1 files changed, 2029 insertions, 502 deletions

diff --git a/toxcore/net_crypto.c b/toxcore/net_crypto.c
index 17d2e8ff..875c639f 100644
--- a/toxcore/net_crypto.c
+++ b/toxcore/net_crypto.c
@@ -35,439 +35,1159 @@ static uint8_t crypt_connection_id_not_valid(Net_Crypto *c, int crypt_connection
     return (uint32_t)crypt_connection_id >= c->crypto_connections_length;
 }
 
-/* Use this instead of memcmp; not vulnerable to timing attacks. */
-uint8_t crypto_iszero(uint8_t *mem, uint32_t length)
+/* return 0 if connection is dead.
+ * return 1 if connection is alive.
+ */
+static int is_alive(uint8_t status)
 {
-    uint8_t check = 0;
-    uint32_t i;
-
-    for (i = 0; i < length; ++i) {
-        check |= mem[i];
+    if (status == CRYPTO_CONN_COOKIE_REQUESTING ||
+            status == CRYPTO_CONN_HANDSHAKE_SENT ||
+            status == CRYPTO_CONN_NOT_CONFIRMED ||
+            status == CRYPTO_CONN_ESTABLISHED) {
+        return 1;
     }
 
-    return check; // We return zero if mem is made out of zeroes.
+    return 0;
 }
 
-/* Precomputes the shared key from their public_key and our secret_key.
- * This way we can avoid an expensive elliptic curve scalar multiply for each
- * encrypt/decrypt operation.
- * enc_key has to be crypto_box_BEFORENMBYTES bytes long.
+/* cookie timeout in seconds */
+#define COOKIE_TIMEOUT 10
+#define COOKIE_DATA_LENGTH (crypto_box_PUBLICKEYBYTES * 2)
+#define COOKIE_CONTENTS_LENGTH (sizeof(uint64_t) + COOKIE_DATA_LENGTH)
+#define COOKIE_LENGTH (crypto_box_NONCEBYTES + COOKIE_CONTENTS_LENGTH + crypto_box_MACBYTES)
+
+#define COOKIE_REQUEST_PLAIN_LENGTH (COOKIE_DATA_LENGTH + sizeof(uint64_t))
+#define COOKIE_REQUEST_LENGTH (1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES + COOKIE_REQUEST_PLAIN_LENGTH + crypto_box_MACBYTES)
+#define COOKIE_RESPONSE_LENGTH (1 + crypto_box_NONCEBYTES + COOKIE_LENGTH + sizeof(uint64_t) + crypto_box_MACBYTES)
+
+/* Create a cookie request packet and put it in packet.
+ * dht_public_key is the dht public key of the other
+ *
+ * packet must be of size COOKIE_REQUEST_LENGTH or bigger.
+ *
+ * return -1 on failure.
+ * return COOKIE_REQUEST_LENGTH on success.
  */
-void encrypt_precompute(uint8_t *public_key, uint8_t *secret_key, uint8_t *enc_key)
+static int create_cookie_request(Net_Crypto *c, uint8_t *packet, uint8_t *dht_public_key, uint64_t number,
+                                 uint8_t *shared_key)
 {
-    crypto_box_beforenm(enc_key, public_key, secret_key);
+    uint8_t plain[COOKIE_REQUEST_PLAIN_LENGTH];
+    uint8_t padding[crypto_box_PUBLICKEYBYTES] = {0};
+
+    memcpy(plain, c->self_public_key, crypto_box_PUBLICKEYBYTES);
+    memcpy(plain + crypto_box_PUBLICKEYBYTES, padding, crypto_box_PUBLICKEYBYTES);
+    memcpy(plain + (crypto_box_PUBLICKEYBYTES * 2), &number, sizeof(uint64_t));
+
+    DHT_get_shared_key_sent(c->dht, shared_key, dht_public_key);
+    uint8_t nonce[crypto_box_NONCEBYTES];
+    new_nonce(nonce);
+    packet[0] = NET_PACKET_COOKIE_REQUEST;
+    memcpy(packet + 1, c->dht->self_public_key, crypto_box_PUBLICKEYBYTES);
+    memcpy(packet + 1 + crypto_box_PUBLICKEYBYTES, nonce, crypto_box_NONCEBYTES);
+    int len = encrypt_data_symmetric(shared_key, nonce, plain, sizeof(plain),
+                                     packet + 1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES);
+
+    if (len != COOKIE_REQUEST_PLAIN_LENGTH + crypto_box_MACBYTES)
+        return -1;
+
+    return (1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES + len);
 }
 
-/* Fast encrypt. Depends on enc_key from encrypt_precompute. */
-int encrypt_data_fast(uint8_t *enc_key, uint8_t *nonce,
-                      uint8_t *plain, uint32_t length, uint8_t *encrypted)
+/* Create cookie of length COOKIE_LENGTH from bytes of length COOKIE_DATA_LENGTH using encryption_key
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int create_cookie(uint8_t *cookie, uint8_t *bytes, uint8_t *encryption_key)
 {
-    if (length + crypto_box_MACBYTES > MAX_DATA_SIZE || length == 0)
+    uint8_t contents[COOKIE_CONTENTS_LENGTH];
+    uint64_t temp_time = unix_time();
+    memcpy(contents, &temp_time, sizeof(temp_time));
+    memcpy(contents + sizeof(temp_time), bytes, COOKIE_DATA_LENGTH);
+    new_nonce(cookie);
+    int len = encrypt_data_symmetric(encryption_key, cookie, contents, sizeof(contents), cookie + crypto_box_NONCEBYTES);
+
+    if (len != COOKIE_LENGTH - crypto_box_NONCEBYTES)
         return -1;
 
-    uint8_t temp_plain[MAX_DATA_SIZE + crypto_box_ZEROBYTES] = {0};
-    uint8_t temp_encrypted[MAX_DATA_SIZE + crypto_box_BOXZEROBYTES];
+    return 0;
+}
+
+/* Open cookie of length COOKIE_LENGTH to bytes of length COOKIE_DATA_LENGTH using encryption_key
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int open_cookie(uint8_t *bytes, uint8_t *cookie, uint8_t *encryption_key)
+{
+    uint8_t contents[COOKIE_CONTENTS_LENGTH];
+    int len = decrypt_data_symmetric(encryption_key, cookie, cookie + crypto_box_NONCEBYTES,
+                                     COOKIE_LENGTH - crypto_box_NONCEBYTES, contents);
 
-    memcpy(temp_plain + crypto_box_ZEROBYTES, plain, length); // Pad the message with 32 0 bytes.
+    if (len != sizeof(contents))
+        return -1;
 
-    crypto_box_afternm(temp_encrypted, temp_plain, length + crypto_box_ZEROBYTES, nonce, enc_key);
+    uint64_t cookie_time;
+    memcpy(&cookie_time, contents, sizeof(cookie_time));
+    uint64_t temp_time = unix_time();
 
-    if (crypto_iszero(temp_encrypted, crypto_box_BOXZEROBYTES) != 0)
+    if (cookie_time + COOKIE_TIMEOUT < temp_time || temp_time < cookie_time)
         return -1;
 
-    /* Unpad the encrypted message. */
-    memcpy(encrypted, temp_encrypted + crypto_box_BOXZEROBYTES, length + crypto_box_MACBYTES);
-    return length + crypto_box_MACBYTES;
+    memcpy(bytes, contents + sizeof(cookie_time), COOKIE_DATA_LENGTH);
+    return 0;
 }
 
-/* Fast decrypt. Depends on enc_ley from encrypt_precompute. */
-int decrypt_data_fast(uint8_t *enc_key, uint8_t *nonce,
-                      uint8_t *encrypted, uint32_t length, uint8_t *plain)
+
+/* Create a cookie response packet and put it in packet.
+ * request_plain must be COOKIE_REQUEST_PLAIN_LENGTH bytes.
+ * packet must be of size COOKIE_RESPONSE_LENGTH or bigger.
+ *
+ * return -1 on failure.
+ * return COOKIE_RESPONSE_LENGTH on success.
+ */
+static int create_cookie_response(Net_Crypto *c, uint8_t *packet, uint8_t *request_plain, uint8_t *shared_key,
+                                  uint8_t *dht_public_key)
 {
-    if (length > MAX_DATA_SIZE || length <= crypto_box_BOXZEROBYTES)
+    uint8_t cookie_plain[COOKIE_DATA_LENGTH];
+    memcpy(cookie_plain, request_plain, crypto_box_PUBLICKEYBYTES);
+    memcpy(cookie_plain + crypto_box_PUBLICKEYBYTES, dht_public_key, crypto_box_PUBLICKEYBYTES);
+    uint8_t plain[COOKIE_LENGTH + sizeof(uint64_t)];
+
+    if (create_cookie(plain, cookie_plain, c->secret_symmetric_key) != 0)
         return -1;
 
-    uint8_t temp_plain[MAX_DATA_SIZE + crypto_box_ZEROBYTES];
-    uint8_t temp_encrypted[MAX_DATA_SIZE + crypto_box_BOXZEROBYTES] = {0};
+    memcpy(plain + COOKIE_LENGTH, request_plain + COOKIE_DATA_LENGTH, sizeof(uint64_t));
+    packet[0] = NET_PACKET_COOKIE_RESPONSE;
+    new_nonce(packet + 1);
+    int len = encrypt_data_symmetric(shared_key, packet + 1, plain, sizeof(plain), packet + 1 + crypto_box_NONCEBYTES);
+
+    if (len != COOKIE_RESPONSE_LENGTH - (1 + crypto_box_NONCEBYTES))
+        return -1;
 
-    memcpy(temp_encrypted + crypto_box_BOXZEROBYTES, encrypted, length); // Pad the message with 16 0 bytes.
+    return COOKIE_RESPONSE_LENGTH;
+}
 
-    if (crypto_box_open_afternm(temp_plain, temp_encrypted, length + crypto_box_BOXZEROBYTES,
-                                nonce, enc_key) == -1)
+/* Handle the cookie request packet of length length.
+ * Put what was in the request in request_plain (must be of size COOKIE_REQUEST_PLAIN_LENGTH)
+ * Put the key used to decrypt the request into shared_key (of size crypto_box_BEFORENMBYTES) for use in the response.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int handle_cookie_request(Net_Crypto *c, uint8_t *request_plain, uint8_t *shared_key, uint8_t *dht_public_key,
+                                 uint8_t *packet, uint16_t length)
+{
+    if (length != COOKIE_REQUEST_LENGTH)
         return -1;
 
-    /* If decryption is successful the first crypto_box_ZEROBYTES of the message will be zero.
-     * Apparently memcmp should not be used so we do this instead:
-     */
-    if (crypto_iszero(temp_plain, crypto_box_ZEROBYTES) != 0)
+    memcpy(dht_public_key, packet + 1, crypto_box_PUBLICKEYBYTES);
+    DHT_get_shared_key_sent(c->dht, shared_key, dht_public_key);
+    int len = decrypt_data_symmetric(shared_key, packet + 1 + crypto_box_PUBLICKEYBYTES,
+                                     packet + 1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES, COOKIE_REQUEST_PLAIN_LENGTH + crypto_box_MACBYTES,
+                                     request_plain);
+
+    if (len != COOKIE_REQUEST_PLAIN_LENGTH)
         return -1;
 
-    /* Unpad the plain message. */
-    memcpy(plain, temp_plain + crypto_box_ZEROBYTES, length - crypto_box_MACBYTES);
-    return length - crypto_box_MACBYTES;
+    return 0;
 }
 
-int encrypt_data(uint8_t *public_key, uint8_t *secret_key, uint8_t *nonce,
-                 uint8_t *plain, uint32_t length, uint8_t *encrypted)
+/* Handle the cookie request packet (for raw UDP)
+ */
+static int udp_handle_cookie_request(void *object, IP_Port source, uint8_t *packet, uint32_t length)
 {
-    uint8_t k[crypto_box_BEFORENMBYTES];
-    encrypt_precompute(public_key, secret_key, k);
-    return encrypt_data_fast(k, nonce, plain, length, encrypted);
+    Net_Crypto *c = object;
+    uint8_t request_plain[COOKIE_REQUEST_PLAIN_LENGTH];
+    uint8_t shared_key[crypto_box_BEFORENMBYTES];
+    uint8_t dht_public_key[crypto_box_PUBLICKEYBYTES];
+
+    if (handle_cookie_request(c, request_plain, shared_key, dht_public_key, packet, length) != 0)
+        return 1;
+
+    uint8_t data[COOKIE_RESPONSE_LENGTH];
+
+    if (create_cookie_response(c, data, request_plain, shared_key, dht_public_key) != sizeof(data))
+        return 1;
+
+    if ((uint32_t)sendpacket(c->dht->net, source, data, sizeof(data)) != sizeof(data))
+        return 1;
+
+    return 0;
 }
 
-int decrypt_data(uint8_t *public_key, uint8_t *secret_key, uint8_t *nonce,
-                 uint8_t *encrypted, uint32_t length, uint8_t *plain)
+/* Handle the cookie request packet (for TCP)
+ */
+static int tcp_handle_cookie_request(Net_Crypto *c, TCP_Client_Connection *TCP_con, uint8_t conn_id, uint8_t *packet,
+                                     uint32_t length)
 {
-    uint8_t k[crypto_box_BEFORENMBYTES];
-    encrypt_precompute(public_key, secret_key, k);
-    return decrypt_data_fast(k, nonce, encrypted, length, plain);
+    uint8_t request_plain[COOKIE_REQUEST_PLAIN_LENGTH];
+    uint8_t shared_key[crypto_box_BEFORENMBYTES];
+    uint8_t dht_public_key[crypto_box_PUBLICKEYBYTES];
+
+    if (handle_cookie_request(c, request_plain, shared_key, dht_public_key, packet, length) != 0)
+        return -1;
+
+    uint8_t data[COOKIE_RESPONSE_LENGTH];
+
+    if (create_cookie_response(c, data, request_plain, shared_key, dht_public_key) != sizeof(data))
+        return -1;
+
+    if (send_data(TCP_con, conn_id, data, sizeof(data)) != 1)
+        return -1;
+
+    return 0;
 }
 
-int encrypt_data_symmetric(uint8_t *secret_key, uint8_t *nonce, uint8_t *plain, uint32_t length, uint8_t *encrypted)
+/* Handle the cookie request packet (for TCP oob packets)
+ */
+static int tcp_oob_handle_cookie_request(Net_Crypto *c, TCP_Client_Connection *TCP_con, uint8_t *dht_public_key,
+        uint8_t *packet, uint32_t length)
 {
-    if (length == 0)
+    uint8_t request_plain[COOKIE_REQUEST_PLAIN_LENGTH];
+    uint8_t shared_key[crypto_box_BEFORENMBYTES];
+    uint8_t dht_public_key_temp[crypto_box_PUBLICKEYBYTES];
+
+    if (handle_cookie_request(c, request_plain, shared_key, dht_public_key_temp, packet, length) != 0)
+        return -1;
+
+    if (memcmp(dht_public_key, dht_public_key_temp, crypto_box_PUBLICKEYBYTES) != 0)
         return -1;
 
-    uint8_t temp_plain[length + crypto_secretbox_ZEROBYTES];
-    uint8_t temp_encrypted[length + crypto_secretbox_MACBYTES + crypto_secretbox_BOXZEROBYTES];
+    uint8_t data[COOKIE_RESPONSE_LENGTH];
+
+    if (create_cookie_response(c, data, request_plain, shared_key, dht_public_key) != sizeof(data))
+        return -1;
 
-    memset(temp_plain, 0, crypto_secretbox_ZEROBYTES);
-    memcpy(temp_plain + crypto_secretbox_ZEROBYTES, plain, length); // Pad the message with 32 0 bytes.
+    if (send_oob_packet(TCP_con, dht_public_key, data, sizeof(data)) != 1)
+        return -1;
 
-    crypto_secretbox(temp_encrypted, temp_plain, length + crypto_secretbox_ZEROBYTES, nonce, secret_key);
-    /* Unpad the encrypted message. */
-    memcpy(encrypted, temp_encrypted + crypto_secretbox_BOXZEROBYTES, length + crypto_secretbox_MACBYTES);
-    return length + crypto_secretbox_MACBYTES;
+    return 0;
 }
 
-int decrypt_data_symmetric(uint8_t *secret_key, uint8_t *nonce, uint8_t *encrypted, uint32_t length, uint8_t *plain)
+/* Handle a cookie response packet of length encrypted with shared_key.
+ * put the cookie in the response in cookie
+ *
+ * cookie must be of length COOKIE_LENGTH.
+ *
+ * return -1 on failure.
+ * return COOKIE_LENGTH on success.
+ */
+static int handle_cookie_response(uint8_t *cookie, uint64_t *number, uint8_t *packet, uint32_t length,
+                                  uint8_t *shared_key)
+{
+    if (length != COOKIE_RESPONSE_LENGTH)
+        return -1;
+
+    uint8_t plain[COOKIE_LENGTH + sizeof(uint64_t)];
+    int len = decrypt_data_symmetric(shared_key, packet + 1, packet + 1 + crypto_box_NONCEBYTES,
+                                     length - (1 + crypto_box_NONCEBYTES), plain);
+
+    if (len != sizeof(plain))
+        return -1;
+
+    memcpy(cookie, plain, COOKIE_LENGTH);
+    memcpy(number, plain + COOKIE_LENGTH, sizeof(uint64_t));
+    return COOKIE_LENGTH;
+}
+
+#define HANDSHAKE_PACKET_LENGTH (1 + COOKIE_LENGTH + crypto_box_NONCEBYTES + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + crypto_hash_sha512_BYTES + COOKIE_LENGTH + crypto_box_MACBYTES)
+
+/* Create a handshake packet and put it in packet.
+ * cookie must be COOKIE_LENGTH bytes.
+ * packet must be of size HANDSHAKE_PACKET_LENGTH or bigger.
+ *
+ * return -1 on failure.
+ * return HANDSHAKE_PACKET_LENGTH on success.
+ */
+static int create_crypto_handshake(Net_Crypto *c, uint8_t *packet, uint8_t *cookie, uint8_t *nonce, uint8_t *session_pk,
+                                   uint8_t *peer_real_pk, uint8_t *peer_dht_pubkey)
+{
+    uint8_t plain[crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + crypto_hash_sha512_BYTES + COOKIE_LENGTH];
+    memcpy(plain, nonce, crypto_box_NONCEBYTES);
+    memcpy(plain + crypto_box_NONCEBYTES, session_pk, crypto_box_PUBLICKEYBYTES);
+    crypto_hash_sha512(plain + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES, cookie, COOKIE_LENGTH);
+    uint8_t cookie_plain[COOKIE_DATA_LENGTH];
+    memcpy(cookie_plain, peer_real_pk, crypto_box_PUBLICKEYBYTES);
+    memcpy(cookie_plain + crypto_box_PUBLICKEYBYTES, peer_dht_pubkey, crypto_box_PUBLICKEYBYTES);
+
+    if (create_cookie(plain + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + crypto_hash_sha512_BYTES, cookie_plain,
+                      c->secret_symmetric_key) != 0)
+        return -1;
+
+    new_nonce(packet + 1 + COOKIE_LENGTH);
+    int len = encrypt_data(peer_real_pk, c->self_secret_key, packet + 1 + COOKIE_LENGTH, plain, sizeof(plain),
+                           packet + 1 + COOKIE_LENGTH + crypto_box_NONCEBYTES);
+
+    if (len != HANDSHAKE_PACKET_LENGTH - (1 + COOKIE_LENGTH + crypto_box_NONCEBYTES))
+        return -1;
+
+    packet[0] = NET_PACKET_CRYPTO_HS;
+    memcpy(packet + 1, cookie, COOKIE_LENGTH);
+
+    return HANDSHAKE_PACKET_LENGTH;
+}
+
+/* Handle a crypto handshake packet of length.
+ * put the nonce contained in the packet in nonce,
+ * the session public key in session_pk
+ * the real public key of the peer in peer_real_pk
+ * the dht public key of the peer in dht_public_key and
+ * the cookie inside the encrypted part of the packet in cookie.
+ *
+ * if expected_real_pk isn't NULL it denotes the real public key
+ * the packet should be from.
+ *
+ * nonce must be at least crypto_box_NONCEBYTES
+ * session_pk must be at least crypto_box_PUBLICKEYBYTES
+ * peer_real_pk must be at least crypto_box_PUBLICKEYBYTES
+ * cookie must be at least COOKIE_LENGTH
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int handle_crypto_handshake(Net_Crypto *c, uint8_t *nonce, uint8_t *session_pk, uint8_t *peer_real_pk,
+                                   uint8_t *dht_public_key, uint8_t *cookie, uint8_t *packet, uint32_t length, uint8_t *expected_real_pk)
 {
-    if (length <= crypto_secretbox_BOXZEROBYTES)
+    if (length != HANDSHAKE_PACKET_LENGTH)
+        return -1;
+
+    uint8_t cookie_plain[COOKIE_DATA_LENGTH];
+
+    if (open_cookie(cookie_plain, packet + 1, c->secret_symmetric_key) != 0)
         return -1;
 
-    uint8_t temp_plain[length + crypto_secretbox_ZEROBYTES];
-    uint8_t temp_encrypted[length + crypto_secretbox_BOXZEROBYTES];
+    if (expected_real_pk)
+        if (crypto_cmp(cookie_plain, expected_real_pk, crypto_box_PUBLICKEYBYTES) != 0)
+            return -1;
+
+    uint8_t cookie_hash[crypto_hash_sha512_BYTES];
+    crypto_hash_sha512(cookie_hash, packet + 1, COOKIE_LENGTH);
 
-    memset(temp_plain, 0, crypto_secretbox_BOXZEROBYTES);
-    memcpy(temp_encrypted + crypto_secretbox_BOXZEROBYTES, encrypted, length); // Pad the message with 16 0 bytes.
+    uint8_t plain[crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + crypto_hash_sha512_BYTES + COOKIE_LENGTH];
+    int len = decrypt_data(cookie_plain, c->self_secret_key, packet + 1 + COOKIE_LENGTH,
+                           packet + 1 + COOKIE_LENGTH + crypto_box_NONCEBYTES,
+                           HANDSHAKE_PACKET_LENGTH - (1 + COOKIE_LENGTH + crypto_box_NONCEBYTES), plain);
 
-    if (crypto_secretbox_open(temp_plain, temp_encrypted, length + crypto_secretbox_BOXZEROBYTES, nonce, secret_key) == -1)
+    if (len != sizeof(plain))
         return -1;
 
-    memcpy(plain, temp_plain + crypto_secretbox_ZEROBYTES, length - crypto_secretbox_MACBYTES);
-    return length - crypto_secretbox_MACBYTES;
+    if (memcmp(cookie_hash, plain + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES, crypto_hash_sha512_BYTES) != 0)
+        return -1;
+
+    memcpy(nonce, plain, crypto_box_NONCEBYTES);
+    memcpy(session_pk, plain + crypto_box_NONCEBYTES, crypto_box_PUBLICKEYBYTES);
+    memcpy(cookie, plain + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + crypto_hash_sha512_BYTES, COOKIE_LENGTH);
+    memcpy(peer_real_pk, cookie_plain, crypto_box_PUBLICKEYBYTES);
+    memcpy(dht_public_key, cookie_plain + crypto_box_PUBLICKEYBYTES, crypto_box_PUBLICKEYBYTES);
+    return 0;
 }
 
-/* Increment the given nonce by 1. */
-void increment_nonce(uint8_t *nonce)
+
+static Crypto_Connection *get_crypto_connection(Net_Crypto *c, int crypt_connection_id)
 {
+    if (crypt_connection_id_not_valid(c, crypt_connection_id))
+        return 0;
+
+    return &c->crypto_connections[crypt_connection_id];
+}
+
+
+/* Sends a packet to the peer using the fastest route.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int send_packet_to(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint16_t length)
+{
+//TODO TCP, etc...
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    int direct_send_attempt = 0;
+
+    //TODO: on bad networks, direct connections might not last indefinitely.
+    if (conn->ip_port.ip.family != 0) {
+        uint8_t direct_connected = 0;
+        crypto_connection_status(c, crypt_connection_id, &direct_connected);
+
+        if (direct_connected && (uint32_t)sendpacket(c->dht->net, conn->ip_port, data, length) == length)
+            return 0;
+
+        //TODO: a better way of sending packets directly to confirm the others ip.
+        if (length < 96 || data[0] == NET_PACKET_COOKIE_REQUEST || data[0] == NET_PACKET_CRYPTO_HS) {
+            if ((uint32_t)sendpacket(c->dht->net, conn->ip_port, data, length) == length)
+                direct_send_attempt = 1;
+        }
+
+    }
+
+    //TODO: spread packets over many relays, detect and kill bad relays.
     uint32_t i;
 
-    for (i = 0; i < crypto_box_NONCEBYTES; ++i) {
-        ++nonce[i];
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (conn->status_tcp[i] == STATUS_TCP_ONLINE) {/* friend is connected to this relay. */
+            if (send_data(c->tcp_connections[i], conn->con_number_tcp[i], data, length) == 1)
+                return 0;
+        }
+    }
 
-        if (nonce[i] != 0)
-            break;
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (conn->status_tcp[i] == STATUS_TCP_INVISIBLE) {
+            if (send_oob_packet(c->tcp_connections[i], conn->dht_public_key, data, length) == 1)
+                return 0;
+        }
+    }
+
+    if (direct_send_attempt) {
+        return 0;
     }
+
+    return -1;
 }
 
-#if crypto_box_NONCEBYTES != crypto_secretbox_NONCEBYTES
-/*if they no longer equal each other, this function must be split into two.*/
-#error random_nonce(): crypto_box_NONCEBYTES must equal crypto_secretbox_NONCEBYTES.
-#endif
-/* Fill the given nonce with random bytes. */
-void random_nonce(uint8_t *nonce)
+/** START: Array Related functions **/
+
+
+/* Return number of packets in array
+ * Note that holes are counted too.
+ */
+static uint32_t num_packets_array(Packets_Array *array)
 {
-    randombytes(nonce, crypto_box_NONCEBYTES);
+    return array->buffer_end - array->buffer_start;
 }
 
-/* Fill a key crypto_secretbox_KEYBYTES big with random bytes */
-void new_symmetric_key(uint8_t *key)
+/* Add data with packet number to array.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int add_data_to_buffer(Packets_Array *array, uint32_t number, Packet_Data *data)
 {
-    randombytes(key, crypto_secretbox_KEYBYTES);
+    if (number - array->buffer_start > CRYPTO_PACKET_BUFFER_SIZE)
+        return -1;
+
+    uint32_t num = number % CRYPTO_PACKET_BUFFER_SIZE;
+
+    if (array->buffer[num])
+        return -1;
+
+    Packet_Data *new_d = malloc(sizeof(Packet_Data));
+
+    if (new_d == NULL)
+        return -1;
+
+    memcpy(new_d, data, sizeof(Packet_Data));
+    array->buffer[num] = new_d;
+
+    if ((number - array->buffer_start) >= (array->buffer_end - array->buffer_start))
+        array->buffer_end = number + 1;
+
+    return 0;
 }
 
-static uint8_t base_nonce[crypto_box_NONCEBYTES];
-static uint8_t nonce_set = 0;
+/* Get pointer of data with packet number.
+ *
+ * return -1 on failure.
+ * return 0 if data at number is empty.
+ * return 1 if data pointer was put in data.
+ */
+static int get_data_pointer(Packets_Array *array, Packet_Data **data, uint32_t number)
+{
+    uint32_t num_spots = array->buffer_end - array->buffer_start;
+
+    if (array->buffer_end - number > num_spots || number - array->buffer_start >= num_spots)
+        return -1;
+
+    uint32_t num = number % CRYPTO_PACKET_BUFFER_SIZE;
 
-#if crypto_box_NONCEBYTES != crypto_secretbox_NONCEBYTES
-/*if they no longer equal each other, this function must be split into two.*/
-#error new_nonce(): crypto_box_NONCEBYTES must equal crypto_secretbox_NONCEBYTES.
-#endif
-/* Gives a nonce guaranteed to be different from previous ones.*/
-void new_nonce(uint8_t *nonce)
+    if (!array->buffer[num])
+        return 0;
+
+    *data = array->buffer[num];
+    return 1;
+}
+
+/* Add data to end of array.
+ *
+ * return -1 on failure.
+ * return packet number on success.
+ */
+static int64_t add_data_end_of_buffer(Packets_Array *array, Packet_Data *data)
 {
-    if (nonce_set == 0) {
-        random_nonce(base_nonce);
-        nonce_set = 1;
-    }
+    if (num_packets_array(array) >= CRYPTO_PACKET_BUFFER_SIZE)
+        return -1;
+
+    Packet_Data *new_d = malloc(sizeof(Packet_Data));
+
+    if (new_d == NULL)
+        return -1;
 
-    increment_nonce(base_nonce);
-    memcpy(nonce, base_nonce, crypto_box_NONCEBYTES);
+    memcpy(new_d, data, sizeof(Packet_Data));
+    uint32_t id = array->buffer_end;
+    array->buffer[id % CRYPTO_PACKET_BUFFER_SIZE] = new_d;
+    ++array->buffer_end;
+    return id;
 }
 
+/* Read data from begginning of array.
+ *
+ * return -1 on failure.
+ * return packet number on success.
+ */
+static int64_t read_data_beg_buffer(Packets_Array *array, Packet_Data *data)
+{
+    if (array->buffer_end == array->buffer_start)
+        return -1;
 
-/*  return 0 if there is no received data in the buffer.
- *  return -1  if the packet was discarded.
- *  return length of received data if successful.
+    uint32_t num = array->buffer_start % CRYPTO_PACKET_BUFFER_SIZE;
+
+    if (!array->buffer[num])
+        return -1;
+
+    memcpy(data, array->buffer[num], sizeof(Packet_Data));
+    uint32_t id = array->buffer_start;
+    ++array->buffer_start;
+    free(array->buffer[num]);
+    array->buffer[num] = NULL;
+    return id;
+}
+
+/* Delete all packets in array before number (but not number)
+ *
+ * return -1 on failure.
+ * return 0 on success
  */
-int read_cryptpacket(Net_Crypto *c, int crypt_connection_id, uint8_t *data)
+static int clear_buffer_until(Packets_Array *array, uint32_t number)
 {
-    if (crypt_connection_id_not_valid(c, crypt_connection_id))
-        return 0;
+    uint32_t num_spots = array->buffer_end - array->buffer_start;
 
-    if (c->crypto_connections[crypt_connection_id].status != CRYPTO_CONN_ESTABLISHED)
-        return 0;
+    if (array->buffer_end - number >= num_spots || number - array->buffer_start > num_spots)
+        return -1;
+
+    uint32_t i;
 
-    uint8_t temp_data[MAX_DATA_SIZE];
-    int length = read_packet(c->lossless_udp, c->crypto_connections[crypt_connection_id].number, temp_data);
+    for (i = array->buffer_start; i != number; ++i) {
+        uint32_t num = i % CRYPTO_PACKET_BUFFER_SIZE;
 
-    if (length == 0)
-        return 0;
+        if (array->buffer[num]) {
+            free(array->buffer[num]);
+            array->buffer[num] = NULL;
+        }
+    }
+
+    array->buffer_start = i;
+    return 0;
+}
 
-    if (temp_data[0] != 3)
+/* Set array buffer end to number.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int set_buffer_end(Packets_Array *array, uint32_t number)
+{
+    if ((number - array->buffer_start) > CRYPTO_PACKET_BUFFER_SIZE)
+        return -1;
+
+    if ((number - array->buffer_end) > CRYPTO_PACKET_BUFFER_SIZE)
         return -1;
 
-    int len = decrypt_data_fast(c->crypto_connections[crypt_connection_id].shared_key,
-                                c->crypto_connections[crypt_connection_id].recv_nonce,
-                                temp_data + 1, length - 1, data);
+    array->buffer_end = number;
+    return 0;
+}
+
+/* Create a packet request packet from recv_array and send_buffer_end into
+ * data of length.
+ *
+ * return -1 on failure.
+ * return length of packet on success.
+ */
+static int generate_request_packet(uint8_t *data, uint16_t length, Packets_Array *recv_array, uint32_t send_buffer_end)
+{
+    if (length <= (sizeof(uint32_t) * 2))
+        return -1;
+
+    uint32_t recv_buffer_start = htonl(recv_array->buffer_start);
+    send_buffer_end = htonl(send_buffer_end);
+    memcpy(data, &recv_buffer_start, sizeof(uint32_t));
+    memcpy(data + sizeof(uint32_t), &send_buffer_end, sizeof(uint32_t));
+    data[sizeof(uint32_t) * 2] = PACKET_ID_REQUEST;
+
+    uint16_t cur_len = sizeof(uint32_t) * 2 + 1;
+
+    if (recv_array->buffer_start == recv_array->buffer_end)
+        return cur_len;
+
+    if (length <= cur_len)
+        return cur_len;
+
+    uint32_t i, n = 1;
+
+    for (i = recv_array->buffer_start; i != recv_array->buffer_end; ++i) {
+        uint32_t num = i % CRYPTO_PACKET_BUFFER_SIZE;
+
+        if (!recv_array->buffer[num]) {
+            data[cur_len] = n;
+            n = 0;
+            ++cur_len;
+
+            if (length <= cur_len)
+                return cur_len;
+
+        } else if (n == 255) {
+            data[cur_len] = 0;
+            n = 0;
+            ++cur_len;
+
+            if (length <= cur_len)
+                return cur_len;
+        }
 
-    if (len != -1) {
-        increment_nonce(c->crypto_connections[crypt_connection_id].recv_nonce);
-        return len;
+        ++n;
     }
 
-    return -1;
+    return cur_len;
 }
 
-/* returns the number of packet slots left in the sendbuffer.
- * return 0 if failure.
+/* Handle a request data packet.
+ * Remove all the packets the other recieved from the array.
+ *
+ * return -1 on failure.
+ * return number of requested packets on success.
  */
-uint32_t crypto_num_free_sendqueue_slots(Net_Crypto *c, int crypt_connection_id)
+static int handle_request_packet(Packets_Array *send_array, uint8_t *data, uint16_t length)
 {
-    if (crypt_connection_id_not_valid(c, crypt_connection_id))
+    if (length < 1)
+        return -1;
+
+    if (data[0] != PACKET_ID_REQUEST)
+        return -1;
+
+    if (length == 1)
         return 0;
 
-    return num_free_sendqueue_slots(c->lossless_udp, c->crypto_connections[crypt_connection_id].number);
+    ++data;
+    --length;
+
+    uint32_t i, n = 1;
+    uint32_t requested = 0;
+
+    for (i = send_array->buffer_start; i != send_array->buffer_end; ++i) {
+        if (length == 0)
+            break;
+
+        uint32_t num = i % CRYPTO_PACKET_BUFFER_SIZE;
+
+        if (n == data[0]) {
+            if (send_array->buffer[num]) {
+                send_array->buffer[num]->time = 0;
+            }
+
+            ++data;
+            --length;
+            n = 0;
+            ++requested;
+        } else {
+            free(send_array->buffer[num]);
+            send_array->buffer[num] = NULL;
+        }
+
+        if (n == 255) {
+            n = 1;
+
+            if (data[0] != 0)
+                return -1;
+
+            ++data;
+            --length;
+        } else {
+            ++n;
+        }
+    }
+
+    return requested;
 }
 
-/*  return 0 if data could not be put in packet queue.
- *  return 1 if data was put into the queue.
+/** END: Array Related functions **/
+
+#define MAX_DATA_DATA_PACKET_SIZE (MAX_CRYPTO_PACKET_SIZE - (1 + sizeof(uint16_t) + crypto_box_MACBYTES))
+
+/* Creates and sends a data packet to the peer using the fastest route.
+ *
+ * return -1 on failure.
+ * return 0 on success.
  */
-int write_cryptpacket(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint32_t length)
+static int send_data_packet(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint16_t length)
 {
-    if (crypt_connection_id_not_valid(c, crypt_connection_id))
-        return 0;
+    if (length == 0 || length + (1 + sizeof(uint16_t) + crypto_box_MACBYTES) > MAX_CRYPTO_PACKET_SIZE)
+        return -1;
 
-    if (length - crypto_box_BOXZEROBYTES + crypto_box_ZEROBYTES > MAX_DATA_SIZE - 1)
-        return 0;
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-    if (c->crypto_connections[crypt_connection_id].status != CRYPTO_CONN_ESTABLISHED)
-        return 0;
+    if (conn == 0)
+        return -1;
 
-    uint8_t temp_data[MAX_DATA_SIZE];
-    int len = encrypt_data_fast(c->crypto_connections[crypt_connection_id].shared_key,
-                                c->crypto_connections[crypt_connection_id].sent_nonce,
-                                data, length, temp_data + 1);
+    uint8_t packet[1 + sizeof(uint16_t) + length + crypto_box_MACBYTES];
+    packet[0] = NET_PACKET_CRYPTO_DATA;
+    memcpy(packet + 1, conn->sent_nonce + (crypto_box_NONCEBYTES - sizeof(uint16_t)), sizeof(uint16_t));
+    int len = encrypt_data_symmetric(conn->shared_key, conn->sent_nonce, data, length, packet + 1 + sizeof(uint16_t));
 
-    if (len == -1)
-        return 0;
+    if (len + 1 + sizeof(uint16_t) != sizeof(packet))
+        return -1;
 
-    temp_data[0] = 3;
+    increment_nonce(conn->sent_nonce);
+    return send_packet_to(c, crypt_connection_id, packet, sizeof(packet));
+}
 
-    if (write_packet(c->lossless_udp, c->crypto_connections[crypt_connection_id].number, temp_data, len + 1) == 0)
-        return 0;
+/* Creates and sends a data packet with buffer_start and num to the peer using the fastest route.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int send_data_packet_helper(Net_Crypto *c, int crypt_connection_id, uint32_t buffer_start, uint32_t num,
+                                   uint8_t *data, uint32_t length)
+{
+    num = htonl(num);
+    buffer_start = htonl(buffer_start);
+    uint8_t packet[sizeof(uint32_t) + sizeof(uint32_t) + length];
+    memcpy(packet, &buffer_start, sizeof(uint32_t));
+    memcpy(packet + sizeof(uint32_t), &num, sizeof(uint32_t));
+    memcpy(packet + (sizeof(uint32_t) * 2), data, length);
+
+    return send_data_packet(c, crypt_connection_id, packet, sizeof(packet));
+}
 
-    increment_nonce(c->crypto_connections[crypt_connection_id].sent_nonce);
-    return 1;
+/*  return -1 if data could not be put in packet queue.
+ *  return positive packet number if data was put into the queue.
+ */
+static int64_t send_lossless_packet(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint32_t length)
+{
+    if (length == 0 || length > MAX_CRYPTO_DATA_SIZE)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    Packet_Data dt;
+    dt.time = current_time_monotonic();
+    dt.length = length;
+    memcpy(dt.data, data, length);
+    int64_t packet_num = add_data_end_of_buffer(&conn->send_array, &dt);
+
+    if (packet_num == -1)
+        return -1;
+
+    if (send_data_packet_helper(c, crypt_connection_id, conn->recv_array.buffer_start, packet_num, data, length) != 0)
+        fprintf(stderr, "send_data_packet failed\n");
+
+    return packet_num;
+}
+
+/* Get the lowest 2 bytes from the nonce and convert
+ * them to host byte format before returning them.
+ */
+static uint16_t get_nonce_uint16(uint8_t *nonce)
+{
+    uint16_t num;
+    memcpy(&num, nonce + (crypto_box_NONCEBYTES - sizeof(uint16_t)), sizeof(uint16_t));
+    return ntohs(num);
 }
 
-/* Create a request to peer.
- * send_public_key and send_secret_key are the pub/secret keys of the sender.
- * recv_public_key is public key of reciever.
- * packet must be an array of MAX_DATA_SIZE big.
- * Data represents the data we send with the request with length being the length of the data.
- * request_id is the id of the request (32 = friend request, 254 = ping request).
+#define DATA_NUM_THRESHOLD 21845
+
+/* Handle a data packet.
+ * Decrypt packet of length and put it into data.
+ * data must be at least MAX_DATA_DATA_PACKET_SIZE big.
  *
- *  return -1 on failure.
- *  return the length of the created packet on success.
+ * return -1 on failure.
+ * return length of data on success.
  */
-int create_request(uint8_t *send_public_key, uint8_t *send_secret_key, uint8_t *packet, uint8_t *recv_public_key,
-                   uint8_t *data, uint32_t length, uint8_t request_id)
+static int handle_data_packet(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint8_t *packet, uint16_t length)
 {
-    if (MAX_DATA_SIZE < length + 1 + crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES + 1 + crypto_box_MACBYTES)
+    if (length <= (1 + sizeof(uint16_t) + crypto_box_MACBYTES) || length > MAX_CRYPTO_PACKET_SIZE)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
         return -1;
 
     uint8_t nonce[crypto_box_NONCEBYTES];
-    uint8_t temp[MAX_DATA_SIZE];
-    memcpy(temp + 1, data, length);
-    temp[0] = request_id;
-    new_nonce(nonce);
-    int len = encrypt_data(recv_public_key, send_secret_key, nonce, temp, length + 1,
-                           1 + crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES + packet);
+    memcpy(nonce, conn->recv_nonce, crypto_box_NONCEBYTES);
+    uint16_t num_cur_nonce = get_nonce_uint16(nonce);
+    uint16_t num;
+    memcpy(&num, packet + 1, sizeof(uint16_t));
+    num = ntohs(num);
+    uint16_t diff = num - num_cur_nonce;
+    increment_nonce_number(nonce, diff);
+    int len = decrypt_data_symmetric(conn->shared_key, nonce, packet + 1 + sizeof(uint16_t),
+                                     length - (1 + sizeof(uint16_t)), data);
+
+    if ((unsigned int)len != length - (1 + sizeof(uint16_t) + crypto_box_MACBYTES))
+        return -1;
 
-    if (len == -1)
+    if (diff > DATA_NUM_THRESHOLD * 2) {
+        increment_nonce_number(conn->recv_nonce, DATA_NUM_THRESHOLD);
+    }
+
+    return len;
+}
+
+/* Send a request packet.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int send_request_packet(Net_Crypto *c, int crypt_connection_id)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
         return -1;
 
-    packet[0] = NET_PACKET_CRYPTO;
-    memcpy(packet + 1, recv_public_key, crypto_box_PUBLICKEYBYTES);
-    memcpy(packet + 1 + crypto_box_PUBLICKEYBYTES, send_public_key, crypto_box_PUBLICKEYBYTES);
-    memcpy(packet + 1 + crypto_box_PUBLICKEYBYTES * 2, nonce, crypto_box_NONCEBYTES);
+    uint8_t packet[MAX_DATA_DATA_PACKET_SIZE];
+    int len = generate_request_packet(packet, sizeof(packet), &conn->recv_array, conn->send_array.buffer_end);
 
-    return len + 1 + crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES;
+    if (len == -1)
+        return -1;
+
+    return send_data_packet(c, crypt_connection_id, packet, len);
 }
 
-/* Puts the senders public key in the request in public_key, the data from the request
- * in data if a friend or ping request was sent to us and returns the length of the data.
- * packet is the request packet and length is its length.
+/* Send up to max num previously requested data packets.
  *
- *  return -1 if not valid request.
+ * return -1 on failure.
+ * return number of packets sent on success.
  */
-int handle_request(uint8_t *self_public_key, uint8_t *self_secret_key, uint8_t *public_key, uint8_t *data,
-                   uint8_t *request_id, uint8_t *packet, uint16_t length)
+static int send_requested_packets(Net_Crypto *c, int crypt_connection_id, uint16_t max_num)
 {
-    if (length > crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES + 1 + crypto_box_MACBYTES &&
-            length <= MAX_DATA_SIZE) {
-        if (memcmp(packet + 1, self_public_key, crypto_box_PUBLICKEYBYTES) == 0) {
-            memcpy(public_key, packet + 1 + crypto_box_PUBLICKEYBYTES, crypto_box_PUBLICKEYBYTES);
-            uint8_t nonce[crypto_box_NONCEBYTES];
-            uint8_t temp[MAX_DATA_SIZE];
-            memcpy(nonce, packet + 1 + crypto_box_PUBLICKEYBYTES * 2, crypto_box_NONCEBYTES);
-            int len1 = decrypt_data(public_key, self_secret_key, nonce,
-                                    packet + 1 + crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES,
-                                    length - (crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES + 1), temp);
+    if (max_num == 0)
+        return -1;
 
-            if (len1 == -1 || len1 == 0)
-                return -1;
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint32_t i, num_sent = 0, array_size = num_packets_array(&conn->send_array);
 
-            request_id[0] = temp[0];
-            --len1;
-            memcpy(data, temp + 1, len1);
-            return len1;
+    for (i = 0; i < array_size; ++i) {
+        Packet_Data *dt;
+        uint32_t packet_num = (i + conn->send_array.buffer_start);
+        int ret = get_data_pointer(&conn->send_array, &dt, packet_num);
+
+        if (ret == -1) {
+            return -1;
+        } else if (ret == 0) {
+            continue;
+        }
+
+        if (dt->time != 0) {
+            continue;
         }
+
+        dt->time = current_time_monotonic();
+
+        if (send_data_packet_helper(c, crypt_connection_id, conn->recv_array.buffer_start, packet_num, dt->data,
+                                    dt->length) == 0)
+            ++num_sent;
+
+        if (num_sent >= max_num)
+            break;
     }
 
-    return -1;
+    return num_sent;
 }
 
-void cryptopacket_registerhandler(Net_Crypto *c, uint8_t byte, cryptopacket_handler_callback cb, void *object)
+
+/* Add a new temp packet to send repeatedly.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int new_temp_packet(Net_Crypto *c, int crypt_connection_id, uint8_t *packet, uint16_t length)
 {
-    c->cryptopackethandlers[byte].function = cb;
-    c->cryptopackethandlers[byte].object = object;
+    if (length == 0 || length > MAX_CRYPTO_PACKET_SIZE)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint8_t *temp_packet = malloc(length);
+
+    if (temp_packet == 0)
+        return -1;
+
+    if (conn->temp_packet)
+        free(conn->temp_packet);
+
+    memcpy(temp_packet, packet, length);
+    conn->temp_packet = temp_packet;
+    conn->temp_packet_length = length;
+    conn->temp_packet_sent_time = 0;
+    conn->temp_packet_num_sent = 0;
+    return 0;
 }
 
-static int cryptopacket_handle(void *object, IP_Port source, uint8_t *packet, uint32_t length)
+/* Clear the temp packet.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int clear_temp_packet(Net_Crypto *c, int crypt_connection_id)
 {
-    DHT *dht = object;
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-    if (packet[0] == NET_PACKET_CRYPTO) {
-        if (length <= crypto_box_PUBLICKEYBYTES * 2 + crypto_box_NONCEBYTES + 1 + crypto_box_MACBYTES ||
-                length > MAX_DATA_SIZE + crypto_box_MACBYTES)
-            return 1;
+    if (conn == 0)
+        return -1;
 
-        if (memcmp(packet + 1, dht->self_public_key, crypto_box_PUBLICKEYBYTES) == 0) { // Check if request is for us.
-            uint8_t public_key[crypto_box_PUBLICKEYBYTES];
-            uint8_t data[MAX_DATA_SIZE];
-            uint8_t number;
-            int len = handle_request(dht->self_public_key, dht->self_secret_key, public_key, data, &number, packet, length);
+    if (conn->temp_packet)
+        free(conn->temp_packet);
 
-            if (len == -1 || len == 0)
-                return 1;
+    conn->temp_packet = 0;
+    conn->temp_packet_length = 0;
+    conn->temp_packet_sent_time = 0;
+    conn->temp_packet_num_sent = 0;
+    return 0;
+}
 
-            if (!dht->c->cryptopackethandlers[number].function) return 1;
 
-            return dht->c->cryptopackethandlers[number].function(dht->c->cryptopackethandlers[number].object, source, public_key,
-                    data, len);
+/* Send the temp packet.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int send_temp_packet(Net_Crypto *c, int crypt_connection_id)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-        } else { /* If request is not for us, try routing it. */
-            int retval = route_packet(dht, packet + 1, packet, length);
+    if (conn == 0)
+        return -1;
 
-            if ((unsigned int)retval == length)
-                return 0;
-        }
-    }
+    if (!conn->temp_packet)
+        return -1;
 
-    return 1;
+    if (send_packet_to(c, crypt_connection_id, conn->temp_packet, conn->temp_packet_length) != 0)
+        return -1;
+
+    conn->temp_packet_sent_time = current_time_monotonic();
+    ++conn->temp_packet_num_sent;
+    return 0;
 }
 
-/* Send a crypto handshake packet containing an encrypted secret nonce and session public key
- * to peer with connection_id and public_key.
- * The packet is encrypted with a random nonce which is sent in plain text with the packet.
+/* Create a handshake packet and set it as a temp packet.
+ * cookie must be COOKIE_LENGTH.
+ *
+ * return -1 on failure.
+ * return 0 on success.
  */
-static int send_cryptohandshake(Net_Crypto *c, int connection_id, uint8_t *public_key, uint8_t *secret_nonce,
-                                uint8_t *session_key)
+static int create_send_handshake(Net_Crypto *c, int crypt_connection_id, uint8_t *cookie, uint8_t *dht_public_key)
 {
-    uint8_t temp_data[MAX_DATA_SIZE];
-    uint8_t temp[crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES];
-    uint8_t nonce[crypto_box_NONCEBYTES];
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-    new_nonce(nonce);
-    memcpy(temp, secret_nonce, crypto_box_NONCEBYTES);
-    memcpy(temp + crypto_box_NONCEBYTES, session_key, crypto_box_PUBLICKEYBYTES);
+    if (conn == 0)
+        return -1;
 
-    int len = encrypt_data(public_key, c->self_secret_key, nonce, temp, crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES,
-                           1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES + temp_data);
+    uint8_t handshake_packet[HANDSHAKE_PACKET_LENGTH];
 
-    if (len == -1)
-        return 0;
+    if (create_crypto_handshake(c, handshake_packet, cookie, conn->sent_nonce, conn->sessionpublic_key,
+                                conn->public_key, dht_public_key) != sizeof(handshake_packet))
+        return -1;
+
+    if (new_temp_packet(c, crypt_connection_id, handshake_packet, sizeof(handshake_packet)) != 0)
+        return -1;
 
-    temp_data[0] = 2;
-    memcpy(temp_data + 1, c->self_public_key, crypto_box_PUBLICKEYBYTES);
-    memcpy(temp_data + 1 + crypto_box_PUBLICKEYBYTES, nonce, crypto_box_NONCEBYTES);
-    return write_packet(c->lossless_udp, connection_id, temp_data,
-                        len + 1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES);
+    send_temp_packet(c, crypt_connection_id);
+    return 0;
 }
 
-/* Extract secret nonce, session public key and public_key from a packet(data) with length length.
+/* Send a kill packet.
  *
- *  return 1 if successful.
- *  return 0 if failure.
+ * return -1 on failure.
+ * return 0 on success.
  */
-static int handle_cryptohandshake(Net_Crypto *c, uint8_t *public_key, uint8_t *secret_nonce,
-                                  uint8_t *session_key, uint8_t *data, uint16_t length)
+static int send_kill_packet(Net_Crypto *c, int crypt_connection_id)
 {
-    int pad = (- crypto_box_BOXZEROBYTES + crypto_box_ZEROBYTES);
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-    if (length != 1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES
-            + crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + pad) {
-        return 0;
+    if (conn == 0)
+        return -1;
+
+    uint8_t kill_packet = PACKET_ID_KILL;
+    return send_data_packet_helper(c, crypt_connection_id, conn->recv_array.buffer_start, conn->send_array.buffer_end,
+                                   &kill_packet, sizeof(kill_packet));
+}
+
+/* Handle a recieved data packet.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int handle_data_packet_helper(Net_Crypto *c, int crypt_connection_id, uint8_t *packet, uint16_t length)
+{
+    if (length > MAX_CRYPTO_PACKET_SIZE || length <= CRYPTO_DATA_PACKET_MIN_SIZE)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint8_t data[MAX_DATA_DATA_PACKET_SIZE];
+    int len = handle_data_packet(c, crypt_connection_id, data, packet, length);
+
+    if (len <= (int)(sizeof(uint32_t) * 2))
+        return -1;
+
+    uint32_t buffer_start, num;
+    memcpy(&buffer_start, data, sizeof(uint32_t));
+    memcpy(&num, data + sizeof(uint32_t), sizeof(uint32_t));
+    buffer_start = ntohl(buffer_start);
+    num = ntohl(num);
+
+    if (buffer_start != conn->send_array.buffer_start && clear_buffer_until(&conn->send_array, buffer_start) != 0)
+        return -1;
+
+    uint8_t *real_data = data + (sizeof(uint32_t) * 2);
+    uint16_t real_length = len - (sizeof(uint32_t) * 2);
+
+    while (real_data[0] == 0) { /* Remove Padding */
+        ++real_data;
+        --real_length;
+
+        if (real_length == 0)
+            return -1;
     }
 
-    if (data[0] != 2)
+    if (real_data[0] == PACKET_ID_REQUEST) {
+        int requested = handle_request_packet(&conn->send_array, real_data, real_length);
+
+        if (requested == -1) {
+            return -1;
+        } else {
+            //TODO?
+        }
+
+        set_buffer_end(&conn->recv_array, num);
+    } else if (real_data[0] == PACKET_ID_KILL) {
+        conn->killed = 1;
         return 0;
+    } else {
+        Packet_Data dt;
+        dt.time = current_time_monotonic();
+        dt.length = real_length;
+        memcpy(dt.data, real_data, real_length);
 
-    uint8_t temp[crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES];
+        if (add_data_to_buffer(&conn->recv_array, num, &dt) != 0)
+            return -1;
 
-    memcpy(public_key, data + 1, crypto_box_PUBLICKEYBYTES);
+        while (read_data_beg_buffer(&conn->recv_array, &dt) != -1) {
+            if (conn->connection_data_callback)
+                conn->connection_data_callback(conn->connection_data_callback_object, conn->connection_data_callback_id, dt.data,
+                                               dt.length);
+        }
 
-    int len = decrypt_data(public_key, c->self_secret_key, data + 1 + crypto_box_PUBLICKEYBYTES,
-                           data + 1 + crypto_box_PUBLICKEYBYTES + crypto_box_NONCEBYTES,
-                           crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES + pad, temp);
+        /* Packet counter. */
+        ++conn->packet_counter;
+    }
 
-    if (len != crypto_box_NONCEBYTES + crypto_box_PUBLICKEYBYTES)
-        return 0;
+    if (conn->status == CRYPTO_CONN_NOT_CONFIRMED) {
+        if (conn->connection_status_callback)
+            conn->connection_status_callback(conn->connection_status_callback_object, conn->connection_status_callback_id, 1);
 
-    memcpy(secret_nonce, temp, crypto_box_NONCEBYTES);
-    memcpy(session_key, temp + crypto_box_NONCEBYTES, crypto_box_PUBLICKEYBYTES);
-    return 1;
+        clear_temp_packet(c, crypt_connection_id);
+        conn->status = CRYPTO_CONN_ESTABLISHED;
+    }
+
+    return 0;
 }
 
-/* Get crypto connection id from public key of peer.
+/* Handle a packet that was recieved for the connection.
  *
- *  return -1 if there are no connections like we are looking for.
- *  return id if it found it.
+ * return -1 on failure.
+ * return 0 on success.
  */
-static int getcryptconnection_id(Net_Crypto *c, uint8_t *public_key)
+static int handle_packet_connection(Net_Crypto *c, int crypt_connection_id, uint8_t *packet, uint16_t length)
 {
-    uint32_t i;
+    if (length == 0 || length > MAX_CRYPTO_PACKET_SIZE)
+        return -1;
 
-    for (i = 0; i < c->crypto_connections_length; ++i) {
-        if (c->crypto_connections[i].status != CRYPTO_CONN_NO_CONNECTION)
-            if (memcmp(public_key, c->crypto_connections[i].public_key, crypto_box_PUBLICKEYBYTES) == 0)
-                return i;
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    switch (packet[0]) {
+        case NET_PACKET_COOKIE_RESPONSE: {
+            if (conn->status != CRYPTO_CONN_COOKIE_REQUESTING)
+                return -1;
+
+            uint8_t cookie[COOKIE_LENGTH];
+            uint64_t number;
+
+            if (handle_cookie_response(cookie, &number, packet, length, conn->shared_key) != sizeof(cookie))
+                return -1;
+
+            if (number != conn->cookie_request_number)
+                return -1;
+
+            if (create_send_handshake(c, crypt_connection_id, cookie, conn->dht_public_key) != 0)
+                return -1;
+
+            conn->status = CRYPTO_CONN_HANDSHAKE_SENT;
+            return 0;
+        }
+
+        case NET_PACKET_CRYPTO_HS: {
+            if (conn->status == CRYPTO_CONN_COOKIE_REQUESTING || conn->status == CRYPTO_CONN_HANDSHAKE_SENT) {
+                uint8_t peer_real_pk[crypto_box_PUBLICKEYBYTES];
+                uint8_t dht_public_key[crypto_box_PUBLICKEYBYTES];
+                uint8_t cookie[COOKIE_LENGTH];
+
+                if (handle_crypto_handshake(c, conn->recv_nonce, conn->peersessionpublic_key, peer_real_pk, dht_public_key, cookie,
+                                            packet, length, conn->public_key) != 0)
+                    return -1;
+
+                encrypt_precompute(conn->peersessionpublic_key, conn->sessionsecret_key, conn->shared_key);
+
+                if (conn->status == CRYPTO_CONN_COOKIE_REQUESTING) {
+                    if (create_send_handshake(c, crypt_connection_id, cookie, dht_public_key) != 0)
+                        return -1;
+                }
+
+                conn->status = CRYPTO_CONN_NOT_CONFIRMED;
+                /* Status needs to be CRYPTO_CONN_NOT_CONFIRMED for this to work. */
+                set_connection_dht_public_key(c, crypt_connection_id, dht_public_key, current_time_monotonic());
+            } else {
+                return -1;
+            }
+
+            return 0;
+        }
+
+        case NET_PACKET_CRYPTO_DATA: {
+            if (conn->status == CRYPTO_CONN_NOT_CONFIRMED || conn->status == CRYPTO_CONN_ESTABLISHED) {
+                return handle_data_packet_helper(c, crypt_connection_id, packet, length);
+            } else {
+                return -1;
+            }
+
+            return 0;
+        }
+
+        default: {
+            return -1;
+        }
     }
 
-    return -1;
+    return 0;
 }
 
 /* Set the size of the friend list to numfriends.
@@ -492,326 +1212,1100 @@ static int realloc_cryptoconnection(Net_Crypto *c, uint32_t num)
     return 0;
 }
 
-/* Start a secure connection with other peer who has public_key and ip_port.
+
+/* Create a new empty crypto connection.
  *
- *  return -1 if failure.
- *  return crypt_connection_id of the initialized connection if everything went well.
+ * return -1 on failure.
+ * return connection id on success.
  */
-int crypto_connect(Net_Crypto *c, uint8_t *public_key, IP_Port ip_port)
+static int create_crypto_connection(Net_Crypto *c)
 {
     uint32_t i;
-    int id_existing = getcryptconnection_id(c, public_key);
 
-    if (id_existing != -1) {
-        IP_Port c_ip = connection_ip(c->lossless_udp, c->crypto_connections[id_existing].number);
-
-        if (ipport_equal(&c_ip, &ip_port))
-            return -1;
+    for (i = 0; i < c->crypto_connections_length; ++i) {
+        if (c->crypto_connections[i].status == CRYPTO_CONN_NO_CONNECTION)
+            return i;
     }
 
-    if (realloc_cryptoconnection(c, c->crypto_connections_length + 1) == -1
-            || c->crypto_connections == NULL)
+    if (realloc_cryptoconnection(c, c->crypto_connections_length + 1) == -1)
         return -1;
 
     memset(&(c->crypto_connections[c->crypto_connections_length]), 0, sizeof(Crypto_Connection));
-    c->crypto_connections[c->crypto_connections_length].number = ~0;
+    int id = c->crypto_connections_length;
+    ++c->crypto_connections_length;
+    return id;
+}
 
-    for (i = 0; i <= c->crypto_connections_length; ++i) {
-        if (c->crypto_connections[i].status == CRYPTO_CONN_NO_CONNECTION) {
-            int id_new = new_connection(c->lossless_udp, ip_port);
+/* Wipe a crypto connection.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int wipe_crypto_connection(Net_Crypto *c, int crypt_connection_id)
+{
+    if (crypt_connection_id_not_valid(c, crypt_connection_id))
+        return -1;
 
-            if (id_new == -1)
-                return -1;
+    uint32_t i;
+    memset(&(c->crypto_connections[crypt_connection_id]), 0 , sizeof(Crypto_Connection));
 
-            c->crypto_connections[i].number = id_new;
-            c->crypto_connections[i].status = CRYPTO_CONN_HANDSHAKE_SENT;
-            random_nonce(c->crypto_connections[i].recv_nonce);
-            memcpy(c->crypto_connections[i].public_key, public_key, crypto_box_PUBLICKEYBYTES);
-            crypto_box_keypair(c->crypto_connections[i].sessionpublic_key, c->crypto_connections[i].sessionsecret_key);
-            c->crypto_connections[i].timeout = unix_time() + CRYPTO_HANDSHAKE_TIMEOUT;
+    for (i = c->crypto_connections_length; i != 0; --i) {
+        if (c->crypto_connections[i - 1].status != CRYPTO_CONN_NO_CONNECTION)
+            break;
+    }
 
-            if (c->crypto_connections_length == i)
-                ++c->crypto_connections_length;
+    if (c->crypto_connections_length != i) {
+        c->crypto_connections_length = i;
+        realloc_cryptoconnection(c, c->crypto_connections_length);
+    }
 
-            if (send_cryptohandshake(c, id_new, public_key,  c->crypto_connections[i].recv_nonce,
-                                     c->crypto_connections[i].sessionpublic_key) == 1) {
-                increment_nonce(c->crypto_connections[i].recv_nonce);
+    return 0;
+}
+
+/* Get crypto connection id from public key of peer.
+ *
+ *  return -1 if there are no connections like we are looking for.
+ *  return id if it found it.
+ */
+static int getcryptconnection_id(Net_Crypto *c, uint8_t *public_key)
+{
+    uint32_t i;
+
+    for (i = 0; i < c->crypto_connections_length; ++i) {
+        if (c->crypto_connections[i].status != CRYPTO_CONN_NO_CONNECTION)
+            if (memcmp(public_key, c->crypto_connections[i].public_key, crypto_box_PUBLICKEYBYTES) == 0)
                 return i;
-            }
+    }
 
-            return -1; /* This should never happen. */
-        }
+    return -1;
+}
+
+/* Get crypto connection id from public key of peer.
+ *
+ *  return -1 if there are no connections like we are looking for.
+ *  return id if it found it.
+ */
+static int getcryptconnection_id_dht_pubkey(Net_Crypto *c, uint8_t *dht_public_key)
+{
+    uint32_t i;
+
+    for (i = 0; i < c->crypto_connections_length; ++i) {
+        if (c->crypto_connections[i].status != CRYPTO_CONN_NO_CONNECTION && c->crypto_connections[i].dht_public_key_set)
+            if (memcmp(dht_public_key, c->crypto_connections[i].dht_public_key, crypto_box_PUBLICKEYBYTES) == 0)
+                return i;
     }
 
     return -1;
 }
 
-/* Handle an incoming connection.
+/* Add a source to the crypto connection.
+ * This is to be used only when we have recieved a packet from that source.
  *
- *  return -1 if no crypto inbound connection.
- *  return incoming connection id (Lossless_UDP one) if there is an incoming crypto connection.
+ *  return -1 on failure.
+ *  return positive number on success.
+ *  0 if source was a direct UDP connection.
+ *  TODO
+ */
+static int crypto_connection_add_source(Net_Crypto *c, int crypt_connection_id, IP_Port source)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    if (source.ip.family == AF_INET || source.ip.family == AF_INET6) {
+        conn->ip_port = source;
+        conn->direct_lastrecv_time = current_time_monotonic();
+        return 0;
+    }
+
+    return -1;
+}
+
+
+/* Set function to be called when someone requests a new connection to us.
  *
- * Put the public key of the peer in public_key, the secret_nonce from the handshake into secret_nonce
- * and the session public key for the connection in session_key.
- * to accept it see: accept_crypto_inbound(...).
- * to refuse it just call kill_connection(...) on the connection id.
+ * The set function should return -1 on failure and 0 on success.
+ *
+ * n_c is only valid for the duration of the function call.
  */
-int crypto_inbound(Net_Crypto *c, uint8_t *public_key, uint8_t *secret_nonce, uint8_t *session_key)
+void new_connection_handler(Net_Crypto *c, int (*new_connection_callback)(void *object, New_Connection *n_c),
+                            void *object)
 {
-    while (1) {
-        int incoming_con = incoming_connection(c->lossless_udp, 1);
+    c->new_connection_callback = new_connection_callback;
+    c->new_connection_callback_object = object;
+}
 
-        if (incoming_con != -1) {
-            if (is_connected(c->lossless_udp, incoming_con) == LUDP_TIMED_OUT) {
-                kill_connection(c->lossless_udp, incoming_con);
-                continue;
-            }
+/* Handle a handshake packet by someone who wants to initiate a new connection with us.
+ * This calls the callback set by new_connection_handler() if the handshake is ok.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int handle_new_connection_handshake(Net_Crypto *c, IP_Port source, uint8_t *data, uint16_t length)
+{
+    New_Connection n_c;
+    n_c.cookie = malloc(COOKIE_LENGTH);
 
-            if (id_packet(c->lossless_udp, incoming_con) == 2) {
-                uint8_t temp_data[MAX_DATA_SIZE];
-                uint16_t len = read_packet_silent(c->lossless_udp, incoming_con, temp_data);
+    if (n_c.cookie == NULL)
+        return -1;
 
-                if (handle_cryptohandshake(c, public_key, secret_nonce, session_key, temp_data, len)) {
-                    return incoming_con;
-                } else {
-                    kill_connection(c->lossless_udp, incoming_con);
-                }
-            } else {
-                kill_connection(c->lossless_udp, incoming_con);
+    n_c.source = source;
+    n_c.cookie_length = COOKIE_LENGTH;
+
+    if (handle_crypto_handshake(c, n_c.recv_nonce, n_c.peersessionpublic_key, n_c.public_key, n_c.dht_public_key,
+                                n_c.cookie, data, length, 0) != 0) {
+        free(n_c.cookie);
+        return -1;
+    }
+
+    int crypt_connection_id = getcryptconnection_id(c, n_c.public_key);
+
+    if (crypt_connection_id != -1) {
+        int ret = -1;
+        Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+        if (conn != 0 && (conn->status == CRYPTO_CONN_COOKIE_REQUESTING || conn->status == CRYPTO_CONN_HANDSHAKE_SENT)) {
+            memcpy(conn->recv_nonce, n_c.recv_nonce, crypto_box_NONCEBYTES);
+            memcpy(conn->peersessionpublic_key, n_c.peersessionpublic_key, crypto_box_PUBLICKEYBYTES);
+            encrypt_precompute(conn->peersessionpublic_key, conn->sessionsecret_key, conn->shared_key);
+
+            crypto_connection_add_source(c, crypt_connection_id, source);
+
+            if (create_send_handshake(c, crypt_connection_id, n_c.cookie, n_c.dht_public_key) == 0) {
+                conn->status = CRYPTO_CONN_NOT_CONFIRMED;
+                /* Status needs to be CRYPTO_CONN_NOT_CONFIRMED for this to work. */
+                set_connection_dht_public_key(c, crypt_connection_id, n_c.dht_public_key, current_time_monotonic());
+                ret = 0;
             }
-        } else {
-            break;
         }
+
+        free(n_c.cookie);
+        return ret;
     }
 
-    return -1;
+    int ret = c->new_connection_callback(c->new_connection_callback_object, &n_c);
+    free(n_c.cookie);
+    return ret;
 }
 
-/* Kill a crypto connection.
+/* Accept a crypto connection.
  *
- *  return 0 if killed successfully.
- *  return 1 if there was a problem.
+ * return -1 on failure.
+ * return connection id on success.
  */
-int crypto_kill(Net_Crypto *c, int crypt_connection_id)
+int accept_crypto_connection(Net_Crypto *c, New_Connection *n_c)
 {
-    if (crypt_connection_id_not_valid(c, crypt_connection_id))
-        return 1;
+    if (getcryptconnection_id(c, n_c->public_key) != -1)
+        return -1;
+
+    int crypt_connection_id = create_crypto_connection(c);
+
+    if (crypt_connection_id == -1)
+        return -1;
 
-    if (c->crypto_connections[crypt_connection_id].status != CRYPTO_CONN_NO_CONNECTION) {
-        c->crypto_connections[crypt_connection_id].status = CRYPTO_CONN_NO_CONNECTION;
-        kill_connection(c->lossless_udp, c->crypto_connections[crypt_connection_id].number);
-        memset(&(c->crypto_connections[crypt_connection_id]), 0 , sizeof(Crypto_Connection));
-        c->crypto_connections[crypt_connection_id].number = ~0;
-        uint32_t i;
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
 
-        for (i = c->crypto_connections_length; i != 0; --i) {
-            if (c->crypto_connections[i - 1].status != CRYPTO_CONN_NO_CONNECTION)
-                break;
+    if (conn == 0)
+        return -1;
+
+    memcpy(conn->public_key, n_c->public_key, crypto_box_PUBLICKEYBYTES);
+    memcpy(conn->recv_nonce, n_c->recv_nonce, crypto_box_NONCEBYTES);
+    memcpy(conn->peersessionpublic_key, n_c->peersessionpublic_key, crypto_box_PUBLICKEYBYTES);
+    random_nonce(conn->sent_nonce);
+    crypto_box_keypair(conn->sessionpublic_key, conn->sessionsecret_key);
+    encrypt_precompute(conn->peersessionpublic_key, conn->sessionsecret_key, conn->shared_key);
+
+    if (n_c->cookie_length != COOKIE_LENGTH)
+        return -1;
+
+    if (create_send_handshake(c, crypt_connection_id, n_c->cookie, n_c->dht_public_key) != 0)
+        return -1;
+
+    conn->status = CRYPTO_CONN_NOT_CONFIRMED;
+    /* Status needs to be CRYPTO_CONN_NOT_CONFIRMED for this to work. */
+    set_connection_dht_public_key(c, crypt_connection_id, n_c->dht_public_key, current_time_monotonic());
+    conn->packet_send_rate = CRYPTO_PACKET_MIN_RATE;
+    crypto_connection_add_source(c, crypt_connection_id, n_c->source);
+    return crypt_connection_id;
+}
+
+/* Create a crypto connection.
+ * If one to that real public key already exists, return it.
+ *
+ * return -1 on failure.
+ * return connection id on success.
+ */
+int new_crypto_connection(Net_Crypto *c, uint8_t *real_public_key)
+{
+    int crypt_connection_id = getcryptconnection_id(c, real_public_key);
+
+    if (crypt_connection_id != -1)
+        return crypt_connection_id;
+
+    crypt_connection_id = create_crypto_connection(c);
+
+    if (crypt_connection_id == -1)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    memcpy(conn->public_key, real_public_key, crypto_box_PUBLICKEYBYTES);
+    random_nonce(conn->sent_nonce);
+    crypto_box_keypair(conn->sessionpublic_key, conn->sessionsecret_key);
+    conn->status = CRYPTO_CONN_COOKIE_REQUESTING;
+    conn->packet_send_rate = CRYPTO_PACKET_MIN_RATE;
+    return crypt_connection_id;
+}
+
+/* Disconnect peer from all associated TCP connections.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int disconnect_peer_tcp(Net_Crypto *c, int crypt_connection_id)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint32_t i;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (conn->status_tcp[i] != STATUS_TCP_NULL) {
+            send_disconnect_request(c->tcp_connections[i], conn->con_number_tcp[i]);
+            conn->status_tcp[i] = STATUS_TCP_NULL;
+            conn->con_number_tcp[i] = 0;
         }
+    }
 
-        if (c->crypto_connections_length != i) {
-            c->crypto_connections_length = i;
-            realloc_cryptoconnection(c, c->crypto_connections_length);
+    return 0;
+}
+
+/* Connect peer to all associated TCP connections.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+static int connect_peer_tcp(Net_Crypto *c, int crypt_connection_id)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint32_t i;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            continue;
+
+        //TODO check function return?
+        send_routing_request(c->tcp_connections[i], conn->dht_public_key);
+    }
+
+    return 0;
+}
+
+/* Copy friends DHT public key into dht_key.
+ *
+ * return 0 on failure (no key copied).
+ * return timestamp on success (key copied).
+ */
+uint64_t get_connection_dht_key(Net_Crypto *c, int crypt_connection_id, uint8_t *dht_public_key)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return 0;
+
+    if (conn->dht_public_key_set == 0)
+        return 0;
+
+    memcpy(dht_public_key, conn->dht_public_key, crypto_box_PUBLICKEYBYTES);
+    return conn->dht_public_key_timestamp;
+}
+
+
+/* Set the DHT public key of the crypto connection.
+ * timestamp is the time (current_time_monotonic()) at which the key was last confirmed belonging to
+ * the other peer.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+int set_connection_dht_public_key(Net_Crypto *c, int crypt_connection_id, uint8_t *dht_public_key, uint64_t timestamp)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    if (timestamp <= conn->dht_public_key_timestamp)
+        return -1;
+
+    if (conn->dht_public_key_set == 1 && memcmp(conn->dht_public_key, dht_public_key, crypto_box_PUBLICKEYBYTES) == 0)
+        return -1;
+
+    if (conn->dht_public_key_set == 1) {
+        disconnect_peer_tcp(c, crypt_connection_id);
+    }
+
+    memcpy(conn->dht_public_key, dht_public_key, crypto_box_PUBLICKEYBYTES);
+    conn->dht_public_key_set = 1;
+    conn->dht_public_key_timestamp = timestamp;
+
+    if (conn->status == CRYPTO_CONN_COOKIE_REQUESTING) {
+        conn->cookie_request_number = random_64b();
+        uint8_t cookie_request[COOKIE_REQUEST_LENGTH];
+
+        if (create_cookie_request(c, cookie_request, conn->dht_public_key, conn->cookie_request_number,
+                                  conn->shared_key) != sizeof(cookie_request))
+            return -1;
+
+        if (new_temp_packet(c, crypt_connection_id, cookie_request, sizeof(cookie_request)) != 0)
+            return -1;
+    }//TODO
+
+    connect_peer_tcp(c, crypt_connection_id);
+    return 0;
+}
+
+/* Set the direct ip of the crypto connection.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+int set_direct_ip_port(Net_Crypto *c, int crypt_connection_id, IP_Port ip_port)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    if (!ipport_equal(&ip_port, &conn->ip_port)) {
+        conn->ip_port = ip_port;
+        conn->direct_lastrecv_time = 0;
+        return 0;
+    }
+
+    return -1;
+}
+
+static int tcp_response_callback(void *object, uint8_t connection_id, uint8_t *public_key)
+{
+    TCP_Client_Connection *TCP_con = object;
+    Net_Crypto *c = TCP_con->net_crypto_pointer;
+
+    int crypt_connection_id = getcryptconnection_id_dht_pubkey(c, public_key);
+
+    if (crypt_connection_id == -1)
+        return -1;
+
+    set_tcp_connection_number(TCP_con, connection_id, crypt_connection_id);
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    uint32_t location = TCP_con->net_crypto_location;
+
+    if (location >= MAX_TCP_CONNECTIONS)
+        return -1;
+
+    if (c->tcp_connections[location] != TCP_con)
+        return -1;
+
+    conn->con_number_tcp[location] = connection_id;
+    uint32_t i;
+
+    for (i = 0; i < conn->num_tcp_relays; ++i) {
+        if (memcmp(TCP_con->public_key, conn->tcp_relays[i].client_id, crypto_box_PUBLICKEYBYTES) == 0) {
+            conn->status_tcp[location] = STATUS_TCP_INVISIBLE;
+            return 0;
+        }
+    }
+
+    conn->status_tcp[location] = STATUS_TCP_OFFLINE;
+    return 0;
+}
+
+static int tcp_status_callback(void *object, uint32_t number, uint8_t connection_id, uint8_t status)
+{
+    TCP_Client_Connection *TCP_con = object;
+    Net_Crypto *c = TCP_con->net_crypto_pointer;
+
+    Crypto_Connection *conn = get_crypto_connection(c, number);
+
+    if (conn == 0)
+        return -1;
+
+    uint32_t location = TCP_con->net_crypto_location;
+
+    if (location >= MAX_TCP_CONNECTIONS)
+        return -1;
+
+    if (c->tcp_connections[location] != TCP_con)
+        return -1;
+
+    if (status == 1) {
+        conn->status_tcp[location] = STATUS_TCP_OFFLINE;
+    } else if (status == 2) {
+        conn->status_tcp[location] = STATUS_TCP_ONLINE;
+    }
+
+    conn->con_number_tcp[location] = connection_id;
+    return 0;
+}
+
+static int tcp_data_callback(void *object, uint32_t number, uint8_t connection_id, uint8_t *data, uint16_t length)
+{
+
+    if (length == 0)
+        return -1;
+
+    TCP_Client_Connection *TCP_con = object;
+    Net_Crypto *c = TCP_con->net_crypto_pointer;
+
+    if (data[0] == NET_PACKET_COOKIE_REQUEST) {
+        return tcp_handle_cookie_request(c, TCP_con, connection_id, data, length);
+    }
+
+    Crypto_Connection *conn = get_crypto_connection(c, number);
+
+    if (conn == 0)
+        return -1;
+
+    if (handle_packet_connection(c, number, data, length) != 0)
+        return -1;
+
+    //TODO detect and kill bad TCP connections.
+    return 0;
+}
+
+static int tcp_oob_callback(void *object, uint8_t *public_key, uint8_t *data, uint16_t length)
+{
+    if (length == 0 || length > MAX_CRYPTO_PACKET_SIZE)
+        return -1;
+
+    TCP_Client_Connection *TCP_con = object;
+    Net_Crypto *c = TCP_con->net_crypto_pointer;
+    uint32_t location = TCP_con->net_crypto_location;
+
+    if (data[0] == NET_PACKET_COOKIE_REQUEST) {
+        return tcp_oob_handle_cookie_request(c, TCP_con, public_key, data, length);
+    }
+
+    int crypt_connection_id = getcryptconnection_id_dht_pubkey(c, public_key);
+
+    if (crypt_connection_id == -1) {
+        IP_Port source;
+        source.ip.family = TCP_FAMILY;
+        source.ip.ip6.uint32[0] = location;
+
+        if (data[0] != NET_PACKET_CRYPTO_HS) {
+            fprintf(stderr, "tcp snhappen %u\n", data[0]);
+            return -1;
         }
 
+        if (handle_new_connection_handshake(c, source, data, length) != 0)
+            return -1;
+
         return 0;
     }
 
-    return 1;
+    if (handle_packet_connection(c, crypt_connection_id, data, length) != 0)
+        return -1;
+
+    return 0;
 }
 
-/* Accept an incoming connection using the parameters provided by crypto_inbound.
+/* Check if tcp connection to public key can be created.
  *
- *  return -1 if not successful.
- *  return the crypt_connection_id if successful.
+ * return -1 if it can't.
+ * return 0 if it can.
  */
-int accept_crypto_inbound(Net_Crypto *c, int connection_id, uint8_t *public_key, uint8_t *secret_nonce,
-                          uint8_t *session_key)
+static int tcp_connection_check(Net_Crypto *c, uint8_t *public_key)
 {
     uint32_t i;
 
-    if (discard_packet(c->lossless_udp, connection_id) == -1)
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections_new[i] == NULL)
+            continue;
+
+        if (memcmp(c->tcp_connections_new[i]->public_key, public_key, crypto_box_PUBLICKEYBYTES) == 0)
+            return -1;
+    }
+
+    uint32_t num = 0;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            continue;
+
+        if (memcmp(c->tcp_connections[i]->public_key, public_key, crypto_box_PUBLICKEYBYTES) == 0)
+            return -1;
+
+        ++num;
+    }
+
+    if (num == MAX_TCP_CONNECTIONS)
         return -1;
 
-    /*
-     * if(getcryptconnection_id(public_key) != -1)
-     * {
-     *     return -1;
-     * }
-     */
+    return 0;
+}
 
-    if (realloc_cryptoconnection(c, c->crypto_connections_length + 1) == -1
-            || c->crypto_connections == NULL)
+/* Add a tcp relay, associating it to a crypt_connection_id.
+ *
+ * return 0 if it was added.
+ * return -1 if it wasn't.
+ */
+int add_tcp_relay_peer(Net_Crypto *c, int crypt_connection_id, IP_Port ip_port, uint8_t *public_key)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
         return -1;
 
-    memset(&(c->crypto_connections[c->crypto_connections_length]), 0, sizeof(Crypto_Connection));
-    c->crypto_connections[c->crypto_connections_length].number = ~0;
-
-    for (i = 0; i <= c->crypto_connections_length; ++i) {
-        if (c->crypto_connections[i].status == CRYPTO_CONN_NO_CONNECTION) {
-            c->crypto_connections[i].number = connection_id;
-            c->crypto_connections[i].status = CRYPTO_CONN_NOT_CONFIRMED;
-            c->crypto_connections[i].timeout = unix_time() + CRYPTO_HANDSHAKE_TIMEOUT;
-            random_nonce(c->crypto_connections[i].recv_nonce);
-            memcpy(c->crypto_connections[i].sent_nonce, secret_nonce, crypto_box_NONCEBYTES);
-            memcpy(c->crypto_connections[i].peersessionpublic_key, session_key, crypto_box_PUBLICKEYBYTES);
-            increment_nonce(c->crypto_connections[i].sent_nonce);
-            memcpy(c->crypto_connections[i].public_key, public_key, crypto_box_PUBLICKEYBYTES);
-
-            crypto_box_keypair(c->crypto_connections[i].sessionpublic_key, c->crypto_connections[i].sessionsecret_key);
-
-            if (c->crypto_connections_length == i)
-                ++c->crypto_connections_length;
-
-            if (send_cryptohandshake(c, connection_id, public_key, c->crypto_connections[i].recv_nonce,
-                                     c->crypto_connections[i].sessionpublic_key) == 1) {
-                increment_nonce(c->crypto_connections[i].recv_nonce);
-                uint32_t zero = 0;
-                encrypt_precompute(c->crypto_connections[i].peersessionpublic_key,
-                                   c->crypto_connections[i].sessionsecret_key,
-                                   c->crypto_connections[i].shared_key);
-                c->crypto_connections[i].status =
-                    CRYPTO_CONN_ESTABLISHED; /* Connection status needs to be 3 for write_cryptpacket() to work. */
-                write_cryptpacket(c, i, ((uint8_t *)&zero), sizeof(zero));
-                c->crypto_connections[i].status = CRYPTO_CONN_NOT_CONFIRMED; /* Set it to its proper value right after. */
-                return i;
-            }
+    if (ip_port.ip.family == TCP_INET) {
+        ip_port.ip.family = AF_INET;
+    } else if (ip_port.ip.family == TCP_INET6) {
+        ip_port.ip.family = AF_INET6;
+    }
+
+    if (ip_port.ip.family != AF_INET && ip_port.ip.family != AF_INET6)
+        return -1;
+
+    uint32_t i;
+
+    for (i = 0; i < conn->num_tcp_relays; ++i) {
+        if (memcmp(conn->tcp_relays[i].client_id, public_key, crypto_box_PUBLICKEYBYTES) == 0) {
+            conn->tcp_relays[i].ip_port = ip_port;
+            return 0;
+        }
+    }
 
-            return -1; /* This should never happen. */
+    if (conn->num_tcp_relays == MAX_TCP_RELAYS_PEER) {
+        uint16_t index = rand() % MAX_TCP_RELAYS_PEER;
+        conn->tcp_relays[index].ip_port = ip_port;
+        memcpy(conn->tcp_relays[index].client_id, public_key, crypto_box_PUBLICKEYBYTES);
+    } else {
+        conn->tcp_relays[conn->num_tcp_relays].ip_port = ip_port;
+        memcpy(conn->tcp_relays[conn->num_tcp_relays].client_id, public_key, crypto_box_PUBLICKEYBYTES);
+        ++conn->num_tcp_relays;
+    }
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            continue;
+
+        if (memcmp(c->tcp_connections[i]->public_key, public_key, crypto_box_PUBLICKEYBYTES) == 0) {
+            if (conn->status_tcp[i] == STATUS_TCP_OFFLINE)
+                conn->status_tcp[i] = STATUS_TCP_INVISIBLE;
+        }
+    }
+
+    return add_tcp_relay(c, ip_port, public_key);
+}
+
+/* Add a tcp relay to the array.
+ *
+ * return 0 if it was added.
+ * return -1 if it wasn't.
+ */
+int add_tcp_relay(Net_Crypto *c, IP_Port ip_port, uint8_t *public_key)
+{
+    if (ip_port.ip.family == TCP_INET) {
+        ip_port.ip.family = AF_INET;
+    } else if (ip_port.ip.family == TCP_INET6) {
+        ip_port.ip.family = AF_INET6;
+    }
+
+    if (ip_port.ip.family != AF_INET && ip_port.ip.family != AF_INET6)
+        return -1;
+
+    if (tcp_connection_check(c, public_key) != 0)
+        return -1;
+
+    uint32_t i;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections_new[i] == NULL) {
+            c->tcp_connections_new[i] = new_TCP_connection(ip_port, public_key, c->dht->self_public_key, c->dht->self_secret_key);
+            return 0;
         }
     }
 
     return -1;
 }
 
-/*  return 0 if no connection.
- *  return 1 we have sent a handshake.
- *  return 2 if connection is not confirmed yet (we have received a handshake but no empty data packet).
- *  return 3 if the connection is established.
- *  return 4 if the connection is timed out and waiting to be killed.
+/* Copy a maximum of num TCP relays we are connected to to tcp_relays.
+ * NOTE that the family of the copied ip ports will be set to TCP_INET or TCP_INET6.
+ *
+ * return number of relays copied to tcp_relays on success.
+ * return 0 on failure.
  */
-int is_cryptoconnected(Net_Crypto *c, int crypt_connection_id)
+unsigned int copy_connected_tcp_relays(Net_Crypto *c, Node_format *tcp_relays, uint16_t num)
 {
-    if ((unsigned int)crypt_connection_id < c->crypto_connections_length)
-        return c->crypto_connections[crypt_connection_id].status;
+    if (num == 0)
+        return 0;
+
+    uint32_t i;
+    uint16_t copied = 0;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] != NULL) {
+            memcpy(tcp_relays[copied].client_id, c->tcp_connections[i]->public_key, crypto_box_PUBLICKEYBYTES);
+            tcp_relays[copied].ip_port = c->tcp_connections[i]->ip_port;
+
+            if (tcp_relays[copied].ip_port.ip.family == AF_INET) {
+                tcp_relays[copied].ip_port.ip.family = TCP_INET;
+            } else if (tcp_relays[copied].ip_port.ip.family == AF_INET6) {
+                tcp_relays[copied].ip_port.ip.family = TCP_INET6;
+            }
+
+            ++copied;
+
+            if (copied == num)
+                return copied;
+        }
+    }
 
-    return CRYPTO_CONN_NO_CONNECTION;
+    return copied;
 }
 
-void new_keys(Net_Crypto *c)
+/* Add a connected tcp connection to the tcp_connections array.
+ *
+ * return 0 if it was added.
+ * return -1 if it wasn't.
+ */
+static int add_tcp_connected(Net_Crypto *c, TCP_Client_Connection *tcp_con)
 {
-    crypto_box_keypair(c->self_public_key, c->self_secret_key);
+    uint32_t i;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            break;
+    }
+
+    if (i == MAX_TCP_CONNECTIONS)
+        return -1;
+
+    uint32_t tcp_num = i;
+
+    for (i = 0; i < c->crypto_connections_length; ++i) {
+        Crypto_Connection *conn = get_crypto_connection(c, i);
+
+        if (conn == 0)
+            return -1;
+
+        if (conn->status == CRYPTO_CONN_NO_CONNECTION)
+            continue;
+
+        if (conn->status == CRYPTO_CONN_TIMED_OUT)
+            continue;
+
+        if (conn->dht_public_key_set)
+            if (send_routing_request(tcp_con, conn->dht_public_key) != 1)
+                return -1;
+
+    }
+
+    tcp_con->net_crypto_pointer = c;
+    tcp_con->net_crypto_location = tcp_num;
+    routing_response_handler(tcp_con, tcp_response_callback, tcp_con);
+    routing_status_handler(tcp_con, tcp_status_callback, tcp_con);
+    routing_data_handler(tcp_con, tcp_data_callback, tcp_con);
+    oob_data_handler(tcp_con, tcp_oob_callback, tcp_con);
+    c->tcp_connections[tcp_num] = tcp_con;
+    return 0;
 }
 
-/* Save the public and private keys to the keys array.
- * Length must be crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES.
+static void do_tcp(Net_Crypto *c)
+{
+    uint32_t i;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections_new[i] == NULL)
+            continue;
+
+        do_TCP_connection(c->tcp_connections_new[i]);
+
+        if (c->tcp_connections_new[i]->status == TCP_CLIENT_CONFIRMED) {
+            if (add_tcp_connected(c, c->tcp_connections_new[i]) == 0) {
+                c->tcp_connections_new[i] = NULL;
+            } else {
+                kill_TCP_connection(c->tcp_connections_new[i]);
+                c->tcp_connections_new[i] = NULL;
+            }
+        }
+    }
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            continue;
+
+        do_TCP_connection(c->tcp_connections[i]);
+    }
+}
+
+static void clear_disconnected_tcp_peer(Crypto_Connection *conn, uint32_t number)
+{
+    if (conn->status == CRYPTO_CONN_NO_CONNECTION)
+        return;
+
+    if (number >= MAX_TCP_CONNECTIONS)
+        return;
+
+    conn->status_tcp[number] = STATUS_TCP_NULL;
+    conn->con_number_tcp[number] = 0;
+}
+
+static void clear_disconnected_tcp(Net_Crypto *c)
+{
+    uint32_t i, j;
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections_new[i] == NULL)
+            continue;
+
+        if (c->tcp_connections_new[i]->status != TCP_CLIENT_DISCONNECTED)
+            continue;
+
+        kill_TCP_connection(c->tcp_connections_new[i]);
+        c->tcp_connections_new[i] = NULL;
+    }
+
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        if (c->tcp_connections[i] == NULL)
+            continue;
+
+        TCP_Client_Connection *tcp_con = c->tcp_connections[i];
+
+        if (tcp_con->status != TCP_CLIENT_DISCONNECTED)
+            continue;
+
+        c->tcp_connections[i] = NULL;
+        kill_TCP_connection(tcp_con);
+
+        for (j = 0; j < c->crypto_connections_length; ++j) {
+            Crypto_Connection *conn = get_crypto_connection(c, j);
+
+            if (conn == 0)
+                return;
+
+            clear_disconnected_tcp_peer(conn, i);
+        }
+    }
+}
+
+/* Set function to be called when connection with crypt_connection_id goes connects/disconnects.
+ *
+ * The set function should return -1 on failure and 0 on success.
+ * Note that if this function is set, the connection will clear itself on disconnect.
+ * Object and id will be passed to this function untouched.
+ * status is 1 if the connection is going online, 0 if it is going offline.
+ *
+ * return -1 on failure.
+ * return 0 on success.
  */
-void save_keys(Net_Crypto *c, uint8_t *keys)
+int connection_status_handler(Net_Crypto *c, int crypt_connection_id, int (*connection_status_callback)(void *object,
+                              int id, uint8_t status), void *object, int id)
 {
-    memcpy(keys, c->self_public_key, crypto_box_PUBLICKEYBYTES);
-    memcpy(keys + crypto_box_PUBLICKEYBYTES, c->self_secret_key, crypto_box_SECRETKEYBYTES);
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    conn->connection_status_callback = connection_status_callback;
+    conn->connection_status_callback_object = object;
+    conn->connection_status_callback_id = id;
+    return 0;
 }
 
-/* Load the public and private keys from the keys array.
- * Length must be crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES.
+/* Set function to be called when connection with crypt_connection_id receives a data packet of length.
+ *
+ * The set function should return -1 on failure and 0 on success.
+ * Object and id will be passed to this function untouched.
+ *
+ * return -1 on failure.
+ * return 0 on success.
  */
-void load_keys(Net_Crypto *c, uint8_t *keys)
+int connection_data_handler(Net_Crypto *c, int crypt_connection_id, int (*connection_data_callback)(void *object,
+                            int id, uint8_t *data, uint16_t length), void *object, int id)
 {
-    memcpy(c->self_public_key, keys, crypto_box_PUBLICKEYBYTES);
-    memcpy(c->self_secret_key, keys + crypto_box_PUBLICKEYBYTES, crypto_box_SECRETKEYBYTES);
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    conn->connection_data_callback = connection_data_callback;
+    conn->connection_data_callback_object = object;
+    conn->connection_data_callback_id = id;
+    return 0;
 }
 
-/* Handle received packets for not yet established crypto connections. */
-static void receive_crypto(Net_Crypto *c)
+/* Get the crypto connection id from the ip_port.
+ *
+ * return -1 on failure.
+ * return connection id on success.
+ */
+static int crypto_id_ip_port(Net_Crypto *c, IP_Port ip_port)
 {
     uint32_t i;
-    uint64_t temp_time = unix_time();
 
     for (i = 0; i < c->crypto_connections_length; ++i) {
-        if (c->crypto_connections[i].status == CRYPTO_CONN_NO_CONNECTION)
-            continue;
+        if (is_alive(c->crypto_connections[i].status))
+            if (ipport_equal(&ip_port, &c->crypto_connections[i].ip_port))
+                return i;
+    }
 
-        if (c->crypto_connections[i].status == CRYPTO_CONN_HANDSHAKE_SENT) {
-            uint8_t temp_data[MAX_DATA_SIZE];
-            uint8_t secret_nonce[crypto_box_NONCEBYTES];
-            uint8_t public_key[crypto_box_PUBLICKEYBYTES];
-            uint8_t session_key[crypto_box_PUBLICKEYBYTES];
-            uint16_t len;
-
-            if (id_packet(c->lossless_udp, c->crypto_connections[i].number) == 2) { /* Handle handshake packet. */
-                len = read_packet(c->lossless_udp, c->crypto_connections[i].number, temp_data);
-
-                if (handle_cryptohandshake(c, public_key, secret_nonce, session_key, temp_data, len)) {
-                    if (memcmp(public_key, c->crypto_connections[i].public_key, crypto_box_PUBLICKEYBYTES) == 0) {
-                        memcpy(c->crypto_connections[i].sent_nonce, secret_nonce, crypto_box_NONCEBYTES);
-                        memcpy(c->crypto_connections[i].peersessionpublic_key, session_key, crypto_box_PUBLICKEYBYTES);
-                        increment_nonce(c->crypto_connections[i].sent_nonce);
-                        uint32_t zero = 0;
-                        encrypt_precompute(c->crypto_connections[i].peersessionpublic_key,
-                                           c->crypto_connections[i].sessionsecret_key,
-                                           c->crypto_connections[i].shared_key);
-                        c->crypto_connections[i].status =
-                            CRYPTO_CONN_ESTABLISHED; /* Connection status needs to be 3 for write_cryptpacket() to work. */
-                        write_cryptpacket(c, i, ((uint8_t *)&zero), sizeof(zero));
-                        c->crypto_connections[i].status = CRYPTO_CONN_NOT_CONFIRMED; /* Set it to its proper value right after. */
-                    } else {
-                        /* This should not happen, timeout the connection if it does. */
-                        c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
-                    }
-                } else {
-                    /* This should not happen, timeout the connection if it does. */
-                    c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
-                }
-            } else if (id_packet(c->lossless_udp,
-                                 c->crypto_connections[i].number) != (uint8_t)~0) {
-                /* This should not happen, timeout the connection if it does. */
-                c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
+    return -1;
+}
+
+#define CRYPTO_MIN_PACKET_SIZE (1 + sizeof(uint16_t) + crypto_box_MACBYTES)
+
+/* Handle raw UDP packets coming directly from the socket.
+ *
+ * Handles:
+ * Cookie response packets.
+ * Crypto handshake packets.
+ * Crypto data packets.
+ *
+ */
+static int udp_handle_packet(void *object, IP_Port source, uint8_t *packet, uint32_t length)
+{
+    if (length <= CRYPTO_MIN_PACKET_SIZE || length > MAX_CRYPTO_PACKET_SIZE)
+        return 1;
+
+    Net_Crypto *c = object;
+    int crypt_connection_id = crypto_id_ip_port(c, source);
+
+    if (crypt_connection_id == -1) {
+        if (packet[0] != NET_PACKET_CRYPTO_HS)
+            return 1;
+
+        if (handle_new_connection_handshake(c, source, packet, length) != 0)
+            return 1;
+
+        return 0;
+    }
+
+    if (handle_packet_connection(c, crypt_connection_id, packet, length) != 0)
+        return 1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    conn->direct_lastrecv_time = current_time_monotonic();
+    return 0;
+}
+
+/* The dT for the average packet recieving rate calculations.
+   Also used as the */
+#define PACKET_COUNTER_AVERAGE_INTERVAL 200
+
+/* Ratio of recv queue size / recv packet rate (in seconds) times
+ * the number of ms between request packets to send at that ratio
+ */
+#define REQUEST_PACKETS_COMPARE_CONSTANT (0.5 * 100.0)
+static void send_crypto_packets(Net_Crypto *c)
+{
+    uint32_t i;
+    uint64_t temp_time = current_time_monotonic();
+
+    for (i = 0; i < c->crypto_connections_length; ++i) {
+        Crypto_Connection *conn = get_crypto_connection(c, i);
+
+        if (conn == 0)
+            return;
+
+        if (CRYPTO_SEND_PACKET_INTERVAL + conn->temp_packet_sent_time < temp_time) {
+            send_temp_packet(c, i);
+        }
+
+        if ((conn->status == CRYPTO_CONN_NOT_CONFIRMED || conn->status == CRYPTO_CONN_ESTABLISHED)
+                && (CRYPTO_SEND_PACKET_INTERVAL + conn->last_request_packet_sent) < temp_time) {
+            if (send_request_packet(c, i) == 0) {
+                conn->last_request_packet_sent = temp_time;
             }
+
         }
 
-        if (c->crypto_connections[i].status == CRYPTO_CONN_NOT_CONFIRMED) {
-            if (id_packet(c->lossless_udp, c->crypto_connections[i].number) == 3) {
-                uint8_t temp_data[MAX_DATA_SIZE];
-                uint8_t data[MAX_DATA_SIZE];
-                int length = read_packet(c->lossless_udp, c->crypto_connections[i].number, temp_data);
-                int len = decrypt_data(c->crypto_connections[i].peersessionpublic_key,
-                                       c->crypto_connections[i].sessionsecret_key,
-                                       c->crypto_connections[i].recv_nonce, temp_data + 1, length - 1, data);
-                uint32_t zero = 0;
-
-                if (len == sizeof(uint32_t) && memcmp(((uint8_t *)&zero), data, sizeof(uint32_t)) == 0) {
-                    increment_nonce(c->crypto_connections[i].recv_nonce);
-                    encrypt_precompute(c->crypto_connections[i].peersessionpublic_key,
-                                       c->crypto_connections[i].sessionsecret_key,
-                                       c->crypto_connections[i].shared_key);
-                    c->crypto_connections[i].status = CRYPTO_CONN_ESTABLISHED;
-                    c->crypto_connections[i].timeout = ~0;
-                    /* Connection is accepted. */
-                    confirm_connection(c->lossless_udp, c->crypto_connections[i].number);
+        if (conn->status == CRYPTO_CONN_ESTABLISHED) {
+            if (((double)num_packets_array(&conn->recv_array) / (conn->packet_recv_rate + 1.0)) * (double)(
+                        temp_time - conn->last_request_packet_sent) > REQUEST_PACKETS_COMPARE_CONSTANT) {
+                if (send_request_packet(c, i) == 0) {
+                    conn->last_request_packet_sent = temp_time;
+                }
+            }
+
+            if ((PACKET_COUNTER_AVERAGE_INTERVAL + conn->packet_counter_set) < temp_time) {
+                conn->packet_recv_rate = (double)conn->packet_counter / ((double)(temp_time - conn->packet_counter_set) / 1000.0);
+                conn->packet_counter = 0;
+                conn->packet_counter_set = temp_time;
+
+                if ((double)num_packets_array(&conn->send_array) < 0.3 * (conn->packet_send_rate)) {
+                    conn->packet_send_rate *= 1.2;
+                } else if ((double)num_packets_array(&conn->send_array) > 0.4 * (conn->packet_send_rate)) {
+                    conn->packet_send_rate *= 0.8;
+                }
+
+                if (conn->packet_send_rate < CRYPTO_PACKET_MIN_RATE || !conn->sending)
+                    conn->packet_send_rate = CRYPTO_PACKET_MIN_RATE;
+
+                if (conn->packet_send_rate > CRYPTO_PACKET_BUFFER_SIZE * 2)
+                    conn->packet_send_rate = CRYPTO_PACKET_BUFFER_SIZE * 2;
+
+            }
+
+            if (conn->last_packets_left_set == 0) {
+                conn->last_packets_left_set = temp_time;
+                conn->packets_left = conn->packet_send_rate;
+            } else if (((1000.0 / conn->packet_send_rate) + conn->last_packets_left_set) < temp_time) {
+                uint32_t num_packets = conn->packet_send_rate * ((double)(temp_time - conn->last_packets_left_set) / 1000.0);
+
+                if (conn->packets_left > num_packets * 2 + CRYPTO_MIN_QUEUE_LENGTH) {
+                    conn->packets_left = num_packets * 2 + CRYPTO_MIN_QUEUE_LENGTH;
                 } else {
-                    /* This should not happen, timeout the connection if it does. */
-                    c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
+                    conn->packets_left += num_packets;
                 }
-            } else if (id_packet(c->lossless_udp, c->crypto_connections[i].number) != (uint8_t)~0) {
-                /* This should not happen, timeout the connection if it does. */
-                c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
+
+                conn->last_packets_left_set = temp_time;
             }
-        }
 
-        if (temp_time > c->crypto_connections[i].timeout) {
-            c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
+            int ret = send_requested_packets(c, i, conn->packets_left);
+
+            if (ret != -1) {
+                conn->packets_left -= ret;
+            }
+
+            if (conn->sending != 0 && num_packets_array(&conn->send_array) < CRYPTO_MIN_QUEUE_LENGTH) {
+                --conn->sending;
+            }
         }
     }
 }
 
+
+/* returns the number of packet slots left in the sendbuffer.
+ * return 0 if failure.
+ */
+uint32_t crypto_num_free_sendqueue_slots(Net_Crypto *c, int crypt_connection_id)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return 0;
+
+    return conn->packets_left;
+}
+
+
+
+
+/*  return -1 if data could not be put in packet queue.
+ *  return positive packet number if data was put into the queue.
+ */
+int64_t write_cryptpacket(Net_Crypto *c, int crypt_connection_id, uint8_t *data, uint32_t length)
+{
+    if (length == 0)
+        return -1;
+
+    if (data[0] < CRYPTO_RESERVED_PACKETS)
+        return -1;
+
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return -1;
+
+    if (conn->status != CRYPTO_CONN_ESTABLISHED)
+        return -1;
+
+    if (conn->packets_left == 0)
+        return -1;
+
+    int64_t ret = send_lossless_packet(c, crypt_connection_id, data, length);
+
+    if (ret == -1)
+        return -1;
+
+    --conn->packets_left;
+    conn->sending = CRYPTO_MIN_QUEUE_LENGTH;
+    return ret;
+}
+
+/* Kill a crypto connection.
+ *
+ * return -1 on failure.
+ * return 0 on success.
+ */
+int crypto_kill(Net_Crypto *c, int crypt_connection_id)
+{
+    //TODO
+    send_kill_packet(c, crypt_connection_id);
+    disconnect_peer_tcp(c, crypt_connection_id);
+    return wipe_crypto_connection(c, crypt_connection_id);
+}
+
+/* return one of CRYPTO_CONN_* values indicating the state of the connection.
+ *
+ * sets direct_connected to 1 if connection connects directly to other, 0 if it isn't.
+ */
+unsigned int crypto_connection_status(Net_Crypto *c, int crypt_connection_id, uint8_t *direct_connected)
+{
+    Crypto_Connection *conn = get_crypto_connection(c, crypt_connection_id);
+
+    if (conn == 0)
+        return CRYPTO_CONN_NO_CONNECTION;
+
+    *direct_connected = 0;
+
+    if ((CRYPTO_SEND_PACKET_INTERVAL * MAX_NUM_SENDPACKET_TRIES + conn->direct_lastrecv_time) > current_time_monotonic())
+        *direct_connected = 1;
+
+    return conn->status;
+}
+
+void new_keys(Net_Crypto *c)
+{
+    crypto_box_keypair(c->self_public_key, c->self_secret_key);
+}
+
+/* Save the public and private keys to the keys array.
+ * Length must be crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES.
+ */
+void save_keys(Net_Crypto *c, uint8_t *keys)
+{
+    memcpy(keys, c->self_public_key, crypto_box_PUBLICKEYBYTES);
+    memcpy(keys + crypto_box_PUBLICKEYBYTES, c->self_secret_key, crypto_box_SECRETKEYBYTES);
+}
+
+/* Load the public and private keys from the keys array.
+ * Length must be crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES.
+ */
+void load_keys(Net_Crypto *c, uint8_t *keys)
+{
+    memcpy(c->self_public_key, keys, crypto_box_PUBLICKEYBYTES);
+    memcpy(c->self_secret_key, keys + crypto_box_PUBLICKEYBYTES, crypto_box_SECRETKEYBYTES);
+}
+
 /* Run this to (re)initialize net_crypto.
  * Sets all the global connection variables to their default values.
  */
-Net_Crypto *new_net_crypto(Networking_Core *net)
+Net_Crypto *new_net_crypto(DHT *dht)
 {
     unix_time_update();
 
-    if (net == NULL)
+    if (dht == NULL)
         return NULL;
 
     Net_Crypto *temp = calloc(1, sizeof(Net_Crypto));
@@ -819,31 +2313,55 @@ Net_Crypto *new_net_crypto(Networking_Core *net)
     if (temp == NULL)
         return NULL;
 
-    temp->lossless_udp = new_lossless_udp(net);
-
-    if (temp->lossless_udp == NULL) {
-        free(temp);
-        return NULL;
-    }
+    temp->dht = dht;
 
     new_keys(temp);
-    return temp;
-}
+    new_symmetric_key(temp->secret_symmetric_key);
 
-void init_cryptopackets(void *dht)
-{
-    DHT *s_dht = dht;
-    networking_registerhandler(s_dht->c->lossless_udp->net, NET_PACKET_CRYPTO, &cryptopacket_handle, s_dht);
+    networking_registerhandler(dht->net, NET_PACKET_COOKIE_REQUEST, &udp_handle_cookie_request, temp);
+    networking_registerhandler(dht->net, NET_PACKET_COOKIE_RESPONSE, &udp_handle_packet, temp);
+    networking_registerhandler(dht->net, NET_PACKET_CRYPTO_HS, &udp_handle_packet, temp);
+    networking_registerhandler(dht->net, NET_PACKET_CRYPTO_DATA, &udp_handle_packet, temp);
+    return temp;
 }
 
 static void kill_timedout(Net_Crypto *c)
 {
     uint32_t i;
+    //uint64_t temp_time = current_time_monotonic();
 
     for (i = 0; i < c->crypto_connections_length; ++i) {
-        if (c->crypto_connections[i].status != CRYPTO_CONN_NO_CONNECTION
-                && is_connected(c->lossless_udp, c->crypto_connections[i].number) == LUDP_TIMED_OUT)
-            c->crypto_connections[i].status = CRYPTO_CONN_TIMED_OUT;
+        Crypto_Connection *conn = get_crypto_connection(c, i);
+
+        if (conn == 0)
+            return;
+
+        if (conn->status == CRYPTO_CONN_NO_CONNECTION || conn->status == CRYPTO_CONN_TIMED_OUT)
+            continue;
+
+        if (conn->status == CRYPTO_CONN_COOKIE_REQUESTING || conn->status == CRYPTO_CONN_HANDSHAKE_SENT
+                || conn->status == CRYPTO_CONN_NOT_CONFIRMED) {
+            if (conn->temp_packet_num_sent < MAX_NUM_SENDPACKET_TRIES)
+                continue;
+
+            conn->killed = 1;
+
+        }
+
+        if (conn->killed) {
+            if (conn->connection_status_callback) {
+                conn->connection_status_callback(conn->connection_status_callback_object, conn->connection_status_callback_id, 0);
+                crypto_kill(c, i);
+                continue;
+            }
+
+            conn->status = CRYPTO_CONN_TIMED_OUT;
+            continue;
+        }
+
+        if (conn->status == CRYPTO_CONN_ESTABLISHED) {
+            //TODO: add a timeout here?
+        }
     }
 }
 
@@ -851,9 +2369,10 @@ static void kill_timedout(Net_Crypto *c)
 void do_net_crypto(Net_Crypto *c)
 {
     unix_time_update();
-    do_lossless_udp(c->lossless_udp);
     kill_timedout(c);
-    receive_crypto(c);
+    do_tcp(c);
+    clear_disconnected_tcp(c);
+    send_crypto_packets(c);
 }
 
 void kill_net_crypto(Net_Crypto *c)
@@ -864,7 +2383,15 @@ void kill_net_crypto(Net_Crypto *c)
         crypto_kill(c, i);
     }
 
-    kill_lossless_udp(c->lossless_udp);
+    for (i = 0; i < MAX_TCP_CONNECTIONS; ++i) {
+        kill_TCP_connection(c->tcp_connections_new[i]);
+        kill_TCP_connection(c->tcp_connections[i]);
+    }
+
+    networking_registerhandler(c->dht->net, NET_PACKET_COOKIE_REQUEST, NULL, NULL);
+    networking_registerhandler(c->dht->net, NET_PACKET_COOKIE_RESPONSE, NULL, NULL);
+    networking_registerhandler(c->dht->net, NET_PACKET_CRYPTO_HS, NULL, NULL);
+    networking_registerhandler(c->dht->net, NET_PACKET_CRYPTO_DATA, NULL, NULL);
     memset(c, 0, sizeof(Net_Crypto));
     free(c);
 }