaris, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	include Makefile.solaris
-else # not supported
-	$(error Not supported platform)
+else ifeq ($(UNAME),Linux)
+	DAEMON_SRC += DaemonLinux.cpp
+	include Makefile.linux
+else # win32
+	DAEMON_SRC += DaemonWin32.cpp
 endif

-INCFLAGS += -I$(LIB_SRC_DIR) -I$(LIB_CLIENT_SRC_DIR) -I$(LANG_SRC_DIR)
-DEFINES += -DOPENSSL_SUPPRESS_DEPRECATED
-NEEDED_CXXFLAGS += -MMD -MP
+all: mk_build_dir $(SHLIB) $(I2PD)

-ifeq ($(USE_GIT_VERSION),yes)
-	GIT_VERSION := $(shell git describe --tags)
-	DEFINES += -DGITVER=$(GIT_VERSION)
-endif
+mk_build_dir:
+	test -d obj || mkdir obj

-LIB_OBJS        += $(patsubst %.cpp,obj/%.o,$(LIB_SRC))
-LIB_CLIENT_OBJS += $(patsubst %.cpp,obj/%.o,$(LIB_CLIENT_SRC))
-LANG_OBJS       += $(patsubst %.cpp,obj/%.o,$(LANG_SRC))
-DAEMON_OBJS     += $(patsubst %.cpp,obj/%.o,$(DAEMON_SRC))
-WRAP_LIB_OBJS   += $(patsubst %.cpp,obj/%.o,$(WRAP_LIB_SRC))
-DEPS            += $(LIB_OBJS:.o=.d) $(LIB_CLIENT_OBJS:.o=.d) $(LANG_OBJS:.o=.d) $(DAEMON_OBJS:.o=.d) $(WRAP_LIB_OBJS:.o=.d)
-
-## Build all code (libi2pd, libi2pdclient, libi2pdlang), link it to .a and build binary
-all: $(ARLIB) $(ARLIB_CLIENT) $(ARLIB_LANG) $(I2PD)
-
-mk_obj_dir:
-	@mkdir -p obj/$(LIB_SRC_DIR)
-	@mkdir -p obj/$(LIB_CLIENT_SRC_DIR)
-	@mkdir -p obj/$(LANG_SRC_DIR)
-	@mkdir -p obj/$(DAEMON_SRC_DIR)
-	@mkdir -p obj/$(WRAP_SRC_DIR)
-	@mkdir -p obj/Win32
-
-api: $(SHLIB) $(ARLIB)
-client: $(SHLIB_CLIENT) $(ARLIB_CLIENT)
-lang:  $(SHLIB_LANG) $(ARLIB_LANG)
-api_client: api client lang
-wrapper: api_client $(SHLIB_WRAP) $(ARLIB_WRAP)
+api: $(SHLIB)

 ## NOTE: The NEEDED_CXXFLAGS are here so that CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
@ -116,77 +36,38 @@ wrapper: api_client $(SHLIB_WRAP) $(ARLIB_WRAP)
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FLAGS to work at build-time.

-obj/%.o: %.cpp | mk_obj_dir
-	$(CXX) $(CXXFLAGS) $(NEEDED_CXXFLAGS) $(DEFINES) $(INCFLAGS) -c -o $@ $<
+deps:
+	@test -d obj || mkdir obj
+	$(CXX) $(CXXFLAGS) $(NEEDED_CXXFLAGS) -MM *.cpp > $(DEPS)
+	@sed -i -e '/\.o:/ s/^/obj\//' $(DEPS)
+
+obj/%.o : %.cpp
+	@test -d obj || mkdir obj
+	$(CXX) $(CXXFLAGS) $(NEEDED_CXXFLAGS) $(INCFLAGS) $(CPU_FLAGS) -c -o $@ $<

 # '-' is 'ignore if missing' on first run
 -include $(DEPS)

-$(I2PD): $(DAEMON_OBJS) $(ARLIB) $(ARLIB_CLIENT) $(ARLIB_LANG)
-	$(CXX) $(DEFINES) $(LDFLAGS) -o $@ $^ $(LDLIBS)
+$(I2PD):  $(patsubst %.cpp,obj/%.o,$(DAEMON_SRC))
+	$(CXX) -o $@ $^ $(LDLIBS) $(LDFLAGS)

-$(SHLIB): $(LIB_OBJS)
+$(SHLIB): $(patsubst %.cpp,obj/%.o,$(LIB_SRC))
 ifneq ($(USE_STATIC),yes)
-	$(CXX) $(LDFLAGS) -shared -o $@ $^ $(LDLIBS)
+	$(CXX) $(LDFLAGS) $(LDLIBS) -shared -o $@ $^
 endif

-$(SHLIB_CLIENT): $(LIB_CLIENT_OBJS) $(SHLIB) $(SHLIB_LANG)
-ifneq ($(USE_STATIC),yes)
-	$(CXX) $(LDFLAGS) -shared -o $@ $^ $(LDLIBS) $(SHLIB) $(SHLIB_LANG)
-endif
-
-$(SHLIB_WRAP): $(WRAP_LIB_OBJS)
-ifneq ($(USE_STATIC),yes)
-	$(CXX) $(LDFLAGS) -shared -o $@ $^ $(LDLIBS)
-endif
-
-$(SHLIB_LANG): $(LANG_OBJS)
-ifneq ($(USE_STATIC),yes)
-	$(CXX) $(LDFLAGS) -shared -o $@ $^ $(LDLIBS)
-endif
-
-$(ARLIB): $(LIB_OBJS)
-	$(AR) -r $@ $^
-
-$(ARLIB_CLIENT): $(LIB_CLIENT_OBJS)
-	$(AR) -r $@ $^
-
-$(ARLIB_WRAP): $(WRAP_LIB_OBJS)
-	$(AR) -r $@ $^
-
-$(ARLIB_LANG): $(LANG_OBJS)
-	$(AR) -r $@ $^
-
 clean:
-	$(RM) -r obj
-	$(RM) -r docs/generated
-	$(RM) $(I2PD) $(SHLIB) $(ARLIB) $(SHLIB_CLIENT) $(ARLIB_CLIENT) $(SHLIB_LANG) $(ARLIB_LANG) $(SHLIB_WRAP) $(ARLIB_WRAP)
+	rm -rf obj
+	$(RM) $(I2PD) $(SHLIB)

-strip: $(I2PD) $(SHLIB) $(SHLIB_CLIENT) $(SHLIB_LANG)
-	strip $^
-
-LATEST_TAG=$(shell git describe --tags --abbrev=0 openssl)
-BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
+LATEST_TAG=$(shell git describe --tags --abbrev=0 master)
 dist:
 	git archive --format=tar.gz -9 --worktree-attributes \
 	    --prefix=i2pd_$(LATEST_TAG)/ $(LATEST_TAG) -o i2pd_$(LATEST_TAG).tar.gz

-last-dist:
-	git archive --format=tar.gz -9 --worktree-attributes \
-	    --prefix=i2pd_$(LATEST_TAG)/ $(BRANCH) -o ../i2pd_$(LATEST_TAG).orig.tar.gz
-
-doxygen:
-	doxygen -s docs/Doxyfile
-
 .PHONY: all
 .PHONY: clean
-.PHONY: doxygen
+.PHONY: deps
 .PHONY: dist
-.PHONY: last-dist
 .PHONY: api
-.PHONY: api_client
-.PHONY: client
-.PHONY: lang
-.PHONY: mk_obj_dir
-.PHONY: install
-.PHONY: strip
+.PHONY: mk_build_dir
--- a/Makefile.bsd
+++ b/Makefile.bsd
@ -1,22 +1,12 @@
-CXX = clang++
-CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wextra -Wno-unused-parameter -pedantic -Wno-misleading-indentation
-DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
-LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
-LDLIBS = -lssl -lcrypto -lz -lpthread -lboost_system -lboost_program_options
-
+CXX = g++
+CXXFLAGS = -O2
 ## NOTE: NEEDED_CXXFLAGS is here so that custom CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
 ## For example, when adding 'hardening flags' to the build
 ## (e.g. -fstack-protector-strong -Wformat -Werror=format-security), we do not want to remove
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FLAGS to work at build-time.
-CXXVER := $(shell $(CXX) -dumpversion|cut -c 1-2)
-ifeq (${CXXVER}, "4.") # older clang always returned 4.2.1
-	$(error Compiler too old)
-else ifeq (${CXXVER}, ${filter ${CXXVER},16 17 18 19})  # clang 16 - 19
-	NEEDED_CXXFLAGS = -std=c++20
-else
-	NEEDED_CXXFLAGS = -std=c++17
-endif
-
+NEEDED_CXXFLAGS = -std=c++11
+INCFLAGS = -I/usr/include/ -I/usr/local/include/
+LDFLAGS = -Wl,-rpath,/usr/local/lib -L/usr/local/lib
+LDLIBS = -lcryptopp -lboost_system -lboost_date_time -lboost_filesystem -lboost_regex -lboost_program_options -lpthread
--- a/Makefile.haiku
+++ b/Makefile.haiku
@ -1,14 +0,0 @@
-ifeq ($(shell $(CXX) -dumpmachine | cut -c 1-4), i586)
-CXX = g++-x86
-else
-CXX = g++
-endif
-CXXFLAGS := -Wall -std=c++20
-INCFLAGS = -I/system/develop/headers
-DEFINES = -D_DEFAULT_SOURCE -D_GNU_SOURCE
-LDLIBS = -lbe -lbsd -lnetwork -lz -lssl -lcrypto -lboost_program_options -lpthread
-
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP
-	LDLIBS += -lminiupnpc
-endif
--- a/Makefile.homebrew
+++ b/Makefile.homebrew
@ -1,49 +0,0 @@
-# root directory holding homebrew
-BREWROOT = /opt/homebrew
-BOOSTROOT = ${BREWROOT}/opt/boost
-SSLROOT = ${BREWROOT}/opt/openssl@1.1
-UPNPROOT = ${BREWROOT}/opt/miniupnpc
-
-CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wno-overloaded-virtual
-NEEDED_CXXFLAGS ?= -std=c++17
-INCFLAGS ?= -I${SSLROOT}/include -I${BOOSTROOT}/include
-LDFLAGS ?= ${LD_DEBUG}
-DEFINES += -DMAC_OSX
-
-ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz ${SSLROOT}/lib/libcrypto.a ${SSLROOT}/lib/libssl.a ${BOOSTROOT}/lib/libboost_system.a ${BOOSTROOT}/lib/libboost_filesystem.a ${BOOSTROOT}/lib/libboost_program_options.a
-ifeq ($(USE_UPNP),yes)
-	LDLIBS += ${UPNPROOT}/lib/libminiupnpc.a
-endif
-	LDLIBS +=  -lpthread -ldl
-else
-	LDFLAGS += -L${SSLROOT}/lib -L${BOOSTROOT}/lib
-	LDLIBS = -lz -lssl -lcrypto -lboost_system -lboost_filesystem -lboost_program_options -lpthread
-ifeq ($(USE_UPNP),yes)
-	LDFLAGS += -L${UPNPROOT}/lib
-	LDLIBS += -lminiupnpc
-endif
-endif
-
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP
-	INCFLAGS += -I${UPNPROOT}/include
-endif
-
-install: all
-	install -d ${PREFIX}/bin
-	install -m 755 ${I2PD} ${PREFIX}/bin
-	install -d ${PREFIX}/etc ${PREFIX}/etc/i2pd ${PREFIX}/etc/i2pd/tunnels.conf.d
-	install -m 644 contrib/i2pd.conf contrib/subscriptions.txt contrib/tunnels.conf ${PREFIX}/etc/i2pd
-	install -d ${PREFIX}/share ${PREFIX}/share/doc ${PREFIX}/share/doc/i2pd
-	install -m 644 ChangeLog LICENSE README.md contrib/i2pd.conf contrib/subscriptions.txt contrib/tunnels.conf ${PREFIX}/share/doc/i2pd
-	install -d ${PREFIX}/share/i2pd
-	@cp -R contrib/certificates ${PREFIX}/share/i2pd/
-	install -d ${PREFIX}/share/man ${PREFIX}/share/man/man1
-	@gzip -kf debian/i2pd.1 && install debian/i2pd.1.gz ${PREFIX}/share/man/man1
-	install -d ${PREFIX}/var ${PREFIX}/var/lib ${PREFIX}/var/lib/i2pd
-	@ln -sf ${PREFIX}/share/i2pd/certificates ${PREFIX}/var/lib/i2pd/certificates
-	@ln -sf ${PREFIX}/etc/i2pd/tunnels.conf.d ${PREFIX}/var/lib/i2pd/tunnels.d
-	@ln -sf ${PREFIX}/etc/i2pd/i2pd.conf ${PREFIX}/var/lib/i2pd/i2pd.conf
-	@ln -sf ${PREFIX}/etc/i2pd/subscriptions.txt ${PREFIX}/var/lib/i2pd/subscriptions.txt
-	@ln -sf ${PREFIX}/etc/i2pd/tunnels.conf ${PREFIX}/var/lib/i2pd/tunnels.conf
--- a/Makefile.linux
+++ b/Makefile.linux
@ -1,70 +1,53 @@
-# set defaults instead redefine
-CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wextra -Wno-unused-parameter -pedantic -Wno-psabi
-LDFLAGS ?= ${LD_DEBUG}
+CXXFLAGS = -g -Wall -fPIC
+INCFLAGS =

 ## NOTE: The NEEDED_CXXFLAGS are here so that custom CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
 ## For example, when adding 'hardening flags' to the build
 ## (e.g. -fstack-protector-strong -Wformat -Werror=format-security), we do not want to remove
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
-## custom FDLAGS to work at build-time.
+## custom FLAGS to work at build-time.

-# detect proper flag for c++17 support by compilers
+# detect proper flag for c++11 support by gcc
 CXXVER := $(shell $(CXX) -dumpversion)
-ifeq ($(shell expr match $(CXX) 'clang'),5)
-	NEEDED_CXXFLAGS += -std=c++17
-else ifeq ($(shell expr match ${CXXVER} "[8-9]"),1) # gcc 8 - 9
-	NEEDED_CXXFLAGS += -std=c++17
-	LDLIBS = -lboost_system -lstdc++fs
-else ifeq ($(shell expr match ${CXXVER} "1[0-2]"),2) # gcc 10 - 12
-	NEEDED_CXXFLAGS += -std=c++17
-else ifeq ($(shell expr match ${CXXVER} "1[3-9]"),2) # gcc 13+
-	NEEDED_CXXFLAGS += -std=c++20
+ifeq ($(shell expr match ${CXXVER} "4\.[0-9][0-9]"),4) # >= 4.10
+	NEEDED_CXXFLAGS += -std=c++11
+else ifeq ($(shell expr match ${CXXVER} "4\.[7-9]"),3) # >= 4.7
+	NEEDED_CXXFLAGS += -std=c++11
+else ifeq ($(shell expr match ${CXXVER} "4\.6"),3) # = 4.6
+	NEEDED_CXXFLAGS += -std=c++0x
+else ifeq ($(shell expr match $(CXX) 'clang'),5)
+	NEEDED_CXXFLAGS += -std=c++11
 else # not supported
 	$(error Compiler too old)
 endif

-NEEDED_CXXFLAGS += -fPIC
-
 ifeq ($(USE_STATIC),yes)
-# NOTE: on glibc you will get this warning:
-#   Using 'getaddrinfo' in statically linked applications requires at runtime
-#   the shared libraries from the glibc version used for linking
-	LIBDIR := /usr/lib/$(SYS)
+  LIBDIR := /usr/lib
+  LDLIBS  = $(LIBDIR)/libboost_system.a
+  LDLIBS += $(LIBDIR)/libboost_date_time.a
+  LDLIBS += $(LIBDIR)/libboost_filesystem.a
+  LDLIBS += $(LIBDIR)/libboost_regex.a
  LDLIBS += $(LIBDIR)/libboost_program_options.a
-	LDLIBS += $(LIBDIR)/libssl.a
-	LDLIBS += $(LIBDIR)/libcrypto.a
-	LDLIBS += $(LIBDIR)/libz.a
-ifeq ($(USE_UPNP),yes)
-	LDLIBS += $(LIBDIR)/libminiupnpc.a
-endif
-	LDLIBS += -lpthread -ldl
+  LDLIBS += $(LIBDIR)/libcryptopp.a
+  LDLIBS += -lpthread -static-libstdc++ -static-libgcc
+  USE_AESNI := no
 else
-	LDLIBS += -lssl -lcrypto -lz -lboost_program_options -lpthread -latomic
-ifeq ($(USE_UPNP),yes)
-	LDLIBS += -lminiupnpc
-endif
+  LDLIBS = -lcryptopp -lboost_system -lboost_date_time -lboost_filesystem -lboost_regex -lboost_program_options -lpthread
 endif

-# UPNP Support (miniupnpc 1.5 and higher)
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP
+# UPNP Support (miniupnpc 1.5 or 1.6)
+ifeq ($(USE_UPNP),1)
+  LDFLAGS += -ldl
+  CXXFLAGS += -DUSE_UPNP
 endif

-install: all
-	install -d ${PREFIX}/bin
-	install -m 755 ${I2PD} ${PREFIX}/bin
-	install -d ${PREFIX}/etc ${PREFIX}/etc/i2pd ${PREFIX}/etc/i2pd/tunnels.conf.d
-	install -m 644 contrib/i2pd.conf contrib/subscriptions.txt contrib/tunnels.conf ${PREFIX}/etc/i2pd
-	install -d ${PREFIX}/share ${PREFIX}/share/doc ${PREFIX}/share/doc/i2pd
-	install -m 644 ChangeLog LICENSE README.md contrib/i2pd.conf contrib/subscriptions.txt contrib/tunnels.conf ${PREFIX}/share/doc/i2pd
-	install -d ${PREFIX}/share/i2pd
-	@cp -R contrib/certificates ${PREFIX}/share/i2pd/
-	install -d ${PREFIX}/share/man ${PREFIX}/share/man/man1
-	@gzip -kf debian/i2pd.1 && install debian/i2pd.1.gz ${PREFIX}/share/man/man1
-	install -d ${PREFIX}/var ${PREFIX}/var/lib ${PREFIX}/var/lib/i2pd
-	@ln -sf ${PREFIX}/share/i2pd/certificates ${PREFIX}/var/lib/i2pd/certificates
-	@ln -sf ${PREFIX}/etc/i2pd/tunnels.conf.d ${PREFIX}/var/lib/i2pd/tunnels.d
-	@ln -sf ${PREFIX}/etc/i2pd/i2pd.conf ${PREFIX}/var/lib/i2pd/i2pd.conf
-	@ln -sf ${PREFIX}/etc/i2pd/subscriptions.txt ${PREFIX}/var/lib/i2pd/subscriptions.txt
-	@ln -sf ${PREFIX}/etc/i2pd/tunnels.conf ${PREFIX}/var/lib/i2pd/tunnels.conf
+IS_64 := $(shell $(CXX) -dumpmachine 2>&1 | $(GREP) -c "64")
+ifeq ($(USE_AESNI),yes)
+ifeq ($(IS_64),1)
+#check if AES-NI is supported by CPU
+ifneq ($(shell grep -c aes /proc/cpuinfo),0)
+	CPU_FLAGS = -maes -DAESNI
+endif
+endif
+endif
--- a/Makefile.mingw
+++ b/Makefile.mingw
@ -1,50 +0,0 @@
-# Build application with GUI (tray, main window)
-USE_WIN32_APP := yes
-
-WINDRES = windres
-
-CXXFLAGS := $(CXX_DEBUG) -fPIC -msse
-INCFLAGS := -I$(DAEMON_SRC_DIR) -IWin32
-LDFLAGS := ${LD_DEBUG} -static -fPIC -msse
-
-NEEDED_CXXFLAGS += -std=c++20
-DEFINES += -DWIN32_LEAN_AND_MEAN
-
-# UPNP Support
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP -DMINIUPNP_STATICLIB
-	LDLIBS = -lminiupnpc
-endif
-
-ifeq ($(USE_WINXP_FLAGS), yes)
-	DEFINES += -DWINVER=0x0501 -D_WIN32_WINNT=0x0501
-endif
-
-LDLIBS += \
-	$(MINGW_PREFIX)/lib/libboost_filesystem-mt.a \
-	$(MINGW_PREFIX)/lib/libboost_program_options-mt.a \
-	$(MINGW_PREFIX)/lib/libssl.a \
-	$(MINGW_PREFIX)/lib/libcrypto.a \
-	$(MINGW_PREFIX)/lib/libz.a \
-	-lwsock32 \
-	-lws2_32 \
-	-liphlpapi \
-	-lcrypt32 \
-	-lgdi32 \
-	-lole32 \
-	-luuid \
-	-lpthread
-
-ifeq ($(USE_WIN32_APP), yes)
-	DEFINES += -DWIN32_APP
-	LDFLAGS += -mwindows
-	DAEMON_RC += Win32/Resource.rc
-	DAEMON_OBJS += $(patsubst %.rc,obj/%.o,$(DAEMON_RC))
-endif
-
-ifeq ($(USE_ASLR),yes)
-	LDFLAGS += -Wl,--nxcompat -Wl,--high-entropy-va -Wl,--dynamicbase,--export-all-symbols
-endif
-
-obj/%.o : %.rc | mk_obj_dir
-	$(WINDRES) $(DEFINES) $(INCFLAGS) --preprocessor-arg=-MMD --preprocessor-arg=-MP --preprocessor-arg=-MF$@.d -i $< -o $@
--- a/Makefile.osx
+++ b/Makefile.osx
@ -1,29 +1,25 @@
 CXX = clang++
-CXXFLAGS := ${CXX_DEBUG} -Wall -std=c++17
+CXXFLAGS = -g -Wall -std=c++11 -DCRYPTOPP_DISABLE_ASM -DMAC_OSX
+#CXXFLAGS = -g -O2 -Wall -std=c++11 -DCRYPTOPP_DISABLE_ASM
 INCFLAGS = -I/usr/local/include
-DEFINES := -DMAC_OSX
-LDFLAGS := -Wl,-rpath,/usr/local/lib -L/usr/local/lib
-LDFLAGS += -Wl,-dead_strip
-LDFLAGS += -Wl,-dead_strip_dylibs
+LDFLAGS = -Wl,-rpath,/usr/local/lib -L/usr/local/lib
+LDLIBS = -lcryptopp -lboost_system -lboost_date_time -lboost_filesystem -lboost_regex -lboost_program_options -lpthread

-ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz /usr/local/lib/libssl.a /usr/local/lib/libcrypto.a /usr/local/lib/libboost_system.a /usr/local/lib/libboost_filesystem.a /usr/local/lib/libboost_program_options.a -lpthread
-else
-	LDLIBS = -lz -lssl -lcrypto -lboost_system -lboost_filesystem -lboost_program_options -lpthread
-endif
-
-ifeq ($(USE_UPNP),yes)
+ifeq ($(USE_UPNP),1)
  LDFLAGS += -ldl
-	DEFINES += -DUSE_UPNP
-	ifeq ($(USE_STATIC),yes)
-		LDLIBS += /usr/local/lib/libminiupnpc.a
-	else
-		LDLIBS += -lminiupnpc
-	endif
+  CXXFLAGS += -DUSE_UPNP
 endif

-OSARCH = $(shell uname -p)
-
-ifneq ($(OSARCH),powerpc)
-	CXXFLAGS += -msse
+# OSX Notes
+# http://www.hutsby.net/2011/08/macs-with-aes-ni.html
+# Seems like all recent Mac's have AES-NI, after firmware upgrade 2.2
+# Found no good way to detect it from command line. TODO: Might be some osx sysinfo magic
+ifeq ($(USE_AESNI),yes)
+  CXXFLAGS += -maes -DAESNI
 endif
+
+# Disabled, since it will be the default make rule. I think its better
+# to define the default rule in Makefile and not Makefile.<ostype> - torkel
+#install: all
+#	test -d ${PREFIX} || mkdir -p ${PREFIX}/
+#	cp -r i2p ${PREFIX}/
--- a/Makefile.solaris
+++ b/Makefile.solaris
@ -1,9 +0,0 @@
-CXX = g++
-INCFLAGS = -I/usr/openssl/3/include
-CXXFLAGS := -Wall -std=c++20
-LDLIBS = -L/usr/openssl/3/lib/64 -lssl -lcrypto -lboost_program_options -lz -lpthread -lsocket
-
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP
-	LDLIBS += -lminiupnpc
-endif
--- a/NTCPSession.cpp
+++ b/NTCPSession.cpp
@ -0,0 +1,658 @@
+#include <string.h>
+#include <stdlib.h>
+#include "I2PEndian.h"
+#include <cryptopp/dh.h>
+#include "base64.h"
+#include "Log.h"
+#include "Timestamp.h"
+#include "CryptoConst.h"
+#include "I2NPProtocol.h"
+#include "RouterContext.h"
+#include "Transports.h"
+#include "NetDb.h"
+#include "NTCPSession.h"
+
+using namespace i2p::crypto;
+
+namespace i2p
+{
+namespace transport
+{
+	NTCPSession::NTCPSession (boost::asio::io_service& service, std::shared_ptr<const i2p::data::RouterInfo> in_RemoteRouter): 
+		TransportSession (in_RemoteRouter),	m_Socket (service), 
+		m_TerminationTimer (service), m_IsEstablished (false), m_ReceiveBufferOffset (0), 
+		m_NextMessage (nullptr), m_NumSentBytes (0), m_NumReceivedBytes (0)
+	{		
+		m_DHKeysPair = transports.GetNextDHKeysPair ();
+		m_Establisher = new Establisher;
+	}
+	
+	NTCPSession::~NTCPSession ()
+	{
+		delete m_Establisher;
+		if (m_NextMessage)	
+			i2p::DeleteI2NPMessage (m_NextMessage);
+		for (auto it :m_DelayedMessages)
+			i2p::DeleteI2NPMessage (it);
+		m_DelayedMessages.clear ();	
+	}
+
+	void NTCPSession::CreateAESKey (uint8_t * pubKey, i2p::crypto::AESKey& key)
+	{
+		CryptoPP::DH dh (elgp, elgg);
+		uint8_t sharedKey[256];
+		if (!dh.Agree (sharedKey, m_DHKeysPair->privateKey, pubKey))
+		{    
+		    LogPrint (eLogError, "Couldn't create shared key");
+			Terminate ();
+			return;
+		};
+
+		uint8_t * aesKey = key;
+		if (sharedKey[0] & 0x80)
+		{
+			aesKey[0] = 0;
+			memcpy (aesKey + 1, sharedKey, 31);
+		}	
+		else if (sharedKey[0])	
+			memcpy (aesKey, sharedKey, 32);
+		else
+		{
+			// find first non-zero byte
+			uint8_t * nonZero = sharedKey + 1;
+			while (!*nonZero)
+			{
+				nonZero++;
+				if (nonZero - sharedKey > 32)
+				{
+					LogPrint (eLogWarning, "First 32 bytes of shared key is all zeros. Ignored");
+					return;
+				}	
+			}
+			memcpy (aesKey, nonZero, 32);
+		}
+	}	
+
+	void NTCPSession::Terminate ()
+	{
+		m_IsEstablished = false;
+		m_Socket.close ();
+		int numDelayed = 0;
+		for (auto it :m_DelayedMessages)
+		{	
+			// try to send them again
+			if (m_RemoteRouter)
+				transports.SendMessage (m_RemoteRouter->GetIdentHash (), it);
+			numDelayed++;
+		}	
+		m_DelayedMessages.clear ();
+		if (numDelayed > 0)
+			LogPrint (eLogWarning, "NTCP session ", numDelayed, " not sent");
+		// TODO: notify tunnels
+		transports.RemoveNTCPSession (shared_from_this ());
+		LogPrint ("NTCP session terminated");
+	}	
+
+	void NTCPSession::Connected ()
+	{
+		m_IsEstablished = true;
+
+		delete m_Establisher;
+		m_Establisher = nullptr;
+		
+		delete m_DHKeysPair;
+		m_DHKeysPair = nullptr;	
+
+		SendTimeSyncMessage ();
+		SendI2NPMessage (CreateDatabaseStoreMsg ()); // we tell immediately who we are		
+
+		if (!m_DelayedMessages.empty ())
+		{
+			for (auto it :m_DelayedMessages)
+				SendI2NPMessage (it);
+			m_DelayedMessages.clear ();
+		}	
+	}	
+		
+	void NTCPSession::ClientLogin ()
+	{
+		if (!m_DHKeysPair)
+			m_DHKeysPair = transports.GetNextDHKeysPair ();
+		// send Phase1
+		const uint8_t * x = m_DHKeysPair->publicKey;
+		memcpy (m_Establisher->phase1.pubKey, x, 256);
+		CryptoPP::SHA256().CalculateDigest(m_Establisher->phase1.HXxorHI, x, 256);
+		const uint8_t * ident = m_RemoteIdentity.GetIdentHash ();
+		for (int i = 0; i < 32; i++)
+			m_Establisher->phase1.HXxorHI[i] ^= ident[i];
+		
+		boost::asio::async_write (m_Socket, boost::asio::buffer (&m_Establisher->phase1, sizeof (NTCPPhase1)), boost::asio::transfer_all (),
+        	std::bind(&NTCPSession::HandlePhase1Sent, shared_from_this (), std::placeholders::_1, std::placeholders::_2));
+	}	
+
+	void NTCPSession::ServerLogin ()
+	{
+		// receive Phase1
+		boost::asio::async_read (m_Socket, boost::asio::buffer(&m_Establisher->phase1, sizeof (NTCPPhase1)), boost::asio::transfer_all (),                    
+			std::bind(&NTCPSession::HandlePhase1Received, shared_from_this (), 
+				std::placeholders::_1, std::placeholders::_2));
+	}	
+		
+	void NTCPSession::HandlePhase1Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogWarning, "Couldn't send Phase 1 message: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 1 sent: ", bytes_transferred);
+			boost::asio::async_read (m_Socket, boost::asio::buffer(&m_Establisher->phase2, sizeof (NTCPPhase2)), boost::asio::transfer_all (),                 
+				std::bind(&NTCPSession::HandlePhase2Received, shared_from_this (), 
+					std::placeholders::_1, std::placeholders::_2));
+		}	
+	}	
+
+	void NTCPSession::HandlePhase1Received (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogError, "Phase 1 read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 1 received: ", bytes_transferred);
+			// verify ident
+			uint8_t digest[32];
+			CryptoPP::SHA256().CalculateDigest(digest, m_Establisher->phase1.pubKey, 256);
+			const uint8_t * ident = i2p::context.GetRouterInfo ().GetIdentHash ();
+			for (int i = 0; i < 32; i++)
+			{	
+				if ((m_Establisher->phase1.HXxorHI[i] ^ ident[i]) != digest[i])
+				{
+					LogPrint (eLogError, "Wrong ident");
+					Terminate ();
+					return;
+				}	
+			}	
+			
+			SendPhase2 ();
+		}	
+	}	
+
+	void NTCPSession::SendPhase2 ()
+	{
+		if (!m_DHKeysPair)
+			m_DHKeysPair = transports.GetNextDHKeysPair ();
+		const uint8_t * y = m_DHKeysPair->publicKey;
+		memcpy (m_Establisher->phase2.pubKey, y, 256);
+		uint8_t xy[512];
+		memcpy (xy, m_Establisher->phase1.pubKey, 256);
+		memcpy (xy + 256, y, 256);
+		CryptoPP::SHA256().CalculateDigest(m_Establisher->phase2.encrypted.hxy, xy, 512); 
+		uint32_t tsB = htobe32 (i2p::util::GetSecondsSinceEpoch ());
+		m_Establisher->phase2.encrypted.timestamp = tsB;
+		// TODO: fill filler
+
+		i2p::crypto::AESKey aesKey;
+		CreateAESKey (m_Establisher->phase1.pubKey, aesKey);
+		m_Encryption.SetKey (aesKey);
+		m_Encryption.SetIV (y + 240);
+		m_Decryption.SetKey (aesKey);
+		m_Decryption.SetIV (m_Establisher->phase1.HXxorHI + 16);
+		
+		m_Encryption.Encrypt ((uint8_t *)&m_Establisher->phase2.encrypted, sizeof(m_Establisher->phase2.encrypted), (uint8_t *)&m_Establisher->phase2.encrypted);
+		boost::asio::async_write (m_Socket, boost::asio::buffer (&m_Establisher->phase2, sizeof (NTCPPhase2)), boost::asio::transfer_all (),
+        	std::bind(&NTCPSession::HandlePhase2Sent, shared_from_this (), std::placeholders::_1, std::placeholders::_2, tsB));
+
+	}	
+		
+	void NTCPSession::HandlePhase2Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogWarning, "Couldn't send Phase 2 message: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 2 sent: ", bytes_transferred);
+			boost::asio::async_read (m_Socket, boost::asio::buffer(m_ReceiveBuffer, NTCP_DEFAULT_PHASE3_SIZE), boost::asio::transfer_all (),                   
+				std::bind(&NTCPSession::HandlePhase3Received, shared_from_this (), 
+					std::placeholders::_1, std::placeholders::_2, tsB));
+		}	
+	}	
+		
+	void NTCPSession::HandlePhase2Received (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("Phase 2 read error: ", ecode.message (), ". Wrong ident assumed");
+			if (ecode != boost::asio::error::operation_aborted)
+			{
+				// this RI is not valid
+				i2p::data::netdb.SetUnreachable (GetRemoteIdentity ().GetIdentHash (), true);
+				transports.ReuseDHKeysPair (m_DHKeysPair);
+				m_DHKeysPair = nullptr;
+				Terminate ();
+			}
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 2 received: ", bytes_transferred);
+		
+			i2p::crypto::AESKey aesKey;
+			CreateAESKey (m_Establisher->phase2.pubKey, aesKey);
+			m_Decryption.SetKey (aesKey);
+			m_Decryption.SetIV (m_Establisher->phase2.pubKey + 240);
+			m_Encryption.SetKey (aesKey);
+			m_Encryption.SetIV (m_Establisher->phase1.HXxorHI + 16);
+			
+			m_Decryption.Decrypt((uint8_t *)&m_Establisher->phase2.encrypted, sizeof(m_Establisher->phase2.encrypted), (uint8_t *)&m_Establisher->phase2.encrypted);
+			// verify
+			uint8_t xy[512];
+			memcpy (xy, m_DHKeysPair->publicKey, 256);
+			memcpy (xy + 256, m_Establisher->phase2.pubKey, 256);
+			if (!CryptoPP::SHA256().VerifyDigest(m_Establisher->phase2.encrypted.hxy, xy, 512)) 
+			{
+				LogPrint (eLogError, "Incorrect hash");
+				transports.ReuseDHKeysPair (m_DHKeysPair);
+				m_DHKeysPair = nullptr;
+				Terminate ();
+				return ;
+			}	
+			SendPhase3 ();
+		}	
+	}	
+
+	void NTCPSession::SendPhase3 ()
+	{
+		auto keys = i2p::context.GetPrivateKeys ();
+		uint8_t * buf = m_ReceiveBuffer; 
+		htobe16buf (buf, keys.GetPublic ().GetFullLen ());
+		buf += 2;
+		buf += i2p::context.GetIdentity ().ToBuffer (buf, NTCP_BUFFER_SIZE);
+		uint32_t tsA = htobe32 (i2p::util::GetSecondsSinceEpoch ());
+		htobuf32(buf,tsA);
+		buf += 4;		
+		size_t signatureLen = keys.GetPublic ().GetSignatureLen ();
+		size_t len = (buf - m_ReceiveBuffer) + signatureLen;
+		size_t paddingSize = len & 0x0F; // %16
+		if (paddingSize > 0) 
+		{
+			paddingSize = 16 - paddingSize;
+			// TODO: fill padding with random data
+			buf += paddingSize;
+			len += paddingSize;
+		}
+
+		SignedData s;
+		s.Insert (m_Establisher->phase1.pubKey, 256); // x
+		s.Insert (m_Establisher->phase2.pubKey, 256); // y
+		s.Insert (m_RemoteIdentity.GetIdentHash (), 32); // ident
+ 		s.Insert (tsA);	// tsA
+		s.Insert (m_Establisher->phase2.encrypted.timestamp); // tsB
+		s.Sign (keys, buf);
+
+		m_Encryption.Encrypt(m_ReceiveBuffer, len, m_ReceiveBuffer);		        
+		boost::asio::async_write (m_Socket, boost::asio::buffer (m_ReceiveBuffer, len), boost::asio::transfer_all (),
+        	std::bind(&NTCPSession::HandlePhase3Sent, shared_from_this (), std::placeholders::_1, std::placeholders::_2, tsA));				
+	}	
+		
+	void NTCPSession::HandlePhase3Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogWarning, "Couldn't send Phase 3 message: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 3 sent: ", bytes_transferred);
+			// wait for phase4 
+			auto signatureLen = m_RemoteIdentity.GetSignatureLen ();
+			size_t paddingSize = signatureLen & 0x0F; // %16
+			if (paddingSize > 0) signatureLen += (16 - paddingSize);	
+			boost::asio::async_read (m_Socket, boost::asio::buffer(m_ReceiveBuffer, signatureLen), boost::asio::transfer_all (),                  
+				std::bind(&NTCPSession::HandlePhase4Received, shared_from_this (), 
+					std::placeholders::_1, std::placeholders::_2, tsA));
+		}	
+	}	
+
+	void NTCPSession::HandlePhase3Received (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB)
+	{	
+		if (ecode)
+        {
+			LogPrint (eLogError, "Phase 3 read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 3 received: ", bytes_transferred);
+			m_Decryption.Decrypt (m_ReceiveBuffer, bytes_transferred, m_ReceiveBuffer);
+			uint8_t * buf = m_ReceiveBuffer;
+			uint16_t size = bufbe16toh (buf);
+			m_RemoteIdentity.FromBuffer (buf + 2, size);
+			size_t expectedSize = size + 2/*size*/ + 4/*timestamp*/ + m_RemoteIdentity.GetSignatureLen ();
+			size_t paddingLen = expectedSize & 0x0F;
+			if (paddingLen) paddingLen = (16 - paddingLen);	
+			if (expectedSize > NTCP_DEFAULT_PHASE3_SIZE)
+			{
+				// we need more bytes for Phase3
+				expectedSize += paddingLen;	
+				LogPrint (eLogDebug, "Wait for ", expectedSize, " more bytes for Phase3");
+				boost::asio::async_read (m_Socket, boost::asio::buffer(m_ReceiveBuffer + NTCP_DEFAULT_PHASE3_SIZE, expectedSize), boost::asio::transfer_all (),                   
+				std::bind(&NTCPSession::HandlePhase3ExtraReceived, shared_from_this (), 
+					std::placeholders::_1, std::placeholders::_2, tsB, paddingLen));
+			}
+			else
+				HandlePhase3 (tsB, paddingLen);
+		}	
+	}
+
+	void NTCPSession::HandlePhase3ExtraReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB, size_t paddingLen)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogError, "Phase 3 extra read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			LogPrint (eLogDebug, "Phase 3 extra received: ", bytes_transferred);
+			m_Decryption.Decrypt (m_ReceiveBuffer + NTCP_DEFAULT_PHASE3_SIZE, bytes_transferred, m_ReceiveBuffer+ NTCP_DEFAULT_PHASE3_SIZE);
+			HandlePhase3 (tsB, paddingLen);
+		}		
+	}	
+
+	void NTCPSession::HandlePhase3 (uint32_t tsB, size_t paddingLen)
+	{
+		uint8_t * buf = m_ReceiveBuffer + m_RemoteIdentity.GetFullLen () + 2 /*size*/;
+		uint32_t tsA = buf32toh(buf); 
+		buf += 4;
+		buf += paddingLen;	
+
+		SignedData s;
+		s.Insert (m_Establisher->phase1.pubKey, 256); // x
+		s.Insert (m_Establisher->phase2.pubKey, 256); // y
+		s.Insert (i2p::context.GetRouterInfo ().GetIdentHash (), 32); // ident
+		s.Insert (tsA); // tsA
+		s.Insert (tsB); // tsB			
+		if (!s.Verify (m_RemoteIdentity, buf))
+		{	
+			LogPrint (eLogError, "signature verification failed");
+			Terminate ();
+			return;
+		}	
+
+		SendPhase4 (tsA, tsB);
+	}
+
+	void NTCPSession::SendPhase4 (uint32_t tsA, uint32_t tsB)
+	{
+		SignedData s;
+		s.Insert (m_Establisher->phase1.pubKey, 256); // x
+		s.Insert (m_Establisher->phase2.pubKey, 256); // y
+		s.Insert (m_RemoteIdentity.GetIdentHash (), 32); // ident
+		s.Insert (tsA); // tsA
+		s.Insert (tsB); // tsB
+		auto keys = i2p::context.GetPrivateKeys ();
+ 		auto signatureLen = keys.GetPublic ().GetSignatureLen ();
+		s.Sign (keys, m_ReceiveBuffer);
+		size_t paddingSize = signatureLen & 0x0F; // %16
+		if (paddingSize > 0) signatureLen += (16 - paddingSize);		
+		m_Encryption.Encrypt (m_ReceiveBuffer, signatureLen, m_ReceiveBuffer);
+
+		boost::asio::async_write (m_Socket, boost::asio::buffer (m_ReceiveBuffer, signatureLen), boost::asio::transfer_all (),
+        	std::bind(&NTCPSession::HandlePhase4Sent, shared_from_this (), std::placeholders::_1, std::placeholders::_2));
+	}	
+
+	void NTCPSession::HandlePhase4Sent (const boost::system::error_code& ecode,  std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogWarning, "Couldn't send Phase 4 message: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 4 sent: ", bytes_transferred);
+			LogPrint ("NTCP server session connected");
+			transports.AddNTCPSession (shared_from_this ());
+
+			Connected ();
+			m_ReceiveBufferOffset = 0;
+			m_NextMessage = nullptr;
+			Receive ();
+		}	
+	}	
+		
+	void NTCPSession::HandlePhase4Received (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogError, "Phase 4 read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+			{
+				 // this router doesn't like us	
+				i2p::data::netdb.SetUnreachable (GetRemoteIdentity ().GetIdentHash (), true);
+				Terminate ();
+			}	
+		}
+		else
+		{	
+			LogPrint (eLogDebug, "Phase 4 received: ", bytes_transferred);
+			m_Decryption.Decrypt(m_ReceiveBuffer, bytes_transferred, m_ReceiveBuffer);
+
+			// verify signature
+			SignedData s;
+			s.Insert (m_Establisher->phase1.pubKey, 256); // x
+			s.Insert (m_Establisher->phase2.pubKey, 256); // y
+			s.Insert (i2p::context.GetRouterInfo ().GetIdentHash (), 32); // ident
+			s.Insert (tsA); // tsA
+			s.Insert (m_Establisher->phase2.encrypted.timestamp); // tsB
+
+			if (!s.Verify (m_RemoteIdentity, m_ReceiveBuffer))
+			{	
+				LogPrint (eLogError, "signature verification failed");
+				Terminate ();
+				return;
+			}	
+			LogPrint ("NTCP session connected");
+			Connected ();
+						
+			m_ReceiveBufferOffset = 0;
+			m_NextMessage = nullptr;
+			Receive ();
+		}
+	}
+
+	void NTCPSession::Receive ()
+	{
+		m_Socket.async_read_some (boost::asio::buffer(m_ReceiveBuffer + m_ReceiveBufferOffset, NTCP_BUFFER_SIZE - m_ReceiveBufferOffset),                
+			std::bind(&NTCPSession::HandleReceived, shared_from_this (), 
+			std::placeholders::_1, std::placeholders::_2));
+	}	
+		
+	void NTCPSession::HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint (eLogError, "Read error: ", ecode.message ());
+			//if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			m_NumReceivedBytes += bytes_transferred;
+			m_ReceiveBufferOffset += bytes_transferred;
+
+			if (m_ReceiveBufferOffset >= 16)
+			{	
+				uint8_t * nextBlock = m_ReceiveBuffer;
+				while (m_ReceiveBufferOffset >= 16)
+				{
+					if (!DecryptNextBlock (nextBlock)) // 16 bytes
+					{
+						Terminate ();
+						return; 
+					}	
+					nextBlock += 16;
+					m_ReceiveBufferOffset -= 16;
+				}	
+				if (m_ReceiveBufferOffset > 0)
+					memcpy (m_ReceiveBuffer, nextBlock, m_ReceiveBufferOffset);
+			}	
+			
+			ScheduleTermination (); // reset termination timer
+			Receive ();
+		}	
+	}	
+
+	bool NTCPSession::DecryptNextBlock (const uint8_t * encrypted) // 16 bytes
+	{
+		if (!m_NextMessage) // new message, header expected
+		{	
+			m_NextMessage = i2p::NewI2NPMessage ();
+			m_NextMessageOffset = 0;
+			
+			m_Decryption.Decrypt (encrypted, m_NextMessage->buf);
+			uint16_t dataSize = bufbe16toh (m_NextMessage->buf);
+			if (dataSize)
+			{
+				// new message
+				if (dataSize > NTCP_MAX_MESSAGE_SIZE)
+				{
+					LogPrint (eLogError, "NTCP data size ", dataSize, " exceeds max size");
+					i2p::DeleteI2NPMessage (m_NextMessage);
+					m_NextMessage = nullptr;
+					return false;
+				}
+				m_NextMessageOffset += 16;
+				m_NextMessage->offset = 2; // size field
+				m_NextMessage->len = dataSize + 2; 
+			}	
+			else
+			{	
+				// timestamp
+				LogPrint ("Timestamp");	
+				i2p::DeleteI2NPMessage (m_NextMessage);
+				m_NextMessage = nullptr;
+				return true;
+			}	
+		}	
+		else // message continues
+		{	
+			m_Decryption.Decrypt (encrypted, m_NextMessage->buf + m_NextMessageOffset);
+			m_NextMessageOffset += 16;
+		}		
+		
+		if (m_NextMessageOffset >= m_NextMessage->len + 4) // +checksum
+		{	
+			// we have a complete I2NP message
+			i2p::HandleI2NPMessage (m_NextMessage);	
+			m_NextMessage = nullptr;
+		}
+		return true;	
+ 	}	
+
+	void NTCPSession::Send (i2p::I2NPMessage * msg)
+	{
+		uint8_t * sendBuffer;
+		int len;
+
+		if (msg)
+		{	
+			// regular I2NP
+			if (msg->offset < 2)
+			{
+				LogPrint (eLogError, "Malformed I2NP message");
+				i2p::DeleteI2NPMessage (msg);
+			}	
+			sendBuffer = msg->GetBuffer () - 2; 
+			len = msg->GetLength ();
+			htobe16buf (sendBuffer, len);
+		}	
+		else
+		{
+			// prepare timestamp
+			sendBuffer = m_TimeSyncBuffer;
+			len = 4;
+			htobuf16(sendBuffer, 0);
+			htobe32buf (sendBuffer + 2, time (0));
+		}	
+		int rem = (len + 6) & 0x0F; // %16
+		int padding = 0;
+		if (rem > 0) padding = 16 - rem;
+		// TODO: fill padding 
+		m_Adler.CalculateDigest (sendBuffer + len + 2 + padding, sendBuffer, len + 2+ padding);
+
+		int l = len + padding + 6;
+		m_Encryption.Encrypt(sendBuffer, l, sendBuffer);	
+
+		boost::asio::async_write (m_Socket, boost::asio::buffer (sendBuffer, l), boost::asio::transfer_all (),                      
+        	std::bind(&NTCPSession::HandleSent, shared_from_this (), std::placeholders::_1, std::placeholders::_2, msg));	
+	}
+		
+	void NTCPSession::HandleSent (const boost::system::error_code& ecode, std::size_t bytes_transferred, i2p::I2NPMessage * msg)
+	{		
+		if (msg)
+			i2p::DeleteI2NPMessage (msg);
+		if (ecode)
+        {
+			LogPrint (eLogWarning, "Couldn't send msg: ", ecode.message ());
+			// we shouldn't call Terminate () here, because HandleReceive takes care
+			// TODO: 'delete this' statement in Terminate () must be eliminated later
+			// Terminate ();
+		}
+		else
+		{	
+			m_NumSentBytes += bytes_transferred;
+			ScheduleTermination (); // reset termination timer
+		}	
+	}
+
+	void NTCPSession::SendTimeSyncMessage ()
+	{
+		Send (nullptr);
+	}	
+
+	void NTCPSession::SendI2NPMessage (I2NPMessage * msg)
+	{
+		if (msg)
+		{
+			if (m_IsEstablished)
+				Send (msg);
+			else
+				m_DelayedMessages.push_back (msg);	
+		}	
+	}	
+
+	void NTCPSession::ScheduleTermination ()
+	{
+		m_TerminationTimer.cancel ();
+		m_TerminationTimer.expires_from_now (boost::posix_time::seconds(NTCP_TERMINATION_TIMEOUT));
+		m_TerminationTimer.async_wait (std::bind (&NTCPSession::HandleTerminationTimer,
+			shared_from_this (), std::placeholders::_1));
+	}
+
+	void NTCPSession::HandleTerminationTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{	
+			LogPrint ("No activity fo ", NTCP_TERMINATION_TIMEOUT, " seconds");
+			//Terminate ();
+			m_Socket.close ();// invoke Terminate () from HandleReceive 
+		}	
+	}	
+}	
+}	
--- a/NTCPSession.h
+++ b/NTCPSession.h
@ -0,0 +1,133 @@
+#ifndef NTCP_SESSION_H__
+#define NTCP_SESSION_H__
+
+#include <inttypes.h>
+#include <list>
+#include <memory>
+#include <cryptopp/modes.h>
+#include <cryptopp/aes.h>
+#include <cryptopp/adler32.h>
+#include "aes.h"
+#include "Identity.h"
+#include "RouterInfo.h"
+#include "I2NPProtocol.h"
+#include "TransportSession.h"
+
+namespace i2p
+{
+namespace transport
+{
+
+#pragma pack(1)
+	struct NTCPPhase1
+	{
+		uint8_t pubKey[256];
+		uint8_t HXxorHI[32];
+	};	
+	
+	struct NTCPPhase2
+	{
+		uint8_t pubKey[256];
+		struct
+		{
+			uint8_t hxy[32];
+			uint32_t timestamp;
+			uint8_t filler[12];
+		} encrypted;	
+	};	
+	
+#pragma pack()	
+
+	const size_t NTCP_MAX_MESSAGE_SIZE = 16384; 
+	const size_t NTCP_BUFFER_SIZE = 1040; // fits one tunnel message (1028)
+	const int NTCP_TERMINATION_TIMEOUT = 120; // 2 minutes
+	const size_t NTCP_DEFAULT_PHASE3_SIZE = 2/*size*/ + i2p::data::DEFAULT_IDENTITY_SIZE/*387*/ + 4/*ts*/ + 15/*padding*/ + 40/*signature*/; // 448 	
+
+	class NTCPSession: public TransportSession, public std::enable_shared_from_this<NTCPSession>
+	{
+		public:
+
+			NTCPSession (boost::asio::io_service& service, std::shared_ptr<const i2p::data::RouterInfo> in_RemoteRouter = nullptr);
+			~NTCPSession ();
+			void Terminate ();
+
+			boost::asio::ip::tcp::socket& GetSocket () { return m_Socket; };
+			bool IsEstablished () const { return m_IsEstablished; };
+			
+			void ClientLogin ();
+			void ServerLogin ();
+			void SendI2NPMessage (I2NPMessage * msg);
+
+			size_t GetNumSentBytes () const { return m_NumSentBytes; };
+			size_t GetNumReceivedBytes () const { return m_NumReceivedBytes; };
+			
+		protected:
+
+			void Connected ();
+			void SendTimeSyncMessage ();
+			void SetIsEstablished (bool isEstablished) { m_IsEstablished = isEstablished; }
+			
+		private:
+
+			void CreateAESKey (uint8_t * pubKey, i2p::crypto::AESKey& key);
+				
+			// client
+			void SendPhase3 ();
+			void HandlePhase1Sent (const boost::system::error_code& ecode,  std::size_t bytes_transferred);
+			void HandlePhase2Received (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandlePhase3Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA);
+			void HandlePhase4Received (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA);
+
+			//server
+			void SendPhase2 ();
+			void SendPhase4 (uint32_t tsA, uint32_t tsB);
+			void HandlePhase1Received (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandlePhase2Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB);
+			void HandlePhase3Received (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB);
+			void HandlePhase3ExtraReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB, size_t paddingLen);
+			void HandlePhase3 (uint32_t tsB, size_t paddingLen);
+			void HandlePhase4Sent (const boost::system::error_code& ecode,  std::size_t bytes_transferred);
+			
+			// common
+			void Receive ();
+			void HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			bool DecryptNextBlock (const uint8_t * encrypted);	
+		
+			void Send (i2p::I2NPMessage * msg);
+			void HandleSent (const boost::system::error_code& ecode, std::size_t bytes_transferred, i2p::I2NPMessage * msg);
+
+
+			// timer
+			void ScheduleTermination ();
+			void HandleTerminationTimer (const boost::system::error_code& ecode);
+			
+		private:
+
+			boost::asio::ip::tcp::socket m_Socket;
+			boost::asio::deadline_timer m_TerminationTimer;
+			bool m_IsEstablished;
+			
+			i2p::crypto::CBCDecryption m_Decryption;
+			i2p::crypto::CBCEncryption m_Encryption;
+			CryptoPP::Adler32 m_Adler;
+
+			struct Establisher
+			{	
+				NTCPPhase1 phase1;
+				NTCPPhase2 phase2;
+			} * m_Establisher;	
+			
+			i2p::crypto::AESAlignedBuffer<NTCP_BUFFER_SIZE + 16> m_ReceiveBuffer;
+			i2p::crypto::AESAlignedBuffer<16> m_TimeSyncBuffer;
+			int m_ReceiveBufferOffset; 
+
+			i2p::I2NPMessage * m_NextMessage;
+			std::list<i2p::I2NPMessage *> m_DelayedMessages;
+			size_t m_NextMessageOffset;
+
+			size_t m_NumSentBytes, m_NumReceivedBytes;
+	};	
+}	
+}	
+
+#endif
--- a/NetDb.cpp
+++ b/NetDb.cpp
@ -0,0 +1,921 @@
+#include <string.h>
+#include "I2PEndian.h"
+#include <fstream>
+#include <vector>
+#include <boost/asio.hpp>
+#include <cryptopp/gzip.h>
+#include "base64.h"
+#include "Log.h"
+#include "Timestamp.h"
+#include "I2NPProtocol.h"
+#include "Tunnel.h"
+#include "Transports.h"
+#include "RouterContext.h"
+#include "Garlic.h"
+#include "NetDb.h"
+#include "Reseed.h"
+#include "util.h"
+
+using namespace i2p::transport;
+
+namespace i2p
+{
+namespace data
+{		
+	I2NPMessage * RequestedDestination::CreateRequestMessage (std::shared_ptr<const RouterInfo> router,
+		const i2p::tunnel::InboundTunnel * replyTunnel)
+	{
+		I2NPMessage * msg = i2p::CreateRouterInfoDatabaseLookupMsg (m_Destination, 
+			replyTunnel->GetNextIdentHash (), replyTunnel->GetNextTunnelID (), m_IsExploratory, 
+		    &m_ExcludedPeers);
+		m_ExcludedPeers.insert (router->GetIdentHash ());
+		m_LastRouter = router;
+		m_CreationTime = i2p::util::GetSecondsSinceEpoch ();
+		return msg;
+	}	
+
+	I2NPMessage * RequestedDestination::CreateRequestMessage (const IdentHash& floodfill)
+	{
+		I2NPMessage * msg = i2p::CreateRouterInfoDatabaseLookupMsg (m_Destination, 
+			i2p::context.GetRouterInfo ().GetIdentHash () , 0, false, &m_ExcludedPeers);
+		m_ExcludedPeers.insert (floodfill);
+		m_LastRouter = nullptr;
+		m_CreationTime = i2p::util::GetSecondsSinceEpoch ();
+		return msg;
+	}	
+
+	void RequestedDestination::ClearExcludedPeers ()
+	{
+		m_ExcludedPeers.clear ();
+	}	
+	
+#ifndef _WIN32		
+	const char NetDb::m_NetDbPath[] = "/netDb";
+#else
+	const char NetDb::m_NetDbPath[] = "\\netDb";
+#endif			
+	NetDb netdb;
+
+	NetDb::NetDb (): m_IsRunning (false), m_Thread (nullptr)
+	{
+	}
+	
+	NetDb::~NetDb ()
+	{
+		Stop ();	
+		for (auto l:m_LeaseSets)
+			delete l.second;
+		for (auto r:m_RequestedDestinations)
+			delete r.second;
+	}	
+
+	void NetDb::Start ()
+	{	
+		Load (m_NetDbPath);
+		if (m_RouterInfos.size () < 50) // reseed if # of router less than 50
+		{	
+			Reseeder reseeder;
+			reseeder.LoadCertificates (); // we need certificates for SU3 verification
+
+			// try SU3 first
+			int reseedRetries = 0;
+			while (m_RouterInfos.size () < 50 && reseedRetries < 10)
+			{	
+				reseeder.ReseedNowSU3();
+				reseedRetries++;
+			}	
+
+			// if still not enough download .dat files
+			reseedRetries = 0;
+			while (m_RouterInfos.size () < 50 && reseedRetries < 10)
+			{
+				reseeder.reseedNow();
+				reseedRetries++;
+				Load (m_NetDbPath);
+			}
+		}	
+		m_Thread = new std::thread (std::bind (&NetDb::Run, this));
+	}
+	
+	void NetDb::Stop ()
+	{
+		if (m_Thread)
+		{	
+			m_IsRunning = false;
+			m_Queue.WakeUp ();
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = 0;
+		}	
+	}	
+	
+	void NetDb::Run ()
+	{
+		uint32_t lastSave = 0, lastPublish = 0;
+		m_IsRunning = true;
+		while (m_IsRunning)
+		{	
+			try
+			{	
+				I2NPMessage * msg = m_Queue.GetNextWithTimeout (15000); // 15 sec
+				if (msg)
+				{	
+					while (msg)
+					{
+						switch (msg->GetTypeID ()) 
+						{
+							case eI2NPDatabaseStore:	
+								LogPrint ("DatabaseStore");
+								HandleDatabaseStoreMsg (msg);
+							break;
+							case eI2NPDatabaseSearchReply:
+								LogPrint ("DatabaseSearchReply");
+								HandleDatabaseSearchReplyMsg (msg);
+							break;
+							case eI2NPDatabaseLookup:
+								LogPrint ("DatabaseLookup");
+								HandleDatabaseLookupMsg (msg);
+							break;	
+							default: // WTF?
+								LogPrint ("NetDb: unexpected message type ", msg->GetTypeID ());
+								i2p::HandleI2NPMessage (msg);
+						}	
+						msg = m_Queue.Get ();
+					}	
+				}
+				else 				
+				{
+					if (!m_IsRunning) break;
+					// if no new DatabaseStore coming, explore it
+					ManageRequests ();
+					auto numRouters = m_RouterInfos.size ();
+					Explore (numRouters < 1500 ? 5 : 1);
+				}	
+
+				uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+				if (ts - lastSave >= 60) // save routers, manage leasesets and validate subscriptions every minute
+				{
+					if (lastSave)
+					{
+						SaveUpdated (m_NetDbPath);
+						ManageLeaseSets ();
+					}	
+					lastSave = ts;
+				}	
+				if (ts - lastPublish >= 600) // publish every 10 minutes
+				{
+					Publish ();
+					lastPublish = ts;
+				}	
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint ("NetDb: ", ex.what ());
+			}	
+		}	
+	}	
+	
+	void NetDb::AddRouterInfo (const uint8_t * buf, int len)
+	{
+		IdentityEx identity;
+		if (identity.FromBuffer (buf, len))
+			AddRouterInfo (identity.GetIdentHash (), buf, len);	
+	}
+
+	void NetDb::AddRouterInfo (const IdentHash& ident, const uint8_t * buf, int len)
+	{	
+		DeleteRequestedDestination (ident);	
+		auto r = FindRouter (ident);
+		if (r)
+		{
+			auto ts = r->GetTimestamp ();
+			r->Update (buf, len);
+			if (r->GetTimestamp () > ts)
+				LogPrint ("RouterInfo updated");
+		}	
+		else	
+		{	
+			LogPrint ("New RouterInfo added");
+			auto newRouter = std::make_shared<RouterInfo> (buf, len);
+			{
+				std::unique_lock<std::mutex> l(m_RouterInfosMutex);
+				m_RouterInfos[newRouter->GetIdentHash ()] = newRouter;
+			}
+			if (newRouter->IsFloodfill ())
+			{
+				std::unique_lock<std::mutex> l(m_FloodfillsMutex);
+				m_Floodfills.push_back (newRouter);
+			}	
+		}	
+	}	
+
+	void NetDb::AddLeaseSet (const IdentHash& ident, const uint8_t * buf, int len,
+		i2p::tunnel::InboundTunnel * from)
+	{
+		DeleteRequestedDestination (ident);
+		if (!from) // unsolicited LS must be received directly
+		{	
+			auto it = m_LeaseSets.find(ident);
+			if (it != m_LeaseSets.end ())
+			{
+				it->second->Update (buf, len); 
+				LogPrint ("LeaseSet updated");
+			}
+			else
+			{	
+				LogPrint ("New LeaseSet added");
+				m_LeaseSets[ident] = new LeaseSet (buf, len);
+			}	
+		}	
+	}	
+
+	std::shared_ptr<RouterInfo> NetDb::FindRouter (const IdentHash& ident) const
+	{
+		std::unique_lock<std::mutex> l(m_RouterInfosMutex);
+		auto it = m_RouterInfos.find (ident);
+		if (it != m_RouterInfos.end ())
+			return it->second;
+		else
+			return nullptr;
+	}
+
+	LeaseSet * NetDb::FindLeaseSet (const IdentHash& destination) const
+	{
+		auto it = m_LeaseSets.find (destination);
+		if (it != m_LeaseSets.end ())
+			return it->second;
+		else
+			return nullptr;
+	}
+
+	void NetDb::SetUnreachable (const IdentHash& ident, bool unreachable)
+	{
+		auto it = m_RouterInfos.find (ident);
+		if (it != m_RouterInfos.end ())
+			return it->second->SetUnreachable (unreachable);
+	}
+
+	// TODO: Move to reseed and/or scheduled tasks. (In java version, scheduler fix this as well as sort RIs.)
+	bool NetDb::CreateNetDb(boost::filesystem::path directory)
+	{
+		LogPrint (directory.string(), " doesn't exist, trying to create it.");
+		if (!boost::filesystem::create_directory (directory))
+		{
+			LogPrint("Failed to create directory ", directory.string());
+			return false;
+		}
+
+		// list of chars might appear in base64 string
+		const char * chars = GetBase64SubstitutionTable (); // 64 bytes
+		boost::filesystem::path suffix;
+		for (int i = 0; i < 64; i++)
+		{
+#ifndef _WIN32
+			suffix = std::string ("/r") + chars[i];
+#else
+			suffix = std::string ("\\r") + chars[i];
+#endif
+			if (!boost::filesystem::create_directory( boost::filesystem::path (directory / suffix) )) return false;
+		}
+		return true;
+	}
+
+	void NetDb::Load (const char * directory)
+	{
+		boost::filesystem::path p (i2p::util::filesystem::GetDataDir());
+		p /= (directory);
+		if (!boost::filesystem::exists (p))
+		{
+			// seems netDb doesn't exist yet
+			if (!CreateNetDb(p)) return;
+		}
+		// make sure we cleanup netDb from previous attempts
+		m_RouterInfos.clear ();	
+		m_Floodfills.clear ();	
+
+		// load routers now
+		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();	
+		int numRouters = 0;
+		boost::filesystem::directory_iterator end;
+		for (boost::filesystem::directory_iterator it (p); it != end; ++it)
+		{
+			if (boost::filesystem::is_directory (it->status()))
+			{
+				for (boost::filesystem::directory_iterator it1 (it->path ()); it1 != end; ++it1)
+				{
+#if BOOST_VERSION > 10500
+					const std::string& fullPath = it1->path().string();
+#else
+					const std::string& fullPath = it1->path();
+#endif
+					auto r = std::make_shared<RouterInfo>(fullPath);
+					if (!r->IsUnreachable () && (!r->UsesIntroducer () || ts < r->GetTimestamp () + 3600*1000LL)) // 1 hour
+					{	
+						r->DeleteBuffer ();
+						m_RouterInfos[r->GetIdentHash ()] = r;
+						if (r->IsFloodfill ())
+							m_Floodfills.push_back (r);
+						numRouters++;
+					}	
+					else
+					{	
+						if (boost::filesystem::exists (fullPath))  
+							boost::filesystem::remove (fullPath);
+					}	
+				}	
+			}	
+		}
+		LogPrint (numRouters, " routers loaded");
+		LogPrint (m_Floodfills.size (), " floodfills loaded");	
+	}	
+
+	void NetDb::SaveUpdated (const char * directory)
+	{	
+		auto GetFilePath = [](const char * directory, const RouterInfo * routerInfo)
+		{
+#ifndef _WIN32
+			return std::string (directory) + "/r" +
+				routerInfo->GetIdentHashBase64 ()[0] + "/routerInfo-" +
+#else
+			return std::string (directory) + "\\r" +
+				routerInfo->GetIdentHashBase64 ()[0] + "\\routerInfo-" +
+#endif
+				routerInfo->GetIdentHashBase64 () + ".dat";
+		};	
+
+		boost::filesystem::path p (i2p::util::filesystem::GetDataDir());
+		p /= (directory);
+#if BOOST_VERSION > 10500		
+		const char * fullDirectory = p.string().c_str ();
+#else
+		const char * fullDirectory = p.c_str ();
+#endif		
+		int count = 0, deletedCount = 0;
+		auto total = m_RouterInfos.size ();
+		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
+		for (auto it: m_RouterInfos)
+		{	
+			if (it.second->IsUpdated ())
+			{
+				it.second->SaveToFile (GetFilePath(fullDirectory, it.second.get ()));
+				it.second->SetUpdated (false);
+				it.second->DeleteBuffer ();
+				count++;
+			}
+			else 
+			{
+				// RouterInfo expires after 1 hour if uses introducer
+				if ((it.second->UsesIntroducer () && ts > it.second->GetTimestamp () + 3600*1000LL) // 1 hour
+				// RouterInfo expires in 72 hours if more than 300
+					|| (total > 300 && ts > it.second->GetTimestamp () + 3*24*3600*1000LL)) // 3 days
+				{	
+					total--;
+					it.second->SetUnreachable (true);
+				}	
+				
+				if (it.second->IsUnreachable ())
+				{	
+					// delete RI file
+					if (boost::filesystem::exists (GetFilePath (fullDirectory, it.second.get ())))
+					{    
+						boost::filesystem::remove (GetFilePath (fullDirectory, it.second.get ()));
+						deletedCount++;
+					}	
+					// delete from floodfills list
+					if (it.second->IsFloodfill ())
+					{
+						std::unique_lock<std::mutex> l(m_FloodfillsMutex);
+						m_Floodfills.remove (it.second);
+					}
+				}
+			}	
+		}	
+		if (count > 0)
+			LogPrint (count," new/updated routers saved");
+		if (deletedCount > 0)
+		{
+			LogPrint (deletedCount," routers deleted");
+			// clean up RouterInfos table
+			std::unique_lock<std::mutex> l(m_RouterInfosMutex);
+			for (auto it = m_RouterInfos.begin (); it != m_RouterInfos.end ();)
+			{
+				if (it->second->IsUnreachable ())
+					it = m_RouterInfos.erase (it);
+				else
+					it++;
+			}
+		}
+	}
+
+	void NetDb::RequestDestination (const IdentHash& destination)
+	{
+		// request RouterInfo directly
+		RequestedDestination * dest = CreateRequestedDestination (destination, false);
+		auto floodfill = GetClosestFloodfill (destination, dest->GetExcludedPeers ());
+		if (floodfill)
+			transports.SendMessage (floodfill->GetIdentHash (), dest->CreateRequestMessage (floodfill->GetIdentHash ()));	
+		else
+		{
+			LogPrint (eLogError, "No floodfills found");
+			DeleteRequestedDestination (dest);
+		}	
+	}	
+	
+	void NetDb::HandleDatabaseStoreMsg (I2NPMessage * m)
+	{	
+		const uint8_t * buf = m->GetPayload ();
+		size_t len = m->GetSize ();		
+		uint32_t replyToken = bufbe32toh (buf + DATABASE_STORE_REPLY_TOKEN_OFFSET);
+		size_t offset = DATABASE_STORE_HEADER_SIZE;
+		if (replyToken)
+			offset += 36;
+		if (buf[DATABASE_STORE_TYPE_OFFSET]) // type
+		{
+			LogPrint ("LeaseSet");
+			AddLeaseSet (buf + DATABASE_STORE_KEY_OFFSET, buf + offset, len - offset, m->from);
+		}	
+		else
+		{
+			LogPrint ("RouterInfo");
+			size_t size = bufbe16toh (buf + offset);
+			if (size > 2048)
+			{
+				LogPrint ("Invalid RouterInfo length ", (int)size);
+				return;
+			}	
+			offset += 2;
+			CryptoPP::Gunzip decompressor;
+			decompressor.Put (buf + offset, size);
+			decompressor.MessageEnd();
+			uint8_t uncompressed[2048];
+			size_t uncomressedSize = decompressor.MaxRetrievable ();
+			decompressor.Get (uncompressed, uncomressedSize);
+			AddRouterInfo (buf + DATABASE_STORE_KEY_OFFSET, uncompressed, uncomressedSize);
+		}	
+		i2p::DeleteI2NPMessage (m);
+	}	
+
+	void NetDb::HandleDatabaseSearchReplyMsg (I2NPMessage * msg)
+	{
+		uint8_t * buf = msg->GetPayload ();
+		char key[48];
+		int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+		key[l] = 0;
+		int num = buf[32]; // num
+		LogPrint ("DatabaseSearchReply for ", key, " num=", num);
+		auto it = m_RequestedDestinations.find (IdentHash (buf));
+		if (it != m_RequestedDestinations.end ())
+		{	
+			RequestedDestination * dest = it->second;
+			bool deleteDest = true;
+			if (num > 0)
+			{	
+				auto pool = i2p::tunnel::tunnels.GetExploratoryPool ();
+				auto outbound = pool->GetNextOutboundTunnel ();
+				auto inbound = pool->GetNextInboundTunnel ();
+				std::vector<i2p::tunnel::TunnelMessageBlock> msgs;
+				if (!dest->IsExploratory ())
+				{
+					// reply to our destination. Try other floodfills
+					if (outbound && inbound )
+					{
+						auto count = dest->GetExcludedPeers ().size ();
+						if (count < 7)
+						{	
+							auto nextFloodfill = GetClosestFloodfill (dest->GetDestination (), dest->GetExcludedPeers ());
+							if (nextFloodfill)
+							{	
+								// tell floodfill about us 
+								msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+									{ 
+										i2p::tunnel::eDeliveryTypeRouter,
+										nextFloodfill->GetIdentHash (), 0,
+										CreateDatabaseStoreMsg () 
+									});  
+								
+								// request destination
+								LogPrint ("Try ", key, " at ", count, " floodfill ", nextFloodfill->GetIdentHash ().ToBase64 ()); 
+								auto msg = dest->CreateRequestMessage (nextFloodfill, inbound);
+								msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+									{ 
+										i2p::tunnel::eDeliveryTypeRouter,
+										nextFloodfill->GetIdentHash (), 0, msg
+									});
+								deleteDest = false;
+							}	
+						}
+						else
+							LogPrint (key, " was not found on 7 floodfills");
+					}	
+				}	
+				
+				for (int i = 0; i < num; i++)
+				{
+					uint8_t * router = buf + 33 + i*32;
+					char peerHash[48];
+					int l1 = i2p::data::ByteStreamToBase64 (router, 32, peerHash, 48);
+					peerHash[l1] = 0;
+					LogPrint (i,": ", peerHash);
+
+					if (dest->IsExploratory ())
+					{	
+						auto r = FindRouter (router); 
+						if (!r || i2p::util::GetMillisecondsSinceEpoch () > r->GetTimestamp () + 3600*1000LL) 
+						{	
+							// router with ident not found or too old (1 hour)
+							LogPrint ("Found new/outdated router. Requesting RouterInfo ...");
+							if (outbound && inbound && dest->GetLastRouter ())
+							{
+								RequestedDestination * d1 = CreateRequestedDestination (router, false);
+								auto msg = d1->CreateRequestMessage (dest->GetLastRouter (), inbound);
+								msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+									{ 
+										i2p::tunnel::eDeliveryTypeRouter,
+										dest->GetLastRouter ()->GetIdentHash (), 0, msg
+									});
+							}	
+							else
+								RequestDestination (router);
+						}
+						else
+							LogPrint ("Bayan");
+					}	
+					else
+					{		
+						auto r = FindRouter (router); 
+						// do we have that floodfill router in our database?
+						if (!r) 
+						{	
+							// request router
+							LogPrint ("Found new floodfill. Request it");
+							RequestDestination (router);
+						}	
+					}						
+				}
+				
+				if (outbound && msgs.size () > 0)
+					outbound->SendTunnelDataMsg (msgs);	
+				if (deleteDest)
+				{
+					// no more requests for the destinationation. delete it
+					delete it->second;
+					m_RequestedDestinations.erase (it);
+				}	
+			}
+			else
+			{
+				// no more requests for detination possible. delete it
+				delete it->second;
+				m_RequestedDestinations.erase (it);
+			}	
+		}
+		else
+		{	
+			LogPrint ("Requested destination for ", key, " not found");
+			// it might contain new routers
+			for (int i = 0; i < num; i++)
+			{
+				IdentHash router (buf + 33 + i*32);
+				if (!FindRouter (router))
+				{	
+					LogPrint ("New router ", router.ToBase64 (), " found. Request it");
+					RequestDestination (router);
+				}	
+			}	
+		}	
+		i2p::DeleteI2NPMessage (msg);
+	}	
+	
+	void NetDb::HandleDatabaseLookupMsg (I2NPMessage * msg)
+	{
+		uint8_t * buf = msg->GetPayload ();
+		char key[48];
+		int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+		key[l] = 0;
+		LogPrint ("DatabaseLookup for ", key, " recieved");
+		uint8_t flag = buf[64];
+		uint8_t * excluded = buf + 65;		
+		uint32_t replyTunnelID = 0;
+		if (flag & 0x01) //reply to tunnel
+		{
+			replyTunnelID = bufbe32toh (buf + 64);
+			excluded += 4;
+		}
+		uint16_t numExcluded = bufbe16toh (excluded);	
+		excluded += 2;
+		if (numExcluded > 512)
+		{
+			LogPrint ("Number of excluded peers", numExcluded, " exceeds 512");
+			numExcluded = 0; // TODO:
+		} 
+
+		I2NPMessage * replyMsg = nullptr;
+
+		{
+			auto router = FindRouter (buf);
+			if (router)
+			{
+				LogPrint ("Requested RouterInfo ", key, " found");
+				router->LoadBuffer ();
+				if (router->GetBuffer ()) 
+					replyMsg = CreateDatabaseStoreMsg (router.get ());
+			}
+		}
+		if (!replyMsg)
+		{
+			auto leaseSet = FindLeaseSet (buf);
+			if (leaseSet) // we don't send back our LeaseSets
+			{
+				LogPrint ("Requested LeaseSet ", key, " found");
+				replyMsg = CreateDatabaseStoreMsg (leaseSet);
+			}
+		}
+		if (!replyMsg)
+		{
+			LogPrint ("Requested ", key, " not found. ", numExcluded, " excluded");
+			std::set<IdentHash> excludedRouters;
+			for (int i = 0; i < numExcluded; i++)
+			{
+				// TODO: check for all zeroes (exploratory)
+				excludedRouters.insert (excluded);
+				excluded += 32;
+			}	
+			replyMsg = CreateDatabaseSearchReply (buf, GetClosestFloodfill (buf, excludedRouters).get ());
+		}
+		else
+			excluded += numExcluded*32; // we don't care about exluded	
+
+		if (replyMsg)
+		{	
+			if (replyTunnelID)
+			{
+				// encryption might be used though tunnel only
+				if (flag & 0x02) // encrypted reply requested
+				{
+					uint8_t * sessionKey = excluded;
+					uint8_t numTags = sessionKey[32];
+					if (numTags > 0) 
+					{
+						uint8_t * sessionTag = sessionKey + 33; // take first tag
+						i2p::garlic::GarlicRoutingSession garlic (sessionKey, sessionTag);
+						replyMsg = garlic.WrapSingleMessage (replyMsg);
+					}
+				}	
+				auto exploratoryPool = i2p::tunnel::tunnels.GetExploratoryPool ();
+				auto outbound = exploratoryPool ? exploratoryPool->GetNextOutboundTunnel () : nullptr;
+				if (outbound)
+					outbound->SendTunnelDataMsg (buf+32, replyTunnelID, replyMsg);
+				else
+					transports.SendMessage (buf+32, i2p::CreateTunnelGatewayMsg (replyTunnelID, replyMsg));
+			}
+			else
+				transports.SendMessage (buf+32, replyMsg);
+		}
+		i2p::DeleteI2NPMessage (msg);
+	}	
+
+	void NetDb::Explore (int numDestinations)
+	{	
+		// new requests
+		auto exploratoryPool = i2p::tunnel::tunnels.GetExploratoryPool ();
+		auto outbound = exploratoryPool ? exploratoryPool->GetNextOutboundTunnel () : i2p::tunnel::tunnels.GetNextOutboundTunnel ();
+		auto inbound = exploratoryPool ? exploratoryPool->GetNextInboundTunnel () : i2p::tunnel::tunnels.GetNextInboundTunnel ();
+		bool throughTunnels = outbound && inbound;
+		
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		uint8_t randomHash[32];
+		std::vector<i2p::tunnel::TunnelMessageBlock> msgs;
+		std::set<const RouterInfo *> floodfills;
+		LogPrint ("Exploring new ", numDestinations, " routers ...");
+		for (int i = 0; i < numDestinations; i++)
+		{	
+			rnd.GenerateBlock (randomHash, 32);
+			RequestedDestination * dest = CreateRequestedDestination (IdentHash (randomHash), true);
+			auto floodfill = GetClosestFloodfill (randomHash, dest->GetExcludedPeers ());
+			if (floodfill && !floodfills.count (floodfill.get ())) // request floodfill only once
+			{	
+				floodfills.insert (floodfill.get ());
+				if (throughTunnels)
+				{	
+					msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+						{ 
+							i2p::tunnel::eDeliveryTypeRouter,
+							floodfill->GetIdentHash (), 0,
+							CreateDatabaseStoreMsg () // tell floodfill about us 
+						});  
+					msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+						{ 
+							i2p::tunnel::eDeliveryTypeRouter,
+							floodfill->GetIdentHash (), 0, 
+							dest->CreateRequestMessage (floodfill, inbound) // explore
+						}); 
+				}	
+				else
+					i2p::transport::transports.SendMessage (floodfill->GetIdentHash (), dest->CreateRequestMessage (floodfill->GetIdentHash ()));
+			}	
+			else
+				DeleteRequestedDestination (dest);
+		}	
+		if (throughTunnels && msgs.size () > 0)
+			outbound->SendTunnelDataMsg (msgs);		
+	}	
+
+	void NetDb::Publish ()
+	{
+		std::set<IdentHash> excluded; // TODO: fill up later
+		for (int i = 0; i < 3; i++)
+		{	
+			auto floodfill = GetClosestFloodfill (i2p::context.GetRouterInfo ().GetIdentHash (), excluded);
+			if (floodfill)
+			{
+				LogPrint ("Publishing our RouterInfo to ", floodfill->GetIdentHashAbbreviation ());
+				transports.SendMessage (floodfill->GetIdentHash (), CreateDatabaseStoreMsg ());	
+				excluded.insert (floodfill->GetIdentHash ());
+			}
+		}	
+	}	
+	
+	RequestedDestination * NetDb::CreateRequestedDestination (const IdentHash& dest, bool isExploratory)
+	{
+		std::unique_lock<std::mutex> l(m_RequestedDestinationsMutex);
+		auto it = m_RequestedDestinations.find (dest);
+		if (it == m_RequestedDestinations.end ()) // not exist yet
+		{
+			RequestedDestination * d = new RequestedDestination (dest, isExploratory);
+			m_RequestedDestinations[dest] = d;
+			return d;
+		}	
+		else
+			return it->second;
+	}
+	
+	bool NetDb::DeleteRequestedDestination (const IdentHash& dest)
+	{
+		auto it = m_RequestedDestinations.find (dest);
+		if (it != m_RequestedDestinations.end ())
+		{	
+			std::unique_lock<std::mutex> l(m_RequestedDestinationsMutex);
+			delete it->second;
+			m_RequestedDestinations.erase (it);
+			return true;
+		}	
+		return false;
+	}	
+
+	void NetDb::DeleteRequestedDestination (RequestedDestination * dest)
+	{
+		if (dest)
+		{
+			std::unique_lock<std::mutex> l(m_RequestedDestinationsMutex);
+			m_RequestedDestinations.erase (dest->GetDestination ());
+			delete dest;
+		}	
+	}	
+
+	std::shared_ptr<const RouterInfo> NetDb::GetRandomRouter () const
+	{
+		return GetRandomRouter (
+			[](std::shared_ptr<const RouterInfo> router)->bool 
+			{ 
+				return !router->IsHidden (); 
+			});
+	}	
+	
+	std::shared_ptr<const RouterInfo> NetDb::GetRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith) const
+	{
+		return GetRandomRouter (
+			[compatibleWith](std::shared_ptr<const RouterInfo> router)->bool 
+			{ 
+				return !router->IsHidden () && router != compatibleWith && 
+					router->IsCompatible (*compatibleWith); 
+			});
+	}	
+
+	std::shared_ptr<const RouterInfo> NetDb::GetHighBandwidthRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith) const
+	{
+		return GetRandomRouter (
+			[compatibleWith](std::shared_ptr<const RouterInfo> router)->bool 
+			{ 
+				return !router->IsHidden () && router != compatibleWith &&
+					router->IsCompatible (*compatibleWith) && (router->GetCaps () & RouterInfo::eHighBandwidth); 
+			});
+	}	
+	
+	template<typename Filter>
+	std::shared_ptr<const RouterInfo> NetDb::GetRandomRouter (Filter filter) const
+	{
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		uint32_t ind = rnd.GenerateWord32 (0, m_RouterInfos.size () - 1);	
+		for (int j = 0; j < 2; j++)
+		{	
+			uint32_t i = 0;
+			std::unique_lock<std::mutex> l(m_RouterInfosMutex);
+			for (auto it: m_RouterInfos)
+			{	
+				if (i >= ind)
+				{	
+					if (!it.second->IsUnreachable () && filter (it.second))
+						return it.second;
+				}	
+				else 
+					i++;
+			}
+			// we couldn't find anything, try second pass
+			ind = 0;
+		}	
+		return nullptr; // seems we have too few routers
+	}	
+	
+	void NetDb::PostI2NPMsg (I2NPMessage * msg)
+	{
+		if (msg) m_Queue.Put (msg);	
+	}	
+
+	std::shared_ptr<const RouterInfo> NetDb::GetClosestFloodfill (const IdentHash& destination, 
+		const std::set<IdentHash>& excluded) const
+	{
+		std::shared_ptr<const RouterInfo> r;
+		XORMetric minMetric;
+		IdentHash destKey = CreateRoutingKey (destination);
+		minMetric.SetMax ();
+		std::unique_lock<std::mutex> l(m_FloodfillsMutex);
+		for (auto it: m_Floodfills)
+		{	
+			if (!it->IsUnreachable () && !excluded.count (it->GetIdentHash ()))
+			{	
+				XORMetric m = destKey ^ it->GetIdentHash ();
+				if (m < minMetric)
+				{
+					minMetric = m;
+					r = it;
+				}
+			}	
+		}	
+		return r;
+	}	
+
+	void NetDb::ManageLeaseSets ()
+	{
+		for (auto it = m_LeaseSets.begin (); it != m_LeaseSets.end ();)
+		{
+			if (it->second->HasNonExpiredLeases ()) // all leases expired
+			{
+				LogPrint ("LeaseSet ", it->second->GetIdentHash ().ToBase64 (), " expired");
+				delete it->second;
+				it = m_LeaseSets.erase (it);
+			}	
+			else 
+				it++;
+		}
+	}
+
+	void NetDb::ManageRequests ()
+	{
+		uint64_t ts = i2p::util::GetSecondsSinceEpoch ();	
+		for (auto it = m_RequestedDestinations.begin (); it != m_RequestedDestinations.end ();)
+		{
+			auto dest = it->second;
+			bool done = false;
+			if (!dest->IsExploratory () && ts < dest->GetCreationTime () + 60) // request is worthless after 1 minute
+			{
+				if (ts > dest->GetCreationTime () + 5) // no response for 5 seconds
+				{
+					auto count = dest->GetExcludedPeers ().size ();
+					if (count < 7)
+					{
+						auto pool = i2p::tunnel::tunnels.GetExploratoryPool ();
+						auto outbound = pool->GetNextOutboundTunnel ();
+						auto inbound = pool->GetNextInboundTunnel ();	
+						auto nextFloodfill = GetClosestFloodfill (dest->GetDestination (), dest->GetExcludedPeers ());
+						if (nextFloodfill && outbound && inbound)
+							outbound->SendTunnelDataMsg (nextFloodfill->GetIdentHash (), 0,
+								dest->CreateRequestMessage (nextFloodfill, inbound));
+						else
+						{
+							done = true;
+							if (!inbound) LogPrint (eLogWarning, "No inbound tunnels");	
+							if (!outbound) LogPrint (eLogWarning, "No outbound tunnels");
+							if (!nextFloodfill) LogPrint (eLogWarning, "No more floodfills");	
+						}
+					}	
+					else
+					{
+						LogPrint (eLogWarning, dest->GetDestination ().ToBase64 (), " not found after 7 attempts");	
+						done = true;
+					}	 
+				}	
+			}	
+			else // delete previous exploratory
+				done = true;
+
+			if (done)
+			{
+				delete it->second;
+				it = m_RequestedDestinations.erase (it);
+			}
+			else
+				it++;
+		}	
+	}
+}
+}
--- a/NetDb.h
+++ b/NetDb.h
@ -0,0 +1,124 @@
+#ifndef NETDB_H__
+#define NETDB_H__
+
+#include <inttypes.h>
+#include <set>
+#include <map>
+#include <list>
+#include <string>
+#include <thread>
+#include <mutex>
+#include <boost/filesystem.hpp>
+#include "Queue.h"
+#include "I2NPProtocol.h"
+#include "RouterInfo.h"
+#include "LeaseSet.h"
+#include "Tunnel.h"
+#include "TunnelPool.h"
+
+namespace i2p
+{
+namespace data
+{		
+	class RequestedDestination
+	{
+		public:
+
+			RequestedDestination (const IdentHash& destination, bool isExploratory = false):
+				m_Destination (destination), m_IsExploratory (isExploratory), m_CreationTime (0) {};
+			
+			const IdentHash& GetDestination () const { return m_Destination; };
+			int GetNumExcludedPeers () const { return m_ExcludedPeers.size (); };
+			const std::set<IdentHash>& GetExcludedPeers () { return m_ExcludedPeers; };
+			void ClearExcludedPeers ();
+			std::shared_ptr<const RouterInfo> GetLastRouter () const { return m_LastRouter; };
+			bool IsExploratory () const { return m_IsExploratory; };
+			bool IsExcluded (const IdentHash& ident) const { return m_ExcludedPeers.count (ident); };
+			uint64_t GetCreationTime () const { return m_CreationTime; };
+			I2NPMessage * CreateRequestMessage (std::shared_ptr<const RouterInfo>, const i2p::tunnel::InboundTunnel * replyTunnel);
+			I2NPMessage * CreateRequestMessage (const IdentHash& floodfill);
+						
+		private:
+
+			IdentHash m_Destination;
+			bool m_IsExploratory;
+			std::set<IdentHash> m_ExcludedPeers;
+			std::shared_ptr<const RouterInfo> m_LastRouter;
+			uint64_t m_CreationTime;
+	};	
+	
+	class NetDb
+	{
+		public:
+
+			NetDb ();
+			~NetDb ();
+
+			void Start ();
+			void Stop ();
+			
+			void AddRouterInfo (const uint8_t * buf, int len);
+			void AddRouterInfo (const IdentHash& ident, const uint8_t * buf, int len);
+			void AddLeaseSet (const IdentHash& ident, const uint8_t * buf, int len, i2p::tunnel::InboundTunnel * from);
+			std::shared_ptr<RouterInfo> FindRouter (const IdentHash& ident) const;
+			LeaseSet * FindLeaseSet (const IdentHash& destination) const;
+
+			void RequestDestination (const IdentHash& destination);			
+			
+			void HandleDatabaseStoreMsg (I2NPMessage * msg);
+			void HandleDatabaseSearchReplyMsg (I2NPMessage * msg);
+			void HandleDatabaseLookupMsg (I2NPMessage * msg);			
+
+			std::shared_ptr<const RouterInfo> GetRandomRouter () const;
+			std::shared_ptr<const RouterInfo> GetRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith) const;
+			std::shared_ptr<const RouterInfo> GetHighBandwidthRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith) const;
+			std::shared_ptr<const RouterInfo> GetClosestFloodfill (const IdentHash& destination, const std::set<IdentHash>& excluded) const;
+			void SetUnreachable (const IdentHash& ident, bool unreachable);			
+
+			void PostI2NPMsg (I2NPMessage * msg);
+
+			// for web interface
+			int GetNumRouters () const { return m_RouterInfos.size (); };
+			int GetNumFloodfills () const { return m_Floodfills.size (); };
+			int GetNumLeaseSets () const { return m_LeaseSets.size (); };
+			
+		private:
+
+			bool CreateNetDb(boost::filesystem::path directory);
+			void Load (const char * directory);
+			void SaveUpdated (const char * directory);
+			void Run (); // exploratory thread
+			void Explore (int numDestinations);	
+			void Publish ();
+			void ManageLeaseSets ();
+			void ManageRequests ();
+
+			RequestedDestination * CreateRequestedDestination (const IdentHash& dest, bool isExploratory = false);
+			bool DeleteRequestedDestination (const IdentHash& dest); // returns true if found
+			void DeleteRequestedDestination (RequestedDestination * dest);
+
+			template<typename Filter>
+			std::shared_ptr<const RouterInfo> GetRandomRouter (Filter filter) const;	
+		
+		private:
+
+			std::map<IdentHash, LeaseSet *> m_LeaseSets;
+			mutable std::mutex m_RouterInfosMutex;
+			std::map<IdentHash, std::shared_ptr<RouterInfo> > m_RouterInfos;
+			mutable std::mutex m_FloodfillsMutex;
+			std::list<std::shared_ptr<RouterInfo> > m_Floodfills;
+			std::mutex m_RequestedDestinationsMutex;
+			std::map<IdentHash, RequestedDestination *> m_RequestedDestinations;
+			
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			i2p::util::Queue<I2NPMessage> m_Queue; // of I2NPDatabaseStoreMsg
+
+			static const char m_NetDbPath[];
+	};
+
+	extern NetDb netdb;
+}
+}
+
+#endif
--- a/libi2pd/Queue.h
+++ b/libi2pd/Queue.h
@ -1,20 +1,11 @@
-/*
-* Copyright (c) 2013-2024, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
 #ifndef QUEUE_H__
 #define QUEUE_H__

-#include <list>
+#include <queue>
 #include <mutex>
 #include <thread>
 #include <condition_variable>
 #include <functional>
-#include <utility>

 namespace i2p
 {
@ -25,27 +16,17 @@ namespace util
 	{	
 		public:

-			void Put (Element e)
+			void Put (Element * e)
 			{
 				std::unique_lock<std::mutex>  l(m_QueueMutex);
-				m_Queue.push_back (std::move(e));
+				m_Queue.push (e);	
 				m_NonEmpty.notify_one ();
 			}

-			void Put (std::list<Element>& list)
-			{
-				if (!list.empty ())
+			Element * GetNext ()
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
-					m_Queue.splice (m_Queue.end (), list); 
-					m_NonEmpty.notify_one ();
-				}	
-			}		
-		
-			Element GetNext ()
-			{
-				std::unique_lock<std::mutex> l(m_QueueMutex);
-				auto el = GetNonThreadSafe ();
+				Element * el = GetNonThreadSafe ();
 				if (!el)
 				{
 					m_NonEmpty.wait (l);
@ -54,10 +35,10 @@ namespace util
 				return el;
 			}

-			Element GetNextWithTimeout (int usec)
+			Element * GetNextWithTimeout (int usec)
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
-				auto el = GetNonThreadSafe ();
+				Element * el = GetNonThreadSafe ();
 				if (!el)
 				{
 					m_NonEmpty.wait_for (l, std::chrono::milliseconds (usec));
@ -84,48 +65,29 @@ namespace util
 				return m_Queue.empty ();
 			}
 			
-			int GetSize () const
-			{
-				std::unique_lock<std::mutex> l(m_QueueMutex);
-				return m_Queue.size ();
-			}
-
 			void WakeUp () { m_NonEmpty.notify_all (); };

-			Element Get ()
+			Element * Get ()
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
 				return GetNonThreadSafe ();
 			}	

-			Element Peek ()
+			Element * Peek ()
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
 				return GetNonThreadSafe (true);
 			}	
 			
-			void GetWholeQueue (std::list<Element>& queue)
-			{
-				if (!queue.empty ())
-				{	
-					std::list<Element> newQueue;
-					queue.swap (newQueue);
-				}	
-				{
-					std::unique_lock<std::mutex> l(m_QueueMutex);
-					m_Queue.swap (queue);
-				}
-			}		
-
 		private:

-			Element GetNonThreadSafe (bool peek = false)
+			Element * GetNonThreadSafe (bool peek = false)
 			{
 				if (!m_Queue.empty ())
 				{
-					auto el = m_Queue.front ();
+					Element * el = m_Queue.front ();
 					if (!peek)
-						m_Queue.pop_front ();
+						m_Queue.pop ();
 					return el;
 				}				
 				return nullptr;
@ -133,10 +95,56 @@ namespace util
 			
 		private:

-			std::list<Element> m_Queue;
-			mutable std::mutex m_QueueMutex;
+			std::queue<Element *> m_Queue;
+			std::mutex m_QueueMutex;
 			std::condition_variable m_NonEmpty;
 	};	
+
+	template<class Msg>
+	class MsgQueue: public Queue<Msg>
+	{
+		public:
+
+			typedef std::function<void()> OnEmpty;
+
+			MsgQueue (): m_IsRunning (true), m_Thread (std::bind (&MsgQueue<Msg>::Run, this))  {};
+			~MsgQueue () { Stop (); };
+			void Stop()
+			{
+				if (m_IsRunning)
+				{
+					m_IsRunning = false;
+					Queue<Msg>::WakeUp ();					
+					m_Thread.join();
+				}
+			}
+
+			void SetOnEmpty (OnEmpty const & e) { m_OnEmpty = e; };
+
+		private:
+
+			void Run ()
+			{
+				while (m_IsRunning)
+				{
+					while (Msg * msg = Queue<Msg>::Get ())
+					{
+						msg->Process ();
+						delete msg;
+					}
+					if (m_OnEmpty != nullptr)
+						m_OnEmpty ();
+					if (m_IsRunning)
+						Queue<Msg>::Wait ();
+				}	
+			}	
+			
+		private:
+			
+			volatile bool m_IsRunning;
+			OnEmpty m_OnEmpty;
+			std::thread m_Thread;	
+	};	
 }		
 }	

--- a/README.md
+++ b/README.md
@ -1,124 +1,85 @@
-[![GitHub release](https://img.shields.io/github/release/PurpleI2P/i2pd.svg?label=latest%20release)](https://github.com/PurpleI2P/i2pd/releases/latest)
-[![Snapcraft release](https://snapcraft.io/i2pd/badge.svg)](https://snapcraft.io/i2pd)
-[![License](https://img.shields.io/github/license/PurpleI2P/i2pd.svg)](https://github.com/PurpleI2P/i2pd/blob/openssl/LICENSE)
-[![Packaging status](https://repology.org/badge/tiny-repos/i2pd.svg)](https://repology.org/project/i2pd/versions)
-[![Docker Pulls](https://img.shields.io/docker/pulls/purplei2p/i2pd)](https://hub.docker.com/r/purplei2p/i2pd)
-[![Crowdin](https://badges.crowdin.net/i2pd/localized.svg)](https://crowdin.com/project/i2pd)
-
-*note: i2pd for Android can be found in [i2pd-android](https://github.com/PurpleI2P/i2pd-android) repository and with Qt GUI in [i2pd-qt](https://github.com/PurpleI2P/i2pd-qt) repository*
-
 i2pd
 ====

-[Русская версия](https://github.com/PurpleI2P/i2pd_docs_ru/blob/master/README.md)
+I2P router written in C++

-i2pd (I2P Daemon) is a full-featured C++ implementation of I2P client.  
+Requirements for Linux/FreeBSD/OSX
+----------------------------------

-I2P (Invisible Internet Protocol) is a universal anonymous network layer.  
-All communications over I2P are anonymous and end-to-end encrypted, participants
-don't reveal their real IP addresses.  
+GCC 4.6 or newer, Boost 1.46 or newer, crypto++. Clang can be used instead of
+GCC.

-I2P client is a software used for building and using anonymous I2P
-networks. Such networks are commonly used for anonymous peer-to-peer
-applications (filesharing, cryptocurrencies) and anonymous client-server
-applications (websites, instant messengers, chat-servers).  
+Requirements for Windows
+------------------------

-I2P allows people from all around the world to communicate and share information
-without restrictions.  
+VS2013 (known to work with 12.0.21005.1 or newer), Boost 1.46 or newer,
+crypto++ 5.62. See Win32/README-Build.txt for instructions on how to build i2pd
+and its dependencies.

-Features
--------
+Build Statuses
+---------------

-* Distributed anonymous networking framework  
-* End-to-end encrypted communications  
-* Small footprint, simple dependencies, fast performance  
-* Rich set of APIs for developers of secure applications  
-
-Resources
---------
-
-* [Website](http://i2pd.website)
-* [Documentation](https://i2pd.readthedocs.io/en/latest/)
-* [Wiki](https://github.com/PurpleI2P/i2pd/wiki)
-* [Tickets/Issues](https://github.com/PurpleI2P/i2pd/issues)
-* [Specifications](https://geti2p.net/spec)
-* [Twitter](https://twitter.com/hashtag/i2pd)
-
-Installing
----------
-
-The easiest way to install i2pd is by using precompiled packages and binaries.
-You can fetch most of them on [release](https://github.com/PurpleI2P/i2pd/releases/latest) page.  
-Please see [documentation](https://i2pd.readthedocs.io/en/latest/user-guide/install/) for more info.
-
-Building
--------
-See [documentation](https://i2pd.readthedocs.io/en/latest/) for how to build
-i2pd from source on your OS.  
-
-note: i2pd with Qt GUI can be found in [i2pd-qt](https://github.com/PurpleI2P/i2pd-qt) repository and for android in [i2pd-android](https://github.com/PurpleI2P/i2pd-android) repository.
+- Linux x64      - [![Build Status](https://jenkins.nordcloud.no/buildStatus/icon?job=i2pd-linux)](https://jenkins.nordcloud.no/job/i2pd-linux/)
+- Linux ARM      - To be added
+- Mac OS X       - Got it working, but not well tested. (Only works with clang, not GCC.)
+- Microsoft VC13 - To be added


-Build instructions:
-
-* [unix](https://i2pd.readthedocs.io/en/latest/devs/building/unix/)
-* [windows](https://i2pd.readthedocs.io/en/latest/devs/building/windows/)
-* [iOS](https://i2pd.readthedocs.io/en/latest/devs/building/ios/)
-* [android](https://i2pd.readthedocs.io/en/latest/devs/building/android/)
-
-
-**Supported systems:**
-
-* GNU/Linux (Debian, Ubuntu, etc) - [![Build on Ubuntu](https://github.com/PurpleI2P/i2pd/actions/workflows/build.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/build.yml)
-* CentOS, Fedora, Mageia - [![Build Status](https://copr.fedorainfracloud.org/coprs/supervillain/i2pd/package/i2pd-git/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/supervillain/i2pd/package/i2pd-git/)
-* Alpine, ArchLinux, openSUSE, Gentoo, etc.
-* Windows - [![Build on Windows](https://github.com/PurpleI2P/i2pd/actions/workflows/build-windows.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/build-windows.yml)
-* Mac OS - [![Build on OSX](https://github.com/PurpleI2P/i2pd/actions/workflows/build-osx.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/build-osx.yml)
-* Docker image - [![Build containers](https://github.com/PurpleI2P/i2pd/actions/workflows/docker.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/docker.yml)
-* Snap - [![i2pd](https://snapcraft.io/i2pd/badge.svg)](https://snapcraft.io/i2pd) [![i2pd](https://snapcraft.io/i2pd/trending.svg?name=0)](https://snapcraft.io/i2pd)
-* FreeBSD - [![Build on FreeBSD](https://github.com/PurpleI2P/i2pd/actions/workflows/build-freebsd.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/build-freebsd.yml)
-* Android - [![Android CI](https://github.com/PurpleI2P/i2pd-android/actions/workflows/android.yml/badge.svg)](https://github.com/PurpleI2P/i2pd-android/actions/workflows/android.yml)
-* iOS
-
-Using i2pd
----------
-
-See [documentation](https://i2pd.readthedocs.io/en/latest/user-guide/run/) and
-[example config file](https://github.com/PurpleI2P/i2pd/blob/openssl/contrib/i2pd.conf).
-
-Localization
------------
-
-You can help us with translation i2pd to your language using Crowdin platform!
-Translation project can be found [here](https://crowdin.com/project/i2pd).
-
-New languages can be requested on project's [discussion page](https://crowdin.com/project/i2pd/discussions).
-
-Current status: [![Crowdin](https://badges.crowdin.net/i2pd/localized.svg)](https://crowdin.com/project/i2pd)
-
-Donations
---------
-
-**E-Mail**: ```i2porignal at yandex.com```
-
-**BTC**: ```3MDoGJW9TLMTCDGrR9bLgWXfm6sjmgy86f```
-
-**LTC**: ```LKQirrYrDeTuAPnpYq5y7LVKtywfkkHi59```
-
-**ETH**: ```0x9e5bac70d20d1079ceaa111127f4fb3bccce379d```
-
-**GST**: ```GbD2JSQHBHCKLa9WTHmigJRpyFgmBj4woG```
-
-**DASH**: ```Xw8YUrQpYzP9tZBmbjqxS3M97Q7v3vJKUF```
-
-**ZEC**: ```t1cTckLuXsr1dwVrK4NDzfhehss4NvMadAJ```
-
-**ANC**: ```AQJYweYYUqM1nVfLqfoSMpUMfzxvS4Xd7z```
-
-**XMR**: ```497pJc7X4xqKvcLBLpSUtRgWqMMyo24u4btCos3cak6gbMkpobgSU6492ztUcUBghyeHpYeczB55s38NpuHoH5WGNSPDRMH```
-
-License
+Testing
 -------

-This project is licensed under the BSD 3-clause license, which can be found in the file
-LICENSE in the root of the project source code.  
+First, build it.
+
+* $ cd i2pd
+* $ make
+
+Next, find out your public ip. (find it for example at http://www.whatismyip.com/)
+
+Then, run it with:
+
+$ ./i2p --host=YOUR_PUBLIC_IP
+
+The client should now reseed by itself.
+
+To visit an I2P page, you need to find the b32 address of your destination.
+After that, go to the webconsole and add it behind the url. (Remove http:// from the address)
+
+This should resulting in for example:
+http://localhost:7070/4oes3rlgrpbkmzv4lqcfili23h3cvpwslqcfjlk6vvguxyggspwa.b32.i2p
+
+
+Cmdline options
+---------------
+
+* --host=               - The external IP
+* --port=               - The port to listen on
+* --httpport=           - The http port to listen on
+* --log=                - Enable or disable logging to file. 1 for yes, 0 for no.
+* --daemon=             - Enable or disable daemon mode. 1 for yes, 0 for no.
+* --service=            - 1 if uses system folders (/var/run/i2pd.pid, /var/log/i2pd.log, /var/lib/i2pd).
+* --unreachable=        - 1 if router is declared as unreachable and works through introducers.
+* --v6=                 - 1 if supports communication through ipv6, off by default
+* --httpproxyport=      - The port to listen on (HTTP Proxy)
+* --socksproxyport=     - The port to listen on (SOCKS Proxy)
+* --ircport=            - The local port of IRC tunnel to listen on. 6668 by default
+* --ircdest=            - I2P destination address of IRC server. For example irc.postman.i2p
+* --irckeys=            - optional keys file for local destination
+* --eepkeys=            - File name containing destination keys, for example privKeys.dat.
+                          The file will be created if it does not already exist (issue #110).
+* --eephost=            - Address incoming trafic forward to. 127.0.0.1 by default
+* --eepport=            - Port incoming trafic forward to. 80 by default
+* --samport=            - Port of SAM bridge. Usually 7656. SAM is off if not specified
+* --bobport=            - Port of BOB command channel. Usually 2827. BOB is off if not specified
+* --conf=               - Config file (default: ~/.i2pd/i2p.conf or /var/lib/i2pd/i2p.conf)
+                          This parameter will be silently ignored if the specified config file does not exist.
+                          Options specified on the command line take precedence over those in the config file.
+
+Config file
+-----------
+
+INI-like, syntax is the following : <key> = <value>.
+All command-line parameters are allowed as keys, for example:
+
+	log = 1
+	v6 = 0
+	ircdest = irc.postman.i2p
--- a/Reseed.cpp
+++ b/Reseed.cpp
@ -0,0 +1,502 @@
+#include <string.h>
+#include <fstream>
+#include <sstream>
+#include <boost/regex.hpp>
+#include <boost/filesystem.hpp>
+#include <cryptopp/osrng.h>
+#include <cryptopp/asn.h>
+#include <cryptopp/base64.h>
+#include <cryptopp/crc.h>
+#include <cryptopp/zinflate.h>
+#include "I2PEndian.h"
+#include "Reseed.h"
+#include "Log.h"
+#include "Identity.h"
+#include "CryptoConst.h"
+#include "NetDb.h"
+#include "util.h"
+
+
+namespace i2p
+{
+namespace data
+{
+
+	static std::vector<std::string> httpReseedHostList = {
+				"http://193.150.121.66/netDb/",
+				"http://netdb.i2p2.no/",
+				"http://reseed.i2p-projekt.de/",
+				"http://cowpuncher.drollette.com/netdb/",
+				"http://i2p.mooo.com/netDb/",
+				"http://reseed.info/",
+				"http://uk.reseed.i2p2.no/",
+				"http://us.reseed.i2p2.no/",
+				"http://jp.reseed.i2p2.no/",
+				"http://i2p-netdb.innovatio.no/",
+				"http://ieb9oopo.mooo.com"
+			};
+
+	//TODO: Remember to add custom port support. Not all serves on 443
+	static std::vector<std::string> httpsReseedHostList = {
+				"https://193.150.121.66/netDb/",
+				"https://netdb.i2p2.no/",
+				"https://reseed.i2p-projekt.de/",
+				"https://cowpuncher.drollette.com/netdb/",
+				"https://i2p.mooo.com/netDb/",
+				"https://reseed.info/",
+				"https://i2p-netdb.innovatio.no/",
+				"https://ieb9oopo.mooo.com/",
+				"https://ssl.webpack.de/ivae2he9.sg4.e-plaza.de/" // Only HTTPS and SU3 (v2) support
+			};
+	
+	//TODO: Implement v2 reseeding. Lightweight zip library is needed.
+	//TODO: Implement SU3, utils.
+	Reseeder::Reseeder()
+	{
+	}
+
+	Reseeder::~Reseeder()
+	{
+	}
+
+	bool Reseeder::reseedNow()
+	{
+		try
+		{
+			// Seems like the best place to try to intercept with SSL
+			/*ssl_server = true;
+			try {
+				// SSL
+			}
+			catch (std::exception& e)
+			{
+				LogPrint("Exception in SSL: ", e.what());
+			}*/
+			std::string reseedHost = httpReseedHostList[(rand() % httpReseedHostList.size())];
+			LogPrint("Reseeding from ", reseedHost);
+			std::string content = i2p::util::http::httpRequest(reseedHost);
+			if (content == "")
+			{
+				LogPrint("Reseed failed");
+				return false;
+			}
+			boost::regex e("<\\s*A\\s+[^>]*href\\s*=\\s*\"([^\"]*)\"", boost::regex::normal | boost::regbase::icase);
+			boost::sregex_token_iterator i(content.begin(), content.end(), e, 1);
+			boost::sregex_token_iterator j;
+			//TODO: Ugly code, try to clean up.
+			//TODO: Try to reduce N number of variables
+			std::string name;
+			std::string routerInfo;
+			std::string tmpUrl;
+			std::string filename;
+			std::string ignoreFileSuffix = ".su3";
+			boost::filesystem::path root = i2p::util::filesystem::GetDataDir();
+			while (i != j)
+			{
+				name = *i++;
+				if (name.find(ignoreFileSuffix)!=std::string::npos)
+					continue;
+				LogPrint("Downloading ", name);
+				tmpUrl = reseedHost;
+				tmpUrl.append(name);
+				routerInfo = i2p::util::http::httpRequest(tmpUrl);
+				if (routerInfo.size()==0)
+					continue;
+				filename = root.string();
+#ifndef _WIN32
+				filename += "/netDb/r";
+#else
+				filename += "\\netDb\\r";
+#endif
+				filename += name.at(11); // first char in id
+#ifndef _WIN32
+				filename.append("/");
+#else
+				filename.append("\\");
+#endif
+				filename.append(name.c_str());
+				std::ofstream outfile (filename, std::ios::binary);
+				outfile << routerInfo;
+				outfile.close();
+			}
+			return true;
+		}
+		catch (std::exception& ex)
+		{
+			//TODO: error reporting
+			return false;
+		}
+		return false;
+	}	
+
+	int Reseeder::ReseedNowSU3 ()
+	{
+		CryptoPP::AutoSeededRandomPool rnd;
+		auto ind = rnd.GenerateWord32 (0, httpReseedHostList.size() - 1);
+		std::string reseedHost = httpReseedHostList[ind];
+		return ReseedFromSU3 (reseedHost);
+	}
+
+	int Reseeder::ReseedFromSU3 (const std::string& host)
+	{
+		std::string url = host + "i2pseeds.su3";
+		LogPrint (eLogInfo, "Dowloading SU3 from ", host);
+		std::string su3 = i2p::util::http::httpRequest (url);
+		if (su3.length () > 0)
+		{
+			std::stringstream s(su3);
+			return ProcessSU3Stream (s);
+		}
+		else
+		{
+			LogPrint (eLogWarning, "SU3 download failed");
+			return 0;
+		}
+	}
+	
+	int Reseeder::ProcessSU3File (const char * filename)
+	{
+		std::ifstream s(filename, std::ifstream::binary);
+		if (s.is_open ())	
+			return ProcessSU3Stream (s);
+		else
+		{
+			LogPrint (eLogError, "Can't open file ", filename);
+			return 0;
+		}
+	}
+
+	const char SU3_MAGIC_NUMBER[]="I2Psu3";	
+	const uint32_t ZIP_HEADER_SIGNATURE = 0x04034B50;
+	const uint32_t ZIP_CENTRAL_DIRECTORY_HEADER_SIGNATURE = 0x02014B50;	
+	const uint16_t ZIP_BIT_FLAG_DATA_DESCRIPTOR = 0x0008;	
+	int Reseeder::ProcessSU3Stream (std::istream& s)
+	{
+		char magicNumber[7];
+		s.read (magicNumber, 7); // magic number and zero byte 6
+		if (strcmp (magicNumber, SU3_MAGIC_NUMBER))
+		{
+			LogPrint (eLogError, "Unexpected SU3 magic number");	
+			return 0;
+		}			
+		s.seekg (1, std::ios::cur); // su3 file format version
+		SigningKeyType signatureType;
+		s.read ((char *)&signatureType, 2);  // signature type
+		signatureType = be16toh (signatureType);
+		uint16_t signatureLength;
+		s.read ((char *)&signatureLength, 2);  // signature length
+		signatureLength = be16toh (signatureLength);
+		s.seekg (1, std::ios::cur); // unused
+		uint8_t versionLength;
+		s.read ((char *)&versionLength, 1);  // version length	
+		s.seekg (1, std::ios::cur); // unused
+		uint8_t signerIDLength;
+		s.read ((char *)&signerIDLength, 1);  // signer ID length	
+		uint64_t contentLength;
+		s.read ((char *)&contentLength, 8);  // content length	
+		contentLength = be64toh (contentLength);
+		s.seekg (1, std::ios::cur); // unused
+		uint8_t fileType;
+		s.read ((char *)&fileType, 1);  // file type	
+		if (fileType != 0x00) //  zip file
+		{
+			LogPrint (eLogError, "Can't handle file type ", (int)fileType);	
+			return 0;
+		}
+		s.seekg (1, std::ios::cur); // unused
+		uint8_t contentType;
+		s.read ((char *)&contentType, 1);  // content type	
+		if (contentType != 0x03) // reseed data
+		{
+			LogPrint (eLogError, "Unexpected content type ", (int)contentType);	
+			return 0;
+		}
+		s.seekg (12, std::ios::cur); // unused
+
+		s.seekg (versionLength, std::ios::cur); // skip version
+		char signerID[256];
+		s.read (signerID, signerIDLength); // signerID
+		signerID[signerIDLength] = 0;
+		
+		//try to verify signature
+		auto it = m_SigningKeys.find (signerID);
+		if (it != m_SigningKeys.end ())
+		{
+			// TODO: implement all signature types
+			if (signatureType == SIGNING_KEY_TYPE_RSA_SHA512_4096)
+			{
+				size_t pos = s.tellg ();
+				size_t tbsLen = pos + contentLength;
+				uint8_t * tbs = new uint8_t[tbsLen];
+				s.seekg (0, std::ios::beg);
+				s.read ((char *)tbs, tbsLen);
+				uint8_t * signature = new uint8_t[signatureLength];
+				s.read ((char *)signature, signatureLength);
+				// RSA-raw
+				i2p::crypto::RSASHA5124096RawVerifier verifier(it->second);
+				verifier.Update (tbs, tbsLen);
+				if (!verifier.Verify (signature))
+					LogPrint (eLogWarning, "SU3 signature verification failed");
+				delete[] signature;
+				delete[] tbs;
+				s.seekg (pos, std::ios::beg);
+			}
+			else
+				LogPrint (eLogWarning, "Signature type ", signatureType, " is not supported");
+		}
+		else
+			LogPrint (eLogWarning, "Certificate for ", signerID, " not loaded");
+		
+		// handle content
+		int numFiles = 0;
+		size_t contentPos = s.tellg ();
+		while (!s.eof ())
+		{	
+			uint32_t signature;
+			s.read ((char *)&signature, 4);
+			signature = le32toh (signature);
+			if (signature == ZIP_HEADER_SIGNATURE)
+			{
+				// next local file
+				s.seekg (2, std::ios::cur); // version
+				uint16_t bitFlag;
+				s.read ((char *)&bitFlag, 2);	
+				bitFlag = le16toh (bitFlag);
+				uint16_t compressionMethod;
+				s.read ((char *)&compressionMethod, 2);	
+				compressionMethod = le16toh (compressionMethod);
+				s.seekg (4, std::ios::cur); // skip fields we don't care about
+				uint32_t crc32, compressedSize, uncompressedSize; 
+				s.read ((char *)&crc32, 4);	
+				crc32 = le32toh (crc32);	
+				s.read ((char *)&compressedSize, 4);	
+				compressedSize = le32toh (compressedSize);	
+				s.read ((char *)&uncompressedSize, 4);
+				uncompressedSize = le32toh (uncompressedSize);	
+				uint16_t fileNameLength, extraFieldLength; 
+				s.read ((char *)&fileNameLength, 2);	
+				fileNameLength = le16toh (fileNameLength);
+				s.read ((char *)&extraFieldLength, 2);
+				extraFieldLength = le16toh (extraFieldLength);
+				char localFileName[255];
+				s.read (localFileName, fileNameLength);
+				localFileName[fileNameLength] = 0;
+				s.seekg (extraFieldLength, std::ios::cur);
+				// take care about data desriptor if presented
+				if (bitFlag & ZIP_BIT_FLAG_DATA_DESCRIPTOR)
+				{
+					size_t pos = s.tellg ();
+					if (!FindZipDataDescriptor (s))
+					{
+						LogPrint (eLogError, "SU3 archive data descriptor not found");
+						return numFiles;
+					}								
+	
+					s.read ((char *)&crc32, 4);	
+					crc32 = le32toh (crc32);
+					s.read ((char *)&compressedSize, 4);	
+					compressedSize = le32toh (compressedSize) + 4; // ??? we must consider signature as part of compressed data
+					s.read ((char *)&uncompressedSize, 4);
+					uncompressedSize = le32toh (uncompressedSize);	
+
+					// now we know compressed and uncompressed size
+					s.seekg (pos, std::ios::beg); // back to compressed data
+				}
+
+				LogPrint (eLogDebug, "Proccessing file ", localFileName, " ", compressedSize, " bytes");
+				if (!compressedSize)
+				{
+					LogPrint (eLogWarning, "Unexpected size 0. Skipped");
+					continue;
+				}	
+				
+				uint8_t * compressed = new uint8_t[compressedSize];
+				s.read ((char *)compressed, compressedSize);
+				if (compressionMethod) // we assume Deflate
+				{
+					CryptoPP::Inflator decompressor;
+					decompressor.Put (compressed, compressedSize);	
+					decompressor.MessageEnd();
+					if (decompressor.MaxRetrievable () <= uncompressedSize)
+					{
+						uint8_t * uncompressed = new uint8_t[uncompressedSize];	
+						decompressor.Get (uncompressed, uncompressedSize);	
+						if (CryptoPP::CRC32().VerifyDigest ((uint8_t *)&crc32, uncompressed, uncompressedSize))
+						{
+							i2p::data::netdb.AddRouterInfo (uncompressed, uncompressedSize);
+							numFiles++;
+						}
+						else
+							LogPrint (eLogError, "CRC32 verification failed");
+						delete[] uncompressed;
+					}
+					else
+						LogPrint (eLogError, "Actual uncompressed size ", decompressor.MaxRetrievable (), " exceed ", uncompressedSize, " from header");
+				}	
+				else // no compression
+				{
+					i2p::data::netdb.AddRouterInfo (compressed, compressedSize);
+					numFiles++;
+				}	
+				delete[] compressed;
+				if (bitFlag & ZIP_BIT_FLAG_DATA_DESCRIPTOR)
+					s.seekg (12, std::ios::cur); // skip data descriptor section if presented (12 = 16 - 4)
+			}
+			else
+			{
+				if (signature != ZIP_CENTRAL_DIRECTORY_HEADER_SIGNATURE)
+					LogPrint (eLogWarning, "Missing zip central directory header");
+				break; // no more files
+			}
+			size_t end = s.tellg ();
+			if (end - contentPos >= contentLength)
+				break; // we are beyond contentLength
+		}
+		return numFiles;
+	}
+
+	const uint8_t ZIP_DATA_DESCRIPTOR_SIGNATURE[] = { 0x50, 0x4B, 0x07, 0x08 };	
+	bool Reseeder::FindZipDataDescriptor (std::istream& s)
+	{
+		size_t nextInd = 0;	
+		while (!s.eof ())
+		{
+			uint8_t nextByte;
+			s.read ((char *)&nextByte, 1);
+			if (nextByte == ZIP_DATA_DESCRIPTOR_SIGNATURE[nextInd])	
+			{
+				nextInd++;
+				if (nextInd >= sizeof (ZIP_DATA_DESCRIPTOR_SIGNATURE))
+					return true;
+			}
+			else
+				nextInd = 0;
+		}
+		return false;
+	}
+
+	const char CERTIFICATE_HEADER[] = "-----BEGIN CERTIFICATE-----";
+	const char CERTIFICATE_FOOTER[] = "-----END CERTIFICATE-----";
+	void Reseeder::LoadCertificate (const std::string& filename)
+	{
+		std::ifstream s(filename, std::ifstream::binary);
+		if (s.is_open ())	
+		{
+			s.seekg (0, std::ios::end);
+			size_t len = s.tellg ();
+			s.seekg (0, std::ios::beg);
+			char buf[2048];
+			s.read (buf, len);
+			std::string cert (buf, len);
+			// assume file in pem format
+			auto pos1 = cert.find (CERTIFICATE_HEADER);	
+			auto pos2 = cert.find (CERTIFICATE_FOOTER);	
+			if (pos1 == std::string::npos || pos2 == std::string::npos)
+			{
+				LogPrint (eLogError, "Malformed certificate file");
+				return;
+			}	
+			pos1 += strlen (CERTIFICATE_HEADER);
+			pos2 -= pos1;
+			std::string base64 = cert.substr (pos1, pos2);
+
+			CryptoPP::ByteQueue queue;
+			CryptoPP::Base64Decoder decoder; // regular base64 rather than I2P 
+			decoder.Attach (new CryptoPP::Redirector (queue));
+			decoder.Put ((const uint8_t *)base64.data(), base64.length());
+			decoder.MessageEnd ();
+
+			// extract X.509
+			CryptoPP::BERSequenceDecoder x509Cert (queue);
+			CryptoPP::BERSequenceDecoder tbsCert (x509Cert);
+			// version
+			uint32_t ver;
+			CryptoPP::BERGeneralDecoder context (tbsCert, CryptoPP::CONTEXT_SPECIFIC | CryptoPP::CONSTRUCTED);
+			CryptoPP::BERDecodeUnsigned<uint32_t>(context, ver, CryptoPP::INTEGER);
+			// serial
+			CryptoPP::Integer serial;
+       		serial.BERDecode(tbsCert);	
+			// signature
+			CryptoPP::BERSequenceDecoder signature (tbsCert);
+       		signature.SkipAll();
+			
+			// issuer
+			std::string name;
+			CryptoPP::BERSequenceDecoder issuer (tbsCert);
+			{
+				CryptoPP::BERSetDecoder c (issuer);	c.SkipAll();
+				CryptoPP::BERSetDecoder st (issuer); st.SkipAll();
+				CryptoPP::BERSetDecoder l (issuer); l.SkipAll();
+				CryptoPP::BERSetDecoder o (issuer); o.SkipAll();
+				CryptoPP::BERSetDecoder ou (issuer); ou.SkipAll();
+				CryptoPP::BERSetDecoder cn (issuer);
+				{		
+					CryptoPP::BERSequenceDecoder attributes (cn);
+					{			
+						CryptoPP::BERGeneralDecoder ident(attributes, CryptoPP::OBJECT_IDENTIFIER);
+						ident.SkipAll ();
+						CryptoPP::BERDecodeTextString (attributes, name, CryptoPP::UTF8_STRING);
+					}	
+				}	
+			}	
+       		issuer.SkipAll();
+			// validity
+			CryptoPP::BERSequenceDecoder validity (tbsCert);
+       		validity.SkipAll();
+			// subject
+			CryptoPP::BERSequenceDecoder subject (tbsCert);
+       		subject.SkipAll();
+			// public key
+			CryptoPP::BERSequenceDecoder publicKey (tbsCert);
+			{			
+				CryptoPP::BERSequenceDecoder ident (publicKey);
+				ident.SkipAll ();
+				CryptoPP::BERGeneralDecoder key (publicKey, CryptoPP::BIT_STRING);
+				key.Skip (1); // FIXME: probably bug in crypto++
+				CryptoPP::BERSequenceDecoder keyPair (key);
+				CryptoPP::Integer n;
+       			n.BERDecode (keyPair);
+				if (name.length () > 0) 
+				{	
+					PublicKey value;
+					n.Encode (value, 512);
+					m_SigningKeys[name] = value;
+				}		
+				else
+					LogPrint (eLogWarning, "Unknown issuer. Skipped");
+			}	
+       		publicKey.SkipAll();
+			
+			tbsCert.SkipAll();
+			x509Cert.SkipAll();
+		}
+		else
+			LogPrint (eLogError, "Can't open certificate file ", filename);
+	}
+
+	void Reseeder::LoadCertificates ()
+	{
+		boost::filesystem::path reseedDir = i2p::util::filesystem::GetCertificatesDir() / "reseed";
+		
+		if (!boost::filesystem::exists (reseedDir))
+		{
+			LogPrint (eLogWarning, "Reseed certificates not loaded. ", reseedDir, " doesn't exist");
+			return;
+		}
+
+		int numCertificates = 0;
+		boost::filesystem::directory_iterator end; // empty
+		for (boost::filesystem::directory_iterator it (reseedDir); it != end; ++it)
+		{
+			if (boost::filesystem::is_regular_file (it->status()) && it->path ().extension () == ".crt")
+			{	
+				LoadCertificate (it->path ().string ());
+				numCertificates++;
+			}	
+		}	
+		LogPrint (eLogInfo, numCertificates, " certificates loaded");
+	}	
+	
+}
+}
+
--- a/Reseed.h
+++ b/Reseed.h
@ -0,0 +1,45 @@
+#ifndef RESEED_H
+#define RESEED_H
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <map>
+#include "Identity.h"
+
+namespace i2p
+{
+namespace data
+{
+
+	class Reseeder
+	{
+		typedef Tag<512> PublicKey;	
+		
+		public:
+		
+			Reseeder();
+			~Reseeder();
+			bool reseedNow(); // depreacted
+			int ReseedNowSU3 ();
+
+			void LoadCertificates ();
+		
+		private:
+
+			void LoadCertificate (const std::string& filename);
+			
+			int ReseedFromSU3 (const std::string& host);
+			int ProcessSU3File (const char * filename);	
+			int ProcessSU3Stream (std::istream& s);	
+
+			bool FindZipDataDescriptor (std::istream& s);
+
+		private:	
+
+			std::map<std::string, PublicKey> m_SigningKeys;
+	};
+}
+}
+
+#endif
--- a/RouterContext.cpp
+++ b/RouterContext.cpp
@ -0,0 +1,211 @@
+#include <fstream>
+#include <cryptopp/dh.h>
+#include <cryptopp/dsa.h>
+#include "CryptoConst.h"
+#include "RouterContext.h"
+#include "Timestamp.h"
+#include "I2NPProtocol.h"
+#include "util.h"
+#include "version.h"
+
+namespace i2p
+{
+	RouterContext context;
+
+	RouterContext::RouterContext ():
+		m_LastUpdateTime (0), m_IsUnreachable (false), m_AcceptsTunnels (true)
+	{
+	}
+
+	void RouterContext::Init ()
+	{
+		if (!Load ())
+			CreateNewRouter ();
+		UpdateRouterInfo ();
+	}
+
+	void RouterContext::CreateNewRouter ()
+	{
+		m_Keys = i2p::data::CreateRandomKeys ();
+		SaveKeys ();
+		NewRouterInfo ();
+	}
+
+	void RouterContext::NewRouterInfo ()
+	{
+		i2p::data::RouterInfo routerInfo;
+		routerInfo.SetRouterIdentity (GetIdentity ());
+		int port = i2p::util::config::GetArg("-port", 0);
+		if (!port)
+			port = m_Rnd.GenerateWord32 (9111, 30777); // I2P network ports range
+		routerInfo.AddSSUAddress (i2p::util::config::GetCharArg("-host", "127.0.0.1"), port, routerInfo.GetIdentHash ());
+		routerInfo.AddNTCPAddress (i2p::util::config::GetCharArg("-host", "127.0.0.1"), port);
+		routerInfo.SetCaps (i2p::data::RouterInfo::eReachable | 
+			i2p::data::RouterInfo::eSSUTesting | i2p::data::RouterInfo::eSSUIntroducer); // LR, BC
+		routerInfo.SetProperty ("coreVersion", I2P_VERSION);
+		routerInfo.SetProperty ("netId", "2");
+		routerInfo.SetProperty ("router.version", I2P_VERSION);
+		routerInfo.SetProperty ("stat_uptime", "90m");
+		routerInfo.CreateBuffer (m_Keys);
+		m_RouterInfo.Update (routerInfo.GetBuffer (), routerInfo.GetBufferLen ());
+	}
+
+	void RouterContext::UpdateRouterInfo ()
+	{
+		m_RouterInfo.CreateBuffer (m_Keys);
+		m_RouterInfo.SaveToFile (i2p::util::filesystem::GetFullPath (ROUTER_INFO));
+		m_LastUpdateTime = i2p::util::GetSecondsSinceEpoch ();
+	}	
+
+	void RouterContext::UpdatePort (int port)
+	{
+		bool updated = false;
+		for (auto& address : m_RouterInfo.GetAddresses ())
+		{
+			if (address.port != port)
+			{	
+				address.port = port;
+				updated = true;
+			}	
+		}	
+		if (updated)
+			UpdateRouterInfo ();
+	}
+
+	void RouterContext::UpdateAddress (const boost::asio::ip::address& host)
+	{
+		bool updated = false;
+		for (auto& address : m_RouterInfo.GetAddresses ())
+		{
+			if (address.host != host && address.IsCompatible (host))
+			{	
+				address.host = host;
+				updated = true;
+			}	
+		}	
+		auto ts = i2p::util::GetSecondsSinceEpoch ();
+		if (updated || ts > m_LastUpdateTime + ROUTER_INFO_UPDATE_INTERVAL)
+			UpdateRouterInfo ();
+	}
+
+	bool RouterContext::AddIntroducer (const i2p::data::RouterInfo& routerInfo, uint32_t tag)
+	{
+		bool ret = false;
+		auto address = routerInfo.GetSSUAddress ();
+		if (address)
+		{	
+			ret = m_RouterInfo.AddIntroducer (address, tag);
+			if (ret)
+				UpdateRouterInfo ();
+		}	
+		return ret;
+	}	
+
+	void RouterContext::RemoveIntroducer (const boost::asio::ip::udp::endpoint& e)
+	{
+		if (m_RouterInfo.RemoveIntroducer (e))
+			UpdateRouterInfo ();
+	}	
+	
+	void RouterContext::SetUnreachable ()
+	{
+		m_IsUnreachable = true;	
+		// set caps
+		m_RouterInfo.SetCaps (i2p::data::RouterInfo::eUnreachable | i2p::data::RouterInfo::eSSUTesting); // LU, B
+		// remove NTCP address
+		auto& addresses = m_RouterInfo.GetAddresses ();
+		for (size_t i = 0; i < addresses.size (); i++)
+		{
+			if (addresses[i].transportStyle == i2p::data::RouterInfo::eTransportNTCP)
+			{
+				addresses.erase (addresses.begin () + i);
+				break;
+			}
+		}	
+		// delete previous introducers
+		for (auto& addr : addresses)
+			addr.introducers.clear ();
+		
+		// update
+		UpdateRouterInfo ();
+	}
+
+	void RouterContext::SetSupportsV6 (bool supportsV6)
+	{
+		if (supportsV6)
+			m_RouterInfo.EnableV6 ();
+		else
+			m_RouterInfo.DisableV6 ();
+		UpdateRouterInfo ();
+	}	
+
+	void RouterContext::UpdateNTCPV6Address (const boost::asio::ip::address& host)
+	{
+		bool updated = false, found = false;	
+		int port = 0;
+		auto& addresses = m_RouterInfo.GetAddresses ();
+		for (auto& addr : addresses)
+		{
+			if (addr.host.is_v6 () && addr.transportStyle == i2p::data::RouterInfo::eTransportNTCP)
+			{
+				if (addr.host != host)
+				{
+					addr.host = host;
+					updated = true;
+				}
+				found = true;	
+			}	
+			else
+				port = addr.port;	
+		}	
+		if (!found)
+		{
+			// create new address
+			m_RouterInfo.AddNTCPAddress (host.to_string ().c_str (), port);
+			auto mtu = i2p::util::net::GetMTU (host);
+			if (mtu)
+			{	
+				LogPrint ("Our v6 MTU=", mtu);
+				if (mtu > 1472) mtu = 1472; 
+			}	
+			m_RouterInfo.AddSSUAddress (host.to_string ().c_str (), port, GetIdentHash (), mtu ? mtu : 1472); // TODO
+			updated = true;
+		}
+		if (updated)
+			UpdateRouterInfo ();
+	}
+		
+	bool RouterContext::Load ()
+	{
+		std::ifstream fk (i2p::util::filesystem::GetFullPath (ROUTER_KEYS).c_str (), std::ifstream::binary | std::ofstream::in);
+		if (!fk.is_open ())	return false;
+		
+		i2p::data::Keys keys;	
+		fk.read ((char *)&keys, sizeof (keys));
+		m_Keys = keys;
+
+		i2p::data::RouterInfo routerInfo(i2p::util::filesystem::GetFullPath (ROUTER_INFO)); // TODO
+		m_RouterInfo.Update (routerInfo.GetBuffer (), routerInfo.GetBufferLen ());
+		m_RouterInfo.SetProperty ("coreVersion", I2P_VERSION);
+		m_RouterInfo.SetProperty ("router.version", I2P_VERSION);
+		
+		return true;
+	}
+
+	void RouterContext::SaveKeys ()
+	{	
+		std::ofstream fk (i2p::util::filesystem::GetFullPath (ROUTER_KEYS).c_str (), std::ofstream::binary | std::ofstream::out);
+		i2p::data::Keys keys;
+		memcpy (keys.privateKey, m_Keys.GetPrivateKey (), sizeof (keys.privateKey));
+		memcpy (keys.signingPrivateKey, m_Keys.GetSigningPrivateKey (), sizeof (keys.signingPrivateKey));
+		auto& ident = GetIdentity ().GetStandardIdentity ();	
+		memcpy (keys.publicKey, ident.publicKey, sizeof (keys.publicKey));
+		memcpy (keys.signingKey, ident.signingKey, sizeof (keys.signingKey));
+		fk.write ((char *)&keys, sizeof (keys));	
+	}
+
+	void RouterContext::HandleI2NPMessage (const uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from)
+	{
+		i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from));
+	}	
+}
--- a/RouterContext.h
+++ b/RouterContext.h
@ -0,0 +1,77 @@
+#ifndef ROUTER_CONTEXT_H__
+#define ROUTER_CONTEXT_H__
+
+#include <inttypes.h>
+#include <string>
+#include <memory>
+#include <boost/asio.hpp>
+#include <cryptopp/dsa.h>
+#include <cryptopp/osrng.h>
+#include "Identity.h"
+#include "RouterInfo.h"
+#include "Garlic.h"
+
+namespace i2p
+{
+	const char ROUTER_INFO[] = "router.info";
+	const char ROUTER_KEYS[] = "router.keys";	
+	const int ROUTER_INFO_UPDATE_INTERVAL = 1800; // 30 minutes
+	
+	class RouterContext: public i2p::garlic::GarlicDestination 
+	{
+		public:
+
+			RouterContext ();
+			void Init ();
+
+			i2p::data::RouterInfo& GetRouterInfo () { return m_RouterInfo; };
+			std::shared_ptr<const i2p::data::RouterInfo> GetSharedRouterInfo () const 
+			{ 
+				return std::shared_ptr<const i2p::data::RouterInfo> (&m_RouterInfo, 
+					[](const i2p::data::RouterInfo *) {});
+			}
+			CryptoPP::RandomNumberGenerator& GetRandomNumberGenerator () { return m_Rnd; };	
+
+			void UpdatePort (int port); // called from Daemon
+			void UpdateAddress (const boost::asio::ip::address& host);	// called from SSU or Daemon
+			bool AddIntroducer (const i2p::data::RouterInfo& routerInfo, uint32_t tag);
+			void RemoveIntroducer (const boost::asio::ip::udp::endpoint& e);
+			bool IsUnreachable () const { return m_IsUnreachable; };
+			void SetUnreachable ();				
+			bool AcceptsTunnels () const { return m_AcceptsTunnels; };
+			void SetAcceptsTunnels (bool acceptsTunnels) { m_AcceptsTunnels = acceptsTunnels; };
+			bool SupportsV6 () const { return m_RouterInfo.IsV6 (); };
+			void SetSupportsV6 (bool supportsV6);
+			void UpdateNTCPV6Address (const boost::asio::ip::address& host); // called from NTCP session				
+
+			// implements LocalDestination
+			const i2p::data::PrivateKeys& GetPrivateKeys () const { return m_Keys; };
+			const uint8_t * GetEncryptionPrivateKey () const { return m_Keys.GetPrivateKey (); };
+			const uint8_t * GetEncryptionPublicKey () const { return GetIdentity ().GetStandardIdentity ().publicKey; };
+			void SetLeaseSetUpdated () {};
+
+			// implements GarlicDestination
+			const i2p::data::LeaseSet * GetLeaseSet () { return nullptr; };
+			void HandleI2NPMessage (const uint8_t * buf, size_t len, i2p::tunnel::InboundTunnel * from);
+			
+		private:
+
+			void CreateNewRouter ();
+			void NewRouterInfo ();
+			void UpdateRouterInfo ();
+			bool Load ();
+			void SaveKeys ();
+			
+		private:
+
+			i2p::data::RouterInfo m_RouterInfo;
+			i2p::data::PrivateKeys m_Keys; 
+			CryptoPP::AutoSeededRandomPool m_Rnd;
+			uint64_t m_LastUpdateTime;
+			bool m_IsUnreachable, m_AcceptsTunnels;
+	};
+
+	extern RouterContext context;
+}	
+
+#endif
--- a/RouterInfo.cpp
+++ b/RouterInfo.cpp
@ -0,0 +1,646 @@
+#include <stdio.h>
+#include <string.h>
+#include "I2PEndian.h"
+#include <fstream>
+#include <boost/lexical_cast.hpp>
+#include <cryptopp/sha.h>
+#include <cryptopp/dsa.h>
+#include "CryptoConst.h"
+#include "base64.h"
+#include "Timestamp.h"
+#include "Log.h"
+#include "RouterInfo.h"
+#include "RouterContext.h"
+
+
+namespace i2p
+{
+namespace data
+{		
+	RouterInfo::RouterInfo (const std::string& fullPath):
+		m_FullPath (fullPath), m_IsUpdated (false), m_IsUnreachable (false), 
+		m_SupportedTransports (0), m_Caps (0)
+	{
+		m_Buffer = new uint8_t[MAX_RI_BUFFER_SIZE];
+		ReadFromFile ();
+	}	
+
+	RouterInfo::RouterInfo (const uint8_t * buf, int len):
+		m_IsUpdated (true), m_IsUnreachable (false), m_SupportedTransports (0), m_Caps (0)
+	{
+		m_Buffer = new uint8_t[MAX_RI_BUFFER_SIZE];
+		memcpy (m_Buffer, buf, len);
+		m_BufferLen = len;
+		ReadFromBuffer (true);
+	}	
+
+	RouterInfo::~RouterInfo ()
+	{
+		delete m_Buffer;
+	}	
+		
+	void RouterInfo::Update (const uint8_t * buf, int len)
+	{
+		if (!m_Buffer)	
+			m_Buffer = new uint8_t[MAX_RI_BUFFER_SIZE];
+		m_IsUpdated = true;
+		m_IsUnreachable = false;
+		m_SupportedTransports = 0;
+		m_Caps = 0;
+		m_Addresses.clear ();
+		m_Properties.clear ();
+		memcpy (m_Buffer, buf, len);
+		m_BufferLen = len;
+		ReadFromBuffer (true);
+		// don't delete buffer until save to file
+	}	
+		
+	void RouterInfo::SetRouterIdentity (const IdentityEx& identity)
+	{	
+		m_RouterIdentity = identity;
+		m_Timestamp = i2p::util::GetMillisecondsSinceEpoch ();
+	}
+	
+	bool RouterInfo::LoadFile ()
+	{
+		std::ifstream s(m_FullPath.c_str (), std::ifstream::binary);
+		if (s.is_open ())	
+		{	
+			s.seekg (0,std::ios::end);
+			m_BufferLen = s.tellg ();
+			if (m_BufferLen < 40)
+			{
+				LogPrint(eLogError, "File", m_FullPath, " is malformed");
+				return false;
+			}
+			s.seekg(0, std::ios::beg);
+			if (!m_Buffer)
+				m_Buffer = new uint8_t[MAX_RI_BUFFER_SIZE];
+			s.read((char *)m_Buffer, m_BufferLen);
+		}	
+		else
+		{
+			LogPrint (eLogError, "Can't open file ", m_FullPath);
+			return false;		
+		}
+		return true;
+	}	
+
+	void RouterInfo::ReadFromFile ()
+	{
+		if (LoadFile ())
+			ReadFromBuffer (false); 
+	}	
+
+	void RouterInfo::ReadFromBuffer (bool verifySignature)
+	{
+		size_t identityLen = m_RouterIdentity.FromBuffer (m_Buffer, m_BufferLen);
+		std::stringstream str (std::string ((char *)m_Buffer + identityLen, m_BufferLen - identityLen));
+		ReadFromStream (str);
+		if (verifySignature)
+		{	
+			// verify signature
+			int l = m_BufferLen - m_RouterIdentity.GetSignatureLen ();
+			if (!m_RouterIdentity.Verify ((uint8_t *)m_Buffer, l, (uint8_t *)m_Buffer + l))
+			{	
+				LogPrint (eLogError, "signature verification failed");	
+				m_IsUnreachable = true;
+			}
+			m_RouterIdentity.DropVerifier ();
+		}	
+	}	
+	
+	void RouterInfo::ReadFromStream (std::istream& s)
+	{
+		s.read ((char *)&m_Timestamp, sizeof (m_Timestamp));
+		m_Timestamp = be64toh (m_Timestamp);
+		// read addresses
+		uint8_t numAddresses;
+		s.read ((char *)&numAddresses, sizeof (numAddresses));
+		bool introducers = false;
+		for (int i = 0; i < numAddresses; i++)
+		{
+			bool isValidAddress = true;
+			Address address;
+			s.read ((char *)&address.cost, sizeof (address.cost));
+			s.read ((char *)&address.date, sizeof (address.date));
+			char transportStyle[5];
+			ReadString (transportStyle, s);
+			if (!strcmp (transportStyle, "NTCP"))
+				address.transportStyle = eTransportNTCP;
+			else if (!strcmp (transportStyle, "SSU"))
+				address.transportStyle = eTransportSSU;
+			else
+				address.transportStyle = eTransportUnknown;
+			address.port = 0;
+			address.mtu = 0;
+			uint16_t size, r = 0;
+			s.read ((char *)&size, sizeof (size));
+			size = be16toh (size);
+			while (r < size)
+			{
+				char key[500], value[500];
+				r += ReadString (key, s);
+				s.seekg (1, std::ios_base::cur); r++; // =
+				r += ReadString (value, s); 
+				s.seekg (1, std::ios_base::cur); r++; // ;
+				if (!strcmp (key, "host"))
+				{	
+					boost::system::error_code ecode;
+					address.host = boost::asio::ip::address::from_string (value, ecode);
+					if (ecode)
+					{	
+						// TODO: we should try to resolve address here
+						LogPrint (eLogWarning, "Unexpected address ", value);
+						isValidAddress = false;
+					}	
+					else
+					{
+						// add supported protocol
+						if (address.host.is_v4 ())
+							m_SupportedTransports |= (address.transportStyle == eTransportNTCP) ? eNTCPV4 : eSSUV4;	
+						else
+							m_SupportedTransports |= (address.transportStyle == eTransportNTCP) ? eNTCPV6 : eSSUV6;
+ 					}	
+				}	
+				else if (!strcmp (key, "port"))
+					address.port = boost::lexical_cast<int>(value);
+				else if (!strcmp (key, "mtu"))
+					address.mtu = boost::lexical_cast<int>(value);
+				else if (!strcmp (key, "key"))
+					Base64ToByteStream (value, strlen (value), address.key, 32);
+				else if (!strcmp (key, "caps"))
+					ExtractCaps (value);
+				else if (key[0] == 'i')
+				{	
+					// introducers
+					introducers = true;
+					size_t l = strlen(key); 	
+					unsigned char index = key[l-1] - '0'; // TODO:
+					key[l-1] = 0;
+					if (index >= address.introducers.size ())
+						address.introducers.resize (index + 1); 
+					Introducer& introducer = address.introducers.at (index);
+					if (!strcmp (key, "ihost"))
+					{
+						boost::system::error_code ecode;
+						introducer.iHost = boost::asio::ip::address::from_string (value, ecode);
+					}	
+					else if (!strcmp (key, "iport"))
+						introducer.iPort = boost::lexical_cast<int>(value);
+					else if (!strcmp (key, "itag"))
+						introducer.iTag = boost::lexical_cast<uint32_t>(value);
+					else if (!strcmp (key, "ikey"))
+						Base64ToByteStream (value, strlen (value), introducer.iKey, 32);
+				}
+			}	
+			if (isValidAddress)
+				m_Addresses.push_back(address);
+		}	
+		// read peers
+		uint8_t numPeers;
+		s.read ((char *)&numPeers, sizeof (numPeers));
+		s.seekg (numPeers*32, std::ios_base::cur); // TODO: read peers
+		// read properties
+		uint16_t size, r = 0;
+		s.read ((char *)&size, sizeof (size));
+		size = be16toh (size);
+		while (r < size)
+		{
+#ifdef _WIN32			
+			char key[500], value[500];
+			// TODO: investigate why properties get read as one long string under Windows
+			// length should not be more than 44
+#else
+			char key[50], value[50];
+#endif			
+			r += ReadString (key, s);
+			s.seekg (1, std::ios_base::cur); r++; // =
+			r += ReadString (value, s); 
+			s.seekg (1, std::ios_base::cur); r++; // ;
+			m_Properties[key] = value;
+			
+			// extract caps	
+			if (!strcmp (key, "caps"))
+				ExtractCaps (value);
+		}		
+
+		if (!m_SupportedTransports || !m_Addresses.size() || (UsesIntroducer () && !introducers))
+			SetUnreachable (true);
+	}	
+
+	void RouterInfo::ExtractCaps (const char * value)
+	{
+		const char * cap = value;
+		while (*cap)
+		{
+			switch (*cap)
+			{
+				case CAPS_FLAG_FLOODFILL:
+					m_Caps |= Caps::eFloodfill;
+				break;
+				case CAPS_FLAG_HIGH_BANDWIDTH1:
+				case CAPS_FLAG_HIGH_BANDWIDTH2:
+				case CAPS_FLAG_HIGH_BANDWIDTH3:
+					m_Caps |= Caps::eHighBandwidth;
+				break;
+				case CAPS_FLAG_HIDDEN:
+					m_Caps |= Caps::eHidden;
+				break;	
+				case CAPS_FLAG_REACHABLE:
+					m_Caps |= Caps::eReachable;
+				break;
+				case CAPS_FLAG_UNREACHABLE:
+					m_Caps |= Caps::eUnreachable;
+				break;	
+				case CAPS_FLAG_SSU_TESTING:
+					m_Caps |= Caps::eSSUTesting;
+				break;	
+				case CAPS_FLAG_SSU_INTRODUCER:
+					m_Caps |= Caps::eSSUIntroducer;
+				break;	
+				default: ;
+			}	
+			cap++;
+		}
+	}
+
+	void RouterInfo::UpdateCapsProperty ()
+	{	
+		std::string caps;
+		caps += (m_Caps & eHighBandwidth) ? CAPS_FLAG_HIGH_BANDWIDTH1 : CAPS_FLAG_LOW_BANDWIDTH2; // bandwidth
+		if (m_Caps & eFloodfill) caps += CAPS_FLAG_FLOODFILL; // floodfill
+		if (m_Caps & eHidden) caps += CAPS_FLAG_HIDDEN; // hidden
+		if (m_Caps & eReachable) caps += CAPS_FLAG_REACHABLE; // reachable
+		if (m_Caps & eUnreachable) caps += CAPS_FLAG_UNREACHABLE; // unreachable
+
+		SetProperty ("caps", caps.c_str ());
+	}
+		
+	void RouterInfo::WriteToStream (std::ostream& s)
+	{
+		uint64_t ts = htobe64 (m_Timestamp);
+		s.write ((char *)&ts, sizeof (ts));
+
+		// addresses
+		uint8_t numAddresses = m_Addresses.size ();
+		s.write ((char *)&numAddresses, sizeof (numAddresses));
+		for (auto& address : m_Addresses)
+		{
+			s.write ((char *)&address.cost, sizeof (address.cost));
+			s.write ((char *)&address.date, sizeof (address.date));
+			std::stringstream properties;
+			if (address.transportStyle == eTransportNTCP)
+				WriteString ("NTCP", s);
+			else if (address.transportStyle == eTransportSSU)
+			{	
+				WriteString ("SSU", s);
+				// caps
+				WriteString ("caps", properties);
+				properties << '=';
+				std::string caps;
+				if (IsPeerTesting ()) caps += CAPS_FLAG_SSU_TESTING;
+				if (IsIntroducer ()) caps += CAPS_FLAG_SSU_INTRODUCER;
+				WriteString (caps, properties);
+				properties << ';';
+			}	
+			else
+				WriteString ("", s);
+
+			WriteString ("host", properties);
+			properties << '=';
+			WriteString (address.host.to_string (), properties);
+			properties << ';';
+			if (address.transportStyle == eTransportSSU)
+			{
+				// write introducers if any
+				if (address.introducers.size () > 0)
+				{	
+					int i = 0;
+					for (auto introducer: address.introducers)
+					{
+						WriteString ("ihost" + boost::lexical_cast<std::string>(i), properties);
+						properties << '=';
+						WriteString (introducer.iHost.to_string (), properties);
+						properties << ';';
+						i++;
+					}	
+					i = 0;
+					for (auto introducer: address.introducers)
+					{
+						WriteString ("ikey" + boost::lexical_cast<std::string>(i), properties);
+						properties << '=';
+						char value[64];
+						size_t l = ByteStreamToBase64 (introducer.iKey, 32, value, 64);
+						value[l] = 0;
+						WriteString (value, properties);
+						properties << ';';
+						i++;
+					}	
+					i = 0;
+					for (auto introducer: address.introducers)
+					{
+						WriteString ("iport" + boost::lexical_cast<std::string>(i), properties);
+						properties << '=';
+						WriteString (boost::lexical_cast<std::string>(introducer.iPort), properties);
+						properties << ';';
+						i++;
+					}	
+					i = 0;
+					for (auto introducer: address.introducers)
+					{
+						WriteString ("itag" + boost::lexical_cast<std::string>(i), properties);
+						properties << '=';
+						WriteString (boost::lexical_cast<std::string>(introducer.iTag), properties);
+						properties << ';';
+						i++;
+					}	
+				}	
+				// write intro key
+				WriteString ("key", properties);
+				properties << '=';
+				char value[64];
+				size_t l = ByteStreamToBase64 (address.key, 32, value, 64);
+				value[l] = 0;
+				WriteString (value, properties);
+				properties << ';';
+				// write mtu
+				if (address.mtu)
+				{
+					WriteString ("mtu", properties);
+					properties << '=';
+					WriteString (boost::lexical_cast<std::string>(address.mtu), properties);
+					properties << ';';
+				}	
+			}	
+			WriteString ("port", properties);
+			properties << '=';
+			WriteString (boost::lexical_cast<std::string>(address.port), properties);
+			properties << ';';
+			
+			uint16_t size = htobe16 (properties.str ().size ());
+			s.write ((char *)&size, sizeof (size));
+			s.write (properties.str ().c_str (), properties.str ().size ());
+		}	
+
+		// peers
+		uint8_t numPeers = 0;
+		s.write ((char *)&numPeers, sizeof (numPeers));
+
+		// properties
+		std::stringstream properties;
+		for (auto& p : m_Properties)
+		{
+			WriteString (p.first, properties);
+			properties << '=';
+			WriteString (p.second, properties);
+			properties << ';';
+		}	
+		uint16_t size = htobe16 (properties.str ().size ());
+		s.write ((char *)&size, sizeof (size));
+		s.write (properties.str ().c_str (), properties.str ().size ());
+	}	
+
+	const uint8_t * RouterInfo::LoadBuffer ()
+	{
+		if (!m_Buffer)
+		{
+			if (LoadFile ())
+				LogPrint ("Buffer for ", GetIdentHashAbbreviation (), " loaded from file");
+		} 
+		return m_Buffer; 
+	}
+
+	void RouterInfo::CreateBuffer (const PrivateKeys& privateKeys)
+	{
+		m_Timestamp = i2p::util::GetMillisecondsSinceEpoch (); // refresh timstamp
+		std::stringstream s;
+		uint8_t ident[1024];
+		auto identLen = privateKeys.GetPublic ().ToBuffer (ident, 1024);
+		s.write ((char *)ident, identLen);			
+		WriteToStream (s);
+		m_BufferLen = s.str ().size ();
+		if (!m_Buffer)
+			m_Buffer = new uint8_t[MAX_RI_BUFFER_SIZE];
+		memcpy (m_Buffer, s.str ().c_str (), m_BufferLen);
+		// signature
+		privateKeys.Sign ((uint8_t *)m_Buffer, m_BufferLen, (uint8_t *)m_Buffer + m_BufferLen);
+		m_BufferLen += privateKeys.GetPublic ().GetSignatureLen ();
+	}	
+
+	void RouterInfo::SaveToFile (const std::string& fullPath)
+	{
+		m_FullPath = fullPath;
+		if (m_Buffer)
+		{	
+			std::ofstream f (fullPath, std::ofstream::binary | std::ofstream::out);
+			f.write ((char *)m_Buffer, m_BufferLen);
+		}	
+		else
+			LogPrint (eLogError, "Can't save to file");
+	}
+	
+	size_t RouterInfo::ReadString (char * str, std::istream& s)
+	{
+		uint8_t len;
+		s.read ((char *)&len, 1);
+		s.read (str, len);
+		str[len] = 0;
+		return len+1;
+	}	
+
+	void RouterInfo::WriteString (const std::string& str, std::ostream& s)
+	{
+		uint8_t len = str.size ();
+		s.write ((char *)&len, 1);
+		s.write (str.c_str (), len);
+	}	
+
+	void RouterInfo::AddNTCPAddress (const char * host, int port)
+	{
+		Address addr;
+		addr.host = boost::asio::ip::address::from_string (host);
+		addr.port = port;
+		addr.transportStyle = eTransportNTCP;
+		addr.cost = 2;
+		addr.date = 0;
+		addr.mtu = 0;
+		m_Addresses.push_back(addr);	
+		m_SupportedTransports |= addr.host.is_v6 () ? eNTCPV6 : eNTCPV4;
+	}	
+
+	void RouterInfo::AddSSUAddress (const char * host, int port, const uint8_t * key, int mtu)
+	{
+		Address addr;
+		addr.host = boost::asio::ip::address::from_string (host);
+		addr.port = port;
+		addr.transportStyle = eTransportSSU;
+		addr.cost = 10; // NTCP should have priority over SSU
+		addr.date = 0;
+		addr.mtu = mtu; 
+		memcpy (addr.key, key, 32);
+		m_Addresses.push_back(addr);	
+		m_SupportedTransports |= addr.host.is_v6 () ? eNTCPV6 : eSSUV4;
+		m_Caps |= eSSUTesting; 
+		m_Caps |= eSSUIntroducer; 
+	}	
+
+	bool RouterInfo::AddIntroducer (const Address * address, uint32_t tag)
+	{
+		for (auto& addr : m_Addresses)
+		{
+			if (addr.transportStyle == eTransportSSU && addr.host.is_v4 ())
+			{	
+				for (auto intro: addr.introducers)
+					if (intro.iTag == tag) return false; // already presented
+				Introducer x;
+				x.iHost = address->host;
+				x.iPort = address->port;
+				x.iTag = tag;
+				memcpy (x.iKey, address->key, 32); // TODO: replace to Tag<32>
+				addr.introducers.push_back (x);
+				return true;
+			}	
+		}	
+		return false;
+	}	
+
+	bool RouterInfo::RemoveIntroducer (const boost::asio::ip::udp::endpoint& e)
+	{		
+		for (auto& addr : m_Addresses)
+		{
+			if (addr.transportStyle == eTransportSSU && addr.host.is_v4 ())
+			{	
+				for (std::vector<Introducer>::iterator it = addr.introducers.begin (); it != addr.introducers.end (); it++)
+					if ( boost::asio::ip::udp::endpoint (it->iHost, it->iPort) == e) 
+					{
+						addr.introducers.erase (it);
+						return true;
+					}	
+			}	
+		}	
+		return false;
+	}
+
+	void RouterInfo::SetCaps (uint8_t caps)
+	{
+		m_Caps = caps;
+		UpdateCapsProperty ();
+	}
+		
+	void RouterInfo::SetCaps (const char * caps)
+	{
+		SetProperty ("caps", caps);
+		m_Caps = 0;
+		ExtractCaps (caps);
+	}	
+		
+	void RouterInfo::SetProperty (const char * key, const char * value)
+	{
+		m_Properties[key] = value;
+	}	
+
+	const char * RouterInfo::GetProperty (const char * key) const
+	{
+		auto it = m_Properties.find (key);
+		if (it != m_Properties.end ())
+			return it->second.c_str ();
+		return 0;
+	}	
+
+	bool RouterInfo::IsFloodfill () const
+	{
+		return m_Caps & Caps::eFloodfill;
+	}	
+
+	bool RouterInfo::IsNTCP (bool v4only) const
+	{
+		if (v4only)
+			return m_SupportedTransports & eNTCPV4;
+		else
+			return m_SupportedTransports & (eNTCPV4 | eNTCPV6);
+	}		
+
+	bool RouterInfo::IsSSU (bool v4only) const
+	{
+		if (v4only)
+			return m_SupportedTransports & eSSUV4;
+		else
+			return m_SupportedTransports & (eSSUV4 | eSSUV6);
+	}
+
+	bool RouterInfo::IsV6 () const
+	{
+		return m_SupportedTransports & (eNTCPV6 | eSSUV6);
+	}
+
+	void RouterInfo::EnableV6 ()
+	{
+		if (!IsV6 ())
+			m_SupportedTransports |= eNTCPV6 | eSSUV6;
+	}
+		
+	void RouterInfo::DisableV6 ()
+	{		
+		if (IsV6 ())
+		{	
+			// NTCP
+			m_SupportedTransports &= ~eNTCPV6; 
+			for (size_t i = 0; i < m_Addresses.size (); i++)
+			{
+				if (m_Addresses[i].transportStyle == i2p::data::RouterInfo::eTransportNTCP &&
+					m_Addresses[i].host.is_v6 ())
+				{
+					m_Addresses.erase (m_Addresses.begin () + i);
+					break;
+				}
+			}	
+			
+			// SSU
+			m_SupportedTransports &= ~eSSUV6; 
+			for (size_t i = 0; i < m_Addresses.size (); i++)
+			{
+				if (m_Addresses[i].transportStyle == i2p::data::RouterInfo::eTransportSSU &&
+					m_Addresses[i].host.is_v6 ())
+				{
+					m_Addresses.erase (m_Addresses.begin () + i);
+					break;
+				}
+			}	
+		}	
+	}
+		
+	bool RouterInfo::UsesIntroducer () const
+	{
+		return m_Caps & Caps::eUnreachable; // non-reachable
+	}		
+		
+	const RouterInfo::Address * RouterInfo::GetNTCPAddress (bool v4only) const
+	{
+		return GetAddress (eTransportNTCP, v4only);
+	}	
+
+	const RouterInfo::Address * RouterInfo::GetSSUAddress (bool v4only) const 
+	{
+		return GetAddress (eTransportSSU, v4only);
+	}	
+
+	const RouterInfo::Address * RouterInfo::GetSSUV6Address () const 
+	{
+		return GetAddress (eTransportSSU, false, true);
+	}	
+		
+	const RouterInfo::Address * RouterInfo::GetAddress (TransportStyle s, bool v4only, bool v6only) const
+	{
+		for (auto& address : m_Addresses)
+		{
+			if (address.transportStyle == s)
+			{	
+				if ((!v4only || address.host.is_v4 ()) && (!v6only || address.host.is_v6 ()))
+					return &address;
+			}	
+		}	
+		return nullptr;
+	}	
+}
+}
--- a/RouterInfo.h
+++ b/RouterInfo.h
@ -0,0 +1,174 @@
+#ifndef ROUTER_INFO_H__
+#define ROUTER_INFO_H__
+
+#include <inttypes.h>
+#include <string>
+#include <map>
+#include <vector>
+#include <iostream>
+#include <boost/asio.hpp>
+#include "Identity.h"
+
+namespace i2p
+{
+namespace data
+{
+	const char CAPS_FLAG_FLOODFILL = 'f';
+	const char CAPS_FLAG_HIDDEN = 'H';
+	const char CAPS_FLAG_REACHABLE = 'R';
+	const char CAPS_FLAG_UNREACHABLE = 'U';	
+	const char CAPS_FLAG_LOW_BANDWIDTH1 = 'K';		
+	const char CAPS_FLAG_LOW_BANDWIDTH2 = 'L';	
+	const char CAPS_FLAG_HIGH_BANDWIDTH1 = 'M';	
+	const char CAPS_FLAG_HIGH_BANDWIDTH2 = 'N';
+	const char CAPS_FLAG_HIGH_BANDWIDTH3 = 'O';
+
+	const char CAPS_FLAG_SSU_TESTING = 'B';
+	const char CAPS_FLAG_SSU_INTRODUCER = 'C';
+
+	const int MAX_RI_BUFFER_SIZE = 2048;
+	class RouterInfo: public RoutingDestination
+	{
+		public:
+
+			enum SupportedTranports
+			{	
+				eNTCPV4 = 0x01,
+				eNTCPV6 = 0x02,
+				eSSUV4 = 0x04,
+				eSSUV6 = 0x08
+			};
+			
+			enum Caps
+			{
+				eFloodfill = 0x01,
+				eHighBandwidth = 0x02,
+				eReachable = 0x04,
+				eSSUTesting = 0x08,
+				eSSUIntroducer = 0x10,
+				eHidden = 0x20,
+				eUnreachable = 0x40
+			};
+
+			enum TransportStyle
+			{
+				eTransportUnknown = 0,
+				eTransportNTCP,
+				eTransportSSU
+			};
+
+			struct Introducer			
+			{
+				boost::asio::ip::address iHost;
+				int iPort;
+				Tag<32> iKey;
+				uint32_t iTag;
+			};
+
+			struct Address
+			{
+				TransportStyle transportStyle;
+				boost::asio::ip::address host;
+				int port, mtu;
+				uint64_t date;
+				uint8_t cost;
+				// SSU only
+				Tag<32> key; // intro key for SSU
+				std::vector<Introducer> introducers;
+
+				bool IsCompatible (const boost::asio::ip::address& other) const 
+				{
+					return (host.is_v4 () && other.is_v4 ()) ||
+						(host.is_v6 () && other.is_v6 ());
+				}	
+			};
+			
+			RouterInfo (const std::string& fullPath);
+			RouterInfo (): m_Buffer (nullptr) { };
+			RouterInfo (const RouterInfo& ) = default;
+			RouterInfo& operator=(const RouterInfo& ) = default;
+			RouterInfo (const uint8_t * buf, int len);
+			~RouterInfo ();
+			
+			const IdentityEx& GetRouterIdentity () const { return m_RouterIdentity; };
+			void SetRouterIdentity (const IdentityEx& identity);
+			std::string GetIdentHashBase64 () const { return GetIdentHash ().ToBase64 (); };
+			std::string GetIdentHashAbbreviation () const { return GetIdentHash ().ToBase64 ().substr (0, 4); };
+			uint64_t GetTimestamp () const { return m_Timestamp; };
+			std::vector<Address>& GetAddresses () { return m_Addresses; };
+			const Address * GetNTCPAddress (bool v4only = true) const;
+			const Address * GetSSUAddress (bool v4only = true) const;
+			const Address * GetSSUV6Address () const;
+			
+			void AddNTCPAddress (const char * host, int port);
+			void AddSSUAddress (const char * host, int port, const uint8_t * key, int mtu = 0);
+			bool AddIntroducer (const Address * address, uint32_t tag);
+			bool RemoveIntroducer (const boost::asio::ip::udp::endpoint& e);
+			void SetProperty (const char * key, const char * value);
+			const char * GetProperty (const char * key) const;
+			bool IsFloodfill () const;
+			bool IsNTCP (bool v4only = true) const;
+			bool IsSSU (bool v4only = true) const;
+			bool IsV6 () const;
+			void EnableV6 ();
+			void DisableV6 ();
+			bool IsCompatible (const RouterInfo& other) const { return m_SupportedTransports & other.m_SupportedTransports; };
+			bool UsesIntroducer () const;
+			bool IsIntroducer () const { return m_Caps & eSSUIntroducer; };
+			bool IsPeerTesting () const { return m_Caps & eSSUTesting; };
+			bool IsHidden () const { return m_Caps & eHidden; };
+
+			uint8_t GetCaps () const { return m_Caps; };	
+			void SetCaps (uint8_t caps);
+			void SetCaps (const char * caps);
+
+			void SetUnreachable (bool unreachable) { m_IsUnreachable = unreachable; }; 
+			bool IsUnreachable () const { return m_IsUnreachable; };
+
+			const uint8_t * GetBuffer () const { return m_Buffer; };
+			const uint8_t * LoadBuffer (); // load if necessary
+			int GetBufferLen () const { return m_BufferLen; };			
+			void CreateBuffer (const PrivateKeys& privateKeys);
+
+			bool IsUpdated () const { return m_IsUpdated; };
+			void SetUpdated (bool updated) { m_IsUpdated = updated; }; 
+			void SaveToFile (const std::string& fullPath);
+
+			void Update (const uint8_t * buf, int len);
+			void DeleteBuffer () { delete m_Buffer; m_Buffer = nullptr; };
+			
+			// implements RoutingDestination
+			const IdentHash& GetIdentHash () const { return m_RouterIdentity.GetIdentHash (); };
+			const uint8_t * GetEncryptionPublicKey () const { return m_RouterIdentity.GetStandardIdentity ().publicKey; };
+			bool IsDestination () const { return false; };
+
+			
+		private:
+
+			bool LoadFile ();
+			void ReadFromFile ();
+			void ReadFromStream (std::istream& s);
+			void ReadFromBuffer (bool verifySignature);
+			void WriteToStream (std::ostream& s);
+			size_t ReadString (char * str, std::istream& s);
+			void WriteString (const std::string& str, std::ostream& s);
+			void ExtractCaps (const char * value);
+			const Address * GetAddress (TransportStyle s, bool v4only, bool v6only = false) const;
+			void UpdateCapsProperty ();			
+
+		private:
+
+			std::string m_FullPath;
+			IdentityEx m_RouterIdentity;
+			uint8_t * m_Buffer;
+			int m_BufferLen;
+			uint64_t m_Timestamp;
+			std::vector<Address> m_Addresses;
+			std::map<std::string, std::string> m_Properties;
+			bool m_IsUpdated, m_IsUnreachable;
+			uint8_t m_SupportedTransports, m_Caps;
+	};	
+}	
+}
+
+#endif
--- a/SAM.cpp
+++ b/SAM.cpp
@ -0,0 +1,773 @@
+#include <string.h>
+#include <stdio.h>
+#ifdef _MSC_VER
+#include <stdlib.h>
+#endif
+#include <boost/lexical_cast.hpp>
+#include "base64.h"
+#include "Identity.h"
+#include "Log.h"
+#include "Destination.h"
+#include "ClientContext.h"
+#include "SAM.h"
+
+namespace i2p
+{
+namespace client
+{
+	SAMSocket::SAMSocket (SAMBridge& owner): 
+		m_Owner (owner), m_Socket (m_Owner.GetService ()), m_Timer (m_Owner.GetService ()),
+		m_SocketType (eSAMSocketTypeUnknown), m_IsSilent (false), m_Stream (nullptr),
+		m_Session (nullptr)
+	{
+	}
+
+	SAMSocket::~SAMSocket ()
+	{
+		Terminate ();
+	}	
+
+	void SAMSocket::CloseStream ()
+	{
+		if (m_Stream)
+		{	
+			m_Stream->Close ();
+			m_Stream.reset ();
+		}	
+	}	
+		
+	void SAMSocket::Terminate ()
+	{
+		CloseStream ();
+		
+		switch (m_SocketType)
+		{
+			case eSAMSocketTypeSession:
+				m_Owner.CloseSession (m_ID);
+			break;
+			case eSAMSocketTypeStream:
+			{
+				if (m_Session)
+					m_Session->sockets.remove (shared_from_this ());
+				break;
+			}
+			case eSAMSocketTypeAcceptor:
+			{
+				if (m_Session)
+				{
+					m_Session->sockets.remove (shared_from_this ());
+					m_Session->localDestination->StopAcceptingStreams ();
+				}
+				break;
+			}
+			default:
+				;
+		}
+		m_SocketType = eSAMSocketTypeTerminated;
+		m_Socket.close ();
+	}
+
+	void SAMSocket::ReceiveHandshake ()
+	{
+		m_Socket.async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),                
+			std::bind(&SAMSocket::HandleHandshakeReceived, shared_from_this (), 
+			std::placeholders::_1, std::placeholders::_2));
+	}
+
+	void SAMSocket::HandleHandshakeReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("SAM handshake read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{	
+			m_Buffer[bytes_transferred] = 0;
+			LogPrint ("SAM handshake ", m_Buffer);
+			char * separator = strchr (m_Buffer, ' ');
+			if (separator)
+			{
+				separator = strchr (separator + 1, ' ');	
+				if (separator) 
+					*separator = 0;
+			}
+
+			if (!strcmp (m_Buffer, SAM_HANDSHAKE))
+			{
+				std::string version("3.0");
+				// try to find MIN and MAX, 3.0 if not found
+				if (separator)
+				{
+					separator++;
+					std::map<std::string, std::string> params;
+					ExtractParams (separator, bytes_transferred - (separator - m_Buffer), params);
+					auto it = params.find (SAM_PARAM_MAX);
+					// TODO: check MIN as well
+					if (it != params.end ())
+						version = it->second;
+				}
+				if (version[0] == '3') // we support v3 (3.0 and 3.1) only
+				{
+#ifdef _MSC_VER
+					size_t l = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_HANDSHAKE_REPLY, version.c_str ());
+#else		
+					size_t l = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_HANDSHAKE_REPLY, version.c_str ());
+#endif
+					boost::asio::async_write (m_Socket, boost::asio::buffer (m_Buffer, l), boost::asio::transfer_all (),
+        				std::bind(&SAMSocket::HandleHandshakeReplySent, shared_from_this (), 
+						std::placeholders::_1, std::placeholders::_2));
+				}	
+				else
+					SendMessageReply (SAM_HANDSHAKE_I2P_ERROR, strlen (SAM_HANDSHAKE_I2P_ERROR), true);
+			}
+			else
+			{
+				LogPrint ("SAM handshake mismatch");
+				Terminate ();
+			}
+		}
+	}
+
+	void SAMSocket::HandleHandshakeReplySent (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("SAM handshake reply send error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			m_Socket.async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),                
+				std::bind(&SAMSocket::HandleMessage, shared_from_this (), 
+				std::placeholders::_1, std::placeholders::_2));	
+		}	
+	}
+
+	void SAMSocket::SendMessageReply (const char * msg, size_t len, bool close)
+	{
+		if (!m_IsSilent || m_SocketType == eSAMSocketTypeAcceptor) 
+			boost::asio::async_write (m_Socket, boost::asio::buffer (msg, len), boost::asio::transfer_all (),
+				std::bind(&SAMSocket::HandleMessageReplySent, shared_from_this (), 
+				std::placeholders::_1, std::placeholders::_2, close));
+		else
+		{
+			if (close)
+				Terminate ();
+			else
+				Receive ();	
+		}		
+	}
+
+	void SAMSocket::HandleMessageReplySent (const boost::system::error_code& ecode, std::size_t bytes_transferred, bool close)
+	{
+		if (ecode)
+        {
+			LogPrint ("SAM reply send error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			if (close)
+				Terminate ();
+			else
+				Receive ();	
+		}	
+	}
+
+	void SAMSocket::HandleMessage (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("SAM read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			m_Buffer[bytes_transferred] = 0;
+			char * eol = strchr (m_Buffer, '\n');
+			if (eol)
+			{
+				*eol = 0;
+				char * separator = strchr (m_Buffer, ' ');
+				if (separator)
+				{
+					separator = strchr (separator + 1, ' ');	
+					if (separator) 
+						*separator = 0;
+					else
+						separator = eol;
+
+					if (!strcmp (m_Buffer, SAM_SESSION_CREATE))
+						ProcessSessionCreate (separator + 1, bytes_transferred - (separator - m_Buffer) - 1);
+					else if (!strcmp (m_Buffer, SAM_STREAM_CONNECT))
+						ProcessStreamConnect (separator + 1, bytes_transferred - (separator - m_Buffer) - 1);
+					else if (!strcmp (m_Buffer, SAM_STREAM_ACCEPT))
+						ProcessStreamAccept (separator + 1, bytes_transferred - (separator - m_Buffer) - 1);
+					else if (!strcmp (m_Buffer, SAM_DEST_GENERATE))
+						ProcessDestGenerate ();
+					else if (!strcmp (m_Buffer, SAM_NAMING_LOOKUP))
+						ProcessNamingLookup (separator + 1, bytes_transferred - (separator - m_Buffer) - 1);
+					else		
+					{	
+						LogPrint ("SAM unexpected message ", m_Buffer);		
+						Terminate ();
+					}
+				}
+				else
+				{
+					LogPrint ("SAM malformed message ", m_Buffer);
+					Terminate ();
+				}
+			}
+			else
+			{	
+				LogPrint ("SAM malformed message ", m_Buffer);
+				Terminate ();
+			}
+		}
+	}
+
+	void SAMSocket::ProcessSessionCreate (char * buf, size_t len)
+	{
+		LogPrint ("SAM session create: ", buf);
+		std::map<std::string, std::string> params;
+		ExtractParams (buf, len, params);
+		std::string& style = params[SAM_PARAM_STYLE]; 
+		std::string& id = params[SAM_PARAM_ID];
+		std::string& destination = params[SAM_PARAM_DESTINATION];
+		m_ID = id; 
+		if (m_Owner.FindSession (id))
+		{
+			// session exists
+			SendMessageReply (SAM_SESSION_CREATE_DUPLICATED_ID, strlen(SAM_SESSION_CREATE_DUPLICATED_ID), true);
+			return;
+		}
+
+		// create destination	
+		m_Session = m_Owner.CreateSession (id, destination == SAM_VALUE_TRANSIENT ? "" : destination, &params); 
+		if (m_Session)
+		{
+			m_SocketType = eSAMSocketTypeSession;
+			if (m_Session->localDestination->IsReady ())
+			{
+				if (style == SAM_VALUE_DATAGRAM)
+				{
+					auto dest = m_Session->localDestination->CreateDatagramDestination ();
+					dest->SetReceiver (std::bind (&SAMSocket::HandleI2PDatagramReceive, shared_from_this (), 
+						std::placeholders::_1, std::placeholders::_2, std::placeholders::_3));
+				}
+				SendSessionCreateReplyOk ();
+			}
+			else
+			{
+				m_Timer.expires_from_now (boost::posix_time::seconds(SAM_SESSION_READINESS_CHECK_INTERVAL));
+				m_Timer.async_wait (std::bind (&SAMSocket::HandleSessionReadinessCheckTimer,
+					shared_from_this (), std::placeholders::_1));	
+			}
+		}
+		else
+			SendMessageReply (SAM_SESSION_CREATE_DUPLICATED_DEST, strlen(SAM_SESSION_CREATE_DUPLICATED_DEST), true);
+	}
+
+	void SAMSocket::HandleSessionReadinessCheckTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{
+			if (m_Session->localDestination->IsReady ())
+				SendSessionCreateReplyOk ();
+			else
+			{
+				m_Timer.expires_from_now (boost::posix_time::seconds(SAM_SESSION_READINESS_CHECK_INTERVAL));
+				m_Timer.async_wait (std::bind (&SAMSocket::HandleSessionReadinessCheckTimer,
+					shared_from_this (), std::placeholders::_1));
+			}	
+		}
+	}
+
+	void SAMSocket::SendSessionCreateReplyOk ()
+	{
+		uint8_t buf[1024];
+		char priv[1024];
+		size_t l = m_Session->localDestination->GetPrivateKeys ().ToBuffer (buf, 1024);
+		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, priv, 1024);
+		priv[l1] = 0;
+#ifdef _MSC_VER
+		size_t l2 = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
+#else		
+		size_t l2 = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
+#endif
+		SendMessageReply (m_Buffer, l2, false);
+	}
+
+	void SAMSocket::ProcessStreamConnect (char * buf, size_t len)
+	{
+		LogPrint ("SAM stream connect: ", buf);
+		std::map<std::string, std::string> params;
+		ExtractParams (buf, len, params);
+		std::string& id = params[SAM_PARAM_ID];
+		std::string& destination = params[SAM_PARAM_DESTINATION];
+		std::string& silent = params[SAM_PARAM_SILENT];
+		if (silent == SAM_VALUE_TRUE) m_IsSilent = true;	
+		m_ID = id;
+		m_Session = m_Owner.FindSession (id);
+		if (m_Session)
+		{
+			i2p::data::IdentityEx dest;
+			dest.FromBase64 (destination);
+			context.GetAddressBook ().InsertAddress (dest);
+			auto leaseSet = i2p::data::netdb.FindLeaseSet (dest.GetIdentHash ());
+			if (leaseSet)
+				Connect (*leaseSet);
+			else
+			{
+				m_Session->localDestination->RequestDestination (dest.GetIdentHash (), 
+					std::bind (&SAMSocket::HandleLeaseSetRequestComplete,
+					shared_from_this (), std::placeholders::_1, dest.GetIdentHash ()));	
+			}
+		}
+		else	
+			SendMessageReply (SAM_STREAM_STATUS_INVALID_ID, strlen(SAM_STREAM_STATUS_INVALID_ID), true);		
+	}
+
+	void SAMSocket::Connect (const i2p::data::LeaseSet& remote)
+	{
+		m_SocketType = eSAMSocketTypeStream;
+		m_Session->sockets.push_back (shared_from_this ());
+		m_Stream = m_Session->localDestination->CreateStream (remote);
+		m_Stream->Send ((uint8_t *)m_Buffer, 0); // connect
+		I2PReceive ();			
+		SendMessageReply (SAM_STREAM_STATUS_OK, strlen(SAM_STREAM_STATUS_OK), false);
+	}
+
+	void SAMSocket::HandleLeaseSetRequestComplete (bool success, i2p::data::IdentHash ident)
+	{
+		const i2p::data::LeaseSet * leaseSet =  nullptr;
+		if (success) // timeout expired
+			leaseSet = m_Session->localDestination->FindLeaseSet (ident);
+		if (leaseSet)
+			Connect (*leaseSet);
+		else
+		{
+			LogPrint ("SAM destination to connect not found");
+			SendMessageReply (SAM_STREAM_STATUS_CANT_REACH_PEER, strlen(SAM_STREAM_STATUS_CANT_REACH_PEER), true);
+		}
+	}
+
+	void SAMSocket::ProcessStreamAccept (char * buf, size_t len)
+	{
+		LogPrint ("SAM stream accept: ", buf);
+		std::map<std::string, std::string> params;
+		ExtractParams (buf, len, params);
+		std::string& id = params[SAM_PARAM_ID];
+		std::string& silent = params[SAM_PARAM_SILENT];
+		if (silent == SAM_VALUE_TRUE) m_IsSilent = true;	
+		m_ID = id;
+		m_Session = m_Owner.FindSession (id);
+		if (m_Session)
+		{
+			if (!m_Session->localDestination->IsAcceptingStreams ())
+			{
+				m_SocketType = eSAMSocketTypeAcceptor;
+				m_Session->sockets.push_back (shared_from_this ());
+				m_Session->localDestination->AcceptStreams (std::bind (&SAMSocket::HandleI2PAccept, shared_from_this (), std::placeholders::_1));
+				SendMessageReply (SAM_STREAM_STATUS_OK, strlen(SAM_STREAM_STATUS_OK), false);
+			}
+			else
+				SendMessageReply (SAM_STREAM_STATUS_I2P_ERROR, strlen(SAM_STREAM_STATUS_I2P_ERROR), true);
+		}	
+		else
+			SendMessageReply (SAM_STREAM_STATUS_INVALID_ID, strlen(SAM_STREAM_STATUS_INVALID_ID), true);
+	}
+
+	void SAMSocket::ProcessDestGenerate ()
+	{
+		LogPrint ("SAM dest generate");
+		auto localDestination = i2p::client::context.CreateNewLocalDestination ();
+		if (localDestination)
+		{
+			auto priv = localDestination->GetPrivateKeys ().ToBase64 ();
+			auto pub = localDestination->GetIdentity ().ToBase64 ();
+#ifdef _MSC_VER
+			size_t len = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_DEST_REPLY, pub.c_str (), priv.c_str ());	
+#else			                        
+			size_t len = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_DEST_REPLY, pub.c_str (), priv.c_str ());
+#endif
+			SendMessageReply (m_Buffer, len, true);
+		}
+		else
+			SendMessageReply (SAM_DEST_REPLY_I2P_ERROR, strlen(SAM_DEST_REPLY_I2P_ERROR), true);
+	}
+
+	void SAMSocket::ProcessNamingLookup (char * buf, size_t len)
+	{
+		LogPrint ("SAM naming lookup: ", buf);
+		std::map<std::string, std::string> params;
+		ExtractParams (buf, len, params);
+		std::string& name = params[SAM_PARAM_NAME];
+		i2p::data::IdentHash ident;
+		i2p::data::IdentityEx identity;
+		if (name == "ME")
+			SendNamingLookupReply (nullptr);
+		else if (context.GetAddressBook ().GetAddress (name, identity))
+			SendNamingLookupReply (identity);
+		else 
+		{
+#ifdef _MSC_VER
+			size_t len = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_NAMING_REPLY_INVALID_KEY, name.c_str());
+#else				
+			size_t len = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_NAMING_REPLY_INVALID_KEY, name.c_str());
+#endif
+			SendMessageReply (m_Buffer, len, false);
+		}
+	}	
+
+	void SAMSocket::SendNamingLookupReply (const i2p::data::LeaseSet * leaseSet)
+	{
+		const i2p::data::IdentityEx& identity = leaseSet ? leaseSet->GetIdentity () : m_Session->localDestination->GetIdentity ();
+		if (leaseSet)
+			// we found LeaseSet for our address, store it to addressbook
+			context.GetAddressBook ().InsertAddress (identity);
+		SendNamingLookupReply (identity);
+	}
+
+	void SAMSocket::SendNamingLookupReply (const i2p::data::IdentityEx& identity)
+	{
+		auto base64 = identity.ToBase64 ();
+#ifdef _MSC_VER
+		size_t l = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_NAMING_REPLY, base64.c_str ()); 	
+#else			
+		size_t l = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_NAMING_REPLY, base64.c_str ());
+#endif
+		SendMessageReply (m_Buffer, l, false);
+	}
+
+	void SAMSocket::ExtractParams (char * buf, size_t len, std::map<std::string, std::string>& params)
+	{
+		char * separator;	
+		do
+		{
+			separator = strchr (buf, ' ');
+			if (separator) *separator = 0;
+			char * value = strchr (buf, '=');
+			if (value)
+			{
+				*value = 0;
+				value++;
+				params[buf] = value;
+			}	
+			buf = separator + 1;
+		}
+		while (separator);
+	}	
+
+	void SAMSocket::Receive ()
+	{
+		m_Socket.async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),                
+			std::bind((m_SocketType == eSAMSocketTypeSession) ? &SAMSocket::HandleMessage : &SAMSocket::HandleReceived,
+			shared_from_this (), std::placeholders::_1, std::placeholders::_2));
+	}
+
+	void SAMSocket::HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+        {
+			LogPrint ("SAM read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			if (m_Stream)
+				m_Stream->Send ((uint8_t *)m_Buffer, bytes_transferred);
+			Receive ();
+		}
+	}
+
+	void SAMSocket::I2PReceive ()
+	{
+		if (m_Stream)
+			m_Stream->AsyncReceive (boost::asio::buffer (m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE),
+				std::bind (&SAMSocket::HandleI2PReceive, shared_from_this (),
+					std::placeholders::_1, std::placeholders::_2),
+				SAM_SOCKET_CONNECTION_MAX_IDLE);
+	}	
+
+	void SAMSocket::HandleI2PReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (ecode)
+		{
+			LogPrint ("SAM stream read error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+		{
+			boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, bytes_transferred),
+        		std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1));
+		}
+	}
+
+	void SAMSocket::HandleWriteI2PData (const boost::system::error_code& ecode)
+	{
+		if (ecode)
+		{
+			LogPrint ("SAM socket write error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+				Terminate ();
+		}
+		else
+			I2PReceive ();
+	}
+
+	void SAMSocket::HandleI2PAccept (std::shared_ptr<i2p::stream::Stream> stream)
+	{
+		if (stream)
+		{
+			LogPrint ("SAM incoming I2P connection for session ", m_ID);
+			m_Stream = stream;
+			context.GetAddressBook ().InsertAddress (stream->GetRemoteIdentity ());
+			auto session = m_Owner.FindSession (m_ID);
+			if (session)	
+				session->localDestination->StopAcceptingStreams ();	
+			if (!m_IsSilent)
+			{
+				// send remote peer address
+				uint8_t ident[1024];
+				size_t l = stream->GetRemoteIdentity ().ToBuffer (ident, 1024);
+				size_t l1 = i2p::data::ByteStreamToBase64 (ident, l, m_Buffer, SAM_SOCKET_BUFFER_SIZE);
+				m_Buffer[l1] = '\n';
+				SendMessageReply (m_Buffer, l1 + 1, false);
+			}	
+			I2PReceive ();
+		}
+	}	
+
+	void SAMSocket::HandleI2PDatagramReceive (const i2p::data::IdentityEx& ident, const uint8_t * buf, size_t len)
+	{
+		auto base64 = ident.ToBase64 ();
+#ifdef _MSC_VER
+		size_t l = sprintf_s ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), len); 	
+#else			
+		size_t l = snprintf ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), len); 	
+#endif
+		if (len < SAM_SOCKET_BUFFER_SIZE - l)	
+		{	
+			memcpy (m_StreamBuffer + l, buf, len);
+			boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, len + l),
+        		std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1));
+		}
+		else
+			LogPrint (eLogWarning, "Datagram size ", len," exceeds buffer");
+	}
+
+	SAMSession::SAMSession (ClientDestination * dest):
+		localDestination (dest)
+	{
+	}
+		
+	SAMSession::~SAMSession ()
+	{
+		for (auto it: sockets)
+			it->SetSocketType (eSAMSocketTypeTerminated);
+		i2p::client::context.DeleteLocalDestination (localDestination);
+	}
+
+	void SAMSession::CloseStreams ()
+	{
+		for (auto it: sockets)
+		{	
+			it->CloseStream ();
+			it->SetSocketType (eSAMSocketTypeTerminated);
+		}	
+		sockets.clear ();
+	}
+
+	SAMBridge::SAMBridge (int port):
+		m_IsRunning (false), m_Thread (nullptr),
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v4(), port)),
+		m_DatagramEndpoint (boost::asio::ip::udp::v4 (), port-1), m_DatagramSocket (m_Service, m_DatagramEndpoint)
+	{
+	}
+
+	SAMBridge::~SAMBridge ()
+	{
+		if (m_IsRunning)
+			Stop ();
+	}	
+
+	void SAMBridge::Start ()
+	{
+		Accept ();
+		ReceiveDatagram ();
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&SAMBridge::Run, this));
+	}
+
+	void SAMBridge::Stop ()
+	{
+		m_IsRunning = false;
+		m_Acceptor.cancel ();
+		for (auto it: m_Sessions)
+			delete it.second;
+		m_Sessions.clear ();
+		m_Service.stop ();
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = nullptr;
+		}	
+	}
+
+	void SAMBridge::Run () 
+	{ 
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_Service.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint ("SAM: ", ex.what ());
+			}	
+		}	
+	}
+
+	void SAMBridge::Accept ()
+	{
+		auto newSocket = std::make_shared<SAMSocket> (*this);
+		m_Acceptor.async_accept (newSocket->GetSocket (), std::bind (&SAMBridge::HandleAccept, this,
+			std::placeholders::_1, newSocket));
+	}
+
+	void SAMBridge::HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<SAMSocket> socket)
+	{
+		if (!ecode)
+		{
+			LogPrint ("New SAM connection from ", socket->GetSocket ().remote_endpoint ());
+			socket->ReceiveHandshake ();		
+		}
+		else
+			LogPrint ("SAM accept error: ",  ecode.message ());
+
+		if (ecode != boost::asio::error::operation_aborted)
+			Accept ();
+	}
+
+	SAMSession * SAMBridge::CreateSession (const std::string& id, const std::string& destination, 
+		const std::map<std::string, std::string> * params)
+	{
+		ClientDestination * localDestination = nullptr; 
+		if (destination != "")
+		{
+			i2p::data::PrivateKeys keys;
+			keys.FromBase64 (destination);
+			localDestination = i2p::client::context.CreateNewLocalDestination (keys, true, params);
+		}
+		else // transient
+		{
+			// extract signature type
+			i2p::data::SigningKeyType signatureType = i2p::data::SIGNING_KEY_TYPE_DSA_SHA1;
+			if (params)
+			{
+				auto it = params->find (SAM_PARAM_SIGNATURE_TYPE);
+				if (it != params->end ())
+					// TODO: extract string values	
+					signatureType = boost::lexical_cast<int> (it->second);
+			}
+			localDestination = i2p::client::context.CreateNewLocalDestination (false, signatureType, params); 
+		}
+		if (localDestination)
+		{
+			std::unique_lock<std::mutex> l(m_SessionsMutex);
+			auto ret = m_Sessions.insert (std::pair<std::string, SAMSession *>(id, new SAMSession (localDestination)));
+			if (!ret.second)
+				LogPrint ("Session ", id, " already exists");
+			return ret.first->second;
+		}
+		return nullptr;
+	}
+
+	void SAMBridge::CloseSession (const std::string& id)
+	{
+		std::unique_lock<std::mutex> l(m_SessionsMutex);
+		auto it = m_Sessions.find (id);
+		if (it != m_Sessions.end ())
+		{
+			auto session = it->second;
+			session->CloseStreams ();
+			m_Sessions.erase (it);
+			delete session;
+		}
+	}
+
+	SAMSession * SAMBridge::FindSession (const std::string& id)
+	{
+		std::unique_lock<std::mutex> l(m_SessionsMutex);
+		auto it = m_Sessions.find (id);
+		if (it != m_Sessions.end ())
+			return it->second;
+		return nullptr;
+	}
+
+	void SAMBridge::ReceiveDatagram ()
+	{
+		m_DatagramSocket.async_receive_from (
+			boost::asio::buffer (m_DatagramReceiveBuffer, i2p::datagram::MAX_DATAGRAM_SIZE), 
+			m_SenderEndpoint,
+			std::bind (&SAMBridge::HandleReceivedDatagram, this, std::placeholders::_1, std::placeholders::_2)); 
+	}
+
+	void SAMBridge::HandleReceivedDatagram (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (!ecode)
+		{
+			m_DatagramReceiveBuffer[bytes_transferred] = 0;
+			char * eol = strchr ((char *)m_DatagramReceiveBuffer, '\n');
+			*eol = 0; eol++;
+			size_t payloadLen = bytes_transferred - ((uint8_t *)eol - m_DatagramReceiveBuffer); 
+			LogPrint ("SAM datagram received ", m_DatagramReceiveBuffer," size=", payloadLen);
+			char * sessionID = strchr ((char *)m_DatagramReceiveBuffer, ' ');
+			if (sessionID)
+			{
+				sessionID++;
+				char * destination = strchr (sessionID, ' ');
+				if (destination)
+				{
+					*destination = 0; destination++;
+					auto session = FindSession (sessionID);
+					if (session)
+					{	
+						i2p::data::IdentityEx dest;
+						dest.FromBase64 (destination);
+						auto leaseSet = i2p::data::netdb.FindLeaseSet (dest.GetIdentHash ());
+						if (leaseSet)
+							session->localDestination->GetDatagramDestination ()->
+								SendDatagramTo ((uint8_t *)eol, payloadLen, *leaseSet);
+						else
+						{
+							LogPrint ("SAM datagram destination not found");
+							session->localDestination->RequestDestination (dest.GetIdentHash ());
+						}	
+					}	
+					else
+						LogPrint ("Session ", sessionID, " not found");
+				}
+				else
+					LogPrint ("Missing destination key");
+			}
+			else
+				LogPrint ("Missing sessionID");
+			ReceiveDatagram ();
+		}
+		else
+			LogPrint ("SAM datagram receive error: ", ecode.message ());
+	}
+}
+}
--- a/SAM.h
+++ b/SAM.h
@ -0,0 +1,181 @@
+#ifndef SAM_H__
+#define SAM_H__
+
+#include <inttypes.h>
+#include <string>
+#include <map>
+#include <list>
+#include <thread>
+#include <mutex>
+#include <memory>
+#include <boost/asio.hpp>
+#include "Identity.h"
+#include "LeaseSet.h"
+#include "Streaming.h"
+#include "Destination.h"
+
+namespace i2p
+{
+namespace client
+{
+	const size_t SAM_SOCKET_BUFFER_SIZE = 4096;
+	const int SAM_SOCKET_CONNECTION_MAX_IDLE = 3600; // in seconds
+	const int SAM_SESSION_READINESS_CHECK_INTERVAL = 20; // in seconds	
+	const char SAM_HANDSHAKE[] = "HELLO VERSION";
+	const char SAM_HANDSHAKE_REPLY[] = "HELLO REPLY RESULT=OK VERSION=%s\n";
+	const char SAM_HANDSHAKE_I2P_ERROR[] = "HELLO REPLY RESULT=I2P_ERROR\n";	
+	const char SAM_SESSION_CREATE[] = "SESSION CREATE";
+	const char SAM_SESSION_CREATE_REPLY_OK[] = "SESSION STATUS RESULT=OK DESTINATION=%s\n";
+	const char SAM_SESSION_CREATE_DUPLICATED_ID[] = "SESSION STATUS RESULT=DUPLICATED_ID\n";
+	const char SAM_SESSION_CREATE_DUPLICATED_DEST[] = "SESSION STATUS RESULT=DUPLICATED_DEST\n";	
+	const char SAM_STREAM_CONNECT[] = "STREAM CONNECT";
+	const char SAM_STREAM_STATUS_OK[] = "STREAM STATUS RESULT=OK\n";
+	const char SAM_STREAM_STATUS_INVALID_ID[] = "STREAM STATUS RESULT=INVALID_ID\n";
+	const char SAM_STREAM_STATUS_CANT_REACH_PEER[] = "STREAM STATUS RESULT=CANT_REACH_PEER\n";
+	const char SAM_STREAM_STATUS_I2P_ERROR[] = "STREAM STATUS RESULT=I2P_ERROR\n";
+	const char SAM_STREAM_ACCEPT[] = "STREAM ACCEPT";	
+	const char SAM_DEST_GENERATE[] = "DEST GENERATE";
+	const char SAM_DEST_REPLY[] = "DEST REPLY PUB=%s PRIV=%s\n";	
+	const char SAM_DEST_REPLY_I2P_ERROR[] = "DEST REPLY RESULT=I2P_ERROR\n";
+	const char SAM_NAMING_LOOKUP[] = "NAMING LOOKUP";
+	const char SAM_NAMING_REPLY[] = "NAMING REPLY RESULT=OK NAME=ME VALUE=%s\n";
+	const char SAM_DATAGRAM_RECEIVED[] = "DATAGRAM_RECEIVED DESTINATION=%s SIZE=%lu\n";	
+	const char SAM_NAMING_REPLY_INVALID_KEY[] = "NAMING REPLY RESULT=INVALID_KEY NAME=%s\n";
+	const char SAM_NAMING_REPLY_KEY_NOT_FOUND[] = "NAMING REPLY RESULT=INVALID_KEY_NOT_FOUND NAME=%s\n";
+	const char SAM_PARAM_MIN[] = "MIN";	
+	const char SAM_PARAM_MAX[] = "MAX";				
+	const char SAM_PARAM_STYLE[] = "STYLE";		
+	const char SAM_PARAM_ID[] = "ID";	
+	const char SAM_PARAM_SILENT[] = "SILENT";
+	const char SAM_PARAM_DESTINATION[] = "DESTINATION";	
+	const char SAM_PARAM_NAME[] = "NAME";
+	const char SAM_PARAM_SIGNATURE_TYPE[] = "SIGNATURE_TYPE";		
+	const char SAM_VALUE_TRANSIENT[] = "TRANSIENT";	
+	const char SAM_VALUE_STREAM[] = "STREAM";
+	const char SAM_VALUE_DATAGRAM[] = "DATAGRAM";
+	const char SAM_VALUE_RAW[] = "RAW";	
+	const char SAM_VALUE_TRUE[] = "true";	
+	const char SAM_VALUE_FALSE[] = "false";	
+
+	enum SAMSocketType
+	{
+		eSAMSocketTypeUnknown,
+		eSAMSocketTypeSession,
+		eSAMSocketTypeStream,
+		eSAMSocketTypeAcceptor,
+		eSAMSocketTypeTerminated
+	};
+
+	class SAMBridge;
+	struct SAMSession;
+	class SAMSocket: public std::enable_shared_from_this<SAMSocket>
+	{
+		public:
+
+			SAMSocket (SAMBridge& owner);
+			~SAMSocket ();			
+			void CloseStream (); // TODO: implement it better	
+
+			boost::asio::ip::tcp::socket& GetSocket () { return m_Socket; };
+			void ReceiveHandshake ();
+			void SetSocketType (SAMSocketType socketType) { m_SocketType = socketType; };
+
+		private:
+
+			void Terminate ();	
+			void HandleHandshakeReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleHandshakeReplySent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleMessage (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void SendMessageReply (const char * msg, size_t len, bool close);			
+			void HandleMessageReplySent (const boost::system::error_code& ecode, std::size_t bytes_transferred, bool close);
+			void Receive ();
+			void HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+
+			void I2PReceive ();	
+			void HandleI2PReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleI2PAccept (std::shared_ptr<i2p::stream::Stream> stream);
+			void HandleWriteI2PData (const boost::system::error_code& ecode);
+			void HandleI2PDatagramReceive (const i2p::data::IdentityEx& ident, const uint8_t * buf, size_t len);
+
+			void ProcessSessionCreate (char * buf, size_t len);
+			void ProcessStreamConnect (char * buf, size_t len);
+			void ProcessStreamAccept (char * buf, size_t len);
+			void ProcessDestGenerate ();
+			void ProcessNamingLookup (char * buf, size_t len);
+			void ExtractParams (char * buf, size_t len, std::map<std::string, std::string>& params);
+
+			void Connect (const i2p::data::LeaseSet& remote);
+			void HandleLeaseSetRequestComplete (bool success, i2p::data::IdentHash ident);
+			void SendNamingLookupReply (const i2p::data::LeaseSet * leaseSet);
+			void SendNamingLookupReply (const i2p::data::IdentityEx& identity);
+			void HandleSessionReadinessCheckTimer (const boost::system::error_code& ecode);
+			void SendSessionCreateReplyOk ();
+
+		private:
+
+			SAMBridge& m_Owner;
+			boost::asio::ip::tcp::socket m_Socket;
+			boost::asio::deadline_timer m_Timer;
+			char m_Buffer[SAM_SOCKET_BUFFER_SIZE + 1];
+			uint8_t m_StreamBuffer[SAM_SOCKET_BUFFER_SIZE];
+			SAMSocketType m_SocketType;
+			std::string m_ID; // nickname
+			bool m_IsSilent;
+			std::shared_ptr<i2p::stream::Stream> m_Stream;
+			SAMSession * m_Session;
+	};	
+
+	struct SAMSession
+	{
+		ClientDestination * localDestination;
+		std::list<std::shared_ptr<SAMSocket> > sockets;
+		
+		SAMSession (ClientDestination * localDestination);		
+		~SAMSession ();
+
+		void CloseStreams ();
+	};
+
+	class SAMBridge
+	{
+		public:
+
+			SAMBridge (int port);
+			~SAMBridge ();
+
+			void Start ();
+			void Stop ();
+			
+			boost::asio::io_service& GetService () { return m_Service; };
+			SAMSession * CreateSession (const std::string& id, const std::string& destination, // empty string  means transient
+				const std::map<std::string, std::string> * params);
+			void CloseSession (const std::string& id);
+			SAMSession * FindSession (const std::string& id);
+
+		private:
+
+			void Run ();
+
+			void Accept ();
+			void HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<SAMSocket> socket);
+
+			void ReceiveDatagram ();
+			void HandleReceivedDatagram (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+
+		private:
+
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			boost::asio::io_service m_Service;
+			boost::asio::ip::tcp::acceptor m_Acceptor;
+			boost::asio::ip::udp::endpoint m_DatagramEndpoint, m_SenderEndpoint;
+			boost::asio::ip::udp::socket m_DatagramSocket;
+			std::mutex m_SessionsMutex;
+			std::map<std::string, SAMSession *> m_Sessions;
+			uint8_t m_DatagramReceiveBuffer[i2p::datagram::MAX_DATAGRAM_SIZE+1];
+	};		
+}
+}
+
+#endif
+
--- a/SOCKS.cpp
+++ b/SOCKS.cpp
@ -0,0 +1,449 @@
+#include "SOCKS.h"
+#include "Identity.h"
+#include "NetDb.h"
+#include "Destination.h"
+#include "ClientContext.h"
+#include "I2PEndian.h"
+#include <cstring>
+#include <cassert>
+
+namespace i2p
+{
+namespace proxy
+{
+	void SOCKSHandler::AsyncSockRead()
+	{
+		LogPrint(eLogDebug,"--- SOCKS async sock read");
+		if(m_sock) {
+			m_sock->async_receive(boost::asio::buffer(m_sock_buff, socks_buffer_size),
+						std::bind(&SOCKSHandler::HandleSockRecv, this,
+								std::placeholders::_1, std::placeholders::_2));
+		} else {
+			LogPrint(eLogError,"--- SOCKS no socket for read");
+		}
+	}
+
+	void SOCKSHandler::Done() {
+		if (m_parent) m_parent->RemoveHandler (shared_from_this ());
+	}
+
+	void SOCKSHandler::Terminate() {
+		if (dead.exchange(true)) return;
+		if (m_sock) {
+			LogPrint(eLogDebug,"--- SOCKS close sock");
+			m_sock->close();
+			delete m_sock;
+			m_sock = nullptr;
+		}
+		if (m_stream) {
+			LogPrint(eLogDebug,"--- SOCKS close stream");
+			m_stream.reset ();
+		}
+		Done();
+	}
+
+	boost::asio::const_buffers_1 SOCKSHandler::GenerateSOCKS4Response(SOCKSHandler::errTypes error, uint32_t ip, uint16_t port)
+	{
+		assert(error >= SOCKS4_OK);
+		m_response[0] = '\x00'; //Version
+		m_response[1] = error; //Response code
+		htobe16buf(m_response+2,port); //Port
+		htobe32buf(m_response+4,ip); //IP
+		return boost::asio::const_buffers_1(m_response,8);
+	}
+
+	boost::asio::const_buffers_1 SOCKSHandler::GenerateSOCKS5Response(SOCKSHandler::errTypes error, SOCKSHandler::addrTypes type,
+								   const SOCKSHandler::address &addr, uint16_t port)
+	{
+		size_t size;
+		assert(error <= SOCKS5_ADDR_UNSUP);
+		m_response[0] = '\x05'; //Version
+		m_response[1] = error; //Response code
+		m_response[2] = '\x00'; //RSV
+		m_response[3] = type; //Address type
+		switch (type) {
+			case ADDR_IPV4:
+				size = 10;
+				htobe32buf(m_response+4,addr.ip);
+				break;
+			case ADDR_IPV6:
+				size = 22;
+				memcpy(m_response+4,addr.ipv6, 16);
+				break;
+			case ADDR_DNS:
+				size = 7+addr.dns.size;
+				m_response[4] = addr.dns.size;
+				memcpy(m_response+5,addr.dns.value, addr.dns.size);
+				break;
+		}
+		htobe16buf(m_response+size-2,port); //Port
+		return boost::asio::const_buffers_1(m_response,size);
+	}
+
+	bool SOCKSHandler::Socks5ChooseAuth()
+	{
+		m_response[0] = '\x05'; //Version
+		m_response[1] = m_authchosen; //Response code
+		boost::asio::const_buffers_1 response(m_response,2);
+		if (m_authchosen == AUTH_UNACCEPTABLE) {
+			LogPrint(eLogWarning,"--- SOCKS5 authentication negotiation failed");
+			boost::asio::async_write(*m_sock, response, std::bind(&SOCKSHandler::SentSocksFailed, this, std::placeholders::_1));
+			return false;
+		} else {
+			LogPrint(eLogDebug,"--- SOCKS5 choosing authentication method: ", m_authchosen);
+			boost::asio::async_write(*m_sock, response, std::bind(&SOCKSHandler::SentSocksResponse, this, std::placeholders::_1));
+			return true;
+		}
+	}
+
+	/* All hope is lost beyond this point */
+	void SOCKSHandler::SocksRequestFailed(SOCKSHandler::errTypes error)
+	{
+		boost::asio::const_buffers_1 response(nullptr,0);
+		assert(error != SOCKS4_OK && error != SOCKS5_OK);
+		switch (m_socksv) {
+			case SOCKS4:
+				LogPrint(eLogWarning,"--- SOCKS4 failed: ", error);
+				if (error < SOCKS4_OK) error = SOCKS4_FAIL; //Transparently map SOCKS5 errors
+				response = GenerateSOCKS4Response(error, m_4aip, m_port);
+				break;
+			case SOCKS5:
+				LogPrint(eLogWarning,"--- SOCKS5 failed: ", error);
+				response = GenerateSOCKS5Response(error, m_addrtype, m_address, m_port);
+				break;
+		}
+		boost::asio::async_write(*m_sock, response, std::bind(&SOCKSHandler::SentSocksFailed, this, std::placeholders::_1));
+	}
+
+	void SOCKSHandler::SocksRequestSuccess()
+	{
+		boost::asio::const_buffers_1 response(nullptr,0);
+		//TODO: this should depend on things like the command type and callbacks may change
+		switch (m_socksv) {
+			case SOCKS4:
+				LogPrint(eLogInfo,"--- SOCKS4 connection success");
+				response = GenerateSOCKS4Response(SOCKS4_OK, m_4aip, m_port);
+				break;
+			case SOCKS5:
+				LogPrint(eLogInfo,"--- SOCKS5 connection success");
+				auto s = i2p::client::context.GetAddressBook().ToAddress(m_parent->GetLocalDestination()->GetIdentHash());
+				address ad; ad.dns.FromString(s);
+				//HACK only 16 bits passed in port as SOCKS5 doesn't allow for more
+				response = GenerateSOCKS5Response(SOCKS5_OK, ADDR_DNS, ad, m_stream->GetRecvStreamID());
+				break;
+		}
+		boost::asio::async_write(*m_sock, response, std::bind(&SOCKSHandler::SentSocksDone, this, std::placeholders::_1));
+	}
+
+	void SOCKSHandler::EnterState(SOCKSHandler::state nstate, uint8_t parseleft) {
+		switch (nstate) {
+			case GET_PORT: parseleft = 2; break;
+			case GET_IPV4: m_addrtype = ADDR_IPV4; m_address.ip = 0; parseleft = 4; break;
+			case GET4_IDENT: m_4aip = m_address.ip; break;
+			case GET4A_HOST:
+			case GET5_HOST: m_addrtype = ADDR_DNS; m_address.dns.size = 0; break;
+			case GET5_IPV6: m_addrtype = ADDR_IPV6; parseleft = 16; break;
+			default:;
+		}
+		m_parseleft = parseleft;
+		m_state = nstate;
+	}
+
+	void SOCKSHandler::ValidateSOCKSRequest() {
+		if ( m_cmd != CMD_CONNECT ) {
+			//TODO: we need to support binds and other shit!
+			LogPrint(eLogError,"--- SOCKS unsupported command: ", m_cmd);
+			SocksRequestFailed(SOCKS5_CMD_UNSUP);
+			return;
+		}
+		//TODO: we may want to support other address types!
+		if ( m_addrtype != ADDR_DNS ) {
+			switch (m_socksv) {
+				case SOCKS5:
+					LogPrint(eLogError,"--- SOCKS5 unsupported address type: ", m_addrtype);
+					break;
+				case SOCKS4:
+					LogPrint(eLogError,"--- SOCKS4a rejected because it's actually SOCKS4");
+					break;
+			}
+			SocksRequestFailed(SOCKS5_ADDR_UNSUP);
+			return;
+		}
+		//TODO: we may want to support other domains
+		if(m_addrtype == ADDR_DNS && m_address.dns.ToString().find(".i2p") == std::string::npos) {
+			LogPrint(eLogError,"--- SOCKS invalid hostname: ", m_address.dns.ToString());
+			SocksRequestFailed(SOCKS5_ADDR_UNSUP);
+			return;
+		}
+	}
+
+	bool SOCKSHandler::HandleData(uint8_t *sock_buff, std::size_t len)
+	{
+		assert(len); // This should always be called with a least a byte left to parse
+		while (len > 0) {
+			switch (m_state) {
+				case GET_SOCKSV:
+					m_socksv = (SOCKSHandler::socksVersions) *sock_buff;
+					switch (*sock_buff) {
+						case SOCKS4:
+							EnterState(GET_COMMAND); //Initialize the parser at the right position
+							break;
+						case SOCKS5:
+							EnterState(GET5_AUTHNUM); //Initialize the parser at the right position
+							break;
+						default:
+							LogPrint(eLogError,"--- SOCKS rejected invalid version: ", ((int)*sock_buff));
+							Terminate();
+							return false;
+					}
+					break;
+				case GET5_AUTHNUM:
+					EnterState(GET5_AUTH, *sock_buff);
+					break;
+				case GET5_AUTH:
+					m_parseleft --;
+					if (*sock_buff == AUTH_NONE)
+						m_authchosen = AUTH_NONE;
+					if ( m_parseleft == 0 ) {
+						if (!Socks5ChooseAuth()) return false;
+						EnterState(GET5_REQUESTV);
+					}
+					break;
+				case GET_COMMAND:
+					switch (*sock_buff) {
+						case CMD_CONNECT:
+						case CMD_BIND:
+							break;
+						case CMD_UDP:
+							if (m_socksv == SOCKS5) break;
+						default:
+							LogPrint(eLogError,"--- SOCKS invalid command: ", ((int)*sock_buff));
+							SocksRequestFailed(SOCKS5_GEN_FAIL);
+							return false;
+					}
+					m_cmd = (SOCKSHandler::cmdTypes)*sock_buff;
+					switch (m_socksv) {
+						case SOCKS5: EnterState(GET5_GETRSV); break;
+						case SOCKS4: EnterState(GET_PORT); break;
+					}
+					break;
+				case GET_PORT:
+					m_port = (m_port << 8)|((uint16_t)*sock_buff);
+					m_parseleft--;
+					if (m_parseleft == 0) {
+						switch (m_socksv) {
+							case SOCKS5: EnterState(DONE); break;
+							case SOCKS4: EnterState(GET_IPV4); break;
+						}
+					}
+					break;
+				case GET_IPV4:
+					m_address.ip = (m_address.ip << 8)|((uint32_t)*sock_buff);
+					m_parseleft--;
+					if (m_parseleft == 0) {
+						switch (m_socksv) {
+							case SOCKS5: EnterState(GET_PORT); break;
+							case SOCKS4: EnterState(GET4_IDENT); m_4aip = m_address.ip; break;
+						}
+					}
+					break;
+				case GET4_IDENT:
+					if (!*sock_buff) {
+						if( m_4aip == 0 || m_4aip > 255 ) {
+							EnterState(DONE);
+						} else {
+							EnterState(GET4A_HOST);
+						}
+					}
+					break;
+				case GET4A_HOST:
+					if (!*sock_buff) {
+						EnterState(DONE);
+						break;
+					}
+					if (m_address.dns.size >= max_socks_hostname_size) {
+						LogPrint(eLogError,"--- SOCKS4a destination is too large");
+						SocksRequestFailed(SOCKS4_FAIL);
+						return false;
+					}
+					m_address.dns.push_back(*sock_buff);
+					break;
+				case GET5_REQUESTV:
+					if (*sock_buff != SOCKS5) {
+						LogPrint(eLogError,"--- SOCKS5 rejected unknown request version: ", ((int)*sock_buff));
+						SocksRequestFailed(SOCKS5_GEN_FAIL);
+						return false;
+					}
+					EnterState(GET_COMMAND);
+					break;
+				case GET5_GETRSV:
+					if ( *sock_buff != 0 ) {
+						LogPrint(eLogError,"--- SOCKS5 unknown reserved field: ", ((int)*sock_buff));
+						SocksRequestFailed(SOCKS5_GEN_FAIL);
+						return false;
+					}
+					EnterState(GET5_GETADDRTYPE);
+					break;
+				case GET5_GETADDRTYPE:
+					switch (*sock_buff) {
+						case ADDR_IPV4: EnterState(GET_IPV4); break;
+						case ADDR_IPV6: EnterState(GET5_IPV6); break;
+						case ADDR_DNS : EnterState(GET5_HOST_SIZE); break;
+						default:
+							LogPrint(eLogError,"--- SOCKS5 unknown address type: ", ((int)*sock_buff));
+							SocksRequestFailed(SOCKS5_GEN_FAIL);
+							return false;
+					}
+					break;
+				case GET5_IPV6:
+					m_address.ipv6[16-m_parseleft] = *sock_buff;
+					m_parseleft--;
+					if (m_parseleft == 0) EnterState(GET_PORT);
+					break;
+				case GET5_HOST_SIZE:
+					EnterState(GET5_HOST, *sock_buff);
+					break;
+				case GET5_HOST:
+					m_address.dns.push_back(*sock_buff);
+					m_parseleft--;
+					if (m_parseleft == 0) EnterState(GET_PORT);
+					break;
+				default:
+					LogPrint(eLogError,"--- SOCKS parse state?? ", m_state);
+					Terminate();
+					return false;
+			}
+			sock_buff++;
+			len--;
+			if (len && m_state == DONE) {
+				LogPrint(eLogError,"--- SOCKS rejected because we can't handle extra data");
+				SocksRequestFailed(SOCKS5_GEN_FAIL);
+				return false;
+			}
+		}
+		return true;
+	}
+
+	void SOCKSHandler::HandleSockRecv(const boost::system::error_code & ecode, std::size_t len)
+	{
+		LogPrint(eLogDebug,"--- SOCKS sock recv: ", len);
+		if(ecode) {
+			LogPrint(eLogWarning," --- SOCKS sock recv got error: ", ecode);
+                        Terminate();
+			return;
+		}
+
+		if (HandleData(m_sock_buff, len)) {
+			if (m_state == DONE) {
+				LogPrint(eLogInfo,"--- SOCKS requested ", m_address.dns.ToString(), ":" , m_port);
+				m_parent->GetLocalDestination ()->CreateStream (
+						std::bind (&SOCKSHandler::HandleStreamRequestComplete,
+						this, std::placeholders::_1), m_address.dns.ToString(), m_port);
+			} else {
+				AsyncSockRead();
+			}
+		}
+
+	}
+
+	void SOCKSHandler::SentSocksFailed(const boost::system::error_code & ecode)
+	{
+		if (!ecode) {
+			Terminate();
+		} else {
+			LogPrint (eLogError,"--- SOCKS Closing socket after sending failure because: ", ecode.message ());
+			Terminate();
+		}
+	}
+
+	void SOCKSHandler::SentSocksDone(const boost::system::error_code & ecode)
+	{
+		if (!ecode) {
+			if (dead.exchange(true)) return;
+			LogPrint (eLogInfo,"--- SOCKS New I2PTunnel connection");
+			auto connection = std::make_shared<i2p::client::I2PTunnelConnection>((i2p::client::I2PTunnel *)m_parent, m_sock, m_stream);
+			m_parent->AddConnection (connection);
+			connection->I2PConnect ();
+			Done();
+		}
+		else
+		{
+			LogPrint (eLogError,"--- SOCKS Closing socket after completion reply because: ", ecode.message ());
+			Terminate();
+		}
+	}
+
+	void SOCKSHandler::SentSocksResponse(const boost::system::error_code & ecode)
+	{
+		if (ecode) {
+			LogPrint (eLogError,"--- SOCKS Closing socket after sending reply because: ", ecode.message ());
+			Terminate();
+		}
+	}
+
+	void SOCKSHandler::HandleStreamRequestComplete (std::shared_ptr<i2p::stream::Stream> stream)
+	{
+		if (stream) {
+			m_stream = stream;
+			SocksRequestSuccess();
+		} else {
+			LogPrint (eLogError,"--- SOCKS Issue when creating the stream, check the previous warnings for more info.");
+			SocksRequestFailed(SOCKS5_HOST_UNREACH);
+		}
+	}
+
+	void SOCKSServer::Start ()
+	{
+		m_Acceptor.listen ();
+		Accept ();
+	}
+
+	void SOCKSServer::Stop ()
+	{
+		m_Acceptor.close();
+		m_Timer.cancel ();
+		ClearConnections ();
+		ClearHandlers();
+	}
+
+	void SOCKSServer::Accept ()
+	{
+		auto newSocket = new boost::asio::ip::tcp::socket (GetService ());
+		m_Acceptor.async_accept (*newSocket, std::bind (&SOCKSServer::HandleAccept, this,
+			std::placeholders::_1, newSocket));
+	}
+
+	void  SOCKSServer::AddHandler (std::shared_ptr<SOCKSHandler> handler) {
+		std::unique_lock<std::mutex> l(m_HandlersMutex);
+		m_Handlers.insert (handler);
+	}
+
+	void  SOCKSServer::RemoveHandler (std::shared_ptr<SOCKSHandler> handler)
+	{
+		std::unique_lock<std::mutex> l(m_HandlersMutex);
+		m_Handlers.erase (handler);
+	}
+
+	void  SOCKSServer::ClearHandlers ()
+	{
+		std::unique_lock<std::mutex> l(m_HandlersMutex);
+		m_Handlers.clear ();
+	}
+
+	void SOCKSServer::HandleAccept (const boost::system::error_code& ecode, boost::asio::ip::tcp::socket * socket)
+	{
+		if (!ecode)
+		{
+			LogPrint(eLogDebug,"--- SOCKS accepted");
+			AddHandler(std::make_shared<SOCKSHandler> (this, socket));
+			Accept();
+		}
+		else
+		{
+			LogPrint (eLogError,"--- SOCKS Closing socket on accept because: ", ecode.message ());
+			delete socket;
+		}
+	}
+
+}
+}
--- a/SOCKS.h
+++ b/SOCKS.h
@ -0,0 +1,169 @@
+#ifndef SOCKS_H__
+#define SOCKS_H__
+
+#include <memory>
+#include <string>
+#include <set>
+#include <boost/asio.hpp>
+#include <mutex>
+#include <atomic>
+#include "Identity.h"
+#include "Streaming.h"
+#include "I2PTunnel.h"
+
+namespace i2p
+{
+namespace proxy
+{
+
+	const size_t socks_buffer_size = 8192;
+	const size_t max_socks_hostname_size = 255; // Limit for socks5 and bad idea to traverse
+
+	struct SOCKSDnsAddress {
+		uint8_t size;
+		char value[max_socks_hostname_size];
+		void FromString (std::string str) {
+			size = str.length();
+			if (str.length() > max_socks_hostname_size) size = max_socks_hostname_size;
+			memcpy(value,str.c_str(),size);
+		}
+		std::string ToString() { return std::string(value, size); }
+		void push_back (char c) { value[size++] = c; }
+	};
+
+	class SOCKSServer;
+	class SOCKSHandler: public std::enable_shared_from_this<SOCKSHandler> {
+		private:
+			enum state {
+				GET_SOCKSV,
+				GET_COMMAND,
+				GET_PORT,
+				GET_IPV4,
+				GET4_IDENT,
+				GET4A_HOST,
+				GET5_AUTHNUM,
+				GET5_AUTH,
+				GET5_REQUESTV,
+				GET5_GETRSV,
+				GET5_GETADDRTYPE,
+				GET5_IPV6,
+				GET5_HOST_SIZE,
+				GET5_HOST,
+				DONE
+			};
+			enum authMethods {
+				AUTH_NONE = 0, //No authentication, skip to next step
+				AUTH_GSSAPI = 1, //GSSAPI authentication
+				AUTH_USERPASSWD = 2, //Username and password
+				AUTH_UNACCEPTABLE = 0xff //No acceptable method found
+			};
+			enum addrTypes {
+				ADDR_IPV4 = 1, //IPv4 address (4 octets)
+				ADDR_DNS = 3, // DNS name (up to 255 octets)
+				ADDR_IPV6 = 4 //IPV6 address (16 octets)
+			};
+			enum errTypes {
+				SOCKS5_OK = 0, // No error for SOCKS5
+				SOCKS5_GEN_FAIL = 1, // General server failure
+				SOCKS5_RULE_DENIED = 2, // Connection disallowed by ruleset
+				SOCKS5_NET_UNREACH = 3, // Network unreachable
+				SOCKS5_HOST_UNREACH = 4, // Host unreachable
+				SOCKS5_CONN_REFUSED = 5, // Connection refused by the peer
+				SOCKS5_TTL_EXPIRED = 6, // TTL Expired
+				SOCKS5_CMD_UNSUP = 7, // Command unsuported
+				SOCKS5_ADDR_UNSUP = 8, // Address type unsuported
+				SOCKS4_OK = 90, // No error for SOCKS4
+				SOCKS4_FAIL = 91, // Failed establishing connecting or not allowed
+				SOCKS4_IDENTD_MISSING = 92, // Couldn't connect to the identd server
+				SOCKS4_IDENTD_DIFFER = 93 // The ID reported by the application and by identd differ
+			};
+			enum cmdTypes {
+				CMD_CONNECT = 1, // TCP Connect
+				CMD_BIND = 2, // TCP Bind
+				CMD_UDP = 3 // UDP associate
+			};
+			enum socksVersions {
+				SOCKS4 = 4, // SOCKS4
+				SOCKS5 = 5 // SOCKS5
+			};
+			union address {
+				uint32_t ip;
+				SOCKSDnsAddress dns;
+				uint8_t ipv6[16];
+			};
+
+			void EnterState(state nstate, uint8_t parseleft = 1);
+			bool HandleData(uint8_t *sock_buff, std::size_t len);
+			void ValidateSOCKSRequest();
+			void HandleSockRecv(const boost::system::error_code & ecode, std::size_t bytes_transfered);
+			void Done();
+			void Terminate();
+			void AsyncSockRead();
+			boost::asio::const_buffers_1 GenerateSOCKS5SelectAuth(authMethods method);
+			boost::asio::const_buffers_1 GenerateSOCKS4Response(errTypes error, uint32_t ip, uint16_t port);
+			boost::asio::const_buffers_1 GenerateSOCKS5Response(errTypes error, addrTypes type, const address &addr, uint16_t port);
+			bool Socks5ChooseAuth();
+			void SocksRequestFailed(errTypes error);
+			void SocksRequestSuccess();
+			void SentSocksFailed(const boost::system::error_code & ecode);
+			void SentSocksDone(const boost::system::error_code & ecode);
+			void SentSocksResponse(const boost::system::error_code & ecode);
+			void HandleStreamRequestComplete (std::shared_ptr<i2p::stream::Stream> stream);
+
+			uint8_t m_sock_buff[socks_buffer_size];
+			SOCKSServer * m_parent;
+			boost::asio::ip::tcp::socket * m_sock;
+			std::shared_ptr<i2p::stream::Stream> m_stream;
+			uint8_t m_response[7+max_socks_hostname_size];
+			address m_address; //Address
+			uint32_t m_4aip; //Used in 4a requests
+			uint16_t m_port;
+			uint8_t m_command;
+			uint8_t m_parseleft; //Octets left to parse
+			authMethods m_authchosen; //Authentication chosen
+			addrTypes m_addrtype; //Address type chosen
+			socksVersions m_socksv; //Socks version
+			cmdTypes m_cmd; // Command requested
+			state m_state;
+			std::atomic<bool> dead; //To avoid cleaning up multiple times
+
+		public:
+			SOCKSHandler(SOCKSServer * parent, boost::asio::ip::tcp::socket * sock) : 
+				m_parent(parent), m_sock(sock), m_stream(nullptr),
+				m_authchosen(AUTH_UNACCEPTABLE), m_addrtype(ADDR_IPV4), dead(false)
+				{ m_address.ip = 0; AsyncSockRead(); EnterState(GET_SOCKSV); }
+			~SOCKSHandler() { Terminate(); }
+	};
+
+	class SOCKSServer: public i2p::client::I2PTunnel
+	{
+		private:
+			std::set<std::shared_ptr<SOCKSHandler> > m_Handlers;
+			boost::asio::ip::tcp::acceptor m_Acceptor;
+			boost::asio::deadline_timer m_Timer;
+			std::mutex m_HandlersMutex;
+
+		private:
+
+			void Accept();
+			void HandleAccept(const boost::system::error_code& ecode, boost::asio::ip::tcp::socket * socket);
+
+		public:
+			SOCKSServer(int port) : I2PTunnel(nullptr),
+				m_Acceptor (GetService (), boost::asio::ip::tcp::endpoint (boost::asio::ip::tcp::v4(), port)),
+				m_Timer (GetService ()) {};
+			~SOCKSServer() { Stop(); }
+
+			void Start ();
+			void Stop ();
+			void AddHandler (std::shared_ptr<SOCKSHandler> handler);
+			void RemoveHandler (std::shared_ptr<SOCKSHandler> handler);
+			void ClearHandlers ();
+	};
+
+	typedef SOCKSServer SOCKSProxy;
+}
+}
+
+
+#endif
--- a/SSU.cpp
+++ b/SSU.cpp
@ -0,0 +1,386 @@
+#include <string.h>
+#include <boost/bind.hpp>
+#include "Log.h"
+#include "Timestamp.h"
+#include "RouterContext.h"
+#include "SSU.h"
+
+namespace i2p
+{
+namespace transport
+{
+	SSUServer::SSUServer (int port): m_Thread (nullptr), m_ThreadV6 (nullptr), m_Work (m_Service), 
+		m_WorkV6 (m_ServiceV6),m_Endpoint (boost::asio::ip::udp::v4 (), port), 
+		m_EndpointV6 (boost::asio::ip::udp::v6 (), port), m_Socket (m_Service, m_Endpoint), 
+		m_SocketV6 (m_ServiceV6), m_IntroducersUpdateTimer (m_Service)	
+	{
+		m_Socket.set_option (boost::asio::socket_base::receive_buffer_size (65535));
+		m_Socket.set_option (boost::asio::socket_base::send_buffer_size (65535));
+		if (context.SupportsV6 ())
+		{
+			m_SocketV6.open (boost::asio::ip::udp::v6());
+			m_SocketV6.set_option (boost::asio::ip::v6_only (true));
+			m_SocketV6.set_option (boost::asio::socket_base::receive_buffer_size (65535));
+			m_SocketV6.set_option (boost::asio::socket_base::send_buffer_size (65535));
+			m_SocketV6.bind (m_EndpointV6);
+		}
+	}
+	
+	SSUServer::~SSUServer ()
+	{
+	}
+
+	void SSUServer::Start ()
+	{
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&SSUServer::Run, this));
+		m_Service.post (std::bind (&SSUServer::Receive, this));  
+		if (context.SupportsV6 ())
+		{	
+			m_ThreadV6 = new std::thread (std::bind (&SSUServer::RunV6, this));
+			m_ServiceV6.post (std::bind (&SSUServer::ReceiveV6, this));  
+		}	
+		if (i2p::context.IsUnreachable ())
+			ScheduleIntroducersUpdateTimer ();
+	}
+
+	void SSUServer::Stop ()
+	{
+		DeleteAllSessions ();
+		m_IsRunning = false;
+		m_Service.stop ();
+		m_Socket.close ();
+		m_ServiceV6.stop ();
+		m_SocketV6.close ();
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = nullptr;
+		}
+		if (m_ThreadV6)
+		{	
+			m_ThreadV6->join (); 
+			delete m_ThreadV6;
+			m_ThreadV6 = nullptr;
+		}
+	}
+
+	void SSUServer::Run () 
+	{ 
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_Service.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint (eLogError, "SSU server: ", ex.what ());
+			}	
+		}	
+	}
+
+	void SSUServer::RunV6 () 
+	{ 
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_ServiceV6.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint (eLogError, "SSU V6 server: ", ex.what ());
+			}	
+		}	
+	}	
+	
+	void SSUServer::AddRelay (uint32_t tag, const boost::asio::ip::udp::endpoint& relay)
+	{
+		m_Relays[tag] = relay;
+	}	
+
+	std::shared_ptr<SSUSession> SSUServer::FindRelaySession (uint32_t tag)
+	{
+		auto it = m_Relays.find (tag);
+		if (it != m_Relays.end ())
+			return FindSession (it->second);
+		return nullptr;
+	}
+
+	void SSUServer::Send (const uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& to)
+	{
+		if (to.protocol () == boost::asio::ip::udp::v4()) 
+			m_Socket.send_to (boost::asio::buffer (buf, len), to);
+		else
+			m_SocketV6.send_to (boost::asio::buffer (buf, len), to);
+	}	
+
+	void SSUServer::Receive ()
+	{
+		m_Socket.async_receive_from (boost::asio::buffer (m_ReceiveBuffer, SSU_MTU_V4), m_SenderEndpoint,
+			boost::bind (&SSUServer::HandleReceivedFrom, this, boost::asio::placeholders::error, boost::asio::placeholders::bytes_transferred)); 
+	}
+
+	void SSUServer::ReceiveV6 ()
+	{
+		m_SocketV6.async_receive_from (boost::asio::buffer (m_ReceiveBufferV6, SSU_MTU_V6), m_SenderEndpointV6,
+			boost::bind (&SSUServer::HandleReceivedFromV6, this, boost::asio::placeholders::error, boost::asio::placeholders::bytes_transferred)); 
+	}	
+
+	void SSUServer::HandleReceivedFrom (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (!ecode)
+		{
+			HandleReceivedBuffer (m_SenderEndpoint, m_ReceiveBuffer, bytes_transferred);
+			Receive ();
+		}
+		else
+			LogPrint ("SSU receive error: ", ecode.message ());
+	}
+
+	void SSUServer::HandleReceivedFromV6 (const boost::system::error_code& ecode, std::size_t bytes_transferred)
+	{
+		if (!ecode)
+		{
+			HandleReceivedBuffer (m_SenderEndpointV6, m_ReceiveBufferV6, bytes_transferred);
+			ReceiveV6 ();
+		}
+		else
+			LogPrint ("SSU V6 receive error: ", ecode.message ());
+	}
+
+	void SSUServer::HandleReceivedBuffer (boost::asio::ip::udp::endpoint& from, uint8_t * buf, std::size_t bytes_transferred)
+	{
+		std::shared_ptr<SSUSession> session;
+		auto it = m_Sessions.find (from);
+		if (it != m_Sessions.end ())
+			session = it->second;
+		if (!session)
+		{
+			session = std::make_shared<SSUSession> (*this, from);
+			session->WaitForConnect ();
+			m_Sessions[from] = session;
+			LogPrint ("New SSU session from ", from.address ().to_string (), ":", from.port (), " created");
+		}
+		session->ProcessNextMessage (buf, bytes_transferred, from);
+	}
+
+	std::shared_ptr<SSUSession> SSUServer::FindSession (std::shared_ptr<const i2p::data::RouterInfo> router) const
+	{
+		if (!router) return nullptr;
+		auto address = router->GetSSUAddress (true); // v4 only
+ 		if (!address) return nullptr;
+		auto session = FindSession (boost::asio::ip::udp::endpoint (address->host, address->port));
+		if (session || !context.SupportsV6 ())
+			return session;
+		// try v6
+		address = router->GetSSUV6Address (); 
+		if (!address) return nullptr;
+		return FindSession (boost::asio::ip::udp::endpoint (address->host, address->port));
+	}	
+
+	std::shared_ptr<SSUSession> SSUServer::FindSession (const boost::asio::ip::udp::endpoint& e) const
+	{
+		auto it = m_Sessions.find (e);
+		if (it != m_Sessions.end ())
+			return it->second;
+		else
+			return nullptr;
+	}
+		
+	std::shared_ptr<SSUSession> SSUServer::GetSession (std::shared_ptr<const i2p::data::RouterInfo> router, bool peerTest)
+	{
+		std::shared_ptr<SSUSession> session;
+		if (router)
+		{
+			auto address = router->GetSSUAddress (!context.SupportsV6 ());
+			if (address)
+			{
+				boost::asio::ip::udp::endpoint remoteEndpoint (address->host, address->port);
+				auto it = m_Sessions.find (remoteEndpoint);
+				if (it != m_Sessions.end ())
+					session = it->second;
+				else
+				{
+					// otherwise create new session					
+					session = std::make_shared<SSUSession> (*this, remoteEndpoint, router, peerTest);
+					m_Sessions[remoteEndpoint] = session;
+					
+					if (!router->UsesIntroducer ())
+					{
+						// connect directly						
+						LogPrint ("Creating new SSU session to [", router->GetIdentHashAbbreviation (), "] ",
+							remoteEndpoint.address ().to_string (), ":", remoteEndpoint.port ());
+						session->Connect ();
+					}
+					else
+					{
+						// connect through introducer
+						int numIntroducers = address->introducers.size ();
+						if (numIntroducers > 0)
+						{
+							std::shared_ptr<SSUSession> introducerSession;
+							const i2p::data::RouterInfo::Introducer * introducer = nullptr;
+							// we might have a session to introducer already
+							for (int i = 0; i < numIntroducers; i++)
+							{
+								introducer = &(address->introducers[i]);
+								it = m_Sessions.find (boost::asio::ip::udp::endpoint (introducer->iHost, introducer->iPort));
+								if (it != m_Sessions.end ())
+								{
+									introducerSession = it->second;
+									break; 
+								}	
+							}
+
+							if (introducerSession) // session found 
+								LogPrint ("Session to introducer already exists");
+							else // create new
+							{
+								LogPrint ("Creating new session to introducer");
+								introducer = &(address->introducers[0]); // TODO:
+								boost::asio::ip::udp::endpoint introducerEndpoint (introducer->iHost, introducer->iPort);
+								introducerSession = std::make_shared<SSUSession> (*this, introducerEndpoint, router);
+								m_Sessions[introducerEndpoint] = introducerSession;													
+							}	
+							// introduce
+							LogPrint ("Introduce new SSU session to [", router->GetIdentHashAbbreviation (), 
+									"] through introducer ", introducer->iHost, ":", introducer->iPort);
+							session->WaitForIntroduction ();	
+							if (i2p::context.GetRouterInfo ().UsesIntroducer ()) // if we are unreachable
+								Send (m_ReceiveBuffer, 0, remoteEndpoint); // send HolePunch
+							introducerSession->Introduce (introducer->iTag, introducer->iKey);
+						}
+						else
+						{	
+							LogPrint (eLogWarning, "Can't connect to unreachable router. No introducers presented");
+							m_Sessions.erase (remoteEndpoint);
+							session.reset ();
+						}	
+					}
+				}
+			}
+			else
+				LogPrint (eLogWarning, "Router ", router->GetIdentHashAbbreviation (), " doesn't have SSU address");
+		}
+		return session;
+	}
+
+	void SSUServer::DeleteSession (std::shared_ptr<SSUSession> session)
+	{
+		if (session)
+		{
+			session->Close ();
+			m_Sessions.erase (session->GetRemoteEndpoint ());
+		}	
+	}	
+
+	void SSUServer::DeleteAllSessions ()
+	{
+		for (auto it: m_Sessions)
+			it.second->Close ();
+		m_Sessions.clear ();
+	}
+
+	template<typename Filter>
+	std::shared_ptr<SSUSession> SSUServer::GetRandomSession (Filter filter)
+	{
+		std::vector<std::shared_ptr<SSUSession> > filteredSessions;
+		for (auto s :m_Sessions)
+			if (filter (s.second)) filteredSessions.push_back (s.second);
+		if (filteredSessions.size () > 0)
+		{
+			auto ind = i2p::context.GetRandomNumberGenerator ().GenerateWord32 (0, filteredSessions.size ()-1);
+			return filteredSessions[ind];
+		}
+		return nullptr;	
+	}
+
+	std::shared_ptr<SSUSession> SSUServer::GetRandomEstablishedSession (std::shared_ptr<const SSUSession> excluded)
+	{
+		return GetRandomSession (
+			[excluded](std::shared_ptr<SSUSession> session)->bool 
+			{ 
+				return session->GetState () == eSessionStateEstablished &&
+					session != excluded; 
+			}
+								);
+	}
+
+	std::set<SSUSession *> SSUServer::FindIntroducers (int maxNumIntroducers)
+	{
+		uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+		std::set<SSUSession *> ret;
+		for (int i = 0; i < maxNumIntroducers; i++)
+		{
+			auto session = GetRandomSession (
+				[&ret, ts](std::shared_ptr<SSUSession> session)->bool 
+				{ 
+					return session->GetRelayTag () && !ret.count (session.get ()) &&
+						session->GetState () == eSessionStateEstablished &&
+						ts < session->GetCreationTime () + SSU_TO_INTRODUCER_SESSION_DURATION; 
+				}
+											);	
+			if (session)
+			{
+				ret.insert (session.get ());
+				break;
+			}	
+		}
+		return ret;
+	}
+
+	void SSUServer::ScheduleIntroducersUpdateTimer ()
+	{
+		m_IntroducersUpdateTimer.expires_from_now (boost::posix_time::seconds(SSU_KEEP_ALIVE_INTERVAL));
+		m_IntroducersUpdateTimer.async_wait (std::bind (&SSUServer::HandleIntroducersUpdateTimer,
+			this, std::placeholders::_1));	
+	}
+
+	void SSUServer::HandleIntroducersUpdateTimer (const boost::system::error_code& ecode)
+	{
+		if (!ecode)
+		{
+			// timeout expired
+			std::list<boost::asio::ip::udp::endpoint> newList;
+			size_t numIntroducers = 0;
+			uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+			for (auto it :m_Introducers)
+			{	
+				auto session = FindSession (it);
+				if (session && ts < session->GetCreationTime () + SSU_TO_INTRODUCER_SESSION_DURATION)
+				{
+					session->SendKeepAlive ();
+					newList.push_back (it);
+					numIntroducers++;
+				}
+				else	
+					i2p::context.RemoveIntroducer (it);
+			}
+
+			if (numIntroducers < SSU_MAX_NUM_INTRODUCERS)
+			{
+				// create new
+				auto introducers = FindIntroducers (SSU_MAX_NUM_INTRODUCERS);
+				if (introducers.size () > 0)
+				{
+					for (auto it1: introducers)
+					{
+						auto router = it1->GetRemoteRouter ();
+						if (router && i2p::context.AddIntroducer (*router, it1->GetRelayTag ()))
+						{	
+							newList.push_back (it1->GetRemoteEndpoint ());
+							if (newList.size () >= SSU_MAX_NUM_INTRODUCERS) break;
+						}	
+					}	
+				}	
+			}	
+			m_Introducers = newList;
+			ScheduleIntroducersUpdateTimer ();
+		}	
+	}	
+}
+}
+
--- a/SSU.h
+++ b/SSU.h
@ -0,0 +1,88 @@
+#ifndef SSU_H__
+#define SSU_H__
+
+#include <inttypes.h>
+#include <string.h>
+#include <map>
+#include <list>
+#include <set>
+#include <thread>
+#include <boost/asio.hpp>
+#include "aes.h"
+#include "I2PEndian.h"
+#include "Identity.h"
+#include "RouterInfo.h"
+#include "I2NPProtocol.h"
+#include "SSUSession.h"
+
+namespace i2p
+{
+namespace transport
+{
+	const int SSU_KEEP_ALIVE_INTERVAL = 30; // 30 seconds	
+	const int SSU_TO_INTRODUCER_SESSION_DURATION = 3600; // 1 hour
+	const size_t SSU_MAX_NUM_INTRODUCERS = 3;
+	
+	class SSUServer
+	{
+		public:
+
+			SSUServer (int port);
+			~SSUServer ();
+			void Start ();
+			void Stop ();
+			std::shared_ptr<SSUSession> GetSession (std::shared_ptr<const i2p::data::RouterInfo> router, bool peerTest = false);
+			std::shared_ptr<SSUSession> FindSession (std::shared_ptr<const i2p::data::RouterInfo> router) const;
+			std::shared_ptr<SSUSession> FindSession (const boost::asio::ip::udp::endpoint& e) const;
+			std::shared_ptr<SSUSession> GetRandomEstablishedSession (std::shared_ptr<const SSUSession> excluded);
+			void DeleteSession (std::shared_ptr<SSUSession> session);
+			void DeleteAllSessions ();			
+
+			boost::asio::io_service& GetService () { return m_Socket.get_io_service(); };
+			const boost::asio::ip::udp::endpoint& GetEndpoint () const { return m_Endpoint; };			
+			void Send (const uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& to);
+			void AddRelay (uint32_t tag, const boost::asio::ip::udp::endpoint& relay);
+			std::shared_ptr<SSUSession> FindRelaySession (uint32_t tag);
+
+		private:
+
+			void Run ();
+			void RunV6 ();
+			void Receive ();
+			void ReceiveV6 ();
+			void HandleReceivedFrom (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleReceivedFromV6 (const boost::system::error_code& ecode, std::size_t bytes_transferred);
+			void HandleReceivedBuffer (boost::asio::ip::udp::endpoint& from, uint8_t * buf, std::size_t bytes_transferred);
+
+			template<typename Filter>
+			std::shared_ptr<SSUSession> GetRandomSession (Filter filter);
+			
+			std::set<SSUSession *> FindIntroducers (int maxNumIntroducers);	
+			void ScheduleIntroducersUpdateTimer ();
+			void HandleIntroducersUpdateTimer (const boost::system::error_code& ecode);
+			
+		private:
+
+			bool m_IsRunning;
+			std::thread * m_Thread, * m_ThreadV6;	
+			boost::asio::io_service m_Service, m_ServiceV6;
+			boost::asio::io_service::work m_Work, m_WorkV6;
+			boost::asio::ip::udp::endpoint m_Endpoint, m_EndpointV6;
+			boost::asio::ip::udp::socket m_Socket, m_SocketV6;
+			boost::asio::ip::udp::endpoint m_SenderEndpoint, m_SenderEndpointV6;
+			boost::asio::deadline_timer m_IntroducersUpdateTimer;
+			std::list<boost::asio::ip::udp::endpoint> m_Introducers; // introducers we are connected to
+			i2p::crypto::AESAlignedBuffer<2*SSU_MTU_V4> m_ReceiveBuffer;
+			i2p::crypto::AESAlignedBuffer<2*SSU_MTU_V6> m_ReceiveBufferV6; 
+			std::map<boost::asio::ip::udp::endpoint, std::shared_ptr<SSUSession> > m_Sessions;
+			std::map<uint32_t, boost::asio::ip::udp::endpoint> m_Relays; // we are introducer
+
+		public:
+			// for HTTP only
+			const decltype(m_Sessions)& GetSessions () const { return m_Sessions; };
+	};
+}
+}
+
+#endif
+
--- a/SSUData.cpp
+++ b/SSUData.cpp
@ -0,0 +1,430 @@
+#include <stdlib.h>
+#include <boost/bind.hpp>
+#include "Log.h"
+#include "Timestamp.h"
+#include "NetDb.h"
+#include "SSU.h"
+#include "SSUData.h"
+
+namespace i2p
+{
+namespace transport
+{
+	SSUData::SSUData (SSUSession& session):
+		m_Session (session), m_ResendTimer (session.m_Server.GetService ())
+	{
+		m_MaxPacketSize = session.IsV6 () ? SSU_V6_MAX_PACKET_SIZE : SSU_V4_MAX_PACKET_SIZE;
+		m_PacketSize = m_MaxPacketSize;
+		auto remoteRouter = session.GetRemoteRouter ();
+		if (remoteRouter)
+			AdjustPacketSize (*remoteRouter);
+	}
+
+	SSUData::~SSUData ()
+	{
+		for (auto it: m_IncomleteMessages)
+			if (it.second)
+			{
+				DeleteI2NPMessage (it.second->msg);
+				delete it.second;
+			}	
+		for (auto it: m_SentMessages)
+			delete it.second;
+	}
+
+	void SSUData::AdjustPacketSize (const i2p::data::RouterInfo& remoteRouter)
+	{
+		auto ssuAddress = remoteRouter.GetSSUAddress ();
+		if (ssuAddress && ssuAddress->mtu)
+		{
+			if (m_Session.IsV6 ())
+				m_PacketSize = ssuAddress->mtu - IPV6_HEADER_SIZE - UDP_HEADER_SIZE;
+			else
+				m_PacketSize = ssuAddress->mtu - IPV4_HEADER_SIZE - UDP_HEADER_SIZE;
+			if (m_PacketSize > 0)
+			{
+				// make sure packet size multiple of 16
+				m_PacketSize >>= 4;
+				m_PacketSize <<= 4;
+				if (m_PacketSize > m_MaxPacketSize) m_PacketSize = m_MaxPacketSize;
+				LogPrint ("MTU=", ssuAddress->mtu, " packet size=", m_PacketSize); 
+			}
+			else
+			{	
+				LogPrint (eLogWarning, "Unexpected MTU ", ssuAddress->mtu);
+				m_PacketSize = m_MaxPacketSize;
+			}	
+		}		
+	}
+
+	void SSUData::UpdatePacketSize (const i2p::data::IdentHash& remoteIdent)
+	{
+ 		auto routerInfo = i2p::data::netdb.FindRouter (remoteIdent);
+		if (routerInfo)
+			AdjustPacketSize (*routerInfo);
+	}
+
+	void SSUData::ProcessSentMessageAck (uint32_t msgID)
+	{
+		auto it = m_SentMessages.find (msgID);
+		if (it != m_SentMessages.end ())
+		{
+			delete it->second;
+			m_SentMessages.erase (it);	
+			if (m_SentMessages.empty ())
+				m_ResendTimer.cancel ();
+		}
+	}		
+
+	void SSUData::ProcessAcks (uint8_t *& buf, uint8_t flag)
+	{
+		if (flag & DATA_FLAG_EXPLICIT_ACKS_INCLUDED)
+		{
+			// explicit ACKs
+			uint8_t numAcks =*buf;
+			buf++;
+			for (int i = 0; i < numAcks; i++)
+				ProcessSentMessageAck (bufbe32toh (buf+i*4));
+			buf += numAcks*4;
+		}
+		if (flag & DATA_FLAG_ACK_BITFIELDS_INCLUDED)
+		{
+			// explicit ACK bitfields
+			uint8_t numBitfields =*buf;
+			buf++;
+			for (int i = 0; i < numBitfields; i++)
+			{
+				uint32_t msgID = bufbe32toh (buf);
+				buf += 4; // msgID
+				auto it = m_SentMessages.find (msgID);		
+				// process individual Ack bitfields
+				bool isNonLast = false;
+				int fragment = 0;
+				do
+				{
+					uint8_t bitfield = *buf;
+					isNonLast = bitfield & 0x80;
+					bitfield &= 0x7F; // clear MSB
+					if (bitfield && it != m_SentMessages.end ())
+					{	
+						int numSentFragments = it->second->fragments.size ();		
+						// process bits
+						uint8_t mask = 0x01;
+						for (int j = 0; j < 7; j++)
+						{			
+							if (bitfield & mask)
+							{
+								if (fragment < numSentFragments)
+								{
+									delete it->second->fragments[fragment];
+									it->second->fragments[fragment] = nullptr;
+								}	
+							}				
+							fragment++;
+							mask <<= 1;
+						}
+					}	
+					buf++;
+				}
+				while (isNonLast); 
+			}	
+		}		
+	}
+
+	void SSUData::ProcessFragments (uint8_t * buf)
+	{
+		uint8_t numFragments = *buf; // number of fragments
+		buf++;
+		for (int i = 0; i < numFragments; i++)
+		{	
+			uint32_t msgID = bufbe32toh (buf); // message ID
+			buf += 4;
+			uint8_t frag[4];
+			frag[0] = 0;
+			memcpy (frag + 1, buf, 3);
+			buf += 3;
+			uint32_t fragmentInfo = bufbe32toh (frag); // fragment info
+			uint16_t fragmentSize = fragmentInfo & 0x1FFF; // bits 0 - 13
+			bool isLast = fragmentInfo & 0x010000; // bit 16	
+			uint8_t fragmentNum = fragmentInfo >> 17; // bits 23 - 17
+			LogPrint (eLogDebug, "SSU data fragment ", (int)fragmentNum, " of message ", msgID, " size=", (int)fragmentSize, isLast ? " last" : " non-last"); 		
+			if (fragmentSize >= SSU_V4_MAX_PACKET_SIZE)
+			{
+				LogPrint (eLogError, "Fragment size ", fragmentSize, "exceeds max SSU packet size");
+				return;
+			}
+
+			//  find message with msgID
+			I2NPMessage * msg = nullptr;
+			IncompleteMessage * incompleteMessage = nullptr;
+			auto it = m_IncomleteMessages.find (msgID);
+			if (it != m_IncomleteMessages.end ()) 
+			{	
+				// message exists
+				incompleteMessage = it->second;
+				msg = incompleteMessage->msg;
+			}	
+			else
+			{
+				// create new message
+				msg = NewI2NPMessage ();
+				msg->len -= I2NP_SHORT_HEADER_SIZE;
+				incompleteMessage = new IncompleteMessage (msg);
+				m_IncomleteMessages[msgID] = incompleteMessage;
+			}	
+
+			// handle current fragment
+			if (fragmentNum == incompleteMessage->nextFragmentNum)
+			{
+				// expected fragment
+				memcpy (msg->buf + msg->len, buf, fragmentSize);
+				msg->len += fragmentSize;
+				incompleteMessage->nextFragmentNum++;
+				if (!isLast && !incompleteMessage->savedFragments.empty ())
+				{
+					// try saved fragments
+					for (auto it1 = incompleteMessage->savedFragments.begin (); it1 != incompleteMessage->savedFragments.end ();)
+					{
+						auto savedFragment = *it1;
+						if (savedFragment->fragmentNum == incompleteMessage->nextFragmentNum)
+						{
+							memcpy (msg->buf + msg->len, savedFragment->buf, savedFragment->len);
+							msg->len += savedFragment->len;
+							isLast = savedFragment->isLast;
+							incompleteMessage->nextFragmentNum++;
+							incompleteMessage->savedFragments.erase (it1++);
+							delete savedFragment;
+						}
+						else
+							break;
+					}
+					if (isLast)
+						LogPrint (eLogDebug, "Message ", msgID, " complete");
+				}	
+			}	
+			else
+			{	
+				if (fragmentNum < incompleteMessage->nextFragmentNum)
+					// duplicate fragment
+					LogPrint (eLogWarning, "Duplicate fragment ", (int)fragmentNum, " of message ", msgID, ". Ignored");	
+				else
+				{
+					// missing fragment
+					LogPrint (eLogWarning, "Missing fragments from ", (int)incompleteMessage->nextFragmentNum, " to ", fragmentNum - 1, " of message ", msgID);	
+					auto savedFragment = new Fragment (fragmentNum, buf, fragmentSize, isLast);
+					if (!incompleteMessage->savedFragments.insert (savedFragment).second)
+					{
+						LogPrint (eLogWarning, "Fragment ", (int)fragmentNum, " of message ", msgID, " already saved");
+						delete savedFragment;
+					}	
+				}
+				isLast = false;
+			}	
+
+			if (isLast)
+			{
+				// delete incomplete message
+				delete incompleteMessage;
+				m_IncomleteMessages.erase (msgID);				
+				// process message
+				SendMsgAck (msgID);
+				msg->FromSSU (msgID);
+				if (m_Session.GetState () == eSessionStateEstablished)
+				{
+					if (!m_ReceivedMessages.count (msgID))
+					{	
+						if (m_ReceivedMessages.size () > 100) m_ReceivedMessages.clear ();
+						m_ReceivedMessages.insert (msgID);
+						i2p::HandleI2NPMessage (msg);
+					}	
+					else
+					{
+						LogPrint (eLogWarning, "SSU message ", msgID, " already received");						
+						i2p::DeleteI2NPMessage (msg);
+					}	
+				}	
+				else
+				{
+					// we expect DeliveryStatus
+					if (msg->GetTypeID () == eI2NPDeliveryStatus)
+					{
+						LogPrint ("SSU session established");
+						m_Session.Established ();
+					}	
+					else
+						LogPrint (eLogError, "SSU unexpected message ", (int)msg->GetTypeID ());
+					DeleteI2NPMessage (msg);
+				}	
+			}	
+			else
+				SendFragmentAck (msgID, fragmentNum);			
+			buf += fragmentSize;
+		}	
+	}
+
+	void SSUData::ProcessMessage (uint8_t * buf, size_t len)
+	{
+		//uint8_t * start = buf;
+		uint8_t flag = *buf;
+		buf++;
+		LogPrint (eLogDebug, "Process SSU data flags=", (int)flag);
+		// process acks if presented
+		if (flag & (DATA_FLAG_ACK_BITFIELDS_INCLUDED | DATA_FLAG_EXPLICIT_ACKS_INCLUDED))
+			ProcessAcks (buf, flag);
+		// extended data if presented
+		if (flag & DATA_FLAG_EXTENDED_DATA_INCLUDED)
+		{
+			uint8_t extendedDataSize = *buf;
+			buf++; // size
+			LogPrint (eLogDebug, "SSU extended data of ", extendedDataSize, " bytes presented");
+			buf += extendedDataSize;
+		}
+		// process data
+		ProcessFragments (buf);
+	}
+
+	void SSUData::Send (i2p::I2NPMessage * msg)
+	{
+		uint32_t msgID = msg->ToSSU ();
+		if (m_SentMessages.count (msgID) > 0)
+		{
+			LogPrint (eLogWarning, "SSU message ", msgID, " already sent");
+			DeleteI2NPMessage (msg);
+			return;
+		}	
+		if (m_SentMessages.empty ()) // schedule resend at first message only
+			ScheduleResend ();
+		SentMessage * sentMessage = new SentMessage;
+		m_SentMessages[msgID] = sentMessage; 
+		sentMessage->nextResendTime = i2p::util::GetSecondsSinceEpoch () + RESEND_INTERVAL;
+		sentMessage->numResends = 0;
+		auto& fragments = sentMessage->fragments;
+		msgID = htobe32 (msgID);	
+		size_t payloadSize = m_PacketSize - sizeof (SSUHeader) - 9; // 9  =  flag + #frg(1) + messageID(4) + frag info (3) 
+		size_t len = msg->GetLength ();
+		uint8_t * msgBuf = msg->GetSSUHeader ();
+
+		uint32_t fragmentNum = 0;
+		while (len > 0)
+		{	
+			Fragment * fragment = new Fragment;
+			fragment->fragmentNum = fragmentNum;
+			uint8_t * buf = fragment->buf;
+			fragments.push_back (fragment);
+			uint8_t	* payload = buf + sizeof (SSUHeader);
+			*payload = DATA_FLAG_WANT_REPLY; // for compatibility
+			payload++;
+			*payload = 1; // always 1 message fragment per message
+			payload++;
+			*(uint32_t *)payload = msgID;
+			payload += 4;
+			bool isLast = (len <= payloadSize);
+			size_t size = isLast ? len : payloadSize;
+			uint32_t fragmentInfo = (fragmentNum << 17);
+			if (isLast)
+				fragmentInfo |= 0x010000;
+			
+			fragmentInfo |= size;
+			fragmentInfo = htobe32 (fragmentInfo);
+			memcpy (payload, (uint8_t *)(&fragmentInfo) + 1, 3);
+			payload += 3;
+			memcpy (payload, msgBuf, size);
+			
+			size += payload - buf;
+			if (size & 0x0F) // make sure 16 bytes boundary
+				size = ((size >> 4) + 1) << 4; // (/16 + 1)*16
+			fragment->len = size; 
+			
+			// encrypt message with session key
+			m_Session.FillHeaderAndEncrypt (PAYLOAD_TYPE_DATA, buf, size);
+			m_Session.Send (buf, size);
+
+			if (!isLast)
+			{	
+				len -= payloadSize;
+				msgBuf += payloadSize;
+			}	
+			else
+				len = 0;
+			fragmentNum++;
+		}	
+		DeleteI2NPMessage (msg);
+	}		
+
+	void SSUData::SendMsgAck (uint32_t msgID)
+	{
+		uint8_t buf[48 + 18]; // actual length is 44 = 37 + 7 but pad it to multiple of 16
+		uint8_t * payload = buf + sizeof (SSUHeader);
+		*payload = DATA_FLAG_EXPLICIT_ACKS_INCLUDED; // flag
+		payload++;
+		*payload = 1; // number of ACKs
+		payload++;
+		*(uint32_t *)(payload) = htobe32 (msgID); // msgID	
+		payload += 4;
+		*payload = 0; // number of fragments
+
+		// encrypt message with session key
+		m_Session.FillHeaderAndEncrypt (PAYLOAD_TYPE_DATA, buf, 48);
+		m_Session.Send (buf, 48);
+	}
+
+	void SSUData::SendFragmentAck (uint32_t msgID, int fragmentNum)
+	{
+		if (fragmentNum > 64)
+		{
+			LogPrint (eLogWarning, "Fragment number ", fragmentNum, " exceeds 64");
+			return;
+		}
+		uint8_t buf[64 + 18];
+		uint8_t * payload = buf + sizeof (SSUHeader);
+		*payload = DATA_FLAG_ACK_BITFIELDS_INCLUDED; // flag
+		payload++;	
+		*payload = 1; // number of ACK bitfields
+		payload++;
+		// one ack
+		*(uint32_t *)(payload) = htobe32 (msgID); // msgID	
+		payload += 4;
+		div_t d = div (fragmentNum, 7);
+		memset (payload, 0x80, d.quot); // 0x80 means non-last
+		payload += d.quot;		
+		*payload = 0x01 << d.rem; // set corresponding bit
+		payload++;
+		*payload = 0; // number of fragments
+
+		size_t len = d.quot < 4 ? 48 : 64; // 48 = 37 + 7 + 4 (3+1)			
+		// encrypt message with session key
+		m_Session.FillHeaderAndEncrypt (PAYLOAD_TYPE_DATA, buf, len);
+		m_Session.Send (buf, len);
+	}	
+
+	void SSUData::ScheduleResend()
+	{		
+		m_ResendTimer.cancel ();
+		m_ResendTimer.expires_from_now (boost::posix_time::seconds(RESEND_INTERVAL));
+		auto s = m_Session.shared_from_this();
+		m_ResendTimer.async_wait ([s](const boost::system::error_code& ecode)
+			{ s->m_Data.HandleResendTimer (ecode); });
+	}
+		
+	void SSUData::HandleResendTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{
+			uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+			for (auto it : m_SentMessages)
+			{
+				if (ts >= it.second->nextResendTime && it.second->numResends < MAX_NUM_RESENDS)
+				{	
+					for (auto f: it.second->fragments)
+						if (f) m_Session.Send (f->buf, f->len); // resend
+
+					it.second->numResends++;
+					it.second->nextResendTime += it.second->numResends*RESEND_INTERVAL;
+				}	
+			}
+			ScheduleResend ();	
+		}	
+	}	
+}
+}
+
--- a/SSUData.h
+++ b/SSUData.h
@ -0,0 +1,114 @@
+#ifndef SSU_DATA_H__
+#define SSU_DATA_H__
+
+#include <inttypes.h>
+#include <string.h>
+#include <map>
+#include <vector>
+#include <set>
+#include <boost/asio.hpp>
+#include "I2NPProtocol.h"
+#include "Identity.h"
+#include "RouterInfo.h"
+
+namespace i2p
+{
+namespace transport
+{
+
+	const size_t SSU_MTU_V4 = 1484;
+	const size_t SSU_MTU_V6 = 1472;
+	const size_t IPV4_HEADER_SIZE = 20;
+	const size_t IPV6_HEADER_SIZE = 40;	
+	const size_t UDP_HEADER_SIZE = 8;
+	const size_t SSU_V4_MAX_PACKET_SIZE = SSU_MTU_V4 - IPV4_HEADER_SIZE - UDP_HEADER_SIZE; // 1456
+	const size_t SSU_V6_MAX_PACKET_SIZE = SSU_MTU_V6 - IPV6_HEADER_SIZE - UDP_HEADER_SIZE; // 1424
+	const int RESEND_INTERVAL = 3; // in seconds
+	const int MAX_NUM_RESENDS = 5;
+	// data flags
+	const uint8_t DATA_FLAG_EXTENDED_DATA_INCLUDED = 0x02;
+	const uint8_t DATA_FLAG_WANT_REPLY = 0x04;
+	const uint8_t DATA_FLAG_REQUEST_PREVIOUS_ACKS = 0x08;
+	const uint8_t DATA_FLAG_EXPLICIT_CONGESTION_NOTIFICATION = 0x10;
+	const uint8_t DATA_FLAG_ACK_BITFIELDS_INCLUDED = 0x40;
+	const uint8_t DATA_FLAG_EXPLICIT_ACKS_INCLUDED = 0x80;	
+
+	struct Fragment
+	{
+		int fragmentNum;
+		size_t len;
+		bool isLast;
+		uint8_t buf[SSU_V4_MAX_PACKET_SIZE + 18]; // use biggest
+
+		Fragment () = default;
+		Fragment (int n, const uint8_t * b, int l, bool last): 
+			fragmentNum (n), len (l), isLast (last) { memcpy (buf, b, len); };		
+	};	
+
+	struct FragmentCmp
+	{
+		bool operator() (const Fragment * f1, const Fragment * f2) const
+  		{	
+			return f1->fragmentNum < f2->fragmentNum; 
+		};
+	};	
+	
+	struct IncompleteMessage
+	{
+		I2NPMessage * msg;
+		int nextFragmentNum;	
+		std::set<Fragment *, FragmentCmp> savedFragments;
+		
+		IncompleteMessage (I2NPMessage * m): msg (m), nextFragmentNum (0) {};
+		~IncompleteMessage () { for (auto it: savedFragments) { delete it; }; };
+	};
+
+	struct SentMessage
+	{
+		std::vector<Fragment *> fragments;
+		uint32_t nextResendTime; // in seconds
+		int numResends;
+
+		~SentMessage () { for (auto it: fragments) { delete it; }; };
+	};	
+	
+	class SSUSession;
+	class SSUData
+	{
+		public:
+
+			SSUData (SSUSession& session);
+			~SSUData ();
+
+			void ProcessMessage (uint8_t * buf, size_t len);
+			void Send (i2p::I2NPMessage * msg);
+
+			void UpdatePacketSize (const i2p::data::IdentHash& remoteIdent);
+
+		private:
+
+			void SendMsgAck (uint32_t msgID);
+			void SendFragmentAck (uint32_t msgID, int fragmentNum);
+			void ProcessAcks (uint8_t *& buf, uint8_t flag);
+			void ProcessFragments (uint8_t * buf);
+			void ProcessSentMessageAck (uint32_t msgID);	
+
+			void ScheduleResend ();
+			void HandleResendTimer (const boost::system::error_code& ecode);	
+			
+			void AdjustPacketSize (const i2p::data::RouterInfo& remoteRouter);	
+			
+		private:	
+
+			SSUSession& m_Session;
+			std::map<uint32_t, IncompleteMessage *> m_IncomleteMessages;
+			std::map<uint32_t, SentMessage *> m_SentMessages;
+			std::set<uint32_t> m_ReceivedMessages;
+			boost::asio::deadline_timer m_ResendTimer;
+			int m_MaxPacketSize, m_PacketSize;
+	};	
+}
+}
+
+#endif
+
--- a/SSUSession.cpp
+++ b/SSUSession.cpp
--- a/SSUSession.h
+++ b/SSUSession.h
@ -0,0 +1,146 @@
+#ifndef SSU_SESSION_H__
+#define SSU_SESSION_H__
+
+#include <inttypes.h>
+#include <set>
+#include <list>
+#include <memory>
+#include "aes.h"
+#include "hmac.h"
+#include "I2NPProtocol.h"
+#include "TransportSession.h"
+#include "SSUData.h"
+
+namespace i2p
+{
+namespace transport
+{
+#pragma pack(1)
+	struct SSUHeader
+	{
+		uint8_t mac[16];
+		uint8_t iv[16];
+		uint8_t flag;
+		uint32_t time;	
+
+		uint8_t GetPayloadType () const { return flag >> 4; };
+	};
+#pragma pack()
+
+	const int SSU_CONNECT_TIMEOUT = 5; // 5 seconds
+	const int SSU_TERMINATION_TIMEOUT = 330; // 5.5 minutes
+
+	// payload types (4 bits)
+	const uint8_t PAYLOAD_TYPE_SESSION_REQUEST = 0;
+	const uint8_t PAYLOAD_TYPE_SESSION_CREATED = 1;
+	const uint8_t PAYLOAD_TYPE_SESSION_CONFIRMED = 2;
+	const uint8_t PAYLOAD_TYPE_RELAY_REQUEST = 3;
+	const uint8_t PAYLOAD_TYPE_RELAY_RESPONSE = 4;
+	const uint8_t PAYLOAD_TYPE_RELAY_INTRO = 5;
+	const uint8_t PAYLOAD_TYPE_DATA = 6;
+	const uint8_t PAYLOAD_TYPE_PEER_TEST = 7;
+	const uint8_t PAYLOAD_TYPE_SESSION_DESTROYED = 8;
+
+	enum SessionState
+	{
+		eSessionStateUnknown,	
+		eSessionStateIntroduced,
+		eSessionStateEstablished,
+		eSessionStateFailed
+	};	
+
+	class SSUServer;
+	class SSUSession: public TransportSession, public std::enable_shared_from_this<SSUSession>
+	{
+		public:
+
+			SSUSession (SSUServer& server, boost::asio::ip::udp::endpoint& remoteEndpoint,
+				std::shared_ptr<const i2p::data::RouterInfo> router = nullptr, bool peerTest = false);
+			void ProcessNextMessage (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& senderEndpoint);		
+			~SSUSession ();
+			
+			void Connect ();
+			void WaitForConnect ();
+			void Introduce (uint32_t iTag, const uint8_t * iKey);
+			void WaitForIntroduction ();
+			void Close ();
+			boost::asio::ip::udp::endpoint& GetRemoteEndpoint () { return m_RemoteEndpoint; };
+			bool IsV6 () const { return m_RemoteEndpoint.address ().is_v6 (); };
+			void SendI2NPMessage (I2NPMessage * msg);
+			void SendPeerTest (); // Alice			
+
+			SessionState GetState () const  { return m_State; };
+			size_t GetNumSentBytes () const { return m_NumSentBytes; };
+			size_t GetNumReceivedBytes () const { return m_NumReceivedBytes; };
+			
+			void SendKeepAlive ();	
+			uint32_t GetRelayTag () const { return m_RelayTag; };	
+			uint32_t GetCreationTime () const { return m_CreationTime; };
+
+		private:
+
+			void CreateAESandMacKey (const uint8_t * pubKey); 
+
+			void PostI2NPMessage (I2NPMessage * msg);
+			void ProcessMessage (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& senderEndpoint); // call for established session
+			void ProcessSessionRequest (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& senderEndpoint);
+			void SendSessionRequest ();
+			void SendRelayRequest (uint32_t iTag, const uint8_t * iKey);
+			void ProcessSessionCreated (uint8_t * buf, size_t len);
+			void SendSessionCreated (const uint8_t * x);
+			void ProcessSessionConfirmed (uint8_t * buf, size_t len);
+			void SendSessionConfirmed (const uint8_t * y, const uint8_t * ourAddress, size_t ourAddressLen);
+			void ProcessRelayRequest (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& from);
+			void SendRelayResponse (uint32_t nonce, const boost::asio::ip::udp::endpoint& from,
+				const uint8_t * introKey, const boost::asio::ip::udp::endpoint& to);
+			void SendRelayIntro (SSUSession * session, const boost::asio::ip::udp::endpoint& from);
+			void ProcessRelayResponse (uint8_t * buf, size_t len);
+			void ProcessRelayIntro (uint8_t * buf, size_t len);
+			void Established ();
+			void Failed ();
+			void ScheduleConnectTimer ();
+			void HandleConnectTimer (const boost::system::error_code& ecode);
+			void ProcessPeerTest (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& senderEndpoint);
+			void SendPeerTest (uint32_t nonce, uint32_t address, uint16_t port, const uint8_t * introKey, bool toAddress = true); 
+			void ProcessData (uint8_t * buf, size_t len);		
+			void SendSesionDestroyed ();
+			void Send (uint8_t type, const uint8_t * payload, size_t len); // with session key
+			void Send (const uint8_t * buf, size_t size); 
+			
+			void FillHeaderAndEncrypt (uint8_t payloadType, uint8_t * buf, size_t len, const uint8_t * aesKey, const uint8_t * iv, const uint8_t * macKey);
+			void FillHeaderAndEncrypt (uint8_t payloadType, uint8_t * buf, size_t len); // with session key 
+			void Decrypt (uint8_t * buf, size_t len, const uint8_t * aesKey);
+			void DecryptSessionKey (uint8_t * buf, size_t len);
+			bool Validate (uint8_t * buf, size_t len, const uint8_t * macKey);			
+			const uint8_t * GetIntroKey () const; 
+
+			void ScheduleTermination ();
+			void HandleTerminationTimer (const boost::system::error_code& ecode);
+
+		private:
+	
+			friend class SSUData; // TODO: change in later
+			SSUServer& m_Server;
+			boost::asio::ip::udp::endpoint m_RemoteEndpoint;
+			boost::asio::deadline_timer m_Timer;
+			bool m_PeerTest;
+			SessionState m_State;
+			bool m_IsSessionKey;
+			uint32_t m_RelayTag;	
+			std::set<uint32_t> m_PeerTestNonces;
+			i2p::crypto::CBCEncryption m_SessionKeyEncryption;
+			i2p::crypto::CBCDecryption m_SessionKeyDecryption;
+			i2p::crypto::AESKey m_SessionKey;
+			i2p::crypto::MACKey m_MacKey;
+			std::list<i2p::I2NPMessage *> m_DelayedMessages;
+			SSUData m_Data;
+			size_t m_NumSentBytes, m_NumReceivedBytes;
+			uint32_t m_CreationTime; // seconds since epoch
+	};
+
+
+}
+}
+
+#endif
+
--- a/Signature.h
+++ b/Signature.h
@ -0,0 +1,417 @@
+#ifndef SIGNATURE_H__
+#define SIGNATURE_H__
+
+#include <inttypes.h>
+#include <cryptopp/dsa.h>
+#include <cryptopp/rsa.h>
+#include <cryptopp/asn.h>
+#include <cryptopp/oids.h>
+#include <cryptopp/osrng.h>
+#include <cryptopp/eccrypto.h>
+#include "CryptoConst.h"
+
+namespace i2p
+{
+namespace crypto
+{
+	class Verifier
+	{
+		public:
+			
+			virtual ~Verifier () {};
+			virtual bool Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const = 0;
+			virtual size_t GetPublicKeyLen () const = 0;
+			virtual size_t GetSignatureLen () const = 0;
+			virtual size_t GetPrivateKeyLen () const { return GetSignatureLen ()/2; };
+	};
+
+	class Signer
+	{
+		public:
+
+			virtual ~Signer () {};		
+			virtual void Sign (CryptoPP::RandomNumberGenerator& rnd, const uint8_t * buf, int len, uint8_t * signature) const = 0; 
+	};
+
+	const size_t DSA_PUBLIC_KEY_LENGTH = 128;
+	const size_t DSA_SIGNATURE_LENGTH = 40;	
+	const size_t DSA_PRIVATE_KEY_LENGTH = DSA_SIGNATURE_LENGTH/2;
+	class DSAVerifier: public Verifier
+	{
+		public:
+
+			DSAVerifier (const uint8_t * signingKey)
+			{
+				m_PublicKey.Initialize (dsap, dsaq, dsag, CryptoPP::Integer (signingKey, DSA_PUBLIC_KEY_LENGTH));
+			}
+	
+			bool Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const
+			{
+				CryptoPP::DSA::Verifier verifier (m_PublicKey);
+				return verifier.VerifyMessage (buf, len, signature, DSA_SIGNATURE_LENGTH);
+			}	
+
+			size_t GetPublicKeyLen () const { return DSA_PUBLIC_KEY_LENGTH; };
+			size_t GetSignatureLen () const { return DSA_SIGNATURE_LENGTH; };
+			
+		private:
+
+			CryptoPP::DSA::PublicKey m_PublicKey;
+	};
+
+	class DSASigner: public Signer
+	{
+		public:
+
+			DSASigner (const uint8_t * signingPrivateKey)
+			{
+				m_PrivateKey.Initialize (dsap, dsaq, dsag, CryptoPP::Integer (signingPrivateKey, DSA_PRIVATE_KEY_LENGTH));
+			}
+
+			void Sign (CryptoPP::RandomNumberGenerator& rnd, const uint8_t * buf, int len, uint8_t * signature) const
+			{
+				CryptoPP::DSA::Signer signer (m_PrivateKey);
+				signer.SignMessage (rnd, buf, len, signature);
+			}
+
+		private:
+
+			CryptoPP::DSA::PrivateKey m_PrivateKey;
+	};
+
+	inline void CreateDSARandomKeys (CryptoPP::RandomNumberGenerator& rnd, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		CryptoPP::DSA::PrivateKey privateKey;
+		CryptoPP::DSA::PublicKey publicKey;
+		privateKey.Initialize (rnd, dsap, dsaq, dsag);
+		privateKey.MakePublicKey (publicKey);
+		privateKey.GetPrivateExponent ().Encode (signingPrivateKey, DSA_PRIVATE_KEY_LENGTH);	
+		publicKey.GetPublicElement ().Encode (signingPublicKey, DSA_PUBLIC_KEY_LENGTH);
+	}	
+
+	template<typename Hash, size_t keyLen>
+	class ECDSAVerifier: public Verifier
+	{		
+		public:
+
+			template<typename Curve>
+			ECDSAVerifier (Curve curve, const uint8_t * signingKey)
+			{
+				m_PublicKey.Initialize (curve, 
+					CryptoPP::ECP::Point (CryptoPP::Integer (signingKey, keyLen/2), 
+					CryptoPP::Integer (signingKey + keyLen/2, keyLen/2)));
+			}
+
+			bool Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const
+			{
+				typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::Verifier verifier (m_PublicKey);
+				return verifier.VerifyMessage (buf, len, signature, keyLen); // signature length
+			}	
+
+			size_t GetPublicKeyLen () const { return keyLen; };
+			size_t GetSignatureLen () const { return keyLen; }; // signature length = key length
+			
+		private:
+
+			typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::PublicKey m_PublicKey;
+	};
+
+	template<typename Hash>
+	class ECDSASigner: public Signer
+	{
+		public:
+
+			template<typename Curve>
+			ECDSASigner (Curve curve, const uint8_t * signingPrivateKey, size_t keyLen)
+			{
+				m_PrivateKey.Initialize (curve, CryptoPP::Integer (signingPrivateKey, keyLen/2)); // private key length
+			}
+
+			void Sign (CryptoPP::RandomNumberGenerator& rnd, const uint8_t * buf, int len, uint8_t * signature) const
+			{
+				typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::Signer signer (m_PrivateKey);
+				signer.SignMessage (rnd, buf, len, signature);
+			}
+
+		private:
+
+			typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::PrivateKey m_PrivateKey;
+	};
+
+	template<typename Hash, typename Curve>
+	inline void CreateECDSARandomKeys (CryptoPP::RandomNumberGenerator& rnd, Curve curve, 
+		size_t keyLen, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::PrivateKey privateKey;
+		typename CryptoPP::ECDSA<CryptoPP::ECP, Hash>::PublicKey publicKey;
+		privateKey.Initialize (rnd, curve);
+		privateKey.MakePublicKey (publicKey);
+		privateKey.GetPrivateExponent ().Encode (signingPrivateKey, keyLen/2);	
+		auto q = publicKey.GetPublicElement ();
+		q.x.Encode (signingPublicKey, keyLen/2);
+		q.y.Encode (signingPublicKey + keyLen/2, keyLen/2);
+	}	
+
+// ECDSA_SHA256_P256
+	const size_t ECDSAP256_KEY_LENGTH = 64;	
+	class ECDSAP256Verifier: public ECDSAVerifier<CryptoPP::SHA256, ECDSAP256_KEY_LENGTH>
+	{
+		public:
+
+			ECDSAP256Verifier (const uint8_t * signingKey): 
+				ECDSAVerifier (CryptoPP::ASN1::secp256r1(), signingKey)
+			{
+			}			
+	};	
+
+	class ECDSAP256Signer: public ECDSASigner<CryptoPP::SHA256>
+	{
+		public:
+
+			ECDSAP256Signer (const uint8_t * signingPrivateKey):
+				ECDSASigner (CryptoPP::ASN1::secp256r1(), signingPrivateKey, ECDSAP256_KEY_LENGTH)
+			{
+			}
+	};
+
+	inline void CreateECDSAP256RandomKeys (CryptoPP::RandomNumberGenerator& rnd, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		CreateECDSARandomKeys<CryptoPP::SHA256> (rnd, CryptoPP::ASN1::secp256r1(), ECDSAP256_KEY_LENGTH, signingPrivateKey, signingPublicKey);
+	}	
+
+// ECDSA_SHA384_P384
+	const size_t ECDSAP384_KEY_LENGTH = 96;
+	class ECDSAP384Verifier: public ECDSAVerifier<CryptoPP::SHA384, ECDSAP384_KEY_LENGTH>
+	{
+		public:
+
+			ECDSAP384Verifier (const uint8_t * signingKey): 
+				ECDSAVerifier (CryptoPP::ASN1::secp384r1(), signingKey)
+			{
+			}			
+	};	
+
+	class ECDSAP384Signer: public ECDSASigner<CryptoPP::SHA384>
+	{
+		public:
+
+			ECDSAP384Signer (const uint8_t * signingPrivateKey):
+				ECDSASigner (CryptoPP::ASN1::secp384r1(), signingPrivateKey, ECDSAP384_KEY_LENGTH)
+			{
+			}
+	};
+
+	inline void CreateECDSAP384RandomKeys (CryptoPP::RandomNumberGenerator& rnd, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		CreateECDSARandomKeys<CryptoPP::SHA384> (rnd, CryptoPP::ASN1::secp384r1(), ECDSAP384_KEY_LENGTH, signingPrivateKey, signingPublicKey);
+	}	
+
+// ECDSA_SHA512_P521
+	const size_t ECDSAP521_KEY_LENGTH = 132;
+	class ECDSAP521Verifier: public ECDSAVerifier<CryptoPP::SHA512, ECDSAP521_KEY_LENGTH>
+	{
+		public:
+
+			ECDSAP521Verifier (const uint8_t * signingKey): 
+				ECDSAVerifier (CryptoPP::ASN1::secp521r1(), signingKey)
+			{
+			}			
+	};	
+
+	class ECDSAP521Signer: public ECDSASigner<CryptoPP::SHA512>
+	{
+		public:
+
+			ECDSAP521Signer (const uint8_t * signingPrivateKey):
+				ECDSASigner (CryptoPP::ASN1::secp521r1(), signingPrivateKey, ECDSAP521_KEY_LENGTH)
+			{
+			}
+	};
+
+	inline void CreateECDSAP521RandomKeys (CryptoPP::RandomNumberGenerator& rnd, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		CreateECDSARandomKeys<CryptoPP::SHA512> (rnd, CryptoPP::ASN1::secp521r1(), ECDSAP521_KEY_LENGTH, signingPrivateKey, signingPublicKey);
+	}
+
+// RSA
+	template<typename Hash, size_t keyLen>	
+	class RSAVerifier: public Verifier
+	{
+		public:
+
+			RSAVerifier (const uint8_t * signingKey)
+			{
+				m_PublicKey.Initialize (CryptoPP::Integer (signingKey, keyLen), CryptoPP::Integer (rsae));
+			}
+
+			bool Verify (const uint8_t * buf, size_t len, const uint8_t * signature) const 
+			{
+				typename CryptoPP::RSASS<CryptoPP::PKCS1v15, Hash>::Verifier verifier (m_PublicKey);
+				return verifier.VerifyMessage (buf, len, signature, keyLen); // signature length
+			}
+			size_t GetPublicKeyLen () const { return keyLen; }
+			size_t GetSignatureLen () const { return keyLen; }	
+			size_t GetPrivateKeyLen () const { return GetSignatureLen ()*2; };
+
+		private:
+			
+			CryptoPP::RSA::PublicKey m_PublicKey;			
+	};	
+
+	
+	template<typename Hash>
+	class RSASigner: public Signer
+	{
+		public:
+
+			RSASigner (const uint8_t * signingPrivateKey, size_t keyLen)
+			{
+				m_PrivateKey.Initialize (CryptoPP::Integer (signingPrivateKey, keyLen/2),
+				    rsae,                 			
+					CryptoPP::Integer (signingPrivateKey + keyLen/2, keyLen/2));
+			}
+
+			void Sign (CryptoPP::RandomNumberGenerator& rnd, const uint8_t * buf, int len, uint8_t * signature) const
+			{
+				typename CryptoPP::RSASS<CryptoPP::PKCS1v15, Hash>::Signer signer (m_PrivateKey);
+				signer.SignMessage (rnd, buf, len, signature);
+			}
+			
+		private:
+
+			CryptoPP::RSA::PrivateKey m_PrivateKey;
+	};		
+
+	inline void CreateRSARandomKeys (CryptoPP::RandomNumberGenerator& rnd, 
+		size_t publicKeyLen, uint8_t * signingPrivateKey, uint8_t * signingPublicKey)
+	{
+		CryptoPP::RSA::PrivateKey privateKey;
+		privateKey.Initialize (rnd, publicKeyLen*8, rsae);
+		privateKey.GetModulus ().Encode (signingPrivateKey, publicKeyLen);	
+		privateKey.GetPrivateExponent ().Encode (signingPrivateKey + publicKeyLen, publicKeyLen);	
+		privateKey.GetModulus ().Encode (signingPublicKey, publicKeyLen);
+	}	
+
+	
+//  RSA_SHA256_2048
+	const size_t RSASHA2562048_KEY_LENGTH = 256;
+	class RSASHA2562048Verifier: public RSAVerifier<CryptoPP::SHA256, RSASHA2562048_KEY_LENGTH> 
+	{
+		public:
+
+			RSASHA2562048Verifier (const uint8_t * signingKey): RSAVerifier (signingKey) 
+			{
+			}
+	};
+
+	class RSASHA2562048Signer: public RSASigner<CryptoPP::SHA256> 
+	{
+		public:
+
+			RSASHA2562048Signer (const uint8_t * signingPrivateKey): 
+				RSASigner (signingPrivateKey, RSASHA2562048_KEY_LENGTH*2) 
+			{
+			}
+	};
+
+//  RSA_SHA384_3072
+	const size_t RSASHA3843072_KEY_LENGTH = 384;
+	class RSASHA3843072Verifier: public RSAVerifier<CryptoPP::SHA384, RSASHA3843072_KEY_LENGTH> 
+	{
+		public:
+
+			RSASHA3843072Verifier (const uint8_t * signingKey): RSAVerifier (signingKey) 
+			{
+			}
+	};
+
+	class RSASHA3843072Signer: public RSASigner<CryptoPP::SHA384> 
+	{
+		public:
+
+			RSASHA3843072Signer (const uint8_t * signingPrivateKey): 
+				RSASigner (signingPrivateKey, RSASHA3843072_KEY_LENGTH*2) 
+			{
+			}
+	};
+
+//  RSA_SHA512_4096
+	const size_t RSASHA5124096_KEY_LENGTH = 512;
+	class RSASHA5124096Verifier: public RSAVerifier<CryptoPP::SHA512, RSASHA5124096_KEY_LENGTH> 
+	{
+		public:
+
+			RSASHA5124096Verifier (const uint8_t * signingKey): RSAVerifier (signingKey) 
+			{
+			}
+	};
+
+	class RSASHA5124096Signer: public RSASigner<CryptoPP::SHA512> 
+	{
+		public:
+
+			RSASHA5124096Signer (const uint8_t * signingPrivateKey): 
+				RSASigner (signingPrivateKey, RSASHA5124096_KEY_LENGTH*2) 
+			{
+			}
+	};
+
+// Raw verifiers	
+	class RawVerifier
+	{
+		public:
+			
+			virtual ~RawVerifier () {};
+			virtual void Update (const uint8_t * buf, size_t len) = 0;
+			virtual bool Verify (const uint8_t * signature) = 0;
+	};		
+
+	template<typename Hash, size_t keyLen>
+	class RSARawVerifier: public RawVerifier
+	{
+		public:
+
+			RSARawVerifier (const uint8_t * signingKey):
+				n (signingKey, keyLen)
+			{
+			}
+
+			void Update (const uint8_t * buf, size_t len)
+			{
+				m_Hash.Update (buf, len);
+			}
+			
+			bool Verify (const uint8_t * signature)
+			{
+				// RSA encryption first
+				CryptoPP::Integer enSig (a_exp_b_mod_c (CryptoPP::Integer (signature, keyLen), 
+					CryptoPP::Integer (i2p::crypto::rsae), n)); // s^e mod n 
+				uint8_t enSigBuf[keyLen];
+				enSig.Encode (enSigBuf, keyLen);
+
+				uint8_t digest[Hash::DIGESTSIZE];
+				m_Hash.Final (digest);
+				if ((int)keyLen < Hash::DIGESTSIZE) return false; // can't verify digest longer than key
+				// we assume digest is right aligned, at least for PKCS#1 v1.5 padding 
+				return !memcmp (enSigBuf + (keyLen - Hash::DIGESTSIZE), digest, Hash::DIGESTSIZE); 				
+			}
+
+		private:
+
+			CryptoPP::Integer n; // RSA modulus	
+			Hash m_Hash;
+	};	
+
+	class RSASHA5124096RawVerifier: public RSARawVerifier<CryptoPP::SHA512, RSASHA5124096_KEY_LENGTH> 
+	{
+		public:
+
+			RSASHA5124096RawVerifier (const uint8_t * signingKey): RSARawVerifier (signingKey) 
+			{
+			}
+	};
+}
+}
+
+#endif
+
--- a/Streaming.cpp
+++ b/Streaming.cpp
@ -0,0 +1,739 @@
+#include <cryptopp/gzip.h>
+#include "Log.h"
+#include "RouterInfo.h"
+#include "RouterContext.h"
+#include "Tunnel.h"
+#include "Timestamp.h"
+#include "Destination.h"
+#include "Streaming.h"
+
+namespace i2p
+{
+namespace stream
+{
+	Stream::Stream (boost::asio::io_service& service, StreamingDestination& local, 
+		const i2p::data::LeaseSet& remote, int port): m_Service (service), m_SendStreamID (0), 
+		m_SequenceNumber (0), m_LastReceivedSequenceNumber (-1), m_IsOpen (false), 
+		m_IsReset (false), m_IsAckSendScheduled (false), m_LocalDestination (local), 
+		m_RemoteLeaseSet (&remote), m_RoutingSession (nullptr), m_CurrentOutboundTunnel (nullptr),
+		m_ReceiveTimer (m_Service), m_ResendTimer (m_Service), m_AckSendTimer (m_Service), 
+		m_NumSentBytes (0), m_NumReceivedBytes (0), m_Port (port)
+	{
+		m_RecvStreamID = i2p::context.GetRandomNumberGenerator ().GenerateWord32 ();
+		UpdateCurrentRemoteLease ();
+	}	
+
+	Stream::Stream (boost::asio::io_service& service, StreamingDestination& local):
+		m_Service (service), m_SendStreamID (0), m_SequenceNumber (0), m_LastReceivedSequenceNumber (-1), 
+		m_IsOpen (false), m_IsReset (false), m_IsAckSendScheduled (false), m_LocalDestination (local),
+		m_RemoteLeaseSet (nullptr), m_RoutingSession (nullptr), m_CurrentOutboundTunnel (nullptr),
+		m_ReceiveTimer (m_Service), m_ResendTimer (m_Service), m_AckSendTimer (m_Service), 
+		m_NumSentBytes (0), m_NumReceivedBytes (0), m_Port (0)
+	{
+		m_RecvStreamID = i2p::context.GetRandomNumberGenerator ().GenerateWord32 ();
+	}
+
+	Stream::~Stream ()
+	{	
+		m_AckSendTimer.cancel ();
+		while (!m_ReceiveQueue.empty ())
+		{
+			auto packet = m_ReceiveQueue.front ();
+			m_ReceiveQueue.pop ();
+			delete packet;
+		}	
+		m_ReceiveTimer.cancel ();
+					
+		for (auto it: m_SentPackets)
+			delete it;
+		m_SentPackets.clear ();
+		m_ResendTimer.cancel ();
+
+		for (auto it: m_SavedPackets)
+			delete it;
+		m_SavedPackets.clear ();
+		LogPrint (eLogDebug, "Stream deleted");
+	}	
+		
+	void Stream::HandleNextPacket (Packet * packet)
+	{
+		m_NumReceivedBytes += packet->GetLength ();
+		if (!m_SendStreamID) 
+			m_SendStreamID = packet->GetReceiveStreamID (); 	
+
+		if (!packet->IsNoAck ()) // ack received
+			ProcessAck (packet);
+		
+		int32_t receivedSeqn = packet->GetSeqn ();
+		bool isSyn = packet->IsSYN ();
+		if (!receivedSeqn && !isSyn)
+		{
+			// plain ack
+			LogPrint (eLogDebug, "Plain ACK received");
+			delete packet;
+			return;
+		}
+
+		LogPrint (eLogDebug, "Received seqn=", receivedSeqn); 
+		if (isSyn || receivedSeqn == m_LastReceivedSequenceNumber + 1)
+		{			
+			// we have received next in sequence message
+			ProcessPacket (packet);
+			
+			// we should also try stored messages if any
+			for (auto it = m_SavedPackets.begin (); it != m_SavedPackets.end ();)
+			{			
+				if ((*it)->GetSeqn () == (uint32_t)(m_LastReceivedSequenceNumber + 1))
+				{
+					Packet * savedPacket = *it;
+					m_SavedPackets.erase (it++);
+
+					ProcessPacket (savedPacket);
+				}
+				else
+					break;
+			}
+
+			// schedule ack for last message
+			if (m_IsOpen)
+			{
+				if (!m_IsAckSendScheduled)
+				{
+					m_IsAckSendScheduled = true;
+					m_AckSendTimer.expires_from_now (boost::posix_time::milliseconds(ACK_SEND_TIMEOUT));
+					m_AckSendTimer.async_wait (std::bind (&Stream::HandleAckSendTimer,
+						shared_from_this (), std::placeholders::_1));
+				}
+			}	
+			else if (isSyn)
+				// we have to send SYN back to incoming connection
+				Send (nullptr, 0); // also sets m_IsOpen				
+		}	
+		else 
+		{	
+			if (receivedSeqn <= m_LastReceivedSequenceNumber)
+			{
+				// we have received duplicate. Most likely our outbound tunnel is dead
+				LogPrint (eLogWarning, "Duplicate message ", receivedSeqn, " received");
+				m_CurrentOutboundTunnel = nullptr; // pick another outbound tunnel 
+				UpdateCurrentRemoteLease (); // pick another lease
+				SendQuickAck (); // resend ack for previous message again
+				delete packet; // packet dropped
+			}	
+			else
+			{
+				LogPrint (eLogWarning, "Missing messages from ", m_LastReceivedSequenceNumber + 1, " to ", receivedSeqn - 1);
+				// save message and wait for missing message again
+				SavePacket (packet);
+				// send NACKs for missing messages ASAP
+				if (m_IsAckSendScheduled)
+				{
+					m_IsAckSendScheduled = false;	
+					m_AckSendTimer.cancel ();
+				}
+				SendQuickAck ();
+			}	
+		}	
+	}	
+
+	void Stream::SavePacket (Packet * packet)
+	{
+		m_SavedPackets.insert (packet);
+	}	
+
+	void Stream::ProcessPacket (Packet * packet)
+	{
+		// process flags
+		uint32_t receivedSeqn = packet->GetSeqn ();
+		uint16_t flags = packet->GetFlags ();
+		LogPrint (eLogDebug, "Process seqn=", receivedSeqn, ", flags=", flags);
+		
+		const uint8_t * optionData = packet->GetOptionData ();
+		if (flags & PACKET_FLAG_SYNCHRONIZE)
+			LogPrint (eLogDebug, "Synchronize");
+
+		if (flags & PACKET_FLAG_DELAY_REQUESTED)
+		{
+			optionData += 2;
+		}	
+		
+		if (flags & PACKET_FLAG_FROM_INCLUDED)
+		{
+			optionData += m_RemoteIdentity.FromBuffer (optionData, packet->GetOptionSize ());
+			LogPrint (eLogInfo, "From identity ", m_RemoteIdentity.GetIdentHash ().ToBase64 ());		
+			if (!m_RemoteLeaseSet)
+				LogPrint (eLogDebug, "Incoming stream from ", m_RemoteIdentity.GetIdentHash ().ToBase64 ());
+		}	
+
+		if (flags & PACKET_FLAG_MAX_PACKET_SIZE_INCLUDED)
+		{
+			uint16_t maxPacketSize = bufbe16toh (optionData);
+			LogPrint (eLogDebug, "Max packet size ", maxPacketSize);
+			optionData += 2;
+		}	
+		
+		if (flags & PACKET_FLAG_SIGNATURE_INCLUDED)
+		{
+			LogPrint (eLogDebug, "Signature");
+			uint8_t signature[256]; 
+			auto signatureLen = m_RemoteIdentity.GetSignatureLen ();
+			memcpy (signature, optionData, signatureLen);
+			memset (const_cast<uint8_t *>(optionData), 0, signatureLen);
+			if (!m_RemoteIdentity.Verify (packet->GetBuffer (), packet->GetLength (), signature))
+			{  
+				LogPrint (eLogError, "Signature verification failed");
+			    Close ();
+				flags |= PACKET_FLAG_CLOSE;
+			}	
+			memcpy (const_cast<uint8_t *>(optionData), signature, signatureLen);
+			optionData += signatureLen;
+		}	
+
+		packet->offset = packet->GetPayload () - packet->buf;
+		if (packet->GetLength () > 0)
+		{	
+			m_ReceiveQueue.push (packet);
+			m_ReceiveTimer.cancel ();
+		}	
+		else
+			delete packet;
+		
+		m_LastReceivedSequenceNumber = receivedSeqn;
+
+		if (flags & PACKET_FLAG_CLOSE)
+		{
+			LogPrint (eLogInfo, "Closed");
+			Close ();
+			m_IsOpen = false;
+			m_IsReset = true;
+		}
+	}	
+
+	void Stream::ProcessAck (Packet * packet)
+	{
+		uint32_t ackThrough = packet->GetAckThrough ();
+		int nackCount = packet->GetNACKCount ();
+		for (auto it = m_SentPackets.begin (); it != m_SentPackets.end ();)
+		{			
+			auto seqn = (*it)->GetSeqn ();
+			if (seqn <= ackThrough)
+			{
+				if (nackCount > 0)
+				{
+					bool nacked = false;
+					for (int i = 0; i < nackCount; i++)
+						if (seqn == packet->GetNACK (i))
+						{
+							nacked = true;
+							break;
+						}
+					if (nacked)
+					{
+						LogPrint (eLogDebug, "Packet ", seqn, " NACK");
+						it++;
+						continue;
+					}	
+				}
+				auto sentPacket = *it;
+				LogPrint (eLogDebug, "Packet ", seqn, " acknowledged");
+				m_SentPackets.erase (it++);
+				delete sentPacket;	
+			}
+			else
+				break;
+		}
+		if (m_SentPackets.empty ())
+			m_ResendTimer.cancel ();
+	}		
+		
+	size_t Stream::Send (const uint8_t * buf, size_t len)
+	{
+		bool isNoAck = m_LastReceivedSequenceNumber < 0; // first packet
+		std::vector<Packet *> packets;
+		while (!m_IsOpen || len > 0)
+		{
+			Packet * p = new Packet ();
+			uint8_t * packet = p->GetBuffer ();
+			// TODO: implement setters
+			size_t size = 0;
+			htobe32buf (packet + size, m_SendStreamID);
+			size += 4; // sendStreamID
+			htobe32buf (packet + size, m_RecvStreamID);
+			size += 4; // receiveStreamID
+			htobe32buf (packet + size, m_SequenceNumber++);
+			size += 4; // sequenceNum
+			if (isNoAck)			
+				htobe32buf (packet + size, m_LastReceivedSequenceNumber);
+			else
+				htobuf32 (packet + size, 0);
+			size += 4; // ack Through
+			packet[size] = 0; 
+			size++; // NACK count
+			packet[size] = RESEND_TIMEOUT;
+			size++; // resend delay
+			if (!m_IsOpen)
+			{	
+				//  initial packet
+				m_IsOpen = true; m_IsReset = false;
+				uint16_t flags = PACKET_FLAG_SYNCHRONIZE | PACKET_FLAG_FROM_INCLUDED | 
+					PACKET_FLAG_SIGNATURE_INCLUDED | PACKET_FLAG_MAX_PACKET_SIZE_INCLUDED;
+				if (isNoAck) flags |= PACKET_FLAG_NO_ACK;
+				htobe16buf (packet + size, flags);
+				size += 2; // flags
+				size_t identityLen = m_LocalDestination.GetOwner ().GetIdentity ().GetFullLen ();
+				size_t signatureLen = m_LocalDestination.GetOwner ().GetIdentity ().GetSignatureLen ();
+				htobe16buf (packet + size, identityLen + signatureLen + 2); // identity + signature + packet size
+				size += 2; // options size
+				m_LocalDestination.GetOwner ().GetIdentity ().ToBuffer (packet + size, identityLen); 
+				size += identityLen; // from
+				htobe16buf (packet + size, STREAMING_MTU);
+				size += 2; // max packet size
+				uint8_t * signature = packet + size; // set it later
+				memset (signature, 0, signatureLen); // zeroes for now
+				size += signatureLen; // signature
+				size_t sentLen = STREAMING_MTU - size;
+				if (len < sentLen) sentLen = len;		
+				memcpy (packet + size, buf, sentLen); 
+				buf += sentLen;
+				len -= sentLen;
+				size += sentLen; // payload
+				m_LocalDestination.GetOwner ().Sign (packet, size, signature);
+			}	
+			else
+			{
+				// follow on packet
+				htobuf16 (packet + size, 0);
+				size += 2; // flags
+				htobuf16 (packet + size, 0); // no options
+				size += 2; // options size
+				size_t sentLen = STREAMING_MTU - size;
+				if (len < sentLen) sentLen = len;		
+				memcpy (packet + size, buf, sentLen); 
+				buf += sentLen;
+				len -= sentLen;
+				size += sentLen; // payload
+			}	
+			p->len = size;
+			packets.push_back (p);
+		}
+		if (packets.size () > 0)
+			m_Service.post (std::bind (&Stream::PostPackets, shared_from_this (), packets));
+		return len;
+	}	
+
+		
+	void Stream::SendQuickAck ()
+	{
+		int32_t lastReceivedSeqn = m_LastReceivedSequenceNumber;
+		if (!m_SavedPackets.empty ())
+		{
+			int32_t seqn = (*m_SavedPackets.rbegin ())->GetSeqn ();
+			if (seqn > lastReceivedSeqn) lastReceivedSeqn = seqn;
+		}	
+		if (lastReceivedSeqn < 0) 
+		{	
+			LogPrint (eLogError, "No packets have been received yet");
+			return;
+		}
+		
+		Packet p;
+		uint8_t * packet = p.GetBuffer ();	
+		size_t size = 0;
+		htobe32buf (packet + size, m_SendStreamID);
+		size += 4; // sendStreamID
+		htobe32buf (packet + size, m_RecvStreamID);
+		size += 4; // receiveStreamID
+		htobuf32 (packet + size, 0); // this is plain Ack message
+		size += 4; // sequenceNum
+		htobe32buf (packet + size, lastReceivedSeqn);
+		size += 4; // ack Through
+		uint8_t numNacks = 0;
+		if (lastReceivedSeqn > m_LastReceivedSequenceNumber) 
+		{	
+			// fill NACKs
+			uint8_t * nacks = packet + size + 1;
+			auto nextSeqn = m_LastReceivedSequenceNumber + 1;
+			for (auto it: m_SavedPackets)
+			{
+				auto seqn = it->GetSeqn ();
+				for (uint32_t i = nextSeqn; i < seqn; i++)
+				{
+					htobe32buf (nacks, i);
+					nacks += 4;
+					numNacks++;
+				}	
+				nextSeqn = seqn + 1;
+			}
+			packet[size] = numNacks; 
+			size++; // NACK count	
+			size += numNacks*4; // NACKs
+		}	
+		else
+		{
+			// No NACKs
+			packet[size] = 0; 
+			size++; // NACK count		
+		}	
+		size++; // resend delay
+		htobuf16 (packet + size, 0); // nof flags set
+		size += 2; // flags
+		htobuf16 (packet + size, 0); // no options
+		size += 2; // options size
+		p.len = size;		
+
+		SendPackets (std::vector<Packet *> { &p });
+		LogPrint ("Quick Ack sent. ", (int)numNacks, " NACKs");
+	}	
+
+	void Stream::Close ()
+	{
+		if (m_IsOpen)
+		{	
+			m_IsOpen = false;
+			Packet * p = new Packet ();
+			uint8_t * packet = p->GetBuffer ();
+			size_t size = 0;
+			htobe32buf (packet + size, m_SendStreamID);
+			size += 4; // sendStreamID
+			htobe32buf (packet + size, m_RecvStreamID);
+			size += 4; // receiveStreamID
+			htobe32buf (packet + size, m_SequenceNumber++);
+			size += 4; // sequenceNum
+			htobe32buf (packet + size, m_LastReceivedSequenceNumber);
+			size += 4; // ack Through
+			packet[size] = 0; 
+			size++; // NACK count
+			size++; // resend delay
+			htobe16buf (packet + size, PACKET_FLAG_CLOSE | PACKET_FLAG_SIGNATURE_INCLUDED);
+			size += 2; // flags
+			size_t signatureLen = m_LocalDestination.GetOwner ().GetIdentity ().GetSignatureLen ();
+			htobe16buf (packet + size, signatureLen); // signature only
+			size += 2; // options size
+			uint8_t * signature = packet + size;
+			memset (packet + size, 0, signatureLen);
+			size += signatureLen; // signature
+			m_LocalDestination.GetOwner ().Sign (packet, size, signature);
+			
+			p->len = size;
+			m_Service.post (std::bind (&Stream::SendPacket, shared_from_this (), p));
+			LogPrint ("FIN sent");
+			m_ReceiveTimer.cancel ();
+			m_LocalDestination.DeleteStream (shared_from_this ());
+		}	
+	}
+
+	size_t Stream::ConcatenatePackets (uint8_t * buf, size_t len)
+	{
+		size_t pos = 0;
+		while (pos < len && !m_ReceiveQueue.empty ())
+		{
+			Packet * packet = m_ReceiveQueue.front ();
+			size_t l = std::min (packet->GetLength (), len - pos);
+			memcpy (buf + pos, packet->GetBuffer (), l);
+			pos += l;
+			packet->offset += l;
+			if (!packet->GetLength ())
+			{
+				m_ReceiveQueue.pop ();
+				delete packet;
+			}	
+		}	
+		return pos; 
+	}
+
+	bool Stream::SendPacket (Packet * packet)
+	{
+		if (packet)
+		{	
+			if (m_IsAckSendScheduled)
+			{
+				m_IsAckSendScheduled = false;	
+				m_AckSendTimer.cancel ();
+			}
+			SendPackets (std::vector<Packet *> { packet });
+			if (m_IsOpen)
+			{	
+				bool isEmpty = m_SentPackets.empty ();
+				m_SentPackets.insert (packet);
+				if (isEmpty)
+					ScheduleResend ();
+			}	
+			else
+				delete packet;
+			return true;	
+		}	
+		else
+			return false;
+	}	
+
+	void Stream::PostPackets (const std::vector<Packet *> packets)
+	{
+		if (m_IsOpen)
+		{	
+			if (packets.size () > 0)
+			{
+				m_IsAckSendScheduled = false;	
+				m_AckSendTimer.cancel ();
+			}
+			bool isEmpty = m_SentPackets.empty ();
+			for (auto it: packets)
+				m_SentPackets.insert (it);
+			SendPackets (packets);
+			if (isEmpty)
+				ScheduleResend ();
+		}
+		else
+		{
+			// delete 
+			for (auto it: packets)
+				delete it;	
+		}	
+	}	
+		
+	void Stream::SendPackets (const std::vector<Packet *>& packets)
+	{
+		if (!m_RemoteLeaseSet)
+		{
+			UpdateCurrentRemoteLease ();	
+			if (!m_RemoteLeaseSet)
+			{
+				LogPrint ("Can't send packets. Missing remote LeaseSet");
+				return;
+			}
+		}
+		m_CurrentOutboundTunnel = m_LocalDestination.GetOwner ().GetTunnelPool ()->GetNextOutboundTunnel (m_CurrentOutboundTunnel);
+		if (!m_CurrentOutboundTunnel)
+		{
+			LogPrint ("No outbound tunnels in the pool");
+			return;
+		}
+
+		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+		if (ts >= m_CurrentRemoteLease.endDate)
+			UpdateCurrentRemoteLease ();
+		if (ts < m_CurrentRemoteLease.endDate)
+		{	
+			std::vector<i2p::tunnel::TunnelMessageBlock> msgs;
+			for (auto it: packets)
+			{ 
+				auto msg = m_RoutingSession->WrapSingleMessage (CreateDataMessage (it->GetBuffer (), it->GetLength ()));
+				msgs.push_back (i2p::tunnel::TunnelMessageBlock 
+							{ 
+								i2p::tunnel::eDeliveryTypeTunnel,
+								m_CurrentRemoteLease.tunnelGateway, m_CurrentRemoteLease.tunnelID,
+								msg
+							});	
+				m_NumSentBytes += it->GetLength ();
+			}
+			m_CurrentOutboundTunnel->SendTunnelDataMsg (msgs);
+		}	
+		else
+			LogPrint ("All leases are expired");
+	}
+
+	void Stream::ScheduleResend ()
+	{
+		m_ResendTimer.cancel ();
+		m_ResendTimer.expires_from_now (boost::posix_time::seconds(RESEND_TIMEOUT));
+		m_ResendTimer.async_wait (std::bind (&Stream::HandleResendTimer,
+			shared_from_this (), std::placeholders::_1));
+	}
+		
+	void Stream::HandleResendTimer (const boost::system::error_code& ecode)
+	{
+		if (ecode != boost::asio::error::operation_aborted)
+		{	
+			std::vector<Packet *> packets;
+			for (auto it : m_SentPackets)
+			{
+				it->numResendAttempts++;
+				if (it->numResendAttempts <= MAX_NUM_RESEND_ATTEMPTS)
+					packets.push_back (it);
+				else
+				{
+					LogPrint (eLogWarning, "Packet ", it->GetSeqn (), "was not ACKed after ", MAX_NUM_RESEND_ATTEMPTS,  " attempts. Terminate");
+					m_IsOpen = false;
+					m_IsReset = true;
+					m_ReceiveTimer.cancel ();
+					return;
+				}	
+			}	
+			if (packets.size () > 0)
+			{
+				m_CurrentOutboundTunnel = nullptr; // pick another outbound tunnel 
+				UpdateCurrentRemoteLease (); // pick another lease
+				SendPackets (packets);
+			}	
+			ScheduleResend ();
+		}	
+	}	
+		
+	void Stream::HandleAckSendTimer (const boost::system::error_code& ecode)
+	{
+		if (m_IsAckSendScheduled)
+		{
+			if (m_IsOpen)
+				SendQuickAck ();
+			m_IsAckSendScheduled = false;
+		}	
+	}
+
+	void Stream::UpdateCurrentRemoteLease ()
+	{
+		if (!m_RemoteLeaseSet)
+		{
+			m_RemoteLeaseSet = m_LocalDestination.GetOwner ().FindLeaseSet (m_RemoteIdentity.GetIdentHash ());
+			if (!m_RemoteLeaseSet)		
+				LogPrint ("LeaseSet ", m_RemoteIdentity.GetIdentHash ().ToBase64 (), " not found");
+		}
+		if (m_RemoteLeaseSet)
+		{
+			if (!m_RoutingSession)
+				m_RoutingSession = m_LocalDestination.GetOwner ().GetRoutingSession (*m_RemoteLeaseSet, 32);
+			auto leases = m_RemoteLeaseSet->GetNonExpiredLeases ();
+			if (!leases.empty ())
+			{	
+				uint32_t i = i2p::context.GetRandomNumberGenerator ().GenerateWord32 (0, leases.size () - 1);
+				m_CurrentRemoteLease = leases[i];
+			}	
+			else
+			{	
+				m_RemoteLeaseSet = m_LocalDestination.GetOwner ().FindLeaseSet (m_RemoteIdentity.GetIdentHash ()); // re-request expired
+				m_CurrentRemoteLease.endDate = 0;
+			}	
+		}
+		else
+			m_CurrentRemoteLease.endDate = 0;
+	}	
+
+	I2NPMessage * Stream::CreateDataMessage (const uint8_t * payload, size_t len)
+	{
+		I2NPMessage * msg = NewI2NPShortMessage ();
+		CryptoPP::Gzip compressor;
+		if (len <= i2p::stream::COMPRESSION_THRESHOLD_SIZE)
+			compressor.SetDeflateLevel (CryptoPP::Gzip::MIN_DEFLATE_LEVEL);
+		else
+			compressor.SetDeflateLevel (CryptoPP::Gzip::DEFAULT_DEFLATE_LEVEL);
+		compressor.Put (payload, len);
+		compressor.MessageEnd();
+		int size = compressor.MaxRetrievable ();
+		uint8_t * buf = msg->GetPayload ();
+		htobe32buf (buf, size); // length
+		buf += 4;
+		compressor.Get (buf, size);
+		htobuf16(buf + 4, 0); // source port
+		htobe16buf (buf + 6, m_Port); // destination port 
+		buf[9] = i2p::client::PROTOCOL_TYPE_STREAMING; // streaming protocol
+		msg->len += size + 4; 
+		FillI2NPMessageHeader (msg, eI2NPData);
+		
+		return msg;
+	}	
+		
+	void StreamingDestination::Start ()
+	{	
+	}
+		
+	void StreamingDestination::Stop ()
+	{	
+		ResetAcceptor ();
+		{
+			std::unique_lock<std::mutex> l(m_StreamsMutex);
+			m_Streams.clear ();
+		}	
+	}	
+		
+	void StreamingDestination::HandleNextPacket (Packet * packet)
+	{
+		uint32_t sendStreamID = packet->GetSendStreamID ();
+		if (sendStreamID)
+		{	
+			auto it = m_Streams.find (sendStreamID);
+			if (it != m_Streams.end ())
+				it->second->HandleNextPacket (packet);
+			else
+			{	
+				LogPrint ("Unknown stream sendStreamID=", sendStreamID);
+				delete packet;
+			}
+		}	
+		else 
+		{
+			if (packet->IsSYN () && !packet->GetSeqn ()) // new incoming stream
+			{	
+				auto incomingStream = CreateNewIncomingStream ();
+				incomingStream->HandleNextPacket (packet);
+				if (m_Acceptor != nullptr)
+					m_Acceptor (incomingStream);
+				else
+				{
+					LogPrint ("Acceptor for incoming stream is not set");
+					DeleteStream (incomingStream);
+				}	
+			}	
+			else // follow on packet without SYN
+			{
+				uint32_t receiveStreamID = packet->GetReceiveStreamID ();
+				for (auto it: m_Streams)
+					if (it.second->GetSendStreamID () == receiveStreamID)
+					{
+						// found
+						it.second->HandleNextPacket (packet);
+						return;
+					}
+				// TODO: should queue it up
+				LogPrint ("Unknown stream receiveStreamID=", receiveStreamID);
+				delete packet;
+			}	
+		}	
+	}	
+
+	std::shared_ptr<Stream> StreamingDestination::CreateNewOutgoingStream (const i2p::data::LeaseSet& remote, int port)
+	{
+		auto s = std::make_shared<Stream> (m_Owner.GetService (), *this, remote, port);
+		std::unique_lock<std::mutex> l(m_StreamsMutex);
+		m_Streams[s->GetRecvStreamID ()] = s;
+		return s;
+	}	
+
+	std::shared_ptr<Stream> StreamingDestination::CreateNewIncomingStream ()
+	{
+		auto s = std::make_shared<Stream> (m_Owner.GetService (), *this);
+		std::unique_lock<std::mutex> l(m_StreamsMutex);
+		m_Streams[s->GetRecvStreamID ()] = s;
+		return s;
+	}
+
+	void StreamingDestination::DeleteStream (std::shared_ptr<Stream> stream)
+	{
+		if (stream)
+		{	
+			std::unique_lock<std::mutex> l(m_StreamsMutex);
+			auto it = m_Streams.find (stream->GetRecvStreamID ());
+			if (it != m_Streams.end ())
+				m_Streams.erase (it);
+		}	
+	}		
+
+	void StreamingDestination::HandleDataMessagePayload (const uint8_t * buf, size_t len)
+	{
+		// unzip it
+		CryptoPP::Gunzip decompressor;
+		decompressor.Put (buf, len);
+		decompressor.MessageEnd();
+		Packet * uncompressed = new Packet;
+		uncompressed->offset = 0;
+		uncompressed->len = decompressor.MaxRetrievable ();
+		if (uncompressed->len <= MAX_PACKET_SIZE)
+		{
+			decompressor.Get (uncompressed->buf, uncompressed->len);
+			HandleNextPacket (uncompressed); 
+		}
+		else
+		{
+			LogPrint ("Received packet size ", uncompressed->len,  " exceeds max packet size. Skipped");
+			delete uncompressed;
+		}	
+	}
+}		
+}	
--- a/Streaming.h
+++ b/Streaming.h
@ -0,0 +1,238 @@
+#ifndef STREAMING_H__
+#define STREAMING_H__
+
+#include <inttypes.h>
+#include <string>
+#include <map>
+#include <set>
+#include <queue>
+#include <functional>
+#include <memory>
+#include <boost/asio.hpp>
+#include "I2PEndian.h"
+#include "Identity.h"
+#include "LeaseSet.h"
+#include "I2NPProtocol.h"
+#include "Garlic.h"
+#include "Tunnel.h"
+
+namespace i2p
+{
+namespace client
+{
+	class ClientDestination;
+}
+namespace stream
+{
+	const uint16_t PACKET_FLAG_SYNCHRONIZE = 0x0001;
+	const uint16_t PACKET_FLAG_CLOSE = 0x0002;
+	const uint16_t PACKET_FLAG_RESET = 0x0004;
+	const uint16_t PACKET_FLAG_SIGNATURE_INCLUDED = 0x0008;
+	const uint16_t PACKET_FLAG_SIGNATURE_REQUESTED = 0x0010;
+	const uint16_t PACKET_FLAG_FROM_INCLUDED = 0x0020;
+	const uint16_t PACKET_FLAG_DELAY_REQUESTED = 0x0040;
+	const uint16_t PACKET_FLAG_MAX_PACKET_SIZE_INCLUDED = 0x0080;
+	const uint16_t PACKET_FLAG_PROFILE_INTERACTIVE = 0x0100;
+	const uint16_t PACKET_FLAG_ECHO = 0x0200;
+	const uint16_t PACKET_FLAG_NO_ACK = 0x0400;
+
+	const size_t STREAMING_MTU = 1730;
+	const size_t MAX_PACKET_SIZE = 4096;
+	const size_t COMPRESSION_THRESHOLD_SIZE = 66;	
+	const int RESEND_TIMEOUT = 10; // in seconds
+	const int ACK_SEND_TIMEOUT = 200; // in milliseconds
+	const int MAX_NUM_RESEND_ATTEMPTS = 5;	
+	
+	struct Packet
+	{
+		size_t len, offset;
+		uint8_t buf[MAX_PACKET_SIZE];	
+		int numResendAttempts;
+		
+		Packet (): len (0), offset (0), numResendAttempts (0) {};
+		uint8_t * GetBuffer () { return buf + offset; };
+		size_t GetLength () const { return len - offset; };
+
+		uint32_t GetSendStreamID () const { return bufbe32toh (buf); };
+		uint32_t GetReceiveStreamID () const { return bufbe32toh (buf + 4); };
+		uint32_t GetSeqn () const { return bufbe32toh (buf + 8); };
+		uint32_t GetAckThrough () const { return bufbe32toh (buf + 12); };
+		uint8_t GetNACKCount () const { return buf[16]; };
+		uint32_t GetNACK (int i) const { return bufbe32toh (buf + 17 + 4 * i); };
+		const uint8_t * GetOption () const { return buf + 17 + GetNACKCount ()*4 + 3; }; // 3 = resendDelay + flags
+		uint16_t GetFlags () const { return bufbe16toh (GetOption () - 2); };
+		uint16_t GetOptionSize () const { return bufbe16toh (GetOption ()); };
+		const uint8_t * GetOptionData () const { return GetOption () + 2; };
+		const uint8_t * GetPayload () const { return GetOptionData () + GetOptionSize (); };
+
+		bool IsSYN () const { return GetFlags () & PACKET_FLAG_SYNCHRONIZE; };
+		bool IsNoAck () const { return GetFlags () & PACKET_FLAG_NO_ACK; };
+	};	
+
+	struct PacketCmp
+	{
+		bool operator() (const Packet * p1, const Packet * p2) const
+  		{	
+			return p1->GetSeqn () < p2->GetSeqn (); 
+		};
+	};	
+	
+	class StreamingDestination;
+	class Stream: public std::enable_shared_from_this<Stream>
+	{	
+		public:
+
+			Stream (boost::asio::io_service& service, StreamingDestination& local, 
+				const i2p::data::LeaseSet& remote, int port = 0); // outgoing
+			Stream (boost::asio::io_service& service, StreamingDestination& local); // incoming			
+
+			~Stream ();
+			uint32_t GetSendStreamID () const { return m_SendStreamID; };
+			uint32_t GetRecvStreamID () const { return m_RecvStreamID; };
+			const i2p::data::LeaseSet * GetRemoteLeaseSet () const { return m_RemoteLeaseSet; };
+			const i2p::data::IdentityEx& GetRemoteIdentity () const { return m_RemoteIdentity; };
+			bool IsOpen () const { return m_IsOpen; };
+			bool IsEstablished () const { return m_SendStreamID; };
+			StreamingDestination& GetLocalDestination () { return m_LocalDestination; };
+			
+			void HandleNextPacket (Packet * packet);
+			size_t Send (const uint8_t * buf, size_t len);
+			
+			template<typename Buffer, typename ReceiveHandler>
+			void AsyncReceive (const Buffer& buffer, ReceiveHandler handler, int timeout = 0);
+			size_t ReadSome (uint8_t * buf, size_t len) { return ConcatenatePackets (buf, len); };
+			
+			void Close ();
+			void Cancel () { m_ReceiveTimer.cancel (); };
+
+			size_t GetNumSentBytes () const { return m_NumSentBytes; };
+			size_t GetNumReceivedBytes () const { return m_NumReceivedBytes; };
+			size_t GetSendQueueSize () const { return m_SentPackets.size (); };
+			size_t GetReceiveQueueSize () const { return m_ReceiveQueue.size (); };
+			
+		private:
+
+			void SendQuickAck ();
+			bool SendPacket (Packet * packet);
+			void PostPackets (const std::vector<Packet *> packets);
+			void SendPackets (const std::vector<Packet *>& packets);
+
+			void SavePacket (Packet * packet);
+			void ProcessPacket (Packet * packet);
+			void ProcessAck (Packet * packet);
+			size_t ConcatenatePackets (uint8_t * buf, size_t len);
+
+			void UpdateCurrentRemoteLease ();
+			
+			template<typename Buffer, typename ReceiveHandler>
+			void HandleReceiveTimer (const boost::system::error_code& ecode, const Buffer& buffer, ReceiveHandler handler);
+
+			void ScheduleResend ();
+			void HandleResendTimer (const boost::system::error_code& ecode);
+			void HandleAckSendTimer (const boost::system::error_code& ecode);
+
+			I2NPMessage * CreateDataMessage (const uint8_t * payload, size_t len);
+			
+		private:
+
+			boost::asio::io_service& m_Service;
+			uint32_t m_SendStreamID, m_RecvStreamID, m_SequenceNumber;
+			int32_t m_LastReceivedSequenceNumber;
+			bool m_IsOpen, m_IsReset, m_IsAckSendScheduled;
+			StreamingDestination& m_LocalDestination;
+			i2p::data::IdentityEx m_RemoteIdentity;
+			const i2p::data::LeaseSet * m_RemoteLeaseSet;
+			i2p::garlic::GarlicRoutingSession * m_RoutingSession;
+			i2p::data::Lease m_CurrentRemoteLease;
+			i2p::tunnel::OutboundTunnel * m_CurrentOutboundTunnel;
+			std::queue<Packet *> m_ReceiveQueue;
+			std::set<Packet *, PacketCmp> m_SavedPackets;
+			std::set<Packet *, PacketCmp> m_SentPackets;
+			boost::asio::deadline_timer m_ReceiveTimer, m_ResendTimer, m_AckSendTimer;
+			size_t m_NumSentBytes, m_NumReceivedBytes;
+			uint16_t m_Port;
+	};
+
+	class StreamingDestination
+	{
+		public:
+
+			typedef std::function<void (std::shared_ptr<Stream>)> Acceptor;
+
+			StreamingDestination (i2p::client::ClientDestination& owner): m_Owner (owner) {};
+			~StreamingDestination () {};	
+
+			void Start ();
+			void Stop ();
+
+			std::shared_ptr<Stream> CreateNewOutgoingStream (const i2p::data::LeaseSet& remote, int port = 0);
+			void DeleteStream (std::shared_ptr<Stream> stream);			
+			void SetAcceptor (const Acceptor& acceptor) { m_Acceptor = acceptor; };
+			void ResetAcceptor () { m_Acceptor = nullptr; };
+			bool IsAcceptorSet () const { return m_Acceptor != nullptr; };	
+			i2p::client::ClientDestination& GetOwner () { return m_Owner; };
+
+			void HandleDataMessagePayload (const uint8_t * buf, size_t len);
+
+		private:		
+	
+			void HandleNextPacket (Packet * packet);
+			std::shared_ptr<Stream> CreateNewIncomingStream ();
+
+		private:
+
+			i2p::client::ClientDestination& m_Owner;
+			std::mutex m_StreamsMutex;
+			std::map<uint32_t, std::shared_ptr<Stream> > m_Streams;
+			Acceptor m_Acceptor;
+			
+		public:
+
+			// for HTTP only
+			const decltype(m_Streams)& GetStreams () const { return m_Streams; };
+	};		
+
+//-------------------------------------------------
+
+	template<typename Buffer, typename ReceiveHandler>
+	void Stream::AsyncReceive (const Buffer& buffer, ReceiveHandler handler, int timeout)
+	{
+		if (!m_ReceiveQueue.empty ())
+		{
+			auto s = shared_from_this();
+			m_Service.post ([=](void) { s->HandleReceiveTimer (
+				boost::asio::error::make_error_code (boost::asio::error::operation_aborted),
+				buffer, handler); });
+		}
+		else
+		{
+			m_ReceiveTimer.expires_from_now (boost::posix_time::seconds(timeout));
+			auto s = shared_from_this();
+			m_ReceiveTimer.async_wait ([=](const boost::system::error_code& ecode)
+				{ s->HandleReceiveTimer (ecode, buffer, handler); });
+		}
+	}
+
+	template<typename Buffer, typename ReceiveHandler>
+	void Stream::HandleReceiveTimer (const boost::system::error_code& ecode, const Buffer& buffer, ReceiveHandler handler)
+	{
+		size_t received = ConcatenatePackets (boost::asio::buffer_cast<uint8_t *>(buffer), boost::asio::buffer_size(buffer));
+		if (ecode == boost::asio::error::operation_aborted)
+		{	
+			// timeout not expired	
+			if (m_IsOpen)
+				// no error
+				handler (boost::system::error_code (), received); 
+			else
+				// socket closed
+				handler (m_IsReset ? boost::asio::error::make_error_code (boost::asio::error::connection_reset) :
+					boost::asio::error::make_error_code (boost::asio::error::operation_aborted), received);
+		}	
+		else
+			// timeout expired
+			handler (boost::asio::error::make_error_code (boost::asio::error::timed_out), received);
+	}
+}		
+}	
+
+#endif
--- a/Timestamp.h
+++ b/Timestamp.h
@ -0,0 +1,32 @@
+#ifndef TIMESTAMP_H__
+#define TIMESTAMP_H__
+
+#include <inttypes.h>
+#include <chrono>
+
+namespace i2p
+{
+namespace util
+{
+	inline uint64_t GetMillisecondsSinceEpoch ()
+	{
+		return std::chrono::duration_cast<std::chrono::milliseconds>(
+			  	 std::chrono::system_clock::now().time_since_epoch()).count ();
+	}
+
+	inline uint32_t GetHoursSinceEpoch ()
+	{
+		return std::chrono::duration_cast<std::chrono::hours>(
+			  	 std::chrono::system_clock::now().time_since_epoch()).count ();
+	}
+
+	inline uint64_t GetSecondsSinceEpoch ()
+	{
+		return std::chrono::duration_cast<std::chrono::seconds>(
+			  	 std::chrono::system_clock::now().time_since_epoch()).count ();
+	}
+}
+}
+
+#endif
+
--- a/TransitTunnel.cpp
+++ b/TransitTunnel.cpp
@ -0,0 +1,85 @@
+#include <string.h>
+#include "I2PEndian.h"
+#include "Log.h"
+#include "RouterContext.h"
+#include "I2NPProtocol.h"
+#include "Tunnel.h"
+#include "Transports.h"
+#include "TransitTunnel.h"
+
+namespace i2p
+{
+namespace tunnel
+{	
+	TransitTunnel::TransitTunnel (uint32_t receiveTunnelID, 
+	    const uint8_t * nextIdent, uint32_t nextTunnelID, 
+		const uint8_t * layerKey,const uint8_t * ivKey): 
+			m_TunnelID (receiveTunnelID),  m_NextTunnelID (nextTunnelID), 
+			m_NextIdent (nextIdent), m_NumTransmittedBytes (0)
+	{	
+		m_Encryption.SetKeys (layerKey, ivKey);
+	}	
+
+	void TransitTunnel::EncryptTunnelMsg (I2NPMessage * tunnelMsg)
+	{		
+		m_Encryption.Encrypt (tunnelMsg->GetPayload () + 4); 
+	}	
+	
+	void TransitTunnel::HandleTunnelDataMsg (i2p::I2NPMessage * tunnelMsg)
+	{
+		EncryptTunnelMsg (tunnelMsg);
+		
+		LogPrint ("TransitTunnel: ",m_TunnelID,"->", m_NextTunnelID);
+		m_NumTransmittedBytes += tunnelMsg->GetLength ();
+		htobe32buf (tunnelMsg->GetPayload (), m_NextTunnelID);
+		FillI2NPMessageHeader (tunnelMsg, eI2NPTunnelData);
+		
+		i2p::transport::transports.SendMessage (m_NextIdent, tunnelMsg);	
+	}
+
+	void TransitTunnel::SendTunnelDataMsg (i2p::I2NPMessage * msg)
+	{	
+		LogPrint ("We are not a gateway for transit tunnel ", m_TunnelID);
+		i2p::DeleteI2NPMessage (msg);	
+	}		
+
+	void TransitTunnelGateway::SendTunnelDataMsg (i2p::I2NPMessage * msg)
+	{
+		TunnelMessageBlock block;
+		block.deliveryType = eDeliveryTypeLocal;
+		block.data = msg;
+		std::unique_lock<std::mutex> l(m_SendMutex);
+		m_Gateway.SendTunnelDataMsg (block);
+	}		
+
+	void TransitTunnelEndpoint::HandleTunnelDataMsg (i2p::I2NPMessage * tunnelMsg)
+	{
+		EncryptTunnelMsg (tunnelMsg);
+		
+		LogPrint ("TransitTunnel endpoint for ", GetTunnelID ());
+		m_Endpoint.HandleDecryptedTunnelDataMsg (tunnelMsg); 
+	}
+		
+	TransitTunnel * CreateTransitTunnel (uint32_t receiveTunnelID,
+		const uint8_t * nextIdent, uint32_t nextTunnelID, 
+	    const uint8_t * layerKey,const uint8_t * ivKey, 
+		bool isGateway, bool isEndpoint)
+	{
+		if (isEndpoint)
+		{	
+			LogPrint ("TransitTunnel endpoint: ", receiveTunnelID, " created");
+			return new TransitTunnelEndpoint (receiveTunnelID, nextIdent, nextTunnelID, layerKey, ivKey);
+		}	
+		else if (isGateway)
+		{	
+			LogPrint ("TransitTunnel gateway: ", receiveTunnelID, " created");
+			return new TransitTunnelGateway (receiveTunnelID, nextIdent, nextTunnelID, layerKey, ivKey);
+		}	
+		else	
+		{	
+			LogPrint ("TransitTunnel: ", receiveTunnelID, "->", nextTunnelID, " created");
+			return new TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID, layerKey, ivKey);
+		}	
+	}		
+}
+}
--- a/TransitTunnel.h
+++ b/TransitTunnel.h
@ -0,0 +1,88 @@
+#ifndef TRANSIT_TUNNEL_H__
+#define TRANSIT_TUNNEL_H__
+
+#include <inttypes.h>
+#include <mutex>
+#include "aes.h"
+#include "I2NPProtocol.h"
+#include "TunnelEndpoint.h"
+#include "TunnelGateway.h"
+#include "TunnelBase.h"
+
+namespace i2p
+{
+namespace tunnel
+{	
+	class TransitTunnel: public TunnelBase // tunnel patricipant
+	{
+		public:
+
+			TransitTunnel (uint32_t receiveTunnelID,
+			    const uint8_t * nextIdent, uint32_t nextTunnelID, 
+	    		const uint8_t * layerKey,const uint8_t * ivKey); 
+			
+			virtual void HandleTunnelDataMsg (i2p::I2NPMessage * tunnelMsg);
+			virtual void SendTunnelDataMsg (i2p::I2NPMessage * msg);
+			virtual size_t GetNumTransmittedBytes () const { return m_NumTransmittedBytes; };
+			
+			uint32_t GetTunnelID () const { return m_TunnelID; };
+
+			// implements TunnelBase
+			void EncryptTunnelMsg (I2NPMessage * tunnelMsg); 
+			uint32_t GetNextTunnelID () const { return m_NextTunnelID; };
+			const i2p::data::IdentHash& GetNextIdentHash () const { return m_NextIdent; };
+			
+		private:
+
+			uint32_t m_TunnelID, m_NextTunnelID;
+			i2p::data::IdentHash m_NextIdent;
+			size_t m_NumTransmittedBytes;
+			
+			i2p::crypto::TunnelEncryption m_Encryption;
+	};	
+
+	class TransitTunnelGateway: public TransitTunnel
+	{
+		public:
+
+			TransitTunnelGateway (uint32_t receiveTunnelID,
+			    const uint8_t * nextIdent, uint32_t nextTunnelID, 
+	    		const uint8_t * layerKey,const uint8_t * ivKey):
+				TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID, 
+				layerKey, ivKey), m_Gateway(this) {};
+
+			void SendTunnelDataMsg (i2p::I2NPMessage * msg);
+			size_t GetNumTransmittedBytes () const { return m_Gateway.GetNumSentBytes (); };
+			
+		private:
+
+			std::mutex m_SendMutex;
+			TunnelGateway m_Gateway;
+	};	
+
+	class TransitTunnelEndpoint: public TransitTunnel
+	{
+		public:
+
+			TransitTunnelEndpoint (uint32_t receiveTunnelID,
+			    const uint8_t * nextIdent, uint32_t nextTunnelID, 
+	    		const uint8_t * layerKey,const uint8_t * ivKey):
+				TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID, layerKey, ivKey),
+				m_Endpoint (false) {}; // transit endpoint is always outbound
+
+			void HandleTunnelDataMsg (i2p::I2NPMessage * tunnelMsg);
+			size_t GetNumTransmittedBytes () const { return m_Endpoint.GetNumReceivedBytes (); }
+			
+		private:
+
+			TunnelEndpoint m_Endpoint;
+	};
+	
+	TransitTunnel * CreateTransitTunnel (uint32_t receiveTunnelID,
+		const uint8_t * nextIdent, uint32_t nextTunnelID, 
+	    const uint8_t * layerKey,const uint8_t * ivKey, 
+		bool isGateway, bool isEndpoint);
+}
+}
+
+#endif
--- a/TransportSession.h
+++ b/TransportSession.h
@ -0,0 +1,76 @@
+#ifndef TRANSPORT_SESSION_H__
+#define TRANSPORT_SESSION_H__
+
+#include <inttypes.h>
+#include <iostream>
+#include <memory>
+#include "Identity.h"
+#include "RouterInfo.h"
+
+namespace i2p
+{
+namespace transport
+{
+	struct DHKeysPair // transient keys for transport sessions
+	{
+		uint8_t publicKey[256];
+		uint8_t privateKey[256];
+	};	
+
+	class SignedData
+	{
+		public:
+
+			SignedData () {};
+			void Insert (const uint8_t * buf, size_t len) 
+			{ 
+				m_Stream.write ((char *)buf, len); 
+			}			
+
+			template<typename T>
+			void Insert (T t)
+			{
+				m_Stream.write ((char *)&t, sizeof (T)); 
+			}
+
+			bool Verify (const i2p::data::IdentityEx& ident, const uint8_t * signature) const
+			{
+				return ident.Verify ((const uint8_t *)m_Stream.str ().c_str (), m_Stream.str ().size (), signature); 
+			}
+
+			void Sign (const i2p::data::PrivateKeys& keys, uint8_t * signature) const
+			{
+				keys.Sign ((const uint8_t *)m_Stream.str ().c_str (), m_Stream.str ().size (), signature); 
+			}	
+
+		private:
+		
+			std::stringstream m_Stream;
+	};		
+
+	class TransportSession
+	{
+		public:
+
+			TransportSession (std::shared_ptr<const i2p::data::RouterInfo> in_RemoteRouter): 
+				m_RemoteRouter (in_RemoteRouter), m_DHKeysPair (nullptr) 
+			{
+				if (m_RemoteRouter)
+					m_RemoteIdentity = m_RemoteRouter->GetRouterIdentity ();
+			}
+
+			virtual ~TransportSession () { delete m_DHKeysPair; };
+			
+			std::shared_ptr<const i2p::data::RouterInfo> GetRemoteRouter () { return m_RemoteRouter; };
+			const i2p::data::IdentityEx& GetRemoteIdentity () { return m_RemoteIdentity; };
+
+		protected:
+
+			std::shared_ptr<const i2p::data::RouterInfo> m_RemoteRouter;
+			i2p::data::IdentityEx m_RemoteIdentity; 
+			DHKeysPair * m_DHKeysPair; // X - for client and Y - for server
+	};	
+}
+}
+
+#endif
--- a/Transports.cpp
+++ b/Transports.cpp
@ -0,0 +1,401 @@
+#include <cryptopp/dh.h>
+#include <boost/bind.hpp>
+#include "Log.h"
+#include "CryptoConst.h"
+#include "RouterContext.h"
+#include "I2NPProtocol.h"
+#include "NetDb.h"
+#include "Transports.h"
+
+using namespace i2p::data;
+
+namespace i2p
+{
+namespace transport
+{
+	DHKeysPairSupplier::DHKeysPairSupplier (int size):
+		m_QueueSize (size), m_IsRunning (false), m_Thread (nullptr)
+	{
+	}	
+
+	DHKeysPairSupplier::~DHKeysPairSupplier ()
+	{
+		Stop ();
+	}
+
+	void DHKeysPairSupplier::Start ()
+	{
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&DHKeysPairSupplier::Run, this));
+	}
+
+	void DHKeysPairSupplier::Stop ()
+	{
+		m_IsRunning = false;
+		m_Acquired.notify_one ();	
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = 0;
+		}	
+	}
+
+	void DHKeysPairSupplier::Run ()
+	{
+		while (m_IsRunning)
+		{
+			int num;
+			while ((num = m_QueueSize - m_Queue.size ()) > 0)
+				CreateDHKeysPairs (num);
+			std::unique_lock<std::mutex>  l(m_AcquiredMutex);
+			m_Acquired.wait (l); // wait for element gets aquired
+		}
+	}		
+
+	void DHKeysPairSupplier::CreateDHKeysPairs (int num)
+	{
+		if (num > 0)
+		{
+			CryptoPP::DH dh (i2p::crypto::elgp, i2p::crypto::elgg);
+			for (int i = 0; i < num; i++)
+			{
+				i2p::transport::DHKeysPair * pair = new i2p::transport::DHKeysPair ();
+				dh.GenerateKeyPair(m_Rnd, pair->privateKey, pair->publicKey);
+				std::unique_lock<std::mutex>  l(m_AcquiredMutex);
+				m_Queue.push (pair);
+			}
+		}
+	}
+
+	DHKeysPair * DHKeysPairSupplier::Acquire ()
+	{
+		if (!m_Queue.empty ())
+		{
+			std::unique_lock<std::mutex>  l(m_AcquiredMutex);
+			auto pair = m_Queue.front ();
+			m_Queue.pop ();
+			m_Acquired.notify_one ();
+			return pair;
+		}	
+		else // queue is empty, create new
+		{
+			DHKeysPair * pair = new DHKeysPair ();
+			CryptoPP::DH dh (i2p::crypto::elgp, i2p::crypto::elgg);
+			dh.GenerateKeyPair(m_Rnd, pair->privateKey, pair->publicKey);
+			return pair;
+		}
+	}
+
+	void DHKeysPairSupplier::Return (DHKeysPair * pair)
+	{
+		std::unique_lock<std::mutex>  l(m_AcquiredMutex);
+		m_Queue.push (pair);
+	}
+
+	Transports transports;	
+	
+	Transports::Transports (): 
+		m_Thread (nullptr), m_Work (m_Service), m_NTCPAcceptor (nullptr), m_NTCPV6Acceptor (nullptr), 
+		m_SSUServer (nullptr), m_DHKeysPairSupplier (5) // 5 pre-generated keys
+	{		
+	}
+		
+	Transports::~Transports () 
+	{ 
+		Stop ();
+	}	
+
+	void Transports::Start ()
+	{
+		m_DHKeysPairSupplier.Start ();
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&Transports::Run, this));
+		// create acceptors
+		auto addresses = context.GetRouterInfo ().GetAddresses ();
+		for (auto& address : addresses)
+		{
+			if (address.transportStyle == RouterInfo::eTransportNTCP && address.host.is_v4 ())
+			{	
+				m_NTCPAcceptor = new boost::asio::ip::tcp::acceptor (m_Service,
+					boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v4(), address.port));
+
+				LogPrint ("Start listening TCP port ", address.port);	
+				auto conn = std::make_shared<NTCPSession>(m_Service);
+				m_NTCPAcceptor->async_accept(conn->GetSocket (), boost::bind (&Transports::HandleAccept, this, 
+					conn, boost::asio::placeholders::error));	
+				
+				if (context.SupportsV6 ())
+				{
+					m_NTCPV6Acceptor = new boost::asio::ip::tcp::acceptor (m_Service);
+					m_NTCPV6Acceptor->open (boost::asio::ip::tcp::v6());
+					m_NTCPV6Acceptor->set_option (boost::asio::ip::v6_only (true));
+					m_NTCPV6Acceptor->bind (boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v6(), address.port));
+					m_NTCPV6Acceptor->listen ();
+
+					LogPrint ("Start listening V6 TCP port ", address.port);	
+					auto conn = std::make_shared<NTCPSession> (m_Service);
+					m_NTCPV6Acceptor->async_accept(conn->GetSocket (), boost::bind (&Transports::HandleAcceptV6,
+						this, conn, boost::asio::placeholders::error));
+				}	
+			}	
+			else if (address.transportStyle == RouterInfo::eTransportSSU && address.host.is_v4 ())
+			{
+				if (!m_SSUServer)
+				{	
+					m_SSUServer = new SSUServer (address.port);
+					LogPrint ("Start listening UDP port ", address.port);
+					m_SSUServer->Start ();	
+					DetectExternalIP ();
+				}
+				else
+					LogPrint ("SSU server already exists");
+			}
+		}	
+	}
+		
+	void Transports::Stop ()
+	{	
+		if (m_SSUServer)
+		{
+			m_SSUServer->Stop ();
+			delete m_SSUServer;
+			m_SSUServer = nullptr;
+		}	
+		m_NTCPSessions.clear ();
+		
+		delete m_NTCPAcceptor;
+		m_NTCPAcceptor = nullptr;
+		delete m_NTCPV6Acceptor;
+		m_NTCPV6Acceptor = nullptr;
+
+		m_DHKeysPairSupplier.Stop ();
+		m_IsRunning = false;
+		m_Service.stop ();
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = nullptr;
+		}	
+	}	
+
+	void Transports::Run () 
+	{ 
+		while (m_IsRunning)
+		{
+			try
+			{	
+				m_Service.run ();
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint ("Transports: ", ex.what ());
+			}	
+		}	
+	}
+		
+	void Transports::AddNTCPSession (std::shared_ptr<NTCPSession> session)
+	{
+		if (session)
+			m_NTCPSessions[session->GetRemoteIdentity ().GetIdentHash ()] = session;
+	}	
+
+	void Transports::RemoveNTCPSession (std::shared_ptr<NTCPSession> session)
+	{
+		if (session)
+			m_NTCPSessions.erase (session->GetRemoteIdentity ().GetIdentHash ());
+	}	
+		
+	void Transports::HandleAccept (std::shared_ptr<NTCPSession> conn, const boost::system::error_code& error)
+	{		
+		if (!error)
+		{
+			LogPrint ("Connected from ", conn->GetSocket ().remote_endpoint().address ().to_string ());
+			conn->ServerLogin ();
+		}
+		
+
+		if (error != boost::asio::error::operation_aborted)
+		{
+    		conn = std::make_shared<NTCPSession> (m_Service);
+			m_NTCPAcceptor->async_accept(conn->GetSocket (), boost::bind (&Transports::HandleAccept, this, 
+				conn, boost::asio::placeholders::error));
+		}	
+	}
+
+	void Transports::HandleAcceptV6 (std::shared_ptr<NTCPSession> conn, const boost::system::error_code& error)
+	{		
+		if (!error)
+		{
+			LogPrint ("Connected from ", conn->GetSocket ().remote_endpoint().address ().to_string ());
+			conn->ServerLogin ();
+		}
+
+		if (error != boost::asio::error::operation_aborted)
+		{
+    		conn = std::make_shared<NTCPSession> (m_Service);
+			m_NTCPV6Acceptor->async_accept(conn->GetSocket (), boost::bind (&Transports::HandleAcceptV6, this, 
+				conn, boost::asio::placeholders::error));
+		}	
+	}
+
+	void Transports::Connect (const boost::asio::ip::address& address, int port, std::shared_ptr<NTCPSession> conn)
+	{
+		LogPrint ("Connecting to ", address ,":",  port);
+		conn->GetSocket ().async_connect (boost::asio::ip::tcp::endpoint (address, port), 
+			boost::bind (&Transports::HandleConnect, this, boost::asio::placeholders::error, conn));
+	}
+
+	void Transports::HandleConnect (const boost::system::error_code& ecode, std::shared_ptr<NTCPSession> conn)
+	{
+		if (ecode)
+        {
+			LogPrint ("Connect error: ", ecode.message ());
+			if (ecode != boost::asio::error::operation_aborted)
+			{
+				i2p::data::netdb.SetUnreachable (conn->GetRemoteIdentity ().GetIdentHash (), true);
+				conn->Terminate ();
+			}
+		}
+		else
+		{
+			LogPrint ("Connected");
+			if (conn->GetSocket ().local_endpoint ().protocol () == boost::asio::ip::tcp::v6()) // ipv6
+				context.UpdateNTCPV6Address (conn->GetSocket ().local_endpoint ().address ());
+			conn->ClientLogin ();
+		}	
+	}	
+
+	std::shared_ptr<NTCPSession> Transports::GetNextNTCPSession ()
+	{
+		for (auto session: m_NTCPSessions)
+			if (session.second->IsEstablished ())
+				return session.second;
+		return 0;
+	}	
+
+	std::shared_ptr<NTCPSession> Transports::FindNTCPSession (const i2p::data::IdentHash& ident)
+	{
+		auto it = m_NTCPSessions.find (ident);
+		if (it != m_NTCPSessions.end ())
+			return it->second;
+		return 0;
+	}	
+
+	void Transports::SendMessage (const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg)
+	{
+		if (ident == i2p::context.GetRouterInfo ().GetIdentHash ())
+			// we send it to ourself
+			i2p::HandleI2NPMessage (msg);
+		else
+			m_Service.post (boost::bind (&Transports::PostMessage, this, ident, msg));                             
+	}	
+
+	void Transports::PostMessage (const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg)
+	{
+		auto session = FindNTCPSession (ident);
+		if (session)
+			session->SendI2NPMessage (msg);
+		else
+		{
+			auto r = netdb.FindRouter (ident);
+			if (r)
+			{	
+				auto ssuSession = m_SSUServer ? m_SSUServer->FindSession (r) : nullptr;
+				if (ssuSession)
+					ssuSession->SendI2NPMessage (msg);
+				else
+				{	
+					// existing session not found. create new 
+					// try NTCP first if message size < 16K
+					auto address = r->GetNTCPAddress (!context.SupportsV6 ()); 
+					if (address && !r->UsesIntroducer () && !r->IsUnreachable () && msg->GetLength () < NTCP_MAX_MESSAGE_SIZE)
+					{	
+						auto s = std::make_shared<NTCPSession> (m_Service, r);
+						AddNTCPSession (s);
+						s->SendI2NPMessage (msg);
+						Connect (address->host, address->port, s);
+					}	
+					else
+					{	
+						// then SSU					
+						auto s = m_SSUServer ? m_SSUServer->GetSession (r) : nullptr;
+						if (s)
+							s->SendI2NPMessage (msg);
+						else
+						{
+							LogPrint ("No NTCP and SSU addresses available");
+							DeleteI2NPMessage (msg); 
+						}
+					}
+				}	
+			}
+			else
+			{
+				LogPrint ("Router not found. Requested");
+				i2p::data::netdb.RequestDestination (ident);
+				auto resendTimer = new boost::asio::deadline_timer (m_Service);
+				resendTimer->expires_from_now (boost::posix_time::seconds(5)); // 5 seconds
+				resendTimer->async_wait (boost::bind (&Transports::HandleResendTimer,
+					this, boost::asio::placeholders::error, resendTimer, ident, msg));			
+			}	
+		}	
+	}	
+
+	void Transports::HandleResendTimer (const boost::system::error_code& ecode, 
+		boost::asio::deadline_timer * timer, const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg)
+	{
+		auto r = netdb.FindRouter (ident);
+		if (r)
+		{
+			LogPrint ("Router found. Sending message");
+			PostMessage (ident, msg);
+		}	
+		else
+		{
+			LogPrint ("Router not found. Failed to send message");
+			DeleteI2NPMessage (msg);
+		}	
+		delete timer;
+	}	
+		
+	void Transports::CloseSession (std::shared_ptr<const i2p::data::RouterInfo> router)
+	{
+		if (!router) return;
+		m_Service.post (boost::bind (&Transports::PostCloseSession, this, router));    
+	}	
+
+	void Transports::PostCloseSession (std::shared_ptr<const i2p::data::RouterInfo> router)
+	{
+		auto ssuSession = m_SSUServer ? m_SSUServer->FindSession (router) : nullptr;
+		if (ssuSession) // try SSU first
+		{	
+			m_SSUServer->DeleteSession (ssuSession);
+			LogPrint ("SSU session closed");	
+		}	
+		// TODO: delete NTCP
+	}	
+		
+	void Transports::DetectExternalIP ()
+	{
+		for (int i = 0; i < 5; i++)
+		{
+			auto router = i2p::data::netdb.GetRandomRouter ();
+			if (router && router->IsSSU () && m_SSUServer)
+				m_SSUServer->GetSession (router, true);  // peer test	
+		}	
+	}
+			
+	DHKeysPair * Transports::GetNextDHKeysPair ()
+	{
+		return m_DHKeysPairSupplier.Acquire ();
+	}
+
+	void Transports::ReuseDHKeysPair (DHKeysPair * pair)
+	{
+		m_DHKeysPairSupplier.Return (pair);
+	}
+}
+}
+
--- a/Transports.h
+++ b/Transports.h
@ -0,0 +1,115 @@
+#ifndef TRANSPORTS_H__
+#define TRANSPORTS_H__
+
+#include <thread>
+#include <mutex>
+#include <condition_variable>
+#include <functional>
+#include <map>
+#include <queue>
+#include <string>
+#include <memory>
+#include <cryptopp/osrng.h>
+#include <boost/asio.hpp>
+#include "TransportSession.h"
+#include "NTCPSession.h"
+#include "SSU.h"
+#include "RouterInfo.h"
+#include "I2NPProtocol.h"
+#include "Identity.h"
+
+namespace i2p
+{
+namespace transport
+{
+	class DHKeysPairSupplier
+	{
+		public:
+
+			DHKeysPairSupplier (int size);
+			~DHKeysPairSupplier ();
+			void Start ();
+			void Stop ();
+			DHKeysPair * Acquire ();
+			void Return (DHKeysPair * pair);
+
+		private:
+
+			void Run ();
+			void CreateDHKeysPairs (int num);
+
+		private:
+
+			const int m_QueueSize;
+			std::queue<DHKeysPair *> m_Queue;
+
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			std::condition_variable m_Acquired;
+			std::mutex m_AcquiredMutex;
+			CryptoPP::AutoSeededRandomPool m_Rnd;
+	};
+
+	class Transports
+	{
+		public:
+
+			Transports ();
+			~Transports ();
+
+			void Start ();
+			void Stop ();
+			
+			boost::asio::io_service& GetService () { return m_Service; };
+			i2p::transport::DHKeysPair * GetNextDHKeysPair ();	
+			void ReuseDHKeysPair (DHKeysPair * pair);
+
+			void AddNTCPSession (std::shared_ptr<NTCPSession> session);
+			void RemoveNTCPSession (std::shared_ptr<NTCPSession> session);
+			
+			std::shared_ptr<NTCPSession> GetNextNTCPSession ();
+			std::shared_ptr<NTCPSession> FindNTCPSession (const i2p::data::IdentHash& ident);
+
+			void SendMessage (const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg);
+			void CloseSession (std::shared_ptr<const i2p::data::RouterInfo> router);
+			
+		private:
+
+			void Run ();
+			void HandleAccept (std::shared_ptr<NTCPSession> conn, const boost::system::error_code& error);
+			void HandleAcceptV6 (std::shared_ptr<NTCPSession> conn, const boost::system::error_code& error);
+			void HandleResendTimer (const boost::system::error_code& ecode, boost::asio::deadline_timer * timer,
+				const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg);
+			void PostMessage (const i2p::data::IdentHash& ident, i2p::I2NPMessage * msg);
+			void PostCloseSession (std::shared_ptr<const i2p::data::RouterInfo> router);
+			
+			void Connect (const boost::asio::ip::address& address, int port, std::shared_ptr<NTCPSession> conn);
+			void HandleConnect (const boost::system::error_code& ecode, std::shared_ptr<NTCPSession> conn);
+
+			void DetectExternalIP ();
+			
+		private:
+
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			boost::asio::io_service m_Service;
+			boost::asio::io_service::work m_Work;
+			boost::asio::ip::tcp::acceptor * m_NTCPAcceptor, * m_NTCPV6Acceptor;
+
+			std::map<i2p::data::IdentHash, std::shared_ptr<NTCPSession> > m_NTCPSessions;
+			SSUServer * m_SSUServer;
+
+			DHKeysPairSupplier m_DHKeysPairSupplier;
+
+		public:
+
+			// for HTTP only
+			const decltype(m_NTCPSessions)& GetNTCPSessions () const { return m_NTCPSessions; };
+			const SSUServer * GetSSUServer () const { return m_SSUServer; };
+	};	
+
+	extern Transports transports;
+}	
+}
+
+#endif
--- a/Tunnel.cpp
+++ b/Tunnel.cpp
@ -0,0 +1,614 @@
+#include <string.h>
+#include "I2PEndian.h"
+#include <thread>
+#include <algorithm>
+#include <vector> 
+#include <cryptopp/sha.h>
+#include "RouterContext.h"
+#include "Log.h"
+#include "Timestamp.h"
+#include "I2NPProtocol.h"
+#include "Transports.h"
+#include "NetDb.h"
+#include "Tunnel.h"
+
+namespace i2p
+{	
+namespace tunnel
+{		
+	
+	Tunnel::Tunnel (TunnelConfig * config): 
+		m_Config (config), m_Pool (nullptr), m_State (eTunnelStatePending)
+	{
+	}	
+
+	Tunnel::~Tunnel ()
+	{
+		delete m_Config;
+	}	
+
+	void Tunnel::Build (uint32_t replyMsgID, OutboundTunnel * outboundTunnel)
+	{
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		auto numHops = m_Config->GetNumHops ();
+		int numRecords = numHops <= STANDARD_NUM_RECORDS ? STANDARD_NUM_RECORDS : numHops; 
+		I2NPMessage * msg = NewI2NPMessage ();
+		*msg->GetPayload () = numRecords;
+		msg->len += numRecords*TUNNEL_BUILD_RECORD_SIZE + 1;		
+
+		// shuffle records
+		std::vector<int> recordIndicies;
+		for (int i = 0; i < numRecords; i++) recordIndicies.push_back(i);
+		std::random_shuffle (recordIndicies.begin(), recordIndicies.end());
+
+		// create real records
+		uint8_t * records = msg->GetPayload () + 1; 
+		TunnelHopConfig * hop = m_Config->GetFirstHop ();
+		int i = 0;
+		while (hop)
+		{
+			int idx = recordIndicies[i];
+			hop->CreateBuildRequestRecord (records + idx*TUNNEL_BUILD_RECORD_SIZE, 
+				hop->next ? rnd.GenerateWord32 () : replyMsgID); // we set replyMsgID for last hop only 
+			hop->recordIndex = idx; 
+			i++;
+			hop = hop->next;
+		}	
+		// fill up fake records with random data	
+		for (int i = numHops; i < numRecords; i++)
+		{
+			int idx = recordIndicies[i];
+			rnd.GenerateBlock (records + idx*TUNNEL_BUILD_RECORD_SIZE, TUNNEL_BUILD_RECORD_SIZE); 
+		}	
+
+		// decrypt real records
+		i2p::crypto::CBCDecryption decryption;
+		hop = m_Config->GetLastHop ()->prev;
+		while (hop)
+		{
+			decryption.SetKey (hop->replyKey);
+			// decrypt records after current hop
+			TunnelHopConfig * hop1 = hop->next;
+			while (hop1)
+			{	
+				decryption.SetIV (hop->replyIV);
+				uint8_t * record = records + hop1->recordIndex*TUNNEL_BUILD_RECORD_SIZE;
+				decryption.Decrypt(record, TUNNEL_BUILD_RECORD_SIZE, record);
+				hop1 = hop1->next;
+			}	
+			hop = hop->prev;
+		}	
+		FillI2NPMessageHeader (msg, eI2NPVariableTunnelBuild);
+
+		// send message
+		if (outboundTunnel)
+			outboundTunnel->SendTunnelDataMsg (GetNextIdentHash (), 0, msg);	
+		else
+			i2p::transport::transports.SendMessage (GetNextIdentHash (), msg);
+	}	
+		
+	bool Tunnel::HandleTunnelBuildResponse (uint8_t * msg, size_t len)
+	{
+		LogPrint ("TunnelBuildResponse ", (int)msg[0], " records.");
+		
+		i2p::crypto::CBCDecryption decryption;
+		TunnelHopConfig * hop = m_Config->GetLastHop (); 
+		while (hop)
+		{	
+			decryption.SetKey (hop->replyKey);
+			// decrypt records before and including current hop
+			TunnelHopConfig * hop1 = hop;
+			while (hop1)
+			{
+				auto idx = hop1->recordIndex;
+				if (idx >= 0 && idx < msg[0])
+				{	
+					uint8_t * record = msg + 1 + idx*TUNNEL_BUILD_RECORD_SIZE;
+					decryption.SetIV (hop->replyIV);
+					decryption.Decrypt(record, TUNNEL_BUILD_RECORD_SIZE, record);
+				}	
+				else
+					LogPrint ("Tunnel hop index ", idx, " is out of range");
+				hop1 = hop1->prev;
+			}	
+			hop = hop->prev;
+		}
+
+		bool established = true;
+		hop = m_Config->GetFirstHop ();
+		while (hop)
+		{			
+			const uint8_t * record = msg + 1 + hop->recordIndex*TUNNEL_BUILD_RECORD_SIZE;
+			uint8_t ret = record[BUILD_RESPONSE_RECORD_RET_OFFSET];
+			LogPrint ("Ret code=", (int)ret);
+			if (ret) 
+				// if any of participants declined the tunnel is not established
+				established = false; 
+			hop = hop->next;
+		}
+		if (established) 
+		{
+			// change reply keys to layer keys
+			hop = m_Config->GetFirstHop ();
+			while (hop)
+			{
+				hop->decryption.SetKeys (hop->layerKey, hop->ivKey);
+				hop = hop->next;
+			}	
+		}	
+		if (established) m_State = eTunnelStateEstablished;
+		return established;
+	}	
+
+	void Tunnel::EncryptTunnelMsg (I2NPMessage * tunnelMsg)
+	{
+		uint8_t * payload = tunnelMsg->GetPayload () + 4;
+		TunnelHopConfig * hop = m_Config->GetLastHop (); 
+		while (hop)
+		{	
+			hop->decryption.Decrypt (payload);
+			hop = hop->prev;
+		}
+	}	
+	
+	void InboundTunnel::HandleTunnelDataMsg (I2NPMessage * msg)
+	{
+		if (IsFailed ()) SetState (eTunnelStateEstablished); // incoming messages means a tunnel is alive			
+		msg->from = this;
+		EncryptTunnelMsg (msg);
+		m_Endpoint.HandleDecryptedTunnelDataMsg (msg);	
+	}	
+
+	void OutboundTunnel::SendTunnelDataMsg (const uint8_t * gwHash, uint32_t gwTunnel, i2p::I2NPMessage * msg)
+	{
+		TunnelMessageBlock block;
+		if (gwHash)
+		{
+			block.hash = gwHash;
+			if (gwTunnel)
+			{	
+				block.deliveryType = eDeliveryTypeTunnel;
+				block.tunnelID = gwTunnel;
+			}	
+			else
+				block.deliveryType = eDeliveryTypeRouter;
+		}	
+		else	
+			block.deliveryType = eDeliveryTypeLocal;
+		block.data = msg;
+		
+		std::unique_lock<std::mutex> l(m_SendMutex);
+		m_Gateway.SendTunnelDataMsg (block);
+	}
+		
+	void OutboundTunnel::SendTunnelDataMsg (const std::vector<TunnelMessageBlock>& msgs)
+	{
+		std::unique_lock<std::mutex> l(m_SendMutex);
+		for (auto& it : msgs)
+			m_Gateway.PutTunnelDataMsg (it);
+		m_Gateway.SendBuffer ();
+	}	
+	
+	Tunnels tunnels;
+	
+	Tunnels::Tunnels (): m_IsRunning (false), m_Thread (nullptr), m_ExploratoryPool (nullptr)
+	{
+	}
+	
+	Tunnels::~Tunnels ()	
+	{
+		for (auto& it : m_OutboundTunnels)
+			delete it;
+		m_OutboundTunnels.clear ();
+
+		for (auto& it : m_InboundTunnels)
+			delete it.second;
+		m_InboundTunnels.clear ();
+		
+		for (auto& it : m_TransitTunnels)
+			delete it.second;
+		m_TransitTunnels.clear ();
+
+		/*for (auto& it : m_PendingTunnels)
+			delete it.second;
+		m_PendingTunnels.clear ();*/
+
+		for (auto& it: m_Pools)
+			delete it;
+		m_Pools.clear ();
+	}	
+	
+	InboundTunnel * Tunnels::GetInboundTunnel (uint32_t tunnelID)
+	{
+		auto it = m_InboundTunnels.find(tunnelID);
+		if (it != m_InboundTunnels.end ())
+			return it->second;
+		return nullptr;
+	}	
+	
+	TransitTunnel * Tunnels::GetTransitTunnel (uint32_t tunnelID)
+	{
+		auto it = m_TransitTunnels.find(tunnelID);
+		if (it != m_TransitTunnels.end ())
+			return it->second;
+		return nullptr;
+	}	
+		
+	Tunnel * Tunnels::GetPendingTunnel (uint32_t replyMsgID)
+	{
+		auto it = m_PendingTunnels.find(replyMsgID);
+		if (it != m_PendingTunnels.end () && it->second->GetState () == eTunnelStatePending)
+		{	
+			it->second->SetState (eTunnelStateBuildReplyReceived);	
+			return it->second;
+		}
+		return nullptr;
+	}	
+
+	InboundTunnel * Tunnels::GetNextInboundTunnel ()
+	{
+		InboundTunnel * tunnel  = nullptr; 
+		size_t minReceived = 0;
+		std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+		for (auto it : m_InboundTunnels)
+		{
+			if (!it.second->IsEstablished ()) continue;
+			if (!tunnel || it.second->GetNumReceivedBytes () < minReceived)
+			{
+				tunnel = it.second;
+				minReceived = it.second->GetNumReceivedBytes ();
+			}
+		}			
+		return tunnel;
+	}
+	
+	OutboundTunnel * Tunnels::GetNextOutboundTunnel ()
+	{
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		uint32_t ind = rnd.GenerateWord32 (0, m_OutboundTunnels.size () - 1), i = 0;
+		OutboundTunnel * tunnel = nullptr;
+		std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+		for (auto it: m_OutboundTunnels)
+		{	
+			if (it->IsEstablished ())
+			{
+				tunnel = it;
+				i++;
+			}
+			if (i > ind && tunnel) break;
+		}	
+		return tunnel;
+	}	
+
+	TunnelPool * Tunnels::CreateTunnelPool (i2p::garlic::GarlicDestination * localDestination, int numInboundHops, int numOutboundHops)
+	{
+		auto pool = new TunnelPool (localDestination, numInboundHops, numOutboundHops);
+		std::unique_lock<std::mutex> l(m_PoolsMutex);
+		m_Pools.push_back (pool);
+		return pool;
+	}	
+
+	void Tunnels::DeleteTunnelPool (TunnelPool * pool)
+	{
+		if (pool)
+		{	
+			StopTunnelPool (pool);
+			{
+				std::unique_lock<std::mutex> l(m_PoolsMutex);
+				m_Pools.remove (pool);
+			}	
+			for (auto it: m_PendingTunnels)
+				if (it.second->GetTunnelPool () == pool)
+					it.second->SetTunnelPool (nullptr);
+			delete pool;
+		}	
+	}	
+
+	void Tunnels::StopTunnelPool (TunnelPool * pool)
+	{
+		if (pool)
+		{
+			pool->SetActive (false);
+			pool->DetachTunnels ();
+		}	
+	}	
+		
+	void Tunnels::AddTransitTunnel (TransitTunnel * tunnel)
+	{
+		std::unique_lock<std::mutex> l(m_TransitTunnelsMutex);
+		m_TransitTunnels[tunnel->GetTunnelID ()] = tunnel;
+	}	
+
+	void Tunnels::Start ()
+	{
+		m_IsRunning = true;
+		m_Thread = new std::thread (std::bind (&Tunnels::Run, this));
+	}
+	
+	void Tunnels::Stop ()
+	{
+		m_IsRunning = false;
+		m_Queue.WakeUp ();
+		if (m_Thread)
+		{	
+			m_Thread->join (); 
+			delete m_Thread;
+			m_Thread = 0;
+		}	
+	}	
+
+	void Tunnels::Run ()
+	{
+		std::this_thread::sleep_for (std::chrono::seconds(1)); // wait for other parts are ready
+		
+		uint64_t lastTs = 0;
+		while (m_IsRunning)
+		{
+			try
+			{	
+				I2NPMessage * msg = m_Queue.GetNextWithTimeout (1000); // 1 sec
+				while (msg)
+				{
+					uint32_t  tunnelID = bufbe32toh (msg->GetPayload ()); 
+					InboundTunnel * tunnel = GetInboundTunnel (tunnelID);
+					if (tunnel)
+						tunnel->HandleTunnelDataMsg (msg);
+					else
+					{	
+						TransitTunnel * transitTunnel = GetTransitTunnel (tunnelID);
+						if (transitTunnel)
+							transitTunnel->HandleTunnelDataMsg (msg);
+						else	
+						{	
+							LogPrint ("Tunnel ", tunnelID, " not found");
+							i2p::DeleteI2NPMessage (msg);
+						}	
+					}	
+					msg = m_Queue.Get ();
+				}	
+			
+				uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+				if (ts - lastTs >= 15) // manage tunnels every 15 seconds
+				{
+					ManageTunnels ();
+					lastTs = ts;
+				}
+			}
+			catch (std::exception& ex)
+			{
+				LogPrint ("Tunnels: ", ex.what ());
+			}	
+		}	
+	}	
+
+	void Tunnels::ManageTunnels ()
+	{
+		ManagePendingTunnels ();
+		ManageInboundTunnels ();
+		ManageOutboundTunnels ();
+		ManageTransitTunnels ();
+		ManageTunnelPools ();
+	}	
+
+	void Tunnels::ManagePendingTunnels ()
+	{
+		// check pending tunnel. delete failed or timeout
+		uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+		for (auto it = m_PendingTunnels.begin (); it != m_PendingTunnels.end ();)
+		{	
+			auto tunnel = it->second;
+			switch (tunnel->GetState ())
+			{
+				case eTunnelStatePending: 
+					if (ts > tunnel->GetCreationTime () + TUNNEL_CREATION_TIMEOUT)
+					{
+						LogPrint ("Pending tunnel build request ", it->first, " timeout. Deleted");
+						delete tunnel;
+						it = m_PendingTunnels.erase (it);
+					}
+					else
+						it++;
+				break;
+				case eTunnelStateBuildFailed:
+					LogPrint ("Pending tunnel build request ", it->first, " failed. Deleted");
+					delete tunnel;
+					it = m_PendingTunnels.erase (it);
+				break;
+				case eTunnelStateBuildReplyReceived:
+					// intermidiate state, will be either established of build failed
+					it++;
+				break;	
+				default:
+					it = m_PendingTunnels.erase (it);
+			}	
+		}	
+	}
+
+	void Tunnels::ManageOutboundTunnels ()
+	{
+		uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+		{
+			for (auto it = m_OutboundTunnels.begin (); it != m_OutboundTunnels.end ();)
+			{
+				auto tunnel = *it;
+				if (ts > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
+				{
+					LogPrint ("Tunnel ", tunnel->GetTunnelID (), " expired");
+					{
+						std::unique_lock<std::mutex> l(m_PoolsMutex);
+						auto pool = tunnel->GetTunnelPool ();
+						if (pool)
+							pool->TunnelExpired (tunnel);
+					}	
+					{
+						std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+						it = m_OutboundTunnels.erase (it);
+					}
+					delete tunnel;
+				}	
+				else 
+				{
+					if (tunnel->IsEstablished () && ts + TUNNEL_EXPIRATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
+						tunnel->SetState (eTunnelStateExpiring);
+					it++;
+				}
+			}
+		}	
+	
+		if (m_OutboundTunnels.size () < 5) 
+		{
+			// trying to create one more oubound tunnel
+			InboundTunnel * inboundTunnel = GetNextInboundTunnel ();
+			if (!inboundTunnel) return;
+			LogPrint ("Creating one hop outbound tunnel...");
+			CreateTunnel<OutboundTunnel> (
+			  	new TunnelConfig (std::vector<std::shared_ptr<const i2p::data::RouterInfo> > 
+				    { 
+						i2p::data::netdb.GetRandomRouter ()
+					},		
+		     		inboundTunnel->GetTunnelConfig ()));
+		}
+	}
+	
+	void Tunnels::ManageInboundTunnels ()
+	{
+		uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+		{
+			for (auto it = m_InboundTunnels.begin (); it != m_InboundTunnels.end ();)
+			{
+				auto tunnel = it->second;
+				if (ts > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
+				{
+					LogPrint ("Tunnel ", tunnel->GetTunnelID (), " expired");
+					{
+						std::unique_lock<std::mutex> l(m_PoolsMutex);
+						auto pool = tunnel->GetTunnelPool ();
+						if (pool)
+							pool->TunnelExpired (tunnel);
+					}	
+					{
+						std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+						it = m_InboundTunnels.erase (it);
+					}
+					delete tunnel;
+				}	
+				else 
+				{
+					if (tunnel->IsEstablished () && ts + TUNNEL_EXPIRATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
+						tunnel->SetState (eTunnelStateExpiring);
+					it++;
+				}
+			}
+		}	
+
+		if (m_InboundTunnels.empty ())
+		{
+			LogPrint ("Creating zero hops inbound tunnel...");
+			CreateZeroHopsInboundTunnel ();
+			if (!m_ExploratoryPool)
+				m_ExploratoryPool = CreateTunnelPool (&i2p::context, 2, 2); // 2-hop exploratory
+			return;
+		}
+		
+		if (m_OutboundTunnels.empty () || m_InboundTunnels.size () < 5) 
+		{
+			// trying to create one more inbound tunnel			
+			LogPrint ("Creating one hop inbound tunnel...");
+			CreateTunnel<InboundTunnel> (
+				new TunnelConfig (std::vector<std::shared_ptr<const i2p::data::RouterInfo> >
+				    {              
+						i2p::data::netdb.GetRandomRouter ()
+					}));
+		}
+	}	
+
+	void Tunnels::ManageTransitTunnels ()
+	{
+		uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
+		for (auto it = m_TransitTunnels.begin (); it != m_TransitTunnels.end ();)
+		{
+			if (ts > it->second->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
+			{
+				LogPrint ("Transit tunnel ", it->second->GetTunnelID (), " expired");
+				auto tmp = it->second;
+				{
+					std::unique_lock<std::mutex> l(m_TransitTunnelsMutex);
+					it = m_TransitTunnels.erase (it);
+				}	
+				delete tmp;
+			}	
+			else 
+				it++;
+		}
+	}	
+
+	void Tunnels::ManageTunnelPools ()
+	{
+		std::unique_lock<std::mutex> l(m_PoolsMutex);
+		for (auto it: m_Pools)
+		{	
+			TunnelPool * pool = it;
+			if (pool->IsActive ())
+			{	
+				pool->CreateTunnels ();
+				pool->TestTunnels ();
+			}		
+		}
+	}	
+	
+	void Tunnels::PostTunnelData (I2NPMessage * msg)
+	{
+		if (msg) m_Queue.Put (msg);		
+	}	
+
+	template<class TTunnel>
+	TTunnel * Tunnels::CreateTunnel (TunnelConfig * config, OutboundTunnel * outboundTunnel)
+	{
+		TTunnel * newTunnel = new TTunnel (config);
+		uint32_t replyMsgID = i2p::context.GetRandomNumberGenerator ().GenerateWord32 ();
+		m_PendingTunnels[replyMsgID] = newTunnel; 
+		newTunnel->Build (replyMsgID, outboundTunnel);
+		return newTunnel;
+	}	
+
+	void Tunnels::AddOutboundTunnel (OutboundTunnel * newTunnel)
+	{
+		std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+		m_OutboundTunnels.push_back (newTunnel);
+		auto pool = newTunnel->GetTunnelPool ();
+		if (pool && pool->IsActive ())
+			pool->TunnelCreated (newTunnel);
+		else
+			newTunnel->SetTunnelPool (nullptr);
+	}	
+
+	void Tunnels::AddInboundTunnel (InboundTunnel * newTunnel)
+	{
+		std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+		m_InboundTunnels[newTunnel->GetTunnelID ()] = newTunnel;
+		auto pool = newTunnel->GetTunnelPool ();
+		if (!pool)
+		{		
+			// build symmetric outbound tunnel
+			CreateTunnel<OutboundTunnel> (newTunnel->GetTunnelConfig ()->Invert (), GetNextOutboundTunnel ());		
+		}
+		else
+		{
+			if (pool->IsActive ())
+				pool->TunnelCreated (newTunnel);
+			else
+				newTunnel->SetTunnelPool (nullptr);
+		}	
+	}	
+
+	
+	void Tunnels::CreateZeroHopsInboundTunnel ()
+	{
+		CreateTunnel<InboundTunnel> (
+			new TunnelConfig (std::vector<std::shared_ptr<const i2p::data::RouterInfo> >
+			    { 
+					i2p::context.GetSharedRouterInfo ()
+				}));
+	}	
+}
+}
--- a/Tunnel.h
+++ b/Tunnel.h
@ -0,0 +1,176 @@
+#ifndef TUNNEL_H__
+#define TUNNEL_H__
+
+#include <inttypes.h>
+#include <map>
+#include <list>
+#include <vector>
+#include <string>
+#include <thread>
+#include <mutex>
+#include "Queue.h"
+#include "TunnelConfig.h"
+#include "TunnelPool.h"
+#include "TransitTunnel.h"
+#include "TunnelEndpoint.h"
+#include "TunnelGateway.h"
+#include "TunnelBase.h"
+#include "I2NPProtocol.h"
+
+namespace i2p
+{
+namespace tunnel
+{	
+	const int TUNNEL_EXPIRATION_TIMEOUT = 660; // 11 minutes	
+	const int TUNNEL_EXPIRATION_THRESHOLD = 60; // 1 minute	
+	const int TUNNEL_CREATION_TIMEOUT = 30; // 30 seconds
+	const int STANDARD_NUM_RECORDS = 5; // in VariableTunnelBuild message
+
+	enum TunnelState
+	{
+		eTunnelStatePending,
+		eTunnelStateBuildReplyReceived,
+		eTunnelStateBuildFailed,
+		eTunnelStateEstablished,
+		eTunnelStateTestFailed,
+		eTunnelStateFailed,
+		eTunnelStateExpiring
+	};	
+	
+	class OutboundTunnel;
+	class InboundTunnel;
+	class Tunnel: public TunnelBase
+	{
+		public:
+
+			Tunnel (TunnelConfig * config);
+			~Tunnel ();
+
+			void Build (uint32_t replyMsgID, OutboundTunnel * outboundTunnel = 0);
+			
+			TunnelConfig * GetTunnelConfig () const { return m_Config; }
+			TunnelState GetState () const { return m_State; };
+			void SetState (TunnelState state)  { m_State = state; };
+			bool IsEstablished () const { return m_State == eTunnelStateEstablished; };
+			bool IsFailed () const { return m_State == eTunnelStateFailed; };
+
+			TunnelPool * GetTunnelPool () const { return m_Pool; };
+			void SetTunnelPool (TunnelPool * pool) { m_Pool = pool; };			
+			
+			bool HandleTunnelBuildResponse (uint8_t * msg, size_t len);
+			
+			// implements TunnelBase
+			void EncryptTunnelMsg (I2NPMessage * tunnelMsg); 
+			uint32_t GetNextTunnelID () const { return m_Config->GetFirstHop ()->tunnelID; };
+			const i2p::data::IdentHash& GetNextIdentHash () const { return m_Config->GetFirstHop ()->router->GetIdentHash (); };
+			
+		private:
+
+			TunnelConfig * m_Config;
+			TunnelPool * m_Pool; // pool, tunnel belongs to, or null
+			TunnelState m_State;
+	};	
+
+	class OutboundTunnel: public Tunnel 
+	{
+		public:
+
+			OutboundTunnel (TunnelConfig * config): Tunnel (config), m_Gateway (this) {};
+
+			void SendTunnelDataMsg (const uint8_t * gwHash, uint32_t gwTunnel, i2p::I2NPMessage * msg);
+			void SendTunnelDataMsg (const std::vector<TunnelMessageBlock>& msgs); // multiple messages
+			std::shared_ptr<const i2p::data::RouterInfo> GetEndpointRouter () const 
+				{ return GetTunnelConfig ()->GetLastHop ()->router; }; 
+			size_t GetNumSentBytes () const { return m_Gateway.GetNumSentBytes (); };
+
+			// implements TunnelBase
+			uint32_t GetTunnelID () const { return GetNextTunnelID (); };
+			
+		private:
+
+			std::mutex m_SendMutex;
+			TunnelGateway m_Gateway; 
+	};
+	
+	class InboundTunnel: public Tunnel 
+	{
+		public:
+
+			InboundTunnel (TunnelConfig * config): Tunnel (config), m_Endpoint (true) {};
+			void HandleTunnelDataMsg (I2NPMessage * msg);
+			size_t GetNumReceivedBytes () const { return m_Endpoint.GetNumReceivedBytes (); };
+
+			// implements TunnelBase
+			uint32_t GetTunnelID () const { return GetTunnelConfig ()->GetLastHop ()->nextTunnelID; };
+		private:
+
+			TunnelEndpoint m_Endpoint; 
+	};	
+
+	
+	class Tunnels
+	{	
+		public:
+
+			Tunnels ();
+			~Tunnels ();
+			void Start ();
+			void Stop ();		
+			
+			InboundTunnel * GetInboundTunnel (uint32_t tunnelID);
+			Tunnel * GetPendingTunnel (uint32_t replyMsgID);
+			InboundTunnel * GetNextInboundTunnel ();
+			OutboundTunnel * GetNextOutboundTunnel ();
+			TunnelPool * GetExploratoryPool () const { return m_ExploratoryPool; };
+			TransitTunnel * GetTransitTunnel (uint32_t tunnelID);
+			void AddTransitTunnel (TransitTunnel * tunnel);
+			void AddOutboundTunnel (OutboundTunnel * newTunnel);
+			void AddInboundTunnel (InboundTunnel * newTunnel);
+			void PostTunnelData (I2NPMessage * msg);
+			template<class TTunnel>
+			TTunnel * CreateTunnel (TunnelConfig * config, OutboundTunnel * outboundTunnel = 0);
+			TunnelPool * CreateTunnelPool (i2p::garlic::GarlicDestination * localDestination, int numInboundHops, int numOuboundHops);
+			void DeleteTunnelPool (TunnelPool * pool);
+			void StopTunnelPool (TunnelPool * pool);
+			
+		private:
+			
+			void Run ();	
+			void ManageTunnels ();
+			void ManageOutboundTunnels ();
+			void ManageInboundTunnels ();
+			void ManageTransitTunnels ();
+			void ManagePendingTunnels ();
+			void ManageTunnelPools ();
+			
+			void CreateZeroHopsInboundTunnel ();
+			
+		private:
+
+			bool m_IsRunning;
+			std::thread * m_Thread;	
+			std::map<uint32_t, Tunnel *> m_PendingTunnels; // by replyMsgID
+			std::mutex m_InboundTunnelsMutex;
+			std::map<uint32_t, InboundTunnel *> m_InboundTunnels;
+			std::mutex m_OutboundTunnelsMutex;
+			std::list<OutboundTunnel *> m_OutboundTunnels;
+			std::mutex m_TransitTunnelsMutex;
+			std::map<uint32_t, TransitTunnel *> m_TransitTunnels;
+			std::mutex m_PoolsMutex;
+			std::list<TunnelPool *> m_Pools;
+			TunnelPool * m_ExploratoryPool;
+			i2p::util::Queue<I2NPMessage> m_Queue;
+
+		public:
+
+			// for HTTP only
+			const decltype(m_OutboundTunnels)& GetOutboundTunnels () const { return m_OutboundTunnels; };
+			const decltype(m_InboundTunnels)& GetInboundTunnels () const { return m_InboundTunnels; };
+			const decltype(m_TransitTunnels)& GetTransitTunnels () const { return m_TransitTunnels; };
+	};	
+
+	extern Tunnels tunnels;
+}	
+}
+
+#endif
--- a/TunnelBase.h
+++ b/TunnelBase.h
@ -0,0 +1,65 @@
+#ifndef TUNNEL_BASE_H__
+#define TUNNEL_BASE_H__
+
+#include <inttypes.h>
+#include "Timestamp.h"
+#include "I2NPProtocol.h"
+#include "Identity.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	const size_t TUNNEL_DATA_MSG_SIZE = 1028;
+	const size_t TUNNEL_DATA_ENCRYPTED_SIZE = 1008;
+	const size_t TUNNEL_DATA_MAX_PAYLOAD_SIZE = 1003;
+	
+	enum TunnelDeliveryType 
+	{ 
+		eDeliveryTypeLocal = 0, 
+		eDeliveryTypeTunnel = 1,
+		eDeliveryTypeRouter = 2
+	};		
+	struct TunnelMessageBlock
+	{
+		TunnelDeliveryType deliveryType;
+		i2p::data::IdentHash hash;	
+		uint32_t tunnelID;
+		I2NPMessage * data;
+	};
+
+	class TunnelBase
+	{
+		public:
+
+			//WARNING!!! GetSecondsSinceEpoch() return uint64_t
+			TunnelBase (): m_CreationTime (i2p::util::GetSecondsSinceEpoch ()) {};
+			virtual ~TunnelBase () {};
+			
+			virtual void EncryptTunnelMsg (I2NPMessage * tunnelMsg) = 0;
+			virtual uint32_t GetNextTunnelID () const = 0;
+			virtual const i2p::data::IdentHash& GetNextIdentHash () const = 0;
+			virtual uint32_t GetTunnelID () const = 0; // as known at our side
+
+			uint32_t GetCreationTime () const { return m_CreationTime; };
+			void SetCreationTime (uint32_t t) { m_CreationTime = t; };
+
+		private:
+			
+			uint32_t m_CreationTime; // seconds since epoch
+	};	
+
+	struct TunnelCreationTimeCmp
+	{
+		bool operator() (const TunnelBase * t1, const TunnelBase * t2) const
+  		{	
+			if (t1->GetCreationTime () != t2->GetCreationTime ())
+				return t1->GetCreationTime () > t2->GetCreationTime (); 
+			else
+				return t1 < t2;
+		};
+	};	
+}
+}
+
+#endif
--- a/TunnelConfig.h
+++ b/TunnelConfig.h
@ -0,0 +1,246 @@
+#ifndef TUNNEL_CONFIG_H__
+#define TUNNEL_CONFIG_H__
+
+#include <inttypes.h>
+#include <sstream>
+#include <vector>
+#include <memory>
+#include "aes.h"
+#include "RouterInfo.h"
+#include "RouterContext.h"
+#include "Timestamp.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	struct TunnelHopConfig
+	{
+		std::shared_ptr<const i2p::data::RouterInfo> router, nextRouter;
+		uint32_t tunnelID, nextTunnelID;
+		uint8_t layerKey[32];
+		uint8_t ivKey[32];
+		uint8_t replyKey[32];
+		uint8_t replyIV[16];
+		bool isGateway, isEndpoint;	
+		
+		TunnelHopConfig * next, * prev;
+		i2p::crypto::TunnelDecryption decryption;	
+		int recordIndex; // record # in tunnel build message
+		
+		TunnelHopConfig (std::shared_ptr<const i2p::data::RouterInfo> r)
+		{
+			CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+			rnd.GenerateBlock (layerKey, 32);
+			rnd.GenerateBlock (ivKey, 32);
+			rnd.GenerateBlock (replyIV, 16);
+			tunnelID = rnd.GenerateWord32 ();
+			isGateway = true;
+			isEndpoint = true;
+			router = r; 
+			//nextRouter = nullptr; 
+			nextTunnelID = 0;
+
+			next = nullptr;
+			prev = nullptr;
+		}	
+
+		void SetNextRouter (std::shared_ptr<const i2p::data::RouterInfo> r)
+		{
+			nextRouter = r;
+			isEndpoint = false;
+			CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+			nextTunnelID = rnd.GenerateWord32 ();
+		}	
+
+		void SetReplyHop (const TunnelHopConfig * replyFirstHop)
+		{
+			nextRouter = replyFirstHop->router;
+			nextTunnelID = replyFirstHop->tunnelID;
+			isEndpoint = true;
+		}
+		
+		void SetNext (TunnelHopConfig * n)
+		{
+			next = n;
+			if (next)
+			{	
+				next->prev = this;
+				next->isGateway = false;
+				isEndpoint = false;
+				nextRouter = next->router;
+				nextTunnelID = next->tunnelID;
+			}	
+		}
+
+		void SetPrev (TunnelHopConfig * p)
+		{
+			prev = p;
+			if (prev) 
+			{	
+				prev->next = this;
+				prev->isEndpoint = false;
+				isGateway = false;
+			}	
+		}
+
+		void CreateBuildRequestRecord (uint8_t * record, uint32_t replyMsgID)
+		{
+			uint8_t clearText[BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE];
+			htobe32buf (clearText + BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET, tunnelID); 
+			memcpy (clearText + BUILD_REQUEST_RECORD_OUR_IDENT_OFFSET, router->GetIdentHash (), 32);
+			htobe32buf (clearText + BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET, nextTunnelID);
+			memcpy (clearText + BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, nextRouter->GetIdentHash (), 32);
+			memcpy (clearText + BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET, layerKey, 32);
+			memcpy (clearText + BUILD_REQUEST_RECORD_IV_KEY_OFFSET, ivKey, 32);
+			memcpy (clearText + BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET, replyKey, 32);
+			memcpy (clearText + BUILD_REQUEST_RECORD_REPLY_IV_OFFSET, replyIV, 16);
+			uint8_t flag = 0;
+			if (isGateway) flag |= 0x80;
+			if (isEndpoint) flag |= 0x40;
+			clearText[BUILD_REQUEST_RECORD_FLAG_OFFSET] = flag;
+			htobe32buf (clearText + BUILD_REQUEST_RECORD_REQUEST_TIME_OFFSET, i2p::util::GetHoursSinceEpoch ()); 
+			htobe32buf (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET, replyMsgID); 
+			// TODO: fill padding
+			router->GetElGamalEncryption ()->Encrypt (clearText, BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE, record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET);
+			memcpy (record + BUILD_REQUEST_RECORD_TO_PEER_OFFSET, (const uint8_t *)router->GetIdentHash (), 16);
+		}	
+	};	
+
+	class TunnelConfig
+	{
+		public:			
+			
+
+			TunnelConfig (std::vector<std::shared_ptr<const i2p::data::RouterInfo> > peers, 
+				const TunnelConfig * replyTunnelConfig = nullptr) // replyTunnelConfig=nullptr means inbound
+			{
+				TunnelHopConfig * prev = nullptr;
+				for (auto it: peers)
+				{
+					auto hop = new TunnelHopConfig (it);
+					if (prev)
+						prev->SetNext (hop);
+					else	
+						m_FirstHop = hop;
+					prev = hop;
+				}	
+				m_LastHop = prev;
+				
+				if (replyTunnelConfig) // outbound
+				{
+					m_FirstHop->isGateway = false;
+					m_LastHop->SetReplyHop (replyTunnelConfig->GetFirstHop ());
+				}	
+				else // inbound
+					m_LastHop->SetNextRouter (i2p::context.GetSharedRouterInfo ());
+			}
+			
+			~TunnelConfig ()
+			{
+				TunnelHopConfig * hop = m_FirstHop;
+				
+				while (hop)
+				{
+					auto tmp = hop;
+					hop = hop->next;
+					delete tmp;
+				}	
+			}
+			
+			TunnelHopConfig * GetFirstHop () const
+			{
+				return m_FirstHop;
+			}
+
+			TunnelHopConfig * GetLastHop () const
+			{
+				return m_LastHop;
+			}
+
+			int GetNumHops () const
+			{
+				int num = 0;
+				TunnelHopConfig * hop = m_FirstHop;		
+				while (hop)
+				{
+					num++;
+					hop = hop->next;
+				}	
+				return num;
+			}
+
+			void Print (std::stringstream& s) const
+			{
+				TunnelHopConfig * hop = m_FirstHop;
+				if (!m_FirstHop->isGateway)
+					s << "me";
+				s << "-->" << m_FirstHop->tunnelID;
+				while (hop)
+				{
+					s << ":" << hop->router->GetIdentHashAbbreviation () << "-->"; 
+					if (!hop->isEndpoint)
+						s << hop->nextTunnelID;
+					else
+						return;
+					hop = hop->next;
+				}	
+				// we didn't reach enpoint that mean we are last hop
+				s << ":me";	
+			}
+
+			TunnelConfig * Invert () const
+			{
+				TunnelConfig * newConfig = new TunnelConfig ();
+				TunnelHopConfig * hop = m_FirstHop, * nextNewHop = nullptr;
+				while (hop)
+				{
+					TunnelHopConfig * newHop = new TunnelHopConfig (hop->router);
+					if (nextNewHop)
+						newHop->SetNext (nextNewHop);
+					nextNewHop = newHop;
+					newHop->isEndpoint = hop->isGateway;
+					newHop->isGateway = hop->isEndpoint;
+					
+					if (!hop->prev) // first hop
+					{	
+						newConfig->m_LastHop = newHop; 
+						if (hop->isGateway) // inbound tunnel
+							newHop->SetReplyHop (m_FirstHop); // use it as reply tunnel
+						else
+							newHop->SetNextRouter (i2p::context.GetSharedRouterInfo ());
+					}	
+					if (!hop->next) newConfig->m_FirstHop = newHop; // last hop
+									
+					hop = hop->next;
+				}	
+				return newConfig;
+			}
+
+			TunnelConfig * Clone (const TunnelConfig * replyTunnelConfig = nullptr) const
+			{
+				std::vector<std::shared_ptr<const i2p::data::RouterInfo> > peers;
+				TunnelHopConfig * hop = m_FirstHop;
+				while (hop)
+				{
+					peers.push_back (hop->router);
+					hop = hop->next;
+				}	
+				return new TunnelConfig (peers, replyTunnelConfig);
+			}	
+			
+		private:
+
+			// this constructor can't be called from outside
+			TunnelConfig (): m_FirstHop (nullptr), m_LastHop (nullptr)
+			{
+			}
+			
+		private:
+
+			TunnelHopConfig * m_FirstHop, * m_LastHop;
+	};	
+}		
+}	
+
+#endif
--- a/TunnelEndpoint.cpp
+++ b/TunnelEndpoint.cpp
@ -0,0 +1,270 @@
+#include "I2PEndian.h"
+#include <string.h>
+#include "Log.h"
+#include "NetDb.h"
+#include "I2NPProtocol.h"
+#include "Transports.h"
+#include "RouterContext.h"
+#include "TunnelEndpoint.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	TunnelEndpoint::~TunnelEndpoint ()
+	{
+		for (auto it: m_IncompleteMessages)
+			i2p::DeleteI2NPMessage (it.second.data);
+		for (auto it: m_OutOfSequenceFragments)
+			i2p::DeleteI2NPMessage (it.second.data);
+	}	
+	
+	void TunnelEndpoint::HandleDecryptedTunnelDataMsg (I2NPMessage * msg)
+	{
+		m_NumReceivedBytes += TUNNEL_DATA_MSG_SIZE;
+		
+		uint8_t * decrypted = msg->GetPayload () + 20; // 4 + 16
+		uint8_t * zero = (uint8_t *)memchr (decrypted + 4, 0, TUNNEL_DATA_ENCRYPTED_SIZE - 4); // witout 4-byte checksum
+		if (zero)
+		{	
+			LogPrint ("TunnelMessage: zero found at ", (int)(zero-decrypted));
+			uint8_t * fragment = zero + 1;
+			// verify checksum
+			memcpy (msg->GetPayload () + TUNNEL_DATA_MSG_SIZE, msg->GetPayload () + 4, 16); // copy iv to the end
+			uint8_t hash[32];
+			CryptoPP::SHA256().CalculateDigest (hash, fragment, TUNNEL_DATA_MSG_SIZE -(fragment - msg->GetPayload ()) + 16); // payload + iv
+			if (memcmp (hash, decrypted, 4))
+			{
+				LogPrint ("TunnelMessage: checksum verification failed");
+				i2p::DeleteI2NPMessage (msg);
+				return;
+			}	
+			// process fragments
+			while (fragment < decrypted + TUNNEL_DATA_ENCRYPTED_SIZE)
+			{
+				uint8_t flag = fragment[0];
+				fragment++;
+				
+				bool isFollowOnFragment = flag & 0x80, isLastFragment = true;		
+				uint32_t msgID = 0;
+				int fragmentNum = 0;
+				TunnelMessageBlockEx m;
+				if (!isFollowOnFragment)
+				{	
+					// first fragment
+					
+					m.deliveryType = (TunnelDeliveryType)((flag >> 5) & 0x03);
+					switch (m.deliveryType)
+					{
+						case eDeliveryTypeLocal: // 0
+							LogPrint ("Delivery type local");
+						break;
+					  	case eDeliveryTypeTunnel: // 1
+							LogPrint ("Delivery type tunnel");	
+							m.tunnelID = bufbe32toh (fragment);
+							fragment += 4; // tunnelID
+							m.hash = i2p::data::IdentHash (fragment);
+							fragment += 32; // hash
+						break;
+						case eDeliveryTypeRouter: // 2
+							LogPrint ("Delivery type router");	
+							m.hash = i2p::data::IdentHash (fragment);	
+							fragment += 32; // to hash
+						break;
+						default:
+							;
+					}	
+
+					bool isFragmented = flag & 0x08;
+					if (isFragmented)
+					{
+						// Message ID
+						msgID = bufbe32toh (fragment); 	
+						fragment += 4;
+						LogPrint ("Fragmented message ", msgID);
+						isLastFragment = false;
+					}	
+				}
+				else
+				{
+					// follow on
+					msgID = bufbe32toh (fragment); // MessageID			
+					fragment += 4; 
+					fragmentNum = (flag >> 1) & 0x3F; // 6 bits
+					isLastFragment = flag & 0x01;
+					LogPrint ("Follow on fragment ", fragmentNum, " of message ", msgID, isLastFragment ? " last" : " non-last");
+				}	
+				
+				uint16_t size = bufbe16toh (fragment);
+				fragment += 2;
+				LogPrint ("Fragment size=", (int)size);
+
+				msg->offset = fragment - msg->buf;
+				msg->len = msg->offset + size;
+				if (fragment + size < decrypted + TUNNEL_DATA_ENCRYPTED_SIZE)
+				{
+					// this is not last message. we have to copy it
+					m.data = NewI2NPMessage ();
+					m.data->offset += TUNNEL_GATEWAY_HEADER_SIZE; // reserve room for TunnelGateway header
+					m.data->len += TUNNEL_GATEWAY_HEADER_SIZE;
+					*(m.data) = *msg;
+				}
+				else
+					m.data = msg;
+				
+				if (!isFollowOnFragment && isLastFragment)
+					HandleNextMessage (m);
+				else
+				{
+					if (msgID) // msgID is presented, assume message is fragmented
+					{
+						if (!isFollowOnFragment) // create new incomlete message
+						{
+							m.nextFragmentNum = 1;
+							auto& msg = m_IncompleteMessages[msgID];
+							msg = m;
+							HandleOutOfSequenceFragment (msgID, msg);
+						}
+						else
+						{
+							m.nextFragmentNum = fragmentNum;
+							HandleFollowOnFragment (msgID, isLastFragment, m);
+						}	
+					}
+					else
+						LogPrint ("Message is fragmented, but msgID is not presented");
+				}	
+					
+				fragment += size;
+			}	
+		}	
+		else
+		{	
+			LogPrint ("TunnelMessage: zero not found");
+			i2p::DeleteI2NPMessage (msg);	
+		}	
+	}	
+
+	void TunnelEndpoint::HandleFollowOnFragment (uint32_t msgID, bool isLastFragment, const TunnelMessageBlockEx& m)
+	{
+		auto fragment = m.data->GetBuffer ();
+		auto size = m.data->GetLength ();
+		auto it = m_IncompleteMessages.find (msgID);
+		if (it != m_IncompleteMessages.end())
+		{
+			auto& msg = it->second;
+			if (m.nextFragmentNum == msg.nextFragmentNum)
+			{
+				if (msg.data->len + size < I2NP_MAX_MESSAGE_SIZE) // check if messega is not too long
+				{	
+					memcpy (msg.data->buf + msg.data->len, fragment, size); // concatenate fragment
+					msg.data->len += size;
+					if (isLastFragment)
+					{
+						// message complete
+						HandleNextMessage (msg);	
+						m_IncompleteMessages.erase (it); 
+					}	
+					else
+					{	
+						msg.nextFragmentNum++;
+						HandleOutOfSequenceFragment (msgID, msg);
+					}	
+				}
+				else
+				{
+					LogPrint ("Fragment ", m.nextFragmentNum, " of message ", msgID, "exceeds max I2NP message size. Message dropped");
+					i2p::DeleteI2NPMessage (msg.data);
+					m_IncompleteMessages.erase (it);
+				}
+				i2p::DeleteI2NPMessage (m.data);
+			}
+			else
+			{	
+				LogPrint ("Unexpected fragment ", (int)m.nextFragmentNum, " instead ", (int)msg.nextFragmentNum, " of message ", msgID, ". Saved");
+				AddOutOfSequenceFragment (msgID, m.nextFragmentNum, isLastFragment, m.data);
+			}
+		}
+		else
+		{	
+			LogPrint ("First fragment of message ", msgID, " not found. Saved");
+			AddOutOfSequenceFragment (msgID, m.nextFragmentNum, isLastFragment, m.data);
+		}	
+	}	
+
+	void TunnelEndpoint::AddOutOfSequenceFragment (uint32_t msgID, uint8_t fragmentNum, bool isLastFragment, I2NPMessage * data)
+	{
+		auto it = m_OutOfSequenceFragments.find (msgID);
+		if (it == m_OutOfSequenceFragments.end ())
+			m_OutOfSequenceFragments.insert (std::pair<uint32_t, Fragment> (msgID, {fragmentNum, isLastFragment, data}));	
+		else
+			i2p::DeleteI2NPMessage (data);
+	}	
+
+	void TunnelEndpoint::HandleOutOfSequenceFragment (uint32_t msgID, TunnelMessageBlockEx& msg)
+	{
+		auto it = m_OutOfSequenceFragments.find (msgID);
+		if (it != m_OutOfSequenceFragments.end ())
+		{
+			if (it->second.fragmentNum == msg.nextFragmentNum)
+			{
+				LogPrint ("Out-of-sequence fragment ", (int)it->second.fragmentNum, " of message ", msgID, " found");
+				auto size = it->second.data->GetLength ();
+				memcpy (msg.data->buf + msg.data->len, it->second.data->GetBuffer (), size); // concatenate out-of-sync fragment
+				msg.data->len += size;
+				if (it->second.isLastFragment)
+				{
+					// message complete
+					HandleNextMessage (msg);	
+					m_IncompleteMessages.erase (msgID); 
+				}	
+				else
+					msg.nextFragmentNum++;
+				i2p::DeleteI2NPMessage (it->second.data);
+				m_OutOfSequenceFragments.erase (it);
+			}	
+		}	
+	}	
+	
+	void TunnelEndpoint::HandleNextMessage (const TunnelMessageBlock& msg)
+	{
+		LogPrint ("TunnelMessage: handle fragment of ", msg.data->GetLength ()," bytes. Msg type ", (int)msg.data->GetTypeID ());
+		switch (msg.deliveryType)
+		{
+			case eDeliveryTypeLocal:
+				i2p::HandleI2NPMessage (msg.data);
+			break;
+			case eDeliveryTypeTunnel:
+				i2p::transport::transports.SendMessage (msg.hash, i2p::CreateTunnelGatewayMsg (msg.tunnelID, msg.data));
+			break;
+			case eDeliveryTypeRouter:
+				if (msg.hash == i2p::context.GetRouterInfo ().GetIdentHash ()) // check if message is sent to us
+					i2p::HandleI2NPMessage (msg.data);
+				else
+				{	
+					// to somebody else
+					if (!m_IsInbound) // outbound transit tunnel
+					{
+						auto typeID = msg.data->GetTypeID ();
+						if (typeID == eI2NPDatabaseStore || typeID == eI2NPDatabaseSearchReply )
+						{
+							// catch RI or reply with new list of routers
+							auto ds = NewI2NPMessage ();
+							*ds = *(msg.data);
+							i2p::data::netdb.PostI2NPMsg (ds);
+						}
+						i2p::transport::transports.SendMessage (msg.hash, msg.data);
+					}
+					else // we shouldn't send this message. possible leakage 
+					{
+						LogPrint ("Message to another router arrived from an inbound tunnel. Dropped");
+						i2p::DeleteI2NPMessage (msg.data);
+					}
+				}
+			break;
+			default:
+				LogPrint ("TunnelMessage: Unknown delivery type ", (int)msg.deliveryType);
+		};	
+	}	
+}		
+}
--- a/TunnelEndpoint.h
+++ b/TunnelEndpoint.h
@ -0,0 +1,54 @@
+#ifndef TUNNEL_ENDPOINT_H__
+#define TUNNEL_ENDPOINT_H__
+
+#include <inttypes.h>
+#include <map>
+#include <string>
+#include "I2NPProtocol.h"
+#include "TunnelBase.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	class TunnelEndpoint
+	{	
+		struct TunnelMessageBlockEx: public TunnelMessageBlock
+		{
+			uint8_t nextFragmentNum;
+		};	
+
+		struct Fragment
+		{
+			uint8_t fragmentNum;
+			bool isLastFragment;
+			I2NPMessage * data;
+		};	
+		
+		public:
+
+			TunnelEndpoint (bool isInbound): m_IsInbound (isInbound), m_NumReceivedBytes (0) {};
+			~TunnelEndpoint ();
+			size_t GetNumReceivedBytes () const { return m_NumReceivedBytes; };
+			
+			void HandleDecryptedTunnelDataMsg (I2NPMessage * msg);
+
+		private:
+
+			void HandleFollowOnFragment (uint32_t msgID, bool isLastFragment, const TunnelMessageBlockEx& m);
+			void HandleNextMessage (const TunnelMessageBlock& msg);
+
+			void AddOutOfSequenceFragment (uint32_t msgID, uint8_t fragmentNum, bool isLastFragment, I2NPMessage * data);
+			void HandleOutOfSequenceFragment (uint32_t msgID, TunnelMessageBlockEx& msg);
+			
+		private:			
+
+			std::map<uint32_t, TunnelMessageBlockEx> m_IncompleteMessages;
+			std::map<uint32_t, Fragment> m_OutOfSequenceFragments;
+			bool m_IsInbound;
+			size_t m_NumReceivedBytes;
+	};	
+}		
+}
+
+#endif
--- a/libi2pd/TunnelGateway.cpp
+++ b/libi2pd/TunnelGateway.cpp
@ -1,14 +1,6 @@
-/*
-* Copyright (c) 2013-2024, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
 #include <string.h>
-#include "Crypto.h"
 #include "I2PEndian.h"
+#include <cryptopp/sha.h>
 #include "Log.h"
 #include "RouterContext.h"
 #include "Transports.h"
@ -18,30 +10,12 @@ namespace i2p
 {
 namespace tunnel
 {
-	TunnelGatewayBuffer::TunnelGatewayBuffer ():
-		m_CurrentTunnelDataMsg (nullptr), m_RemainingSize (0), m_NonZeroRandomBuffer (nullptr)
-	{
-	}
-
-	TunnelGatewayBuffer::~TunnelGatewayBuffer ()
-	{
-		ClearTunnelDataMsgs ();
-		if (m_NonZeroRandomBuffer) delete[] m_NonZeroRandomBuffer;
-	}
-
 	void TunnelGatewayBuffer::PutI2NPMsg (const TunnelMessageBlock& block)
 	{
 		bool messageCreated = false;
 		if (!m_CurrentTunnelDataMsg)
 		{	
 			CreateCurrentTunnelDataMessage ();
-			if (block.data && block.data->onDrop)
-			{	
-				// onDrop is called for the first fragment in tunnel message
-				// that's usually true for short TBMs or lookups 
-				m_CurrentTunnelDataMsg->onDrop = block.data->onDrop;
-				block.data->onDrop = nullptr;
-			}	
 			messageCreated = true;
 		}	

@ -62,21 +36,8 @@ namespace tunnel
 		di[0] = block.deliveryType << 5; // set delivery type

 		// create fragments
-		const std::shared_ptr<I2NPMessage> & msg = block.data;
-		size_t fullMsgLen = diLen + msg->GetLength () + 2; // delivery instructions + payload + 2 bytes length
-
-		if (!messageCreated && fullMsgLen > m_RemainingSize) // check if we should complete previous message
-		{
-			size_t numFollowOnFragments = fullMsgLen / TUNNEL_DATA_MAX_PAYLOAD_SIZE;
-			// length of bytes doesn't fit full tunnel message
-			// every follow-on fragment adds 7 bytes
-			size_t nonFit = (fullMsgLen + numFollowOnFragments*7) % TUNNEL_DATA_MAX_PAYLOAD_SIZE;
-			if (!nonFit || nonFit > m_RemainingSize || m_RemainingSize < fullMsgLen/5)
-			{
-				CompleteCurrentTunnelDataMessage ();
-				CreateCurrentTunnelDataMessage ();
-			}
-		}
+		I2NPMessage * msg = block.data;
+		auto fullMsgLen = diLen + msg->GetLength () + 2; // delivery instructions + payload + 2 bytes length
 		if (fullMsgLen <= m_RemainingSize)
 		{
 			// message fits. First and last fragment
@ -88,9 +49,22 @@ namespace tunnel
 			m_RemainingSize -= diLen + msg->GetLength ();
 			if (!m_RemainingSize)
 				CompleteCurrentTunnelDataMessage ();
+			DeleteI2NPMessage (msg);
 		}	
 		else
 		{
+			if (!messageCreated) // check if we should complete previous message
+			{	
+				auto numFollowOnFragments = fullMsgLen / TUNNEL_DATA_MAX_PAYLOAD_SIZE;
+				// length of bytes don't fit full tunnel message
+				// every follow-on fragment adds 7 bytes
+				auto nonFit = (fullMsgLen + numFollowOnFragments*7) % TUNNEL_DATA_MAX_PAYLOAD_SIZE; 
+				if (!nonFit || nonFit > m_RemainingSize)
+				{
+					CompleteCurrentTunnelDataMessage ();
+					CreateCurrentTunnelDataMessage ();
+				}	
+			}	
 			if (diLen + 6 <= m_RemainingSize)
 			{
 				// delivery instructions fit
@ -130,19 +104,16 @@ namespace tunnel
 					m_CurrentTunnelDataMsg->len += s+7;
 					if (isLastFragment)
 					{
-						if(m_RemainingSize < (s+7)) {
-							LogPrint (eLogError, "TunnelGateway: remaining size overflow: ", m_RemainingSize, " < ", s+7);
-						} else {
 						m_RemainingSize -= s+7; 
-							if (m_RemainingSize == 0)
+						if (!m_RemainingSize)
 							CompleteCurrentTunnelDataMessage ();
 					}
-					}
 					else
 						CompleteCurrentTunnelDataMessage ();
 					size += s;
 					fragmentNumber++;
 				}
+				DeleteI2NPMessage (msg);
 			}	
 			else
 			{
@ -157,12 +128,12 @@ namespace tunnel
 	void TunnelGatewayBuffer::ClearTunnelDataMsgs ()
 	{
 		m_TunnelDataMsgs.clear ();
-		m_CurrentTunnelDataMsg = nullptr;
 	}

 	void TunnelGatewayBuffer::CreateCurrentTunnelDataMessage ()
 	{
-		m_CurrentTunnelDataMsg = NewI2NPTunnelMessage (true); // tunnel endpoint is at least of two tunnel messages size
+		m_CurrentTunnelDataMsg = NewI2NPMessage ();
+		m_CurrentTunnelDataMsg->Align (12);
 		// we reserve space for padding
 		m_CurrentTunnelDataMsg->offset += TUNNEL_DATA_MSG_SIZE + I2NP_HEADER_SIZE;
 		m_CurrentTunnelDataMsg->len = m_CurrentTunnelDataMsg->offset;
@ -177,26 +148,17 @@ namespace tunnel
 		
 		m_CurrentTunnelDataMsg->offset = m_CurrentTunnelDataMsg->len - TUNNEL_DATA_MSG_SIZE - I2NP_HEADER_SIZE;
 		uint8_t * buf = m_CurrentTunnelDataMsg->GetPayload ();
-		RAND_bytes (buf + 4, 16); // original IV
+		htobe32buf (buf, m_TunnelID);
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		rnd.GenerateBlock (buf + 4, 16); // original IV	
 		memcpy (payload + size, buf + 4, 16); // copy IV for checksum 
 		uint8_t hash[32];
-		SHA256(payload, size+16, hash);
+		CryptoPP::SHA256().CalculateDigest (hash, payload, size+16);
 		memcpy (buf+20, hash, 4); // checksum		
 		payload[-1] = 0; // zero	
 		ptrdiff_t paddingSize = payload - buf - 25; // 25  = 24 + 1 
 		if (paddingSize > 0)
-		{
-			// non-zero padding
-			if (!m_NonZeroRandomBuffer) // first time?
-			{
-				m_NonZeroRandomBuffer = new uint8_t[TUNNEL_DATA_MAX_PAYLOAD_SIZE];
-				RAND_bytes (m_NonZeroRandomBuffer, TUNNEL_DATA_MAX_PAYLOAD_SIZE);
-				for (size_t i = 0; i < TUNNEL_DATA_MAX_PAYLOAD_SIZE; i++)
-					if (!m_NonZeroRandomBuffer[i]) m_NonZeroRandomBuffer[i] = 1;
-			}
-			auto randomOffset = rand () % (TUNNEL_DATA_MAX_PAYLOAD_SIZE - paddingSize + 1);
-			memcpy (buf + 24, m_NonZeroRandomBuffer + randomOffset, paddingSize);
-		}
+			memset (buf + 24, 1, paddingSize); // padding TODO: fill with random data

 		// we can't fill message header yet because encryption is required
 		m_TunnelDataMsgs.push_back (m_CurrentTunnelDataMsg);
@ -220,24 +182,17 @@ namespace tunnel

 	void TunnelGateway::SendBuffer ()
 	{
-		// create list or tunnel messages
 		m_Buffer.CompleteCurrentTunnelDataMessage ();
-		std::list<std::shared_ptr<I2NPMessage> > newTunnelMsgs;
-		const auto& tunnelDataMsgs = m_Buffer.GetTunnelDataMsgs ();
-		for (auto& tunnelMsg : tunnelDataMsgs)
+		auto tunnelMsgs = m_Buffer.GetTunnelDataMsgs ();
+		for (auto tunnelMsg : tunnelMsgs)
 		{	
-			auto newMsg = CreateEmptyTunnelDataMsg (false);
-			m_Tunnel.EncryptTunnelMsg (tunnelMsg, newMsg);
-			htobe32buf (newMsg->GetPayload (), m_Tunnel.GetNextTunnelID ());
-			newMsg->FillI2NPMessageHeader (eI2NPTunnelData);
-			if (tunnelMsg->onDrop) newMsg->onDrop = tunnelMsg->onDrop;
-			newTunnelMsgs.push_back (newMsg);
+			m_Tunnel->EncryptTunnelMsg (tunnelMsg);
+			FillI2NPMessageHeader (tunnelMsg, eI2NPTunnelData);
+			i2p::transport::transports.SendMessage (m_Tunnel->GetNextIdentHash (), tunnelMsg);
 			m_NumSentBytes += TUNNEL_DATA_MSG_SIZE;
 		}	
 		m_Buffer.ClearTunnelDataMsgs ();
-		// send 
-		if (!m_Sender) m_Sender = std::make_unique<TunnelTransportSender>();
-		m_Sender->SendMessagesTo (m_Tunnel.GetNextIdentHash (), std::move (newTunnelMsgs));		
 	}	
 }		
 }	
+
--- a/TunnelGateway.h
+++ b/TunnelGateway.h
@ -0,0 +1,55 @@
+#ifndef TUNNEL_GATEWAY_H__
+#define TUNNEL_GATEWAY_H__
+
+#include <inttypes.h>
+#include <vector>
+#include "I2NPProtocol.h"
+#include "TunnelBase.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	class TunnelGatewayBuffer
+	{
+		public:
+			TunnelGatewayBuffer (uint32_t tunnelID): m_TunnelID (tunnelID), 
+				m_CurrentTunnelDataMsg (nullptr), m_RemainingSize (0) {};
+			void PutI2NPMsg (const TunnelMessageBlock& block);	
+			const std::vector<I2NPMessage *>& GetTunnelDataMsgs () const { return m_TunnelDataMsgs; };
+			void ClearTunnelDataMsgs ();
+			void CompleteCurrentTunnelDataMessage ();
+
+		private:
+
+			void CreateCurrentTunnelDataMessage ();
+			
+		private:
+
+			uint32_t m_TunnelID;
+			std::vector<I2NPMessage *> m_TunnelDataMsgs;
+			I2NPMessage * m_CurrentTunnelDataMsg;
+			size_t m_RemainingSize;
+	};	
+
+	class TunnelGateway
+	{
+		public:
+
+			TunnelGateway (TunnelBase * tunnel): 
+				m_Tunnel (tunnel), m_Buffer (tunnel->GetNextTunnelID ()), m_NumSentBytes (0) {};
+			void SendTunnelDataMsg (const TunnelMessageBlock& block);	
+			void PutTunnelDataMsg (const TunnelMessageBlock& block);
+			void SendBuffer ();			
+			size_t GetNumSentBytes () const { return m_NumSentBytes; };
+		
+		private:
+
+			TunnelBase * m_Tunnel;
+			TunnelGatewayBuffer m_Buffer;
+			size_t m_NumSentBytes;
+	};	
+}		
+}	
+
+#endif
--- a/TunnelPool.cpp
+++ b/TunnelPool.cpp
@ -0,0 +1,358 @@
+#include "I2PEndian.h"
+#include "CryptoConst.h"
+#include "Tunnel.h"
+#include "NetDb.h"
+#include "Timestamp.h"
+#include "Garlic.h"
+#include "TunnelPool.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	TunnelPool::TunnelPool (i2p::garlic::GarlicDestination * localDestination, int numInboundHops, int numOutboundHops, int numTunnels):
+		m_LocalDestination (localDestination), m_NumInboundHops (numInboundHops), m_NumOutboundHops (numOutboundHops),
+		m_NumTunnels (numTunnels), m_IsActive (true)
+	{
+	}
+
+	TunnelPool::~TunnelPool ()
+	{
+		DetachTunnels ();
+	}
+
+	void TunnelPool::DetachTunnels ()
+	{
+		{
+			std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);	
+			for (auto it: m_InboundTunnels)
+				it->SetTunnelPool (nullptr);
+			m_InboundTunnels.clear ();
+		}
+		{
+			std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+			for (auto it: m_OutboundTunnels)
+				it->SetTunnelPool (nullptr);
+			m_OutboundTunnels.clear ();
+		}
+		m_Tests.clear ();
+	}	
+		
+	void TunnelPool::TunnelCreated (InboundTunnel * createdTunnel)
+	{
+		if (!m_IsActive) return;
+		{
+			std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+			m_InboundTunnels.insert (createdTunnel);
+		}
+		if (m_LocalDestination)
+			m_LocalDestination->SetLeaseSetUpdated ();
+	}
+
+	void TunnelPool::TunnelExpired (InboundTunnel * expiredTunnel)
+	{
+		if (expiredTunnel)
+		{	
+			expiredTunnel->SetTunnelPool (nullptr);
+			for (auto it: m_Tests)
+				if (it.second.second == expiredTunnel) it.second.second = nullptr;
+			RecreateInboundTunnel (expiredTunnel);	
+
+			std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+			m_InboundTunnels.erase (expiredTunnel);
+		}	
+	}	
+
+	void TunnelPool::TunnelCreated (OutboundTunnel * createdTunnel)
+	{
+		if (!m_IsActive) return;
+		std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+		m_OutboundTunnels.insert (createdTunnel);
+	}
+
+	void TunnelPool::TunnelExpired (OutboundTunnel * expiredTunnel)
+	{
+		if (expiredTunnel)
+		{
+			expiredTunnel->SetTunnelPool (nullptr);
+			for (auto it: m_Tests)
+				if (it.second.first == expiredTunnel) it.second.first = nullptr;
+			RecreateOutboundTunnel (expiredTunnel);
+
+			std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+			m_OutboundTunnels.erase (expiredTunnel);
+		}
+	}
+		
+	std::vector<InboundTunnel *> TunnelPool::GetInboundTunnels (int num) const
+	{
+		std::vector<InboundTunnel *> v;
+		int i = 0;
+		std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+		for (auto it : m_InboundTunnels)
+		{
+			if (i >= num) break;
+			if (it->IsEstablished ())
+			{
+				v.push_back (it);
+				i++;
+			}	
+		}	
+		return v;
+	}
+
+	OutboundTunnel * TunnelPool::GetNextOutboundTunnel (OutboundTunnel * suggested) const
+	{
+		std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);	
+		return GetNextTunnel (m_OutboundTunnels, suggested);
+	}	
+
+	InboundTunnel * TunnelPool::GetNextInboundTunnel (InboundTunnel * suggested) const
+	{
+		std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);	
+		return GetNextTunnel (m_InboundTunnels, suggested);
+	}
+
+	template<class TTunnels>
+	typename TTunnels::value_type TunnelPool::GetNextTunnel (TTunnels& tunnels, 
+		typename TTunnels::value_type suggested) const
+	{
+		if (tunnels.empty ()) return nullptr;
+		if (suggested && tunnels.count (suggested) > 0 && suggested->IsEstablished ())
+				return suggested;
+		
+		CryptoPP::RandomNumberGenerator& rnd = i2p::context.GetRandomNumberGenerator ();
+		uint32_t ind = rnd.GenerateWord32 (0, tunnels.size ()/2), i = 0;
+		typename TTunnels::value_type tunnel = nullptr;
+		for (auto it: tunnels)
+		{	
+			if (it->IsEstablished ())
+			{
+				tunnel = it;
+				i++;
+			}
+			if (i > ind && tunnel) break;
+		}	
+		return tunnel;
+	}
+
+	void TunnelPool::CreateTunnels ()
+	{
+		int num = 0;
+		{
+			std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+			for (auto it : m_InboundTunnels)
+				if (it->IsEstablished ()) num++;
+		}
+		for (int i = num; i < m_NumTunnels; i++)
+			CreateInboundTunnel ();	
+		
+		num = 0;
+		{
+			std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);	
+			for (auto it : m_OutboundTunnels)
+				if (it->IsEstablished ()) num++;
+		}
+		for (int i = num; i < m_NumTunnels; i++)
+			CreateOutboundTunnel ();	
+	}
+
+	void TunnelPool::TestTunnels ()
+	{
+		auto& rnd = i2p::context.GetRandomNumberGenerator ();
+		for (auto it: m_Tests)
+		{
+			LogPrint ("Tunnel test ", (int)it.first, " failed"); 
+			// if test failed again with another tunnel we consider it failed
+			if (it.second.first)
+			{	
+				if (it.second.first->GetState () == eTunnelStateTestFailed)
+				{	
+					it.second.first->SetState (eTunnelStateFailed);
+					std::unique_lock<std::mutex> l(m_OutboundTunnelsMutex);
+					m_OutboundTunnels.erase (it.second.first);
+				}
+				else
+					it.second.first->SetState (eTunnelStateTestFailed);
+			}	
+			if (it.second.second)
+			{
+				if (it.second.second->GetState () == eTunnelStateTestFailed)
+				{	
+					it.second.second->SetState (eTunnelStateFailed);
+					{
+						std::unique_lock<std::mutex> l(m_InboundTunnelsMutex);
+						m_InboundTunnels.erase (it.second.second);
+					}
+					if (m_LocalDestination)
+						m_LocalDestination->SetLeaseSetUpdated ();
+				}	
+				else
+					it.second.second->SetState (eTunnelStateTestFailed);
+			}	
+		}
+		m_Tests.clear ();
+		// new tests	
+		auto it1 = m_OutboundTunnels.begin ();
+		auto it2 = m_InboundTunnels.begin ();
+		while (it1 != m_OutboundTunnels.end () && it2 != m_InboundTunnels.end ())
+		{
+			bool failed = false;
+			if ((*it1)->IsFailed ())
+			{	
+				failed = true;
+				it1++;
+			}
+			if ((*it2)->IsFailed ())
+			{	
+				failed = true;
+				it2++;
+			}
+			if (!failed)
+			{
+ 				uint32_t msgID = rnd.GenerateWord32 ();
+ 				m_Tests[msgID] = std::make_pair (*it1, *it2);
+ 				(*it1)->SendTunnelDataMsg ((*it2)->GetNextIdentHash (), (*it2)->GetNextTunnelID (),
+					CreateDeliveryStatusMsg (msgID));
+				it1++; it2++;
+			}	
+		}
+	}
+
+	void TunnelPool::ProcessGarlicMessage (I2NPMessage * msg)
+	{
+		if (m_LocalDestination)
+			m_LocalDestination->ProcessGarlicMessage (msg);
+		else
+		{
+			LogPrint (eLogWarning, "Local destination doesn't exist. Dropped");
+			DeleteI2NPMessage (msg);
+		}	
+	}	
+		
+	void TunnelPool::ProcessDeliveryStatus (I2NPMessage * msg)
+	{
+		const uint8_t * buf = msg->GetPayload ();
+		uint32_t msgID = bufbe32toh (buf);
+		buf += 4;	
+		uint64_t timestamp = bufbe64toh (buf);
+
+		auto it = m_Tests.find (msgID);
+		if (it != m_Tests.end ())
+		{
+			// restore from test failed state if any
+			if (it->second.first->GetState () == eTunnelStateTestFailed)
+				it->second.first->SetState (eTunnelStateEstablished);
+			if (it->second.second->GetState () == eTunnelStateTestFailed)
+				it->second.second->SetState (eTunnelStateEstablished);
+			LogPrint ("Tunnel test ", it->first, " successive. ", i2p::util::GetMillisecondsSinceEpoch () - timestamp, " milliseconds");
+			m_Tests.erase (it);
+			DeleteI2NPMessage (msg);
+		}
+		else
+		{
+			if (m_LocalDestination)
+				m_LocalDestination->ProcessDeliveryStatusMessage (msg);
+			else
+			{	
+				LogPrint (eLogWarning, "Local destination doesn't exist. Dropped");
+				DeleteI2NPMessage (msg);
+			}	
+		}	
+	}
+
+	std::shared_ptr<const i2p::data::RouterInfo> TunnelPool::SelectNextHop (std::shared_ptr<const i2p::data::RouterInfo> prevHop) const
+	{
+		bool isExploratory = (m_LocalDestination == &i2p::context); // TODO: implement it better
+		auto hop =  isExploratory ? i2p::data::netdb.GetRandomRouter (prevHop): 
+			i2p::data::netdb.GetHighBandwidthRandomRouter (prevHop);
+			
+		if (!hop)
+			hop = i2p::data::netdb.GetRandomRouter ();
+		return hop;	
+	}	
+		
+	void TunnelPool::CreateInboundTunnel ()
+	{
+		OutboundTunnel * outboundTunnel = GetNextOutboundTunnel ();
+		if (!outboundTunnel)
+			outboundTunnel = tunnels.GetNextOutboundTunnel ();
+		LogPrint ("Creating destination inbound tunnel...");
+		auto prevHop = i2p::context.GetSharedRouterInfo ();	
+		std::vector<std::shared_ptr<const i2p::data::RouterInfo> > hops;
+		int numHops = m_NumInboundHops;
+		if (outboundTunnel)
+		{	
+			// last hop
+			auto hop = outboundTunnel->GetTunnelConfig ()->GetFirstHop ()->router;
+			if (hop->GetIdentHash () != i2p::context.GetIdentHash ()) // outbound shouldn't be zero-hop tunnel
+			{	
+				prevHop = hop;
+				hops.push_back (prevHop);
+				numHops--;
+			}
+		}
+		for (int i = 0; i < numHops; i++)
+		{
+			auto hop = SelectNextHop (prevHop);
+			prevHop = hop;
+			hops.push_back (hop);
+		}		
+		std::reverse (hops.begin (), hops.end ());	
+		auto * tunnel = tunnels.CreateTunnel<InboundTunnel> (new TunnelConfig (hops), outboundTunnel);
+		tunnel->SetTunnelPool (this);
+	}
+
+	void TunnelPool::RecreateInboundTunnel (InboundTunnel * tunnel)
+	{
+		OutboundTunnel * outboundTunnel = GetNextOutboundTunnel ();
+		if (!outboundTunnel)
+			outboundTunnel = tunnels.GetNextOutboundTunnel ();
+		LogPrint ("Re-creating destination inbound tunnel...");
+		auto * newTunnel = tunnels.CreateTunnel<InboundTunnel> (tunnel->GetTunnelConfig ()->Clone (), outboundTunnel);
+		newTunnel->SetTunnelPool (this);
+	}	
+		
+	void TunnelPool::CreateOutboundTunnel ()
+	{
+		InboundTunnel * inboundTunnel = GetNextInboundTunnel ();
+		if (!inboundTunnel)
+			inboundTunnel = tunnels.GetNextInboundTunnel ();
+		if (inboundTunnel)
+		{	
+			LogPrint ("Creating destination outbound tunnel...");
+
+			auto prevHop = i2p::context.GetSharedRouterInfo ();
+			std::vector<std::shared_ptr<const i2p::data::RouterInfo> > hops;
+			for (int i = 0; i < m_NumOutboundHops; i++)
+			{
+				auto hop = SelectNextHop (prevHop);
+				prevHop = hop;
+				hops.push_back (hop);
+			}	
+				
+			auto * tunnel = tunnels.CreateTunnel<OutboundTunnel> (
+				new TunnelConfig (hops, inboundTunnel->GetTunnelConfig ()));
+			tunnel->SetTunnelPool (this);
+		}	
+		else
+			LogPrint ("Can't create outbound tunnel. No inbound tunnels found");
+	}	
+		
+	void TunnelPool::RecreateOutboundTunnel (OutboundTunnel * tunnel)
+	{
+		InboundTunnel * inboundTunnel = GetNextInboundTunnel ();
+		if (!inboundTunnel)
+			inboundTunnel = tunnels.GetNextInboundTunnel ();
+		if (inboundTunnel)
+		{	
+			LogPrint ("Re-creating destination outbound tunnel...");
+			auto * newTunnel = tunnels.CreateTunnel<OutboundTunnel> (
+				tunnel->GetTunnelConfig ()->Clone (inboundTunnel->GetTunnelConfig ()));
+			newTunnel->SetTunnelPool (this);
+		}	
+		else
+			LogPrint ("Can't re-create outbound tunnel. No inbound tunnels found");
+	}			
+}
+}
--- a/TunnelPool.h
+++ b/TunnelPool.h
@ -0,0 +1,85 @@
+#ifndef TUNNEL_POOL__
+#define TUNNEL_POOL__
+
+#include <inttypes.h>
+#include <set>
+#include <vector>
+#include <utility>
+#include <mutex>
+#include "Identity.h"
+#include "LeaseSet.h"
+#include "RouterInfo.h"
+#include "I2NPProtocol.h"
+#include "TunnelBase.h"
+#include "RouterContext.h"
+#include "Garlic.h"
+
+namespace i2p
+{
+namespace tunnel
+{
+	class Tunnel;
+	class InboundTunnel;
+	class OutboundTunnel;
+
+	class TunnelPool // per local destination
+	{
+		public:
+
+			TunnelPool (i2p::garlic::GarlicDestination * localDestination, int numInboundHops, int numOutboundHops, int numTunnels = 5);
+			~TunnelPool ();
+		
+			i2p::garlic::GarlicDestination * GetLocalDestination () const { return m_LocalDestination; };
+			void SetLocalDestination (i2p::garlic::GarlicDestination * destination) { m_LocalDestination = destination; };
+
+			void CreateTunnels ();
+			void TunnelCreated (InboundTunnel * createdTunnel);
+			void TunnelExpired (InboundTunnel * expiredTunnel);
+			void TunnelCreated (OutboundTunnel * createdTunnel);
+			void TunnelExpired (OutboundTunnel * expiredTunnel);
+			std::vector<InboundTunnel *> GetInboundTunnels (int num) const;
+			OutboundTunnel * GetNextOutboundTunnel (OutboundTunnel * suggested = nullptr) const;
+			InboundTunnel * GetNextInboundTunnel (InboundTunnel * suggested = nullptr) const;		
+
+			void TestTunnels ();
+			void ProcessGarlicMessage (I2NPMessage * msg);
+			void ProcessDeliveryStatus (I2NPMessage * msg);
+
+			bool IsActive () const { return m_IsActive; };
+			void SetActive (bool isActive) { m_IsActive = isActive; };
+			void DetachTunnels ();
+			
+		private:
+
+			void CreateInboundTunnel ();	
+			void CreateOutboundTunnel ();
+			void RecreateInboundTunnel (InboundTunnel * tunnel);
+			void RecreateOutboundTunnel (OutboundTunnel * tunnel);
+			template<class TTunnels>
+			typename TTunnels::value_type GetNextTunnel (TTunnels& tunnels, 
+				typename TTunnels::value_type suggested = nullptr) const;
+			std::shared_ptr<const i2p::data::RouterInfo> SelectNextHop (std::shared_ptr<const i2p::data::RouterInfo> prevHop) const;
+			
+		private:
+
+			i2p::garlic::GarlicDestination * m_LocalDestination;
+			int m_NumInboundHops, m_NumOutboundHops, m_NumTunnels;
+			mutable std::mutex m_InboundTunnelsMutex;
+			std::set<InboundTunnel *, TunnelCreationTimeCmp> m_InboundTunnels; // recent tunnel appears first
+			mutable std::mutex m_OutboundTunnelsMutex;
+			std::set<OutboundTunnel *, TunnelCreationTimeCmp> m_OutboundTunnels;
+			std::map<uint32_t, std::pair<OutboundTunnel *, InboundTunnel *> > m_Tests;
+			bool m_IsActive;
+
+		public:
+
+			// for HTTP only
+			const decltype(m_OutboundTunnels)& GetOutboundTunnels () const { return m_OutboundTunnels; };
+			const decltype(m_InboundTunnels)& GetInboundTunnels () const { return m_InboundTunnels; };
+
+	};	
+}
+}
+
+#endif
+
--- a/UPnP.cpp
+++ b/UPnP.cpp
@ -0,0 +1,270 @@
+#ifdef USE_UPNP
+#include <string>
+#include <thread>
+
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+#include <boost/thread/thread.hpp>
+#include <boost/asio.hpp>
+#include <boost/bind.hpp>
+
+#include "Log.h"
+#include "RouterContext.h"
+#include "UPnP.h"
+#include "NetDb.h"
+#include "util.h"
+
+#include <miniupnpc/miniupnpc.h>
+#include <miniupnpc/upnpcommands.h>
+#include <dlfcn.h>
+
+#ifndef UPNPDISCOVER_SUCCESS
+/* miniupnpc 1.5 */
+typedef UPNPDev* (*upnp_upnpDiscoverFunc) (int, const char *, const char *, int);
+typedef int (*upnp_UPNP_AddPortMappingFunc) (const char *, const char *, const char *, const char *, 
+                                             const char *, const char *, const char *, const char *);
+#else
+/* miniupnpc 1.6 */
+typedef UPNPDev* (*upnp_upnpDiscoverFunc) (int, const char *, const char *, int, int, int *);
+typedef int (*upnp_UPNP_AddPortMappingFunc) (const char *, const char *, const char *, const char *, 
+                                             const char *, const char *, const char *, const char *, const char *);
+#endif
+typedef int (*upnp_UPNP_GetValidIGDFunc) (struct UPNPDev *, struct UPNPUrls *, struct IGDdatas *, char *, int);
+typedef int (*upnp_UPNP_GetExternalIPAddressFunc) (const char *, const char *, char *);
+typedef int (*upnp_UPNP_DeletePortMappingFunc) (const char *, const char *, const char *, const char *, const char *);
+typedef void (*upnp_freeUPNPDevlistFunc) (struct UPNPDev *);
+typedef void (*upnp_FreeUPNPUrlsFunc) (struct UPNPUrls *);
+
+namespace i2p
+{
+namespace UPnP
+{
+    UPnP upnpc;
+
+    UPnP::UPnP () : m_Thread (nullptr) , m_IsModuleLoaded (false)
+    {
+    }
+
+    void UPnP::Stop ()
+    {
+        if (m_Thread)
+        {   
+            m_Thread->join (); 
+            delete m_Thread;
+            m_Thread = nullptr;
+        }
+    }
+
+    void UPnP::Start()
+    {
+        m_Thread = new std::thread (std::bind (&UPnP::Run, this));
+    }
+    
+    UPnP::~UPnP ()
+    {
+    } 
+
+    void UPnP::Run ()
+    {
+#ifdef MAC_OSX
+        m_Module = dlopen ("libminiupnpc.dylib", RTLD_LAZY);
+#elif _WIN32
+        m_Module = LoadLibrary ("libminiupnpc.dll");
+        if (m_Module == NULL)
+        {
+            LogPrint ("Error loading UPNP library. This often happens if there is version mismatch!");
+            return;
+        }
+        else
+        {
+            m_IsModuleLoaded = true;
+        }
+#else
+        m_Module = dlopen ("libminiupnpc.so", RTLD_LAZY);
+#endif
+#ifndef _WIN32
+        if (!m_Module)
+        {
+            LogPrint ("no UPnP module available (", dlerror (), ")");
+            return;
+        }
+        else
+        {
+            m_IsModuleLoaded = true;
+        }
+#endif
+        for (auto& address : context.GetRouterInfo ().GetAddresses ())
+        {
+            if (!address.host.is_v6 ())
+            {
+                m_Port = std::to_string (util::config::GetArg ("-port", address.port));
+                Discover ();
+                if (address.transportStyle == data::RouterInfo::eTransportSSU )
+                {
+                    TryPortMapping (I2P_UPNP_UDP);
+                }
+                else if (address.transportStyle == data::RouterInfo::eTransportNTCP )
+                {
+                    TryPortMapping (I2P_UPNP_TCP);
+                }
+            }
+        }
+    } 
+        
+    void UPnP::Discover ()
+    {
+        const char *error;
+#ifdef _WIN32
+        upnp_upnpDiscoverFunc upnpDiscoverFunc = (upnp_upnpDiscoverFunc) GetProcAddress (m_Module, "upnpDiscover");
+#else
+        upnp_upnpDiscoverFunc upnpDiscoverFunc = (upnp_upnpDiscoverFunc) dlsym (m_Module, "upnpDiscover");
+        // reinterpret_cast<upnp_upnpDiscoverFunc> (dlsym(...));
+        if ( (error = dlerror ()))
+        {
+            LogPrint ("Error loading UPNP library. This often happens if there is version mismatch!");
+            return;
+        }
+#endif // _WIN32
+#ifndef UPNPDISCOVER_SUCCESS
+        /* miniupnpc 1.5 */
+        m_Devlist = upnpDiscoverFunc (2000, m_MulticastIf, m_Minissdpdpath, 0);
+#else
+        /* miniupnpc 1.6 */
+        int nerror = 0;
+        m_Devlist = upnpDiscoverFunc (2000, m_MulticastIf, m_Minissdpdpath, 0, 0, &nerror);
+#endif
+
+        int r;
+#ifdef _WIN32
+        upnp_UPNP_GetValidIGDFunc UPNP_GetValidIGDFunc = (upnp_UPNP_GetValidIGDFunc) GetProcAddress (m_Module, "UPNP_GetValidIGD");
+#else
+        upnp_UPNP_GetValidIGDFunc UPNP_GetValidIGDFunc = (upnp_UPNP_GetValidIGDFunc) dlsym (m_Module, "UPNP_GetValidIGD");
+#endif
+        r = (*UPNP_GetValidIGDFunc) (m_Devlist, &m_upnpUrls, &m_upnpData, m_NetworkAddr, sizeof (m_NetworkAddr));
+        if (r == 1)
+        {
+            upnp_UPNP_GetExternalIPAddressFunc UPNP_GetExternalIPAddressFunc = (upnp_UPNP_GetExternalIPAddressFunc) dlsym (m_Module, "UPNP_GetExternalIPAddress");
+            r = UPNP_GetExternalIPAddressFunc (m_upnpUrls.controlURL, m_upnpData.first.servicetype, m_externalIPAddress);
+            if(r != UPNPCOMMAND_SUCCESS)
+            {
+                LogPrint ("UPnP: UPNP_GetExternalIPAddress () returned ", r);
+                return;
+            }
+            else
+            {
+                if (m_externalIPAddress[0])
+                {
+                    LogPrint ("UPnP: ExternalIPAddress = ", m_externalIPAddress);
+                    i2p::context.UpdateAddress (boost::asio::ip::address::from_string (m_externalIPAddress));
+                    return;
+                }
+                else
+                {
+                    LogPrint ("UPnP: GetExternalIPAddress failed.");
+                    return;
+                }
+            }
+        }
+    }
+
+    void UPnP::TryPortMapping (int type)
+    {
+        std::string strType;
+        switch (type)
+        {
+            case I2P_UPNP_TCP:
+                strType = "TCP";
+                break;
+            case I2P_UPNP_UDP:
+            default:
+                strType = "UDP";
+        }
+        int r;
+        std::string strDesc = "I2Pd";
+        try {
+            for (;;) {
+#ifdef _WIN32
+                upnp_UPNP_AddPortMappingFunc UPNP_AddPortMappingFunc = (upnp_UPNP_AddPortMappingFunc) GetProcAddress (m_Module, "UPNP_AddPortMapping");
+#else
+                upnp_UPNP_AddPortMappingFunc UPNP_AddPortMappingFunc = (upnp_UPNP_AddPortMappingFunc) dlsym (m_Module, "UPNP_AddPortMapping");
+#endif
+#ifndef UPNPDISCOVER_SUCCESS
+                /* miniupnpc 1.5 */
+                r = UPNP_AddPortMappingFunc (m_upnpUrls.controlURL, m_upnpData.first.servicetype, m_Port.c_str (), m_Port.c_str (), m_NetworkAddr, strDesc.c_str (), strType.c_str (), 0);
+#else
+                /* miniupnpc 1.6 */
+                r = UPNP_AddPortMappingFunc (m_upnpUrls.controlURL, m_upnpData.first.servicetype, m_Port.c_str (), m_Port.c_str (), m_NetworkAddr, strDesc.c_str (), strType.c_str (), 0, "0");
+#endif
+                if (r!=UPNPCOMMAND_SUCCESS)
+                {
+                    LogPrint ("AddPortMapping (", m_Port.c_str () ,", ", m_Port.c_str () ,", ", m_NetworkAddr, ") failed with code ", r);
+                    return;
+                }
+                else
+                {
+                    LogPrint ("UPnP Port Mapping successful. (", m_NetworkAddr ,":", m_Port.c_str(), " type ", strType.c_str () ," -> ", m_externalIPAddress ,":", m_Port.c_str() ,")");
+                    return;
+                }
+                sleep(20*60);
+            }
+        }
+        catch (boost::thread_interrupted)
+        {
+            CloseMapping(type);
+            Close();
+            throw;
+        }
+    }
+
+    void UPnP::CloseMapping (int type)
+    {
+        std::string strType;
+        switch (type)
+        {
+            case I2P_UPNP_TCP:
+                strType = "TCP";
+                break;
+            case I2P_UPNP_UDP:
+            default:
+                strType = "UDP";
+        }
+        int r = 0;
+#ifdef _WIN32
+        upnp_UPNP_DeletePortMappingFunc UPNP_DeletePortMappingFunc = (upnp_UPNP_DeletePortMappingFunc) GetProcAddress (m_Module, "UPNP_DeletePortMapping");
+#else
+        upnp_UPNP_DeletePortMappingFunc UPNP_DeletePortMappingFunc = (upnp_UPNP_DeletePortMappingFunc) dlsym (m_Module, "UPNP_DeletePortMapping");
+#endif
+        r = UPNP_DeletePortMappingFunc (m_upnpUrls.controlURL, m_upnpData.first.servicetype, m_Port.c_str (), strType.c_str (), 0);
+        LogPrint ("UPNP_DeletePortMapping() returned : ", r, "\n");
+    }
+
+    void UPnP::Close ()
+    {
+#ifdef _WIN32
+        upnp_freeUPNPDevlistFunc freeUPNPDevlistFunc = (upnp_freeUPNPDevlistFunc) GetProcAddress (m_Module, "freeUPNPDevlist");
+#else
+        upnp_freeUPNPDevlistFunc freeUPNPDevlistFunc = (upnp_freeUPNPDevlistFunc) dlsym (m_Module, "freeUPNPDevlist");
+#endif
+        freeUPNPDevlistFunc (m_Devlist);
+        m_Devlist = 0;
+#ifdef _WIN32
+        upnp_FreeUPNPUrlsFunc FreeUPNPUrlsFunc = (upnp_FreeUPNPUrlsFunc) GetProcAddress (m_Module, "FreeUPNPUrlsFunc");
+#else
+        upnp_FreeUPNPUrlsFunc FreeUPNPUrlsFunc = (upnp_FreeUPNPUrlsFunc) dlsym (m_Module, "FreeUPNPUrlsFunc");
+#endif
+        FreeUPNPUrlsFunc (&m_upnpUrls);
+#ifndef _WIN32
+        dlclose (m_Module);
+#else
+        FreeLibrary (m_Module);
+#endif
+    }
+
+}
+}
+
+
+#endif
+
--- a/UPnP.h
+++ b/UPnP.h
@ -0,0 +1,65 @@
+#ifndef __UPNP_H__
+#define __UPNP_H__
+
+#ifdef USE_UPNP
+#include <string>
+#include <thread>
+
+#include <miniupnpc/miniwget.h>
+#include <miniupnpc/miniupnpc.h>
+#include <miniupnpc/upnpcommands.h>
+#include <miniupnpc/upnperrors.h>
+
+#include <boost/asio.hpp>
+
+#include "util.h"
+
+#define I2P_UPNP_TCP 1
+#define I2P_UPNP_UDP 2
+
+namespace i2p
+{
+namespace UPnP
+{
+	class UPnP
+	{
+	public:
+
+		UPnP ();
+		~UPnP ();
+        void Close ();
+
+        void Start ();
+        void Stop ();
+
+		void Discover ();
+		void TryPortMapping (int type);
+		void CloseMapping (int type);
+	private:
+		void Run ();
+
+        std::thread * m_Thread;
+        struct UPNPUrls m_upnpUrls;
+        struct IGDdatas m_upnpData;
+
+        // For miniupnpc
+        char * m_MulticastIf = 0;
+        char * m_Minissdpdpath = 0;
+        struct UPNPDev * m_Devlist = 0;
+        char m_NetworkAddr[64];
+        char m_externalIPAddress[40];
+        bool m_IsModuleLoaded;
+        std::string m_Port = std::to_string (util::config::GetArg ("-port", 17070));
+#ifndef _WIN32
+        void *m_Module;
+#else
+        HINSTANCE *m_Module;
+#endif
+	};
+	extern UPnP upnpc;
+}
+}
+
+#endif
+
+#endif
--- a/Show more
+++ b/Show more