Pluck of 48ac112fe938c8e960413ad60f64d313a1e5c9ac and e415e24aca895c5a1f88380b1a3946e3b49749a9

* Add new *.i2p2.de certificate * Added backup's ressed server. (Thanks backup!) * Temporary removing h2ik's server since he's been AWOL since 06-03-2013 and he's reseed server is down. applied changes from 185bc62d33224812060d2f68266a029935fb710d through 48ac112fe938c8e960413ad60f64d313a1e5c9ac applied changes from 1194eb12084302380b4315b20e5ae0c574ce1be3 through e415e24aca895c5a1f88380b1a3946e3b49749a9
Add EXTRA version "win1" in prep for Windows-only point release.
2013-04-21 13:47:16 +00:00 · 2013-04-20 19:07:11 +00:00 · 2013-04-20 19:03:38 +00:00 · 2013-04-20 18:53:01 +00:00 · 2013-04-20 18:46:27 +00:00 · 2013-04-20 18:42:55 +00:00
826 changed files with 121803 additions and 73358 deletions
--- a/.mtn-ignore
+++ b/.mtn-ignore
@ -2,6 +2,7 @@
 # Use mtn add --no-respect-ignore foo.jar to ignore this ignore list
 _jsp\.java$
 \.bz2$
+\.tar$
 \.class$
 \.diff$
 \.exe$
@ -15,6 +16,7 @@ _jsp\.java$
 \.su2$
 \.tar$
 \.war$
+.\deb$
 \.zip$
 ^\.
 ^build
@ -23,4 +25,7 @@ _jsp\.java$
 /build
 /classes/
 ^debian/copyright
+^debian/changelog
 override.properties
+sloccount.sc
+^reports/
--- a/.tx/config
+++ b/.tx/config
@ -9,7 +9,10 @@ trans.es = apps/i2ptunnel/locale/messages_es.po
 trans.fr = apps/i2ptunnel/locale/messages_fr.po
 trans.hu = apps/i2ptunnel/locale/messages_hu.po
 trans.it = apps/i2ptunnel/locale/messages_it.po
+trans.nb = apps/i2ptunnel/locale/messages_nb.po
 trans.nl = apps/i2ptunnel/locale/messages_nl.po
+trans.pl = apps/i2ptunnel/locale/messages_pl.po
+trans.pt = apps/i2ptunnel/locale/messages_pt.po
 trans.ru = apps/i2ptunnel/locale/messages_ru.po
 trans.sv_SE = apps/i2ptunnel/locale/messages_sv.po
 trans.uk_UA = apps/i2ptunnel/locale/messages_uk.po
@ -25,13 +28,15 @@ trans.da = apps/routerconsole/locale/messages_da.po
 trans.de = apps/routerconsole/locale/messages_de.po
 trans.el = apps/routerconsole/locale/messages_el.po
 trans.es = apps/routerconsole/locale/messages_es.po
-trans.et_EE = apps/routerconsole/locale/messages_ee.po
+trans.et_EE = apps/routerconsole/locale/messages_et.po
 trans.fi = apps/routerconsole/locale/messages_fi.po
 trans.fr = apps/routerconsole/locale/messages_fr.po
 trans.hu = apps/routerconsole/locale/messages_hu.po
 trans.it = apps/routerconsole/locale/messages_it.po
+trans.nb = apps/routerconsole/locale/messages_nb.po
 trans.nl = apps/routerconsole/locale/messages_nl.po
 trans.pl = apps/routerconsole/locale/messages_pl.po
+trans.pt = apps/routerconsole/locale/messages_pt.po
 trans.ru = apps/routerconsole/locale/messages_ru.po
 trans.sv_SE = apps/routerconsole/locale/messages_sv.po
 trans.uk_UA = apps/routerconsole/locale/messages_uk.po
@ -48,6 +53,7 @@ trans.es = apps/i2psnark/locale/messages_es.po
 trans.fr = apps/i2psnark/locale/messages_fr.po
 trans.hu = apps/i2psnark/locale/messages_hu.po
 trans.it = apps/i2psnark/locale/messages_it.po
+trans.nb = apps/i2psnark/locale/messages_nb.po
 trans.nl = apps/i2psnark/locale/messages_nl.po
 trans.pl = apps/i2psnark/locale/messages_pl.po
 trans.pt = apps/i2psnark/locale/messages_pt.po
@ -70,6 +76,7 @@ trans.hu = apps/susidns/locale/messages_hu.po
 trans.it = apps/susidns/locale/messages_it.po
 trans.nl = apps/susidns/locale/messages_nl.po
 trans.pl = apps/susidns/locale/messages_pl.po
+trans.pt = apps/susidns/locale/messages_pt.po
 trans.ru = apps/susidns/locale/messages_ru.po
 trans.sv_SE = apps/susidns/locale/messages_sv.po
 trans.uk_UA = apps/susidns/locale/messages_uk.po
@ -120,6 +127,7 @@ trans.cs = debian/po/cs.po
 trans.de = debian/po/de.po
 trans.el = debian/po/el.po
 trans.es = debian/po/es.po
+trans.fr = debian/po/fr.po
 trans.it = debian/po/it.po
 trans.hu = debian/po/hu.po
 trans.pl = debian/po/pl.po
@ -127,6 +135,13 @@ trans.ru = debian/po/ru.po
 trans.sv_SE = debian/po/sv.po
 trans.uk_UA = debian/po/uk.po

+[I2P.i2prouter-script]
+source_file = installer/resources/locale/messages_en.po
+source_lang = en
+trans.de = installer/resources/locale/po/messages_de.po
+trans.fr = installer/resources/locale/po/messages_fr.po
+trans.it = installer/resources/locale/po/messages_it.po
+
 [main]
 host = http://www.transifex.net

--- a/INSTALL-headless.txt
+++ b/INSTALL-headless.txt
@ -11,7 +11,7 @@ you may use:
  lynx http://localhost:7657/
 to configure the router.

-If you're having trouble, swing by http://forum.i2p2.de/, check the
+If you're having trouble, swing by http://forum.i2p/, check the
 website at http://www.i2p2.de/, or get on irc://irc.freenode.net/#i2p

 I2P will create and store files and configuration data in the user directory
--- a/LICENSE.txt
+++ b/LICENSE.txt
@ -72,6 +72,9 @@ Public domain except as listed below:
   Copyright (c) 2006, Matthew Estes
   See licenses/LICENSE-BlockFile.txt

+   SipHashInline:
+   Copyright 2012  Hiroshi Nakamura <nahi@ruby-lang.org>
+   See licenses/LICENSE-Apache2.0.txt

 Router (router.jar):
 Public domain except as listed below:
@ -197,6 +200,7 @@ Applications:
         - Jersey and EU flag icons: public domain, courtesy Xrmap flag
           collection http://www.arvernes.com/wiki/index.php/Xrmap
         - Guernsey and Isle of Man flags from the Open Clip Art Library, released into the public domain
+         - Curaçao, courtesy of David Benbennick, released into the public domain
         - All other flag icons: public domain, courtesy mjames@gmail.com http://www.famfamfam.com/
       Silk icons: See licenses/LICENSE-SilkIcons.txt
       FatCow icons: See licenses/LICENSE-FatCowIcons.txt
@ -238,8 +242,8 @@ Applications:
      Bundles systray4j-2.4.1:
      See licenses/LICENSE-LGPLv2.1.txt

-   Tomcat 6.0.35:
-   Copyright 1999-2011 The Apache Software Foundation
+   Tomcat 6.0.36:
+   Copyright 1999-2012 The Apache Software Foundation
   See licenses/LICENSE-Apache2.0.txt
   See licenses/NOTICE-Tomcat.txt

--- a/README.txt
+++ b/README.txt
@ -32,7 +32,7 @@ FAQ:

 Need help?
 	IRC irc.freenode.net #i2p
-	http://forum.i2p2.de/
+	http://forum.i2p/

 Licenses:
 	See LICENSE.txt
--- a/Slackware/i2p/i2p.SlackBuild
+++ b/Slackware/i2p/i2p.SlackBuild
@ -128,7 +128,7 @@ cat $CWD/slack-desc > $PKG/install/slack-desc

 cd $PKG
 #
-# requiredbuilder fucks up REALLY bad, and thinks java is perl?!
+# requiredbuilder messes up REALLY bad, and thinks java is perl?!
 # It also did not catch the shell requirements! BOOOOOOOOOOO! HISSSSSSSS!
 #
 # requiredbuilder -v -y -s $CWD $PKG
--- a/apps/BOB/Demos/echo/echoclient/src/net/i2p/BOB/Demos/echo/echoclient/Main.java
+++ b/apps/BOB/Demos/echo/echoclient/src/net/i2p/BOB/Demos/echo/echoclient/Main.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB.Demos.echo.echoclient;

@ -55,7 +47,7 @@ public class Main {
 				// exit on anything not legal
 				break;
 			}
-			c = (char)(b & 0x7f); // We only really give a fuck about ASCII
+			c = (char)(b & 0x7f); // We only care about ASCII
 			S = new String(S + c);
 		}
 		return S;
--- a/apps/BOB/Demos/echo/echoserver/src/net/i2p/BOB/Demos/echo/echoserver/Main.java
+++ b/apps/BOB/Demos/echo/echoserver/src/net/i2p/BOB/Demos/echo/echoserver/Main.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB.Demos.echo.echoserver;

@ -52,7 +44,7 @@ public class Main {
 			if(b < 20) {
 				break;
 			}
-			c = (char)(b & 0x7f); // We only really give a fuck about ASCII
+			c = (char)(b & 0x7f); // We only care about ASCII
 			S = new String(S + c);
 		}
 		return S;
--- a/apps/BOB/build.xml
+++ b/apps/BOB/build.xml
@ -83,7 +83,7 @@
 	        <pathelement path="${javac.classpath}" />
 	    </path>
 	</copy>
-	<copy todir="${dist.dir}/lib" file="../../installer/lib/jbigi/jbigi.jar" />
+	<copy todir="${dist.dir}/lib" file="../../build/jbigi.jar" />

 	<!-- Extract the classes inside the jar files -->
 	<unjar dest="${dist.dir}/classes" >
--- a/apps/BOB/nbproject/project.properties
+++ b/apps/BOB/nbproject/project.properties
@ -30,11 +30,11 @@ excludes=**/*.html,**/*.txt
 file.reference.build-javadoc=../../i2p.i2p/build/javadoc
 file.reference.i2p.jar=../../core/java/build/i2p.jar
 file.reference.i2ptunnel.jar=../i2ptunnel/java/build/i2ptunnel.jar
-file.reference.jbigi.jar=../../installer/lib/jbigi/jbigi.jar
+file.reference.jbigi.jar=../../build/jbigi.jar
 file.reference.mstreaming.jar=../ministreaming/java/build/mstreaming.jar
 file.reference.router.jar=../../router/java/build/router.jar
 file.reference.streaming.jar=../streaming/java/build/streaming.jar
-file.reference.wrapper.jar=../../installer/lib/wrapper/linux/wrapper.jar
+file.reference.wrapper.jar=../../installer/lib/wrapper/all/wrapper.jar
 includes=**
 jar.compress=true
 javac.classpath=\
--- a/apps/BOB/src/net/i2p/BOB/BOB.java
+++ b/apps/BOB/src/net/i2p/BOB/BOB.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/DoCMDS.java
+++ b/apps/BOB/src/net/i2p/BOB/DoCMDS.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/I2Plistener.java
+++ b/apps/BOB/src/net/i2p/BOB/I2Plistener.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

@ -94,7 +86,7 @@ public class I2Plistener implements Runnable {

 				}
 			} catch (I2PException e) {
-				// bad shit
+				// bad stuff
 				System.out.println("Exception " + e);
 			}
 		} finally {
--- a/apps/BOB/src/net/i2p/BOB/I2PtoTCP.java
+++ b/apps/BOB/src/net/i2p/BOB/I2PtoTCP.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/Lifted.java
+++ b/apps/BOB/src/net/i2p/BOB/Lifted.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/MUXlisten.java
+++ b/apps/BOB/src/net/i2p/BOB/MUXlisten.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

@ -302,14 +294,14 @@ public class MUXlisten implements Runnable {

 			// Hopefully nuke stuff here...
 			{
-				String boner = tg.getName();
+				String groupName = tg.getName();
 				try {
-					_log.warn("destroySocketManager " + boner);
+					_log.warn("destroySocketManager " + groupName);
 					socketManager.destroySocketManager();
-					_log.warn("destroySocketManager Successful" + boner);
+					_log.warn("destroySocketManager Successful" + groupName);
 				} catch (Exception e) {
 					// nop
-					_log.warn("destroySocketManager Failed" + boner);
+					_log.warn("destroySocketManager Failed" + groupName);
 					_log.warn(e.toString());
 				}
 			}
@ -333,25 +325,25 @@ public class MUXlisten implements Runnable {

 			// Wait around till all threads are collected.
 			if (tg != null) {
-				String boner = tg.getName();
-				// System.out.println("BOB: MUXlisten: Starting thread collection for: " + boner);
-				_log.warn("BOB: MUXlisten: Starting thread collection for: " + boner);
+				String groupName = tg.getName();
+				// System.out.println("BOB: MUXlisten: Starting thread collection for: " + groupName);
+				_log.warn("BOB: MUXlisten: Starting thread collection for: " + groupName);
 				if (tg.activeCount() + tg.activeGroupCount() != 0) {
-					// visit(tg, 0, boner);
+					// visit(tg, 0, groupName);
 					int foo = tg.activeCount() + tg.activeGroupCount();
 					// hopefully no longer needed!
 					// int bar = lives;
-					// System.out.println("BOB: MUXlisten: Waiting on threads for " + boner);
-					// System.out.println("\nBOB: MUXlisten: ThreadGroup dump BEGIN " + boner);
-					// visit(tg, 0, boner);
-					// System.out.println("BOB: MUXlisten: ThreadGroup dump END " + boner + "\n");
+					// System.out.println("BOB: MUXlisten: Waiting on threads for " + groupName);
+					// System.out.println("\nBOB: MUXlisten: ThreadGroup dump BEGIN " + groupName);
+					// visit(tg, 0, groupName);
+					// System.out.println("BOB: MUXlisten: ThreadGroup dump END " + groupName + "\n");
 					// Happily spin forever :-(
 					while (foo != 0) {
 						foo = tg.activeCount() + tg.activeGroupCount();
 						// if (lives != bar && lives != 0) {
-						// 	System.out.println("\nBOB: MUXlisten: ThreadGroup dump BEGIN " + boner);
-						// 	visit(tg, 0, boner);
-						// 	System.out.println("BOB: MUXlisten: ThreadGroup dump END " + boner + "\n");
+						// 	System.out.println("\nBOB: MUXlisten: ThreadGroup dump BEGIN " + groupName);
+						// 	visit(tg, 0, groupName);
+						// 	System.out.println("BOB: MUXlisten: ThreadGroup dump END " + groupName + "\n");
 						// }
 						// bar = lives;
 						try {
@ -361,8 +353,8 @@ public class MUXlisten implements Runnable {
 						}
 					}
 				}
-				// System.out.println("BOB: MUXlisten: Threads went away. Success: " + boner);
-				_log.warn("BOB: MUXlisten: Threads went away. Success: " + boner);
+				// System.out.println("BOB: MUXlisten: Threads went away. Success: " + groupName);
+				_log.warn("BOB: MUXlisten: Threads went away. Success: " + groupName);
 				tg.destroy();
 				// Zap reference to the ThreadGroup so the JVM can GC it.
 				tg = null;
--- a/apps/BOB/src/net/i2p/BOB/Main.java
+++ b/apps/BOB/src/net/i2p/BOB/Main.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/NamedDB.java
+++ b/apps/BOB/src/net/i2p/BOB/NamedDB.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/TCPio.java
+++ b/apps/BOB/src/net/i2p/BOB/TCPio.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/TCPlistener.java
+++ b/apps/BOB/src/net/i2p/BOB/TCPlistener.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/BOB/src/net/i2p/BOB/TCPtoI2P.java
+++ b/apps/BOB/src/net/i2p/BOB/TCPtoI2P.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

@ -94,7 +86,7 @@ public class TCPtoI2P implements Runnable {
 				// exit on anything not legal
 				break;
 			}
-			c = (char) (b & 0x7f); // We only really give a fuck about ASCII
+			c = (char) (b & 0x7f); // We only care about ASCII
 			S = new String(S + c);
 		}
 		return S;
--- a/apps/BOB/src/net/i2p/BOB/UDPIOthread.java
+++ b/apps/BOB/src/net/i2p/BOB/UDPIOthread.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,7 +11,7 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
 package net.i2p.BOB;

--- a/apps/addressbook/java/src/net/i2p/addressbook/ConfigParser.java
+++ b/apps/addressbook/java/src/net/i2p/addressbook/ConfigParser.java
@ -37,6 +37,7 @@ import java.util.Map;

 import net.i2p.util.SecureFile;
 import net.i2p.util.SecureFileOutputStream;
+import net.i2p.util.SystemVersion;

 /**
 * Utility class providing methods to parse and write files in config file
@ -49,7 +50,7 @@ import net.i2p.util.SecureFileOutputStream;
 */
 class ConfigParser {

-    private static final boolean isWindows = System.getProperty("os.name").startsWith("Win");
+    private static final boolean isWindows = SystemVersion.isWindows();

    /**
     * Strip the comments from a String. Lines that begin with '#' and ';' are
--- a/apps/addressbook/java/src/net/i2p/addressbook/Daemon.java
+++ b/apps/addressbook/java/src/net/i2p/addressbook/Daemon.java
@ -230,7 +230,7 @@ public class Daemon {
     */
    public static void update(Map<String, String> settings, String home) {
        File published = null;
-        boolean should_publish = Boolean.valueOf(settings.get("should_publish")).booleanValue();
+        boolean should_publish = Boolean.parseBoolean(settings.get("should_publish"));
        if (should_publish) 
            published = new File(home, settings
                .get("published_addressbook"));
@ -261,7 +261,7 @@ public class Daemon {

        // If false, add hosts via naming service; if true, write hosts.txt file directly
        // Default false
-        if (Boolean.valueOf(settings.get("update_direct")).booleanValue()) {
+        if (Boolean.parseBoolean(settings.get("update_direct"))) {
            // Direct hosts.txt access
            File routerFile = new File(home, settings.get("router_addressbook"));
            AddressBook master;
--- a/apps/addressbook/java/src/net/i2p/addressbook/Servlet.java
+++ b/apps/addressbook/java/src/net/i2p/addressbook/Servlet.java
@ -42,8 +42,8 @@ import javax.servlet.http.HttpServletResponse;
 */
 public class Servlet extends HttpServlet {
    private DaemonThread thread;
-    private String nonce;
-    private static final String PROP_NONCE = "addressbook.nonce";
+    //private String nonce;
+    //private static final String PROP_NONCE = "addressbook.nonce";

    /**
     * Hack to allow susidns to kick the daemon when the subscription list changes.
@ -54,15 +54,15 @@ public class Servlet extends HttpServlet {
     */
    public void service(HttpServletRequest request, HttpServletResponse response) throws IOException {
        //System.err.println("Got request nonce = " + request.getParameter("nonce"));
-        if (this.thread != null && request.getParameter("wakeup") != null &&
-            this.nonce != null && this.nonce.equals(request.getParameter("nonce"))) {
-            //System.err.println("Sending interrupt");
-            this.thread.interrupt();
-            // no output
-        } else {
+        //if (this.thread != null && request.getParameter("wakeup") != null &&
+        //    this.nonce != null && this.nonce.equals(request.getParameter("nonce"))) {
+        //    //System.err.println("Sending interrupt");
+        //    this.thread.interrupt();
+        //    // no output
+        //} else {
            PrintWriter out = response.getWriter();
            out.write("I2P addressbook OK");
-        }
+        //}
    }

    /* (non-Javadoc)
@ -75,9 +75,9 @@ public class Servlet extends HttpServlet {
        } catch (ServletException exp) {
            System.err.println("Addressbook init exception: " + exp);
        }
-        this.nonce = "" + Math.abs((new Random()).nextLong());
+        //this.nonce = "" + Math.abs((new Random()).nextLong());
        // put the nonce where susidns can get it
-        System.setProperty(PROP_NONCE, this.nonce);
+        //System.setProperty(PROP_NONCE, this.nonce);
        String[] args = new String[1];
        args[0] = config.getInitParameter("home");
        this.thread = new DaemonThread(args);
--- a/apps/desktopgui/.classpath
+++ b/apps/desktopgui/.classpath
@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="src" path="src"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/i2p_router"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/i2p_sdk"/>
+	<classpathentry kind="lib" path="/lib/wrapper/all/wrapper.jar"/>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
+	<classpathentry kind="output" path="build"/>
+</classpath>
--- a/apps/desktopgui/.project
+++ b/apps/desktopgui/.project
@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>desktopgui</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+	</natures>
+</projectDescription>
--- a/apps/desktopgui/build.xml
+++ b/apps/desktopgui/build.xml
@ -8,12 +8,15 @@
 	<property name="resources" value="resources"/>
    <property name="javadoc" value="javadoc"/>

+    <condition property="no.bundle">
+        <isfalse value="${require.gettext}" />
+    </condition>
 	<property name="javac.compilerargs" value=""/>
 	<property name="require.gettext" value="true" />

 	<target name="init">
-		<mkdir dir="${build}"/>
-        <mkdir dir="${build}/${resources}"/>
+	<mkdir dir="${build}"/>
+	<mkdir dir="${build}/${resources}"/>
        <mkdir dir="${build}/${javadoc}"/>
 		<mkdir dir="${dist}"/>
 	</target>
@ -39,7 +42,7 @@
        </copy>
 	</target>

-	<target name="bundle" >
+	<target name="bundle" unless="no.bundle">
        <exec executable="sh" osfamily="unix" failifexecutionfails="true" failonerror="${require.gettext}" >
            <arg value="./bundle-messages.sh" />
        </exec>
--- a/apps/desktopgui/bundle-messages.sh
+++ b/apps/desktopgui/bundle-messages.sh
@ -1,3 +1,4 @@
+#!/bin/sh
 #
 # Update messages_xx.po and messages_xx.class files,
 # from both java and jsp sources.
--- a/apps/fortuna/build.xml
+++ b/apps/fortuna/build.xml
@ -1,106 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project basedir="." default="all" name="fortuna">
-
-	<property name="cvs.base.dir" value="java/gnu-crypto" />
-	<property name="cvs.etc.dir" value="${cvs.base.dir}/etc" />
-	<property name="cvs.lib.dir" value="${cvs.base.dir}/lib" />
-	<property name="cvs.object.dir" value="${cvs.base.dir}/classes" />
-	<property name="cvs.base.crypto.object.dir" value="${cvs.object.dir}/gnu/crypto" />
-	<property name="cvs.cipher.object.dir" value="${cvs.base.crypto.object.dir}/cipher" />
-	<property name="cvs.hash.object.dir" value="${cvs.base.crypto.object.dir}/hash" />
-	<property name="cvs.prng.object.dir" value="${cvs.base.crypto.object.dir}/prng" />
-
-	<patternset id="fortuna.files">
-		<include name="${cvs.base.crypto.object.dir}/Registry.class"/>
-		<include name="${cvs.prng.object.dir}/Fortuna*.class"/>
-		<include name="${cvs.prng.object.dir}/BasePRNG.class"/>
-		<include name="${cvs.prng.object.dir}/RandomEventListener.class"/>
-		<include name="${cvs.prng.object.dir}/IRandom.class"/>
-		<include name="${cvs.cipher.object.dir}/CipherFactory.class"/>
-		<include name="${cvs.cipher.object.dir}/IBlockCipher.class"/>
-		<include name="${cvs.hash.object.dir}/HashFactory.class"/>
-		<include name="${cvs.hash.object.dir}/IMessageDigest.class"/>
-	</patternset>
-
-	<target name="all" depends="build,jar" 
-		description="Create and test the custom Fortuna library" />
-
-	<target name="build" depends="-init,checkout"
-		description="Build the source and tests">
-		<ant dir="${cvs.base.dir}" target="jar" />
-	</target>
-
-	<target name="builddep" />
-
-	<target name="checkout" depends="-init" unless="cvs.source.available"
-		description="Check out GNU Crypto sources from CVS HEAD">
-		<cvs cvsRoot=":ext:anoncvs@savannah.gnu.org:/cvsroot/gnu-crypto"
-			cvsRsh="ssh"
-			dest="java"
-			package="gnu-crypto" />
-	</target>
-
-	<target name="clean"
-		description="Remove generated tests and object files">
-		<ant dir="${cvs.base.dir}" target="clean" />
-	</target>
-
-	<target name="cleandep" />
-
-	<target name="compile" />
-
-	<target name="distclean" depends="clean"
-		description="Remove all generated files">
-		<delete dir="build" />
-		<delete dir="jartemp" />
-		<!--
-			Annoyingly the GNU Crypto distclean task called here doesn't clean
-			*all* derived files from java/gnu-crypto/lib like it should.....
-		-->
-		<ant dir="${cvs.base.dir}" target="distclean" />
-		<!--
-			.....and so we mop up the rest ourselves.
-		-->
-		<delete dir="${cvs.lib.dir}" />
-	</target>
-
-	<target name="-init">
-		<available property="cvs.source.available" file="${cvs.base.dir}" />
-	</target>
-
-	<target name="jar" depends="build"
-		description="Create the custom Fortuna jar library">
-		<delete dir="build" />
-		<delete dir="jartemp" />
-		<mkdir dir="build" />
-		<mkdir dir="jartemp/${cvs.object.dir}" />
-		<copy todir="jartemp">
-			<fileset dir=".">
-				<patternset refid="fortuna.files" />
-			</fileset>
-		</copy>
-		<jar basedir="jartemp/${cvs.object.dir}" jarfile="build/fortuna.jar">
-			<manifest>
-				<section name="fortuna">
-					<attribute name="Implementation-Title" value="I2P Custom GNU Crypto Fortuna Library" />
-					<attribute name="Implementation-Version" value="CVS HEAD" /> 
-					<attribute name="Implementation-Vendor" value="Free Software Foundation" />
-					<attribute name="Implementation-Vendor-Id" value="FSF" />
-					<attribute name="Implementation-URL" value="http://www.gnu.org/software/gnu-crypto" />
-				</section>
-			</manifest>
-		</jar>
-		<delete dir="jartemp" />
-	</target>
-
-	<target name="test" depends="jar"
-		description="Perform crypto tests on custom Fortuna jar library" />
-		<!--
-			Add this when Fortuna tests are added to GNU Crypto, else write some
-		-->
-
-	<target name="update" depends="checkout"
-		description="Update GNU Crypto sources to latest CVS HEAD">
-		<cvs command="update -d" cvsRsh="ssh" dest="java/gnu-crypto" />
-	</target>
-</project>
--- a/apps/i2psnark/.classpath
+++ b/apps/i2psnark/.classpath
@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="src" path="java/src"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/i2p_sdk"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/ministreaming"/>
+	<classpathentry kind="lib" path="/jetty/jettylib/javax.servlet.jar"/>
+	<classpathentry kind="lib" path="/jetty/jettylib/jetty-util.jar"/>
+	<classpathentry kind="lib" path="/jetty/jettylib/org.mortbay.jetty.jar"/>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
+	<classpathentry kind="output" path="java/build/obj"/>
+</classpath>
--- a/apps/i2psnark/.project
+++ b/apps/i2psnark/.project
@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>i2psnark</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+	</natures>
+</projectDescription>
--- a/apps/i2psnark/java/build.xml
+++ b/apps/i2psnark/java/build.xml
@ -24,6 +24,9 @@
        </depend>
    </target>

+    <condition property="no.bundle">
+        <isfalse value="${require.gettext}" />
+    </condition>
    <property name="javac.compilerargs" value="" />
    <property name="require.gettext" value="true" />

@ -80,7 +83,7 @@
                    <isset property="jar.uptodate" />
                </not>
                <not>
-                    <isset property="wjar.uptodate" />
+                    <isset property="war.uptodate" />
                </not>
                <isset property="mtn.available" />
            </and>
@ -120,7 +123,7 @@
        </uptodate>
    </target>
    
-    <target name="bundle" depends="compile">
+    <target name="bundle" depends="compile" unless="no.bundle">
        <!-- Update the messages_*.po files.
             We need to supply the bat file for windows, and then change the fail property to true -->
        <exec executable="sh" osfamily="unix" failifexecutionfails="true" failonerror="${require.gettext}" >
--- a/apps/i2psnark/java/bundle-messages.sh
+++ b/apps/i2psnark/java/bundle-messages.sh
@ -1,3 +1,4 @@
+#!/bin/sh
 #
 # Update messages_xx.po and messages_xx.class files,
 # from both java and jsp sources.
--- a/apps/i2psnark/java/src/net/i2p/kademlia/KBucketSet.java
+++ b/apps/i2psnark/java/src/net/i2p/kademlia/KBucketSet.java
@ -14,7 +14,6 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashSet;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@ -24,6 +23,7 @@ import java.util.concurrent.locks.ReentrantReadWriteLock;
 import net.i2p.I2PAppContext;
 import net.i2p.data.DataHelper;
 import net.i2p.data.SimpleDataStructure;
+import net.i2p.util.LHMCache;
 import net.i2p.util.Log;

 /**
@ -209,10 +209,10 @@ public class KBucketSet<T extends SimpleDataStructure> {
            int s1, e1, s2, e2;
            s1 = b0.getRangeBegin();
            e2 = b0.getRangeEnd();
-            if (B_FACTOR > 1 &&
-                (s1 & (B_FACTOR - 1)) == 0 &&
-                ((e2 + 1) & (B_FACTOR - 1)) == 0 &&
-                e2 > s1 + B_FACTOR) {
+            if (B_VALUE == 1 ||
+                ((s1 & (B_FACTOR - 1)) == 0 &&
+                 ((e2 + 1) & (B_FACTOR - 1)) == 0 &&
+                 e2 > s1 + B_FACTOR)) {
                // The bucket is a "whole" kbucket with a range > B_FACTOR,
                // so it should be split into two "whole" kbuckets each with
                // a range >= B_FACTOR.
@ -518,6 +518,7 @@ public class KBucketSet<T extends SimpleDataStructure> {
    
    /**
     *  For every bucket that hasn't been updated in this long,
+     *  or isn't close to full,
     *  generate a random key that would be a member of that bucket.
     *  The returned keys may be searched for to "refresh" the buckets.
     *  @return non-null, closest first
@ -528,7 +529,10 @@ public class KBucketSet<T extends SimpleDataStructure> {
        getReadLock();
        try {
            for (KBucket b : _buckets) {
-                if (b.getLastChanged() < old)
+                int curSize = b.getKeyCount();
+                // Always explore the closest bucket
+                if ((b.getRangeBegin() == 0) ||
+                    (b.getLastChanged() < old || curSize < BUCKET_SIZE * 3 / 4))
                    rv.add(generateRandomKey(b));
            }
        } finally { releaseReadLock(); }
@ -658,7 +662,7 @@ public class KBucketSet<T extends SimpleDataStructure> {
        public Range(T us, int bValue) {
            _bValue = bValue;
            _bigUs = new BigInteger(1, us.getData());
-            _distanceCache = new LHM(256);
+            _distanceCache = new LHMCache(256);
        }

        /** @return 0 to max-1 or -1 for us */
@ -697,20 +701,6 @@ public class KBucketSet<T extends SimpleDataStructure> {
        }
    }

-    private static class LHM<K, V> extends LinkedHashMap<K, V> {
-        private final int _max;
-
-        public LHM(int max) {
-            super(max, 0.75f, true);
-            _max = max;
-        }
-
-        @Override
-        protected boolean removeEldestEntry(Map.Entry<K, V> eldest) {
-            return size() > _max;
-        }
-    }
-
    /**
     *  For Collections.binarySearch.
     *  getRangeBegin == getRangeEnd.
@ -772,8 +762,8 @@ public class KBucketSet<T extends SimpleDataStructure> {
    public String toString() {
        StringBuilder buf = new StringBuilder(1024);
        buf.append("Bucket set rooted on: ").append(_us.toString())
-           .append(" K= ").append(BUCKET_SIZE)
-           .append(" B= ").append(B_VALUE)
+           .append(" K=").append(BUCKET_SIZE)
+           .append(" B=").append(B_VALUE)
           .append(" with ").append(size())
           .append(" keys in ").append(_buckets.size()).append(" buckets:\n");
        getReadLock();
--- a/apps/i2psnark/java/src/org/klomp/snark/BitField.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/BitField.java
@ -39,7 +39,6 @@ public class BitField
    this.size = size;
    int arraysize = ((size-1)/8)+1;
    bitfield = new byte[arraysize];
-    this.count = 0;
  }

  /**
@ -60,7 +59,6 @@ public class BitField
    // cleared or clear them explicitly ourselves.
    System.arraycopy(bitfield, 0, this.bitfield, 0, arraysize);

-    this.count = 0;
    for (int i = 0; i < size; i++)
      if (get(i))
        this.count++;
@ -99,9 +97,11 @@ public class BitField
      throw new IndexOutOfBoundsException(Integer.toString(bit));
    int index = bit/8;
    int mask = 128 >> (bit % 8);
-    if ((bitfield[index] & mask) == 0) {
-      count++;
-      bitfield[index] |= mask;
+    synchronized(this) {
+        if ((bitfield[index] & mask) == 0) {
+            count++;
+            bitfield[index] |= mask;
+        }
    }
  }

--- a/apps/i2psnark/java/src/org/klomp/snark/CompleteListener.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/CompleteListener.java
@ -0,0 +1,60 @@
+/* CompleteListener - Callback for Snark events
+   
+   Copyright (C) 2003 Mark J. Wielaard
+
+   This file is part of Snark.
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+ 
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+ 
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+*/
+
+package org.klomp.snark;
+
+/**
+ *  Callback for Snark events.
+ *  @since 0.9.4 moved from Snark.java
+ */
+public interface CompleteListener {
+    public void torrentComplete(Snark snark);
+    public void updateStatus(Snark snark);
+
+    /**
+     * We transitioned from magnet mode, we have now initialized our
+     * metainfo and storage. The listener should now call getMetaInfo()
+     * and save the data to disk.
+     *
+     * @return the new name for the torrent or null on error
+     * @since 0.8.4
+     */
+    public String gotMetaInfo(Snark snark);
+
+    /**
+     * @since 0.9
+     */
+    public void fatal(Snark snark, String error);
+
+    /**
+     * @since 0.9.2
+     */
+    public void addMessage(Snark snark, String message);
+
+    /**
+     * @since 0.9.4
+     */
+    public void gotPiece(Snark snark);
+
+    // not really listeners but the easiest way to get back to an optional SnarkManager
+    public long getSavedTorrentTime(Snark snark);
+    public BitField getSavedTorrentBitField(Snark snark);
+}
--- a/apps/i2psnark/java/src/org/klomp/snark/DataLoader.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/DataLoader.java
@ -1,5 +1,7 @@
 package org.klomp.snark;

+import net.i2p.data.ByteArray;
+
 /**
 * Callback used to fetch data
 * @since 0.8.2
@ -10,5 +12,5 @@ interface DataLoader
   *  This is the callback that PeerConnectionOut calls to get the data from disk
   *  @return bytes or null for errors
   */
-    public byte[] loadData(int piece, int begin, int length);
+    public ByteArray loadData(int piece, int begin, int length);
 }
--- a/apps/i2psnark/java/src/org/klomp/snark/I2PSnarkUtil.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/I2PSnarkUtil.java
@ -1,5 +1,6 @@
 package org.klomp.snark;

+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
@ -58,7 +59,7 @@ public class I2PSnarkUtil {
    private volatile I2PSocketManager _manager;
    private boolean _configured;
    private volatile boolean _connecting;
-    private final Set<Hash> _shitlist;
+    private final Set<Hash> _banlist;
    private int _maxUploaders;
    private int _maxUpBW;
    private int _maxConnections;
@ -78,7 +79,7 @@ public class I2PSnarkUtil {
    public static final int DEFAULT_MAX_UP_BW = 8;  //KBps
    public static final int MAX_CONNECTIONS = 16; // per torrent
    public static final String PROP_MAX_BW = "i2cp.outboundBytesPerSecond";
-    public static final boolean DEFAULT_USE_DHT = false;
+    public static final boolean DEFAULT_USE_DHT = true;

    public I2PSnarkUtil(I2PAppContext ctx) {
        _context = ctx;
@ -86,7 +87,7 @@ public class I2PSnarkUtil {
        _opts = new HashMap();
        //setProxy("127.0.0.1", 4444);
        setI2CPConfig("127.0.0.1", 7654, null);
-        _shitlist = new ConcurrentHashSet();
+        _banlist = new ConcurrentHashSet();
        _maxUploaders = Snark.MAX_TOTAL_UPLOADERS;
        _maxUpBW = DEFAULT_MAX_UP_BW;
        _maxConnections = MAX_CONNECTIONS;
@ -218,6 +219,8 @@ public class I2PSnarkUtil {
                opts.setProperty("inbound.nickname", "I2PSnark");
            if (opts.getProperty("outbound.nickname") == null)
                opts.setProperty("outbound.nickname", "I2PSnark");
+            if (opts.getProperty("outbound.priority") == null)
+                opts.setProperty("outbound.priority", "-10");
            // Dont do this for now, it is set in I2PSocketEepGet for announces,
            // we don't need fast handshake for peer connections.
            //if (opts.getProperty("i2p.streaming.connectDelay") == null)
@ -244,6 +247,8 @@ public class I2PSnarkUtil {
                opts.setProperty("i2p.streaming.maxConnsPerHour", "20");
            if (opts.getProperty("i2p.streaming.enforceProtocol") == null)
                opts.setProperty("i2p.streaming.enforceProtocol", "true");
+            if (opts.getProperty("i2p.streaming.disableRejectLogging") == null)
+                opts.setProperty("i2p.streaming.disableRejectLogging", "true");
            _manager = I2PSocketManagerFactory.createManager(_i2cpHost, _i2cpPort, opts);
            _connecting = false;
        }
@ -283,7 +288,7 @@ public class I2PSnarkUtil {
        I2PSocketManager mgr = _manager;
        // FIXME this can cause race NPEs elsewhere
        _manager = null;
-        _shitlist.clear();
+        _banlist.clear();
        if (mgr != null) {
            if (_log.shouldLog(Log.DEBUG))
                _log.debug("Disconnecting from I2P", new Exception("I did it"));
@ -306,24 +311,24 @@ public class I2PSnarkUtil {
        if (addr.equals(getMyDestination()))
            throw new IOException("Attempt to connect to myself");
        Hash dest = addr.calculateHash();
-        if (_shitlist.contains(dest))
-            throw new IOException("Not trying to contact " + dest.toBase64() + ", as they are shitlisted");
+        if (_banlist.contains(dest))
+            throw new IOException("Not trying to contact " + dest.toBase64() + ", as they are banlisted");
        try {
            I2PSocket rv = _manager.connect(addr);
            if (rv != null)
-                _shitlist.remove(dest);
+                _banlist.remove(dest);
            return rv;
        } catch (I2PException ie) {
-            _shitlist.add(dest);
-            _context.simpleScheduler().addEvent(new Unshitlist(dest), 10*60*1000);
+            _banlist.add(dest);
+            _context.simpleScheduler().addEvent(new Unbanlist(dest), 10*60*1000);
            throw new IOException("Unable to reach the peer " + peer + ": " + ie.getMessage());
        }
    }
    
-    private class Unshitlist implements SimpleTimer.TimedEvent {
+    private class Unbanlist implements SimpleTimer.TimedEvent {
        private Hash _dest;
-        public Unshitlist(Hash dest) { _dest = dest; }
-        public void timeReached() { _shitlist.remove(_dest); }
+        public Unbanlist(Hash dest) { _dest = dest; }
+        public void timeReached() { _banlist.remove(_dest); }
    }
    
    /**
@ -391,6 +396,46 @@ public class I2PSnarkUtil {
        }
    }
    
+    /**
+     * Fetch to memory
+     * @param retries if < 0, set timeout to a few seconds
+     * @param initialSize buffer size
+     * @param maxSize fails if greater
+     * @return null on error
+     * @since 0.9.4
+     */
+    public byte[] get(String url, boolean rewrite, int retries, int initialSize, int maxSize) {
+        if (_log.shouldLog(Log.DEBUG))
+            _log.debug("Fetching [" + url + "] to memory");
+        String fetchURL = url;
+        if (rewrite)
+            fetchURL = rewriteAnnounce(url);
+        int timeout;
+        if (retries < 0) {
+            if (!connected())
+                return null;
+            timeout = EEPGET_CONNECT_TIMEOUT_SHORT;
+            retries = 0;
+        } else {
+            timeout = EEPGET_CONNECT_TIMEOUT;
+            if (!connected()) {
+                if (!connect())
+                    return null;
+            }
+        }
+        ByteArrayOutputStream out = new ByteArrayOutputStream(initialSize);
+        EepGet get = new I2PSocketEepGet(_context, _manager, retries, -1, maxSize, null, out, fetchURL);
+        if (get.fetch(timeout)) {
+            if (_log.shouldLog(Log.DEBUG))
+                _log.debug("Fetch successful [" + url + "]: size=" + out.size());
+            return out.toByteArray();
+        } else {
+            if (_log.shouldLog(Log.WARN))
+                _log.warn("Fetch failed [" + url + "]");
+            return null;
+        }
+    }
+    
    public I2PServerSocket getServerSocket() { 
        I2PSocketManager mgr = _manager;
        if (mgr != null)
@ -521,6 +566,15 @@ public class I2PSnarkUtil {
            return Collections.EMPTY_LIST;
        return _openTrackers;
    }
+
+    /**
+     *  List of open trackers to use as backups even if disabled
+     *  @return non-null
+     *  @since 0.9.4
+     */
+    public List<String> getBackupTrackers() { 
+        return _openTrackers;
+    }
    
    public void setUseOpenTrackers(boolean yes) {
        _shouldUseOT = yes;
--- a/apps/i2psnark/java/src/org/klomp/snark/MagnetURI.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/MagnetURI.java
@ -0,0 +1,212 @@
+package org.klomp.snark;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+import net.i2p.data.Base32;
+
+/**
+ *
+ * @since 0.9.4 moved from I2PSnarkServlet
+ */
+public class MagnetURI {
+
+    private final String _tracker;
+    private final String _name;
+    private final byte[] _ih;
+
+    /** BEP 9 */
+    public static final String MAGNET = "magnet:";
+    public static final String MAGNET_FULL = MAGNET + "?xt=urn:btih:";
+    /** http://sponge.i2p/files/maggotspec.txt */
+    public static final String MAGGOT = "maggot://";
+
+    /**
+     *  @param url non-null
+     */
+    public MagnetURI(I2PSnarkUtil util, String url) throws IllegalArgumentException {
+        String ihash;
+        String name;
+        String trackerURL = null;
+        if (url.startsWith(MAGNET)) {
+            // magnet:?xt=urn:btih:0691e40aae02e552cfcb57af1dca56214680c0c5&tr=http://tracker2.postman.i2p/announce.php
+            String xt = getParam("xt", url);
+            if (xt == null || !xt.startsWith("urn:btih:"))
+                throw new IllegalArgumentException();
+            ihash = xt.substring("urn:btih:".length());
+            trackerURL = getTrackerParam(url);
+            name = util.getString("Magnet") + ' ' + ihash;
+            String dn = getParam("dn", url);
+            if (dn != null)
+                name += " (" + Storage.filterName(dn) + ')';
+        } else if (url.startsWith(MAGGOT)) {
+            // maggot://0691e40aae02e552cfcb57af1dca56214680c0c5:0b557bbdf8718e95d352fbe994dec3a383e2ede7
+            ihash = url.substring(MAGGOT.length()).trim();
+            int col = ihash.indexOf(':');
+            if (col >= 0)
+                ihash = ihash.substring(0, col);
+            name = util.getString("Magnet") + ' ' + ihash;
+        } else {
+            throw new IllegalArgumentException();
+        }
+        byte[] ih = null;
+        if (ihash.length() == 32) {
+            ih = Base32.decode(ihash);
+        } else if (ihash.length() == 40) {
+            //  Like DataHelper.fromHexString() but ensures no loss of leading zero bytes
+            ih = new byte[20];
+            try {
+                for (int i = 0; i < 20; i++) {
+                    ih[i] = (byte) (Integer.parseInt(ihash.substring(i*2, (i*2) + 2), 16) & 0xff);
+                }
+            } catch (NumberFormatException nfe) {
+                ih = null;
+            }
+        }
+        if (ih == null || ih.length != 20)
+            throw new IllegalArgumentException();
+        _ih = ih;
+        _name = name;
+        _tracker = trackerURL;
+    }
+
+    /**
+     *  @return 20 bytes or null
+     */
+    public byte[] getInfoHash() {
+        return _ih;
+    }
+
+    /**
+     *  @return pretty name or null
+     */
+    public String getName() {
+        return _name;
+    }
+
+    /**
+     *  @return tracker url or null
+     */
+    public String getTrackerURL() {
+        return _tracker;
+    }
+
+    /**
+     *  @return first decoded parameter or null
+     */
+    private static String getParam(String key, String uri) {
+        int idx = uri.indexOf('?' + key + '=');
+        if (idx >= 0) {
+            idx += key.length() + 2;
+        } else {
+            idx = uri.indexOf('&' + key + '=');
+            if (idx >= 0)
+                idx += key.length() + 2;
+        }
+        if (idx < 0 || idx > uri.length())
+            return null;
+        String rv = uri.substring(idx);
+        idx = rv.indexOf('&');
+        if (idx >= 0)
+            rv = rv.substring(0, idx);
+        else
+            rv = rv.trim();
+        return decode(rv);
+    }
+
+    /**
+     *  @return all decoded parameters or null
+     *  @since 0.9.1
+     */
+    private static List<String> getMultiParam(String key, String uri) {
+        int idx = uri.indexOf('?' + key + '=');
+        if (idx >= 0) {
+            idx += key.length() + 2;
+        } else {
+            idx = uri.indexOf('&' + key + '=');
+            if (idx >= 0)
+                idx += key.length() + 2;
+        }
+        if (idx < 0 || idx > uri.length())
+            return null;
+        List<String> rv = new ArrayList();
+        while (true) {
+            String p = uri.substring(idx);
+            uri = p;
+            idx = p.indexOf('&');
+            if (idx >= 0)
+                p = p.substring(0, idx);
+            else
+                p = p.trim();
+            rv.add(decode(p));
+            idx = uri.indexOf('&' + key + '=');
+            if (idx < 0)
+                break;
+            idx += key.length() + 2;
+        }
+        return rv;
+    }
+
+    /**
+     *  @return first valid I2P tracker or null
+     *  @since 0.9.1
+     */
+    private static String getTrackerParam(String uri) {
+        List<String> trackers = getMultiParam("tr", uri);
+        if (trackers == null)
+            return null;
+        for (String t : trackers) {
+            try {
+                URI u = new URI(t);
+                String protocol = u.getScheme();
+                String host = u.getHost();
+                if (protocol == null || host == null ||
+                    !protocol.toLowerCase(Locale.US).equals("http") ||
+                    !host.toLowerCase(Locale.US).endsWith(".i2p"))
+                    continue;
+                return t;
+            } catch(URISyntaxException use) {}
+        }
+        return null;
+    }
+
+    /**
+     *  Decode %xx encoding, convert to UTF-8 if necessary
+     *  Copied from i2ptunnel LocalHTTPServer
+     *  @since 0.9.1
+     */
+    private static String decode(String s) {
+        if (!s.contains("%"))
+            return s;
+        StringBuilder buf = new StringBuilder(s.length());
+        boolean utf8 = false;
+        for (int i = 0; i < s.length(); i++) {
+            char c = s.charAt(i);
+            if (c != '%') {
+                buf.append(c);
+            } else {
+                try {
+                    int val = Integer.parseInt(s.substring(++i, (++i) + 1), 16);
+                    if ((val & 0x80) != 0)
+                        utf8 = true;
+                    buf.append((char) val);
+                } catch (IndexOutOfBoundsException ioobe) {
+                    break;
+                } catch (NumberFormatException nfe) {
+                    break;
+                }
+            }
+        }
+        if (utf8) {
+            try {
+                return new String(buf.toString().getBytes("ISO-8859-1"), "UTF-8");
+            } catch (UnsupportedEncodingException uee) {}
+        }
+        return buf.toString();
+    }
+
+}
--- a/apps/i2psnark/java/src/org/klomp/snark/Message.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/Message.java
@ -23,8 +23,13 @@ package org.klomp.snark;
 import java.io.DataOutputStream;
 import java.io.IOException;

-// Used to queue outgoing connections
-// sendMessage() should be used to translate them to wire format.
+import net.i2p.data.ByteArray;
+import net.i2p.util.ByteCache;
+
+/**
+ * Used to queue outgoing connections
+ * sendMessage() should be used to translate them to wire format.
+ */
 class Message
 {
  final static byte KEEP_ALIVE   = -1;
@ -69,6 +74,9 @@ class Message
  // now unused
  //SimpleTimer.TimedEvent expireEvent;
  
+  private static final int BUFSIZE = PeerState.PARTSIZE;
+  private static final ByteCache _cache = ByteCache.getInstance(16, BUFSIZE);
+
  /** Utility method for sending a message through a DataStream. */
  void sendMessage(DataOutputStream dos) throws IOException
  {
@ -79,11 +87,15 @@ class Message
        return;
      }

+    ByteArray ba;
    // Get deferred data
    if (data == null && dataLoader != null) {
-        data = dataLoader.loadData(piece, begin, length);
-        if (data == null)
+        ba = dataLoader.loadData(piece, begin, length);
+        if (ba == null)
            return;  // hmm will get retried, but shouldn't happen
+        data = ba.getData();
+    } else {
+        ba = null;
    }

    // Calculate the total length in bytes
@ -139,6 +151,10 @@ class Message
    // Send actual data
    if (type == BITFIELD || type == PIECE || type == EXTENSION)
      dos.write(data, off, len);
+
+    // Was pulled from cache in Storage.getPiece() via dataLoader
+    if (ba != null && ba.getData().length == BUFSIZE)
+        _cache.release(ba, false);
  }

    @Override
--- a/apps/i2psnark/java/src/org/klomp/snark/MetaInfo.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/MetaInfo.java
@ -61,6 +61,7 @@ public class MetaInfo
  private final byte[] piece_hashes;
  private final long length;
  private final boolean privateTorrent;
+  private final List<List<String>> announce_list;
  private Map<String, BEValue> infoMap;

  /**
@ -69,9 +70,11 @@ public class MetaInfo
   *  @param announce may be null
   *  @param files null for single-file torrent
   *  @param lengths null for single-file torrent
+   *  @param announce_list may be null
   */
  MetaInfo(String announce, String name, String name_utf8, List<List<String>> files, List<Long> lengths,
-           int piece_length, byte[] piece_hashes, long length, boolean privateTorrent)
+           int piece_length, byte[] piece_hashes, long length, boolean privateTorrent,
+           List<List<String>> announce_list)
  {
    this.announce = announce;
    this.name = name;
@ -83,6 +86,7 @@ public class MetaInfo
    this.piece_hashes = piece_hashes;
    this.length = length;
    this.privateTorrent = privateTorrent;
+    this.announce_list = announce_list;

    // TODO if we add a parameter for other keys
    //if (other != null) {
@ -141,6 +145,23 @@ public class MetaInfo
        this.announce = val.getString();
    }

+    // BEP 12
+    val = m.get("announce-list");
+    if (val == null) {
+        this.announce_list = null;
+    } else {
+        this.announce_list = new ArrayList();
+        List<BEValue> bl1 = val.getList();
+        for (BEValue bev : bl1) {
+            List<BEValue> bl2 = bev.getList();
+            List<String> sl2 = new ArrayList();           
+            for (BEValue bev2 : bl2) {
+                sl2.add(bev2.getString());
+            }
+            this.announce_list.add(sl2);
+        }
+    }
+
    val = m.get("info");
    if (val == null)
        throw new InvalidBEncodingException("Missing info map");
@ -296,6 +317,15 @@ public class MetaInfo
    return announce;
  }

+  /**
+   * Returns a list of lists of urls.
+   *
+   * @since 0.9.5
+   */
+  public List<List<String>> getAnnounceList() {
+    return announce_list;
+  }
+
  /**
   * Returns the original 20 byte SHA1 hash over the bencoded info map.
   */
@ -470,12 +500,13 @@ public class MetaInfo
  /**
   * Creates a copy of this MetaInfo that shares everything except the
   * announce URL.
+   * Drops any announce-list.
   */
  public MetaInfo reannounce(String announce)
  {
    return new MetaInfo(announce, name, name_utf8, files,
                        lengths, piece_length,
-                        piece_hashes, length, privateTorrent);
+                        piece_hashes, length, privateTorrent, null);
  }

  /**
@ -486,6 +517,8 @@ public class MetaInfo
        Map m = new HashMap();
        if (announce != null)
            m.put("announce", announce);
+        if (announce_list != null)
+            m.put("announce-list", announce_list);
        Map info = createInfoMap();
        m.put("info", info);
        // don't save this locally, we should only do this once
--- a/apps/i2psnark/java/src/org/klomp/snark/PartialPiece.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/PartialPiece.java
@ -9,6 +9,8 @@ import java.security.MessageDigest;

 import net.i2p.I2PAppContext;
 import net.i2p.crypto.SHA1;
+import net.i2p.data.ByteArray;
+import net.i2p.util.ByteCache;
 import net.i2p.util.Log;
 import net.i2p.util.SecureFile;

@ -42,6 +44,9 @@ class PartialPiece implements Comparable {
    private final int pclen;
    private final File tempDir;

+    private static final int BUFSIZE = PeerState.PARTSIZE;
+    private static final ByteCache _cache = ByteCache.getInstance(16, BUFSIZE);
+
    // Any bigger than this, use temp file instead of heap
    private static final int MAX_IN_MEM = 128 * 1024;
    // May be reduced on OOM
@ -154,7 +159,16 @@ class PartialPiece implements Comparable {
            sha1.update(bs);
        } else {
            int read = 0;
-            byte[] buf = new byte[Math.min(pclen, 16384)];
+            int buflen = Math.min(pclen, BUFSIZE);
+            ByteArray ba;
+            byte[] buf;
+            if (buflen == BUFSIZE) {
+                ba = _cache.acquire();
+                buf = ba.getData();
+            } else {
+                ba = null;
+                buf = new byte[buflen];
+            }
            synchronized (this) {
                if (raf == null)
                    throw new IOException();
@ -167,6 +181,8 @@ class PartialPiece implements Comparable {
                    sha1.update(buf, 0, rd);
                }
            }
+            if (ba != null)
+                _cache.release(ba, false);
            if (read < pclen)
                throw new IOException();
        }
@ -182,7 +198,15 @@ class PartialPiece implements Comparable {
            din.readFully(bs, off, len);
        } else {
            // read in fully before synching on raf
-            byte[] tmp = new byte[len];
+            ByteArray ba;
+            byte[] tmp;
+            if (len == BUFSIZE) {
+                ba = _cache.acquire();
+                tmp = ba.getData();
+            } else {
+                ba = null;
+                tmp = new byte[len];
+            }
            din.readFully(tmp);
            synchronized (this) {
                if (raf == null)
@ -190,6 +214,8 @@ class PartialPiece implements Comparable {
                raf.seek(off);
                raf.write(tmp);
            }
+            if (ba != null)
+                _cache.release(ba, false);
        }
    }

@ -208,7 +234,16 @@ class PartialPiece implements Comparable {
            out.write(bs, offset, len);
        } else {
            int read = 0;
-            byte[] buf = new byte[Math.min(len, 16384)];
+            int buflen = Math.min(len, BUFSIZE);
+            ByteArray ba;
+            byte[] buf;
+            if (buflen == BUFSIZE) {
+                ba = _cache.acquire();
+                buf = ba.getData();
+            } else {
+                ba = null;
+                buf = new byte[buflen];
+            }
            synchronized (this) {
                if (raf == null)
                    throw new IOException();
@ -220,6 +255,8 @@ class PartialPiece implements Comparable {
                    out.write(buf, 0, rd);
                }
            }
+            if (ba != null)
+                _cache.release(ba, false);
        }
    }
    
--- a/apps/i2psnark/java/src/org/klomp/snark/PeerConnectionOut.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/PeerConnectionOut.java
@ -437,6 +437,7 @@ class PeerConnectionOut implements Runnable
   */
  void sendPiece(int piece, int begin, int length, DataLoader loader)
  {
+    /****
      boolean sendNow = false;
      // are there any cases where we should?

@ -447,6 +448,7 @@ class PeerConnectionOut implements Runnable
            sendPiece(piece, begin, length, bytes);
        return;
      }
+    ****/

      // queue a fake message... set everything up,
      // except save the PeerState instead of the bytes.
--- a/apps/i2psnark/java/src/org/klomp/snark/PeerCoordinator.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/PeerCoordinator.java
@ -35,6 +35,7 @@ import java.util.Set;
 import java.util.concurrent.LinkedBlockingQueue;

 import net.i2p.I2PAppContext;
+import net.i2p.data.ByteArray;
 import net.i2p.data.DataHelper;
 import net.i2p.data.Destination;
 import net.i2p.util.ConcurrentHashSet;
@ -214,7 +215,7 @@ class PeerCoordinator implements PeerListener

  public Storage getStorage() { return storage; }

-  // for web page detailed stats
+  /** for web page detailed stats */
  public List<Peer> peerList()
  {
        return new ArrayList(peers);
@ -376,7 +377,10 @@ class PeerCoordinator implements PeerListener
  public boolean needOutboundPeers() {
        //return wantedBytes != 0 && needPeers();
        // minus one to make it a little easier for new peers to get in on large swarms
-        return wantedBytes != 0 && !halted && peers.size() < getMaxConnections() - 1;
+        return wantedBytes != 0 &&
+               !halted &&
+               peers.size() < getMaxConnections() - 1 &&
+               (storage == null || !storage.isChecking());
  }
  
  /**
@ -445,6 +449,12 @@ class PeerCoordinator implements PeerListener
    synchronized (downloaded_old) {
        Arrays.fill(downloaded_old, 0);
    }
+    // failsafe
+    synchronized(wantedPieces) {
+        for (Piece pc : wantedPieces) {
+            pc.clear();
+        }
+    }
    timer.schedule((CHECK_PERIOD / 2) + _random.nextInt((int) CHECK_PERIOD));
  }

@ -508,8 +518,8 @@ class PeerCoordinator implements PeerListener
            peerCount = peers.size();
            unchokePeer();

-            if (listener != null)
-              listener.peerChange(this, peer);
+            //if (listener != null)
+            //  listener.peerChange(this, peer);
          }
      }
    if (toDisconnect != null) {
@ -645,13 +655,18 @@ class PeerCoordinator implements PeerListener
   */
  public boolean gotHave(Peer peer, int piece)
  {
-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);

-    synchronized(wantedPieces)
-      {
-        return wantedPieces.contains(new Piece(piece));
-      }
+    synchronized(wantedPieces) {
+        for (Piece pc : wantedPieces) {
+            if (pc.getId() == piece) {
+                pc.addPeer(peer);
+                return true;
+            }
+        }
+        return false;
+    }
  }

  /**
@ -660,23 +675,20 @@ class PeerCoordinator implements PeerListener
   */
  public boolean gotBitField(Peer peer, BitField bitfield)
  {
-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);

-    synchronized(wantedPieces)
-      {
-        Iterator<Piece> it = wantedPieces.iterator();
-        while (it.hasNext())
-          {
-            Piece p = it.next();
+    boolean rv = false;
+    synchronized(wantedPieces) {
+        for (Piece p : wantedPieces) {
            int i = p.getId();
            if (bitfield.get(i)) {
              p.addPeer(peer);
-              return true;
+              rv = true;
            }
-          }
-      }
-    return false;
+        }
+    }
+    return rv;
  }

  /**
@ -732,7 +744,19 @@ class PeerCoordinator implements PeerListener
                break;
            if (havePieces.get(p.getId()) && !p.isRequested())
              {
-                piece = p;
+                // never ever choose one that's in partialPieces, or we
+                // will create a second one and leak
+                boolean hasPartial = false;
+                for (PartialPiece pp : partialPieces) {
+                    if (pp.getPiece() == p.getId()) {
+                        if (_log.shouldLog(Log.INFO))
+                            _log.info("wantPiece() skipping partial for " + peer + ": piece = " + pp);
+                        hasPartial = true;
+                        break;
+                    }
+                }
+                if (!hasPartial)
+                    piece = p;
              }
            else if (p.isRequested()) 
            {
@ -747,8 +771,12 @@ class PeerCoordinator implements PeerListener
            // AND if there are almost no wanted pieces left (real end game).
            // If we do end game all the time, we generate lots of extra traffic
            // when the seeder is super-slow and all the peers are "caught up"
-            if (wantedSize > END_GAME_THRESHOLD)
+            if (wantedSize > END_GAME_THRESHOLD) {
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Nothing to request, " + requested.size() + " being requested and " +
+                              wantedSize + " still wanted");
                return null;  // nothing to request and not in end game
+            }
            // let's not all get on the same piece
            // Even better would be to sort by number of requests
            if (record)
@ -784,7 +812,8 @@ class PeerCoordinator implements PeerListener
        }
        if (record) {
            if (_log.shouldLog(Log.INFO))
-                _log.info(peer + " is now requesting: piece " + piece + " priority " + piece.getPriority());
+                _log.info("Now requesting from " + peer + ": piece " + piece + " priority " + piece.getPriority() +
+                          " peers " + piece.getPeerCount() + '/' + peers.size());
            piece.setRequested(peer, true);
        }
        return piece;
@ -874,7 +903,7 @@ class PeerCoordinator implements PeerListener
   *
   * @throws RuntimeException on IOE getting the data
   */
-  public byte[] gotRequest(Peer peer, int piece, int off, int len)
+  public ByteArray gotRequest(Peer peer, int piece, int off, int len)
  {
    if (halted)
      return null;
@ -905,8 +934,8 @@ class PeerCoordinator implements PeerListener
  {
    uploaded += size;

-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);
  }

  /**
@ -916,8 +945,8 @@ class PeerCoordinator implements PeerListener
  {
    downloaded += size;

-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);
  }

  /**
@ -929,13 +958,11 @@ class PeerCoordinator implements PeerListener
   */
  public boolean gotPiece(Peer peer, PartialPiece pp)
  {
-    if (metainfo == null || storage == null)
+    if (metainfo == null || storage == null || storage.isChecking() || halted) {
+        pp.release();
        return true;
-    int piece = pp.getPiece();
-    if (halted) {
-      _log.info("Got while-halted piece " + piece + "/" + metainfo.getPieces() +" from " + peer + " for " + metainfo.getName());
-      return true; // We don't actually care anymore.
    }
+    int piece = pp.getPiece();
    
    synchronized(wantedPieces)
      {
@ -948,12 +975,15 @@ class PeerCoordinator implements PeerListener
            // Assume we got a good piece, we don't really care anymore.
            // Well, this could be caused by a change in priorities, so
            // only return true if we already have it, otherwise might as well keep it.
-            if (storage.getBitField().get(piece))
+            if (storage.getBitField().get(piece)) {
+                pp.release();
                return true;
+            }
          }
        
        try
          {
+            // this takes forever if complete, as it rechecks
            if (storage.putPiece(pp))
              {
                if (_log.shouldLog(Log.INFO))
@ -1026,8 +1056,8 @@ class PeerCoordinator implements PeerListener
    if (_log.shouldLog(Log.INFO))
      _log.info("Got choke(" + choke + "): " + peer);

-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);
  }

  public void gotInterest(Peer peer, boolean interest)
@ -1046,8 +1076,8 @@ class PeerCoordinator implements PeerListener
              }
      }

-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);
  }

  public void disconnected(Peer peer)
@ -1067,18 +1097,18 @@ class PeerCoordinator implements PeerListener
        peerCount = peers.size();
      }

-    if (listener != null)
-      listener.peerChange(this, peer);
+    //if (listener != null)
+    //  listener.peerChange(this, peer);
  }
  
  /** Called when a peer is removed, to prevent it from being used in 
   * rarest-first calculations.
   */
-  public void removePeerFromPieces(Peer peer) {
+  private void removePeerFromPieces(Peer peer) {
      synchronized(wantedPieces) {
-          for(Iterator<Piece> iter = wantedPieces.iterator(); iter.hasNext(); ) {
-              Piece piece = iter.next();
+          for (Piece piece : wantedPieces) {
              piece.removePeer(peer);
+              piece.setRequested(peer, false);
          }
      } 
  }
@ -1159,6 +1189,8 @@ class PeerCoordinator implements PeerListener
  public PartialPiece getPartialPiece(Peer peer, BitField havePieces) {
      if (metainfo == null)
          return null;
+      if (storage != null && storage.isChecking())
+          return null;
      synchronized(wantedPieces) {
          // sorts by remaining bytes, least first
          Collections.sort(partialPieces);
@ -1171,11 +1203,24 @@ class PeerCoordinator implements PeerListener
                 for(Piece piece : wantedPieces) {
                     if (piece.getId() == savedPiece) {
                         if (peer.isCompleted() && piece.getPeerCount() > 1) {
-                             // Try to preserve rarest-first when we have only one seeder
-                             // by not preferring a partial piece that others have too
+                             // Try to preserve rarest-first
+                             // by not requesting a partial piece that non-seeders also have
                             // from a seeder
-                             skipped = true;
-                             break;
+                             boolean nonSeeds = false;
+                             for (Peer pr : peers) {
+                                 PeerState state = pr.state;
+                                 if (state == null) continue;
+                                 BitField bf = state.bitfield;
+                                 if (bf == null) continue;
+                                 if (bf.get(savedPiece) && !pr.isCompleted()) {
+                                     nonSeeds = true;
+                                     break;
+                                 }
+                             }
+                             if (nonSeeds) {
+                                 skipped = true;
+                                 break;
+                             }
                         }
                         iter.remove();
                         piece.setRequested(peer, true);
@ -1250,6 +1295,7 @@ class PeerCoordinator implements PeerListener
              PartialPiece pp = iter.next();
              if (pp.getPiece() == piece) {
                  iter.remove();
+                  pp.release();
                  // there should be only one but keep going to be sure
              }
          }
@ -1393,6 +1439,7 @@ class PeerCoordinator implements PeerListener

  /**
   *  Called by TrackerClient
+   *  @return the Set itself, modifiable, not a copy, caller should clear()
   *  @since 0.8.4
   */
  Set<PeerID> getPEXPeers() {
--- a/apps/i2psnark/java/src/org/klomp/snark/PeerListener.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/PeerListener.java
@ -22,6 +22,8 @@ package org.klomp.snark;

 import java.util.List;

+import net.i2p.data.ByteArray;
+
 /**
 * Listener for Peer events.
 */
@ -114,7 +116,7 @@ interface PeerListener
   * @return a byte array containing the piece or null when the piece
   * is not available (which is a protocol error).
   */
-  byte[] gotRequest(Peer peer, int piece, int off, int len);
+  ByteArray gotRequest(Peer peer, int piece, int off, int len);

  /**
   * Called when a (partial) piece has been downloaded from the peer.
--- a/apps/i2psnark/java/src/org/klomp/snark/PeerState.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/PeerState.java
@ -27,6 +27,7 @@ import java.util.List;
 import java.util.Set;

 import net.i2p.I2PAppContext;
+import net.i2p.data.ByteArray;
 import net.i2p.util.Log;

 class PeerState implements DataLoader
@ -245,8 +246,8 @@ class PeerState implements DataLoader
   *  @return bytes or null for errors
   *  @since 0.8.2
   */
-  public byte[] loadData(int piece, int begin, int length) {
-    byte[] pieceBytes = listener.gotRequest(peer, piece, begin, length);
+  public ByteArray loadData(int piece, int begin, int length) {
+    ByteArray pieceBytes = listener.gotRequest(peer, piece, begin, length);
    if (pieceBytes == null)
      {
        // XXX - Protocol error-> diconnect?
@ -256,7 +257,7 @@ class PeerState implements DataLoader
      }

    // More sanity checks
-    if (length != pieceBytes.length)
+    if (length != pieceBytes.getData().length)
      {
        // XXX - Protocol error-> disconnect?
        if (_log.shouldLog(Log.WARN))
@ -355,22 +356,21 @@ class PeerState implements DataLoader
                  + piece + "," + begin + "," + length + ") from "
                  + peer);

-    int r = getFirstOutstandingRequest(piece);
-
-    // Unrequested piece number?
-    if (r == -1)
-      {
-        if (_log.shouldLog(Log.INFO))
-          _log.info("Unrequested 'piece: " + piece + ", "
-                      + begin + ", " + length + "' received from "
-                      + peer);
-        return null;
-      }
-
    // Lookup the correct piece chunk request from the list.
    Request req;
    synchronized(this)
      {
+        int r = getFirstOutstandingRequest(piece);
+
+        // Unrequested piece number?
+        if (r == -1) {
+            if (_log.shouldLog(Log.INFO))
+                _log.info("Unrequested 'piece: " + piece + ", "
+                      + begin + ", " + length + "' received from "
+                      + peer);
+            return null;
+        }
+
        req = outstandingRequests.get(r);
        while (req.getPiece() == piece && req.off != begin
               && r < outstandingRequests.size() - 1)
@ -591,6 +591,7 @@ class PeerState implements DataLoader
                // Send cancel even when we are choked to make sure that it is
                // really never ever send.
                out.sendCancel(req);
+                req.getPartialPiece().release();
              }
          }
  }
@ -681,6 +682,7 @@ class PeerState implements DataLoader
                  _log.debug(peer + " addRequest() we are choked, delaying requestNextPiece()");
              return;
          }
+          // huh? rv unused
          more_pieces = requestNextPiece();
        } else if (more_pieces) // We want something
          {
@ -710,6 +712,8 @@ class PeerState implements DataLoader
      }

    // failsafe
+    // However this is bad as it thrashes the peer when we change our mind
+    // Ticket 691 cause here?
    if (interesting && lastRequest == null && outstandingRequests.isEmpty())
        setInteresting(false);

@ -737,6 +741,10 @@ class PeerState implements DataLoader
                  out.sendRequest(r);
                lastRequest = r;
                return true;
+            } else {
+                if (_log.shouldLog(Log.WARN))
+                    _log.warn("Got dup from coord: " + pp);
+                pp.release();
            }
        }

@ -783,6 +791,8 @@ class PeerState implements DataLoader
    }

    // failsafe
+    // However this is bad as it thrashes the peer when we change our mind
+    // Ticket 691 cause here?
    if (outstandingRequests.isEmpty())
        lastRequest = null;

--- a/apps/i2psnark/java/src/org/klomp/snark/Piece.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/Piece.java
@ -12,13 +12,13 @@ class Piece implements Comparable {
    private final int id;
    private final Set<PeerID> peers;
    /** @since 0.8.3 */
-    private Set<PeerID> requests;
+    private volatile Set<PeerID> requests;
    /** @since 0.8.1 */
    private int priority;
    
    public Piece(int id) {
        this.id = id;
-        this.peers = new HashSet(I2PSnarkUtil.MAX_CONNECTIONS);
+        this.peers = new HashSet(I2PSnarkUtil.MAX_CONNECTIONS / 2);
        // defer creating requests to save memory
    }
    
@ -54,7 +54,10 @@ class Piece implements Comparable {
    /** caller must synchronize */
    public boolean addPeer(Peer peer) { return this.peers.add(peer.getPeerID()); }

-    /** caller must synchronize */
+    /**
+     * Caller must synchronize.
+     * @return true if removed
+     */
    public boolean removePeer(Peer peer) { return this.peers.remove(peer.getPeerID()); }

    /**
@ -104,6 +107,17 @@ class Piece implements Comparable {
    public int getRequestCount() {
        return this.requests == null ? 0 : this.requests.size();
    } 
+
+    /**
+     * Clear all knowledge of peers
+     * Caller must synchronize
+     * @since 0.9.3
+     */
+    public void clear() {
+        peers.clear();
+        if (requests != null)
+            requests.clear();
+    } 
    
    /** @return default 0 @since 0.8.1 */
    public int getPriority() { return this.priority; }
--- a/apps/i2psnark/java/src/org/klomp/snark/Snark.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/Snark.java
@ -688,6 +688,22 @@ public class Snark
        starting = true;
    }

+    /**
+     *  File checking in progress.
+     *  @since 0.9.3
+     */
+    public boolean isChecking() {
+        return storage != null && storage.isChecking();
+    }
+
+    /**
+     *  Disk allocation (ballooning) in progress.
+     *  @since 0.9.3
+     */
+    public boolean isAllocating() {
+        return storage != null && storage.isAllocating();
+    }
+
    /**
     *  @since 0.8.4
     */
@ -1099,7 +1115,12 @@ public class Snark
      }
  }

+
+  ///////////// Begin StorageListener methods
+
  //private boolean allocating = false;
+
+  /** does nothing */
  public void storageCreateFile(Storage storage, String name, long length)
  {
    //if (allocating)
@ -1113,6 +1134,7 @@ public class Snark
  // How much storage space has been allocated
  private long allocated = 0;

+  /** does nothing */
  public void storageAllocated(Storage storage, long length)
  {
    //allocating = true;
@ -1124,7 +1146,8 @@ public class Snark

  private boolean allChecked = false;
  private boolean checking = false;
-  private boolean prechecking = true;
+  //private boolean prechecking = true;
+
  public void storageChecked(Storage storage, int num, boolean checked)
  {
    //allocating = false;
@ -1142,6 +1165,8 @@ public class Snark
    if (!checking) {
        if (_log.shouldLog(Log.INFO))
            _log.info("Got " + (checked ? "" : "BAD ") + "piece: " + num);
+        if (completeListener != null)
+            completeListener.gotPiece(this);
    }
  }

@ -1171,6 +1196,9 @@ public class Snark
    coordinator.setWantedPieces();
  }

+  ///////////// End StorageListener methods
+
+
  /** SnarkSnutdown callback unused */
  public void shutdown()
  {
@ -1188,34 +1216,6 @@ public class Snark
          completeListener.addMessage(this, message);
  }

-  public interface CompleteListener {
-    public void torrentComplete(Snark snark);
-    public void updateStatus(Snark snark);
-
-    /**
-     * We transitioned from magnet mode, we have now initialized our
-     * metainfo and storage. The listener should now call getMetaInfo()
-     * and save the data to disk.
-     *
-     * @return the new name for the torrent or null on error
-     * @since 0.8.4
-     */
-    public String gotMetaInfo(Snark snark);
-
-    /**
-     * @since 0.9
-     */
-    public void fatal(Snark snark, String error);
-
-    /**
-     * @since 0.9.2
-     */
-    public void addMessage(Snark snark, String message);
-
-    // not really listeners but the easiest way to get back to an optional SnarkManager
-    public long getSavedTorrentTime(Snark snark);
-    public BitField getSavedTorrentBitField(Snark snark);
-  }

  /** Maintain a configurable total uploader cap
   * coordinatorListener
--- a/apps/i2psnark/java/src/org/klomp/snark/SnarkManager.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/SnarkManager.java
@ -27,6 +27,7 @@ import java.util.concurrent.LinkedBlockingQueue;
 import net.i2p.I2PAppContext;
 import net.i2p.data.Base64;
 import net.i2p.data.DataHelper;
+import net.i2p.update.*;
 import net.i2p.util.ConcurrentHashSet;
 import net.i2p.util.FileUtil;
 import net.i2p.util.I2PAppThread;
@ -42,7 +43,7 @@ import org.klomp.snark.dht.DHT;
 /**
 * Manage multiple snarks
 */
-public class SnarkManager implements Snark.CompleteListener {
+public class SnarkManager implements CompleteListener {
    
    /**
     *  Map of (canonical) filename of the .torrent file to Snark instance.
@ -65,6 +66,8 @@ public class SnarkManager implements Snark.CompleteListener {
    private volatile boolean _running;
    private volatile boolean _stopping;
    private final Map<String, Tracker> _trackerMap;
+    private UpdateManager _umgr;
+    private UpdateHandler _uhandler;
    
    public static final String PROP_I2CP_HOST = "i2psnark.i2cpHost";
    public static final String PROP_I2CP_PORT = "i2psnark.i2cpPort";
@ -117,7 +120,7 @@ public class SnarkManager implements Snark.CompleteListener {
 //       , "Galen", "http://5jpwQMI5FT303YwKa5Rd38PYSX04pbIKgTaKQsWbqoWjIfoancFdWCShXHLI5G5ofOb0Xu11vl2VEMyPsg1jUFYSVnu4-VfMe3y4TKTR6DTpetWrnmEK6m2UXh91J5DZJAKlgmO7UdsFlBkQfR2rY853-DfbJtQIFl91tbsmjcA5CGQi4VxMFyIkBzv-pCsuLQiZqOwWasTlnzey8GcDAPG1LDcvfflGV~6F5no9mnuisZPteZKlrv~~TDoXTj74QjByWc4EOYlwqK8sbU9aOvz~s31XzErbPTfwiawiaZ0RUI-IDrKgyvmj0neuFTWgjRGVTH8bz7cBZIc3viy6ioD-eMQOrXaQL0TCWZUelRwHRvgdPiQrxdYQs7ixkajeHzxi-Pq0EMm5Vbh3j3Q9kfUFW3JjFDA-MLB4g6XnjCbM5J1rC0oOBDCIEfhQkszru5cyLjHiZ5yeA0VThgu~c7xKHybv~OMXION7V8pBKOgET7ZgAkw1xgYe3Kkyq5syAAAA.i2p/tr/announce.php=http://galen.i2p/tr/"
       "Postman", "http://tracker2.postman.i2p/announce.php=http://tracker2.postman.i2p/"
       ,"Welterde", "http://tracker.welterde.i2p/a=http://tracker.welterde.i2p/stats?mode=top5"
-       ,"Diftracker", "http://n--XWjHjUPjnMNrSwXA2OYXpMIUL~u4FNXnrt2HtjK3y6j~4SOClyyeKzd0zRPlixxkCe2wfBIYye3bZsaqAD8bd0QMmowxbq91WpjsPfKMiphJbePKXtYAVARiy0cqyvh1d2LyDE-6wkvgaw45hknmS0U-Dg3YTJZbAQRU2SKXgIlAbWCv4R0kDFBLEVpReDiJef3rzAWHiW8yjmJuJilkYjMwlfRjw8xx1nl2s~yhlljk1pl13jGYb0nfawQnuOWeP-ASQWvAAyVgKvZRJE2O43S7iveu9piuv7plXWbt36ef7ndu2GNoNyPOBdpo9KUZ-NOXm4Kgh659YtEibL15dEPAOdxprY0sYUurVw8OIWqrpX7yn08nbi6qHVGqQwTpxH35vkL8qrCbm-ym7oQJQnNmSDrNTyWYRFSq5s5~7DAdFDzqRPW-pX~g0zEivWj5tzkhvG9rVFgFo0bpQX3X0PUAV9Xbyf8u~v8Zbr9K1pCPqBq9XEr4TqaLHw~bfAAAA.i2p/announce.php=http://diftracker.i2p/"
+       ,"Diftracker", "http://diftracker.i2p/announce.php=http://diftracker.i2p/"
 //       , "CRSTRACK", "http://b4G9sCdtfvccMAXh~SaZrPqVQNyGQbhbYMbw6supq2XGzbjU4NcOmjFI0vxQ8w1L05twmkOvg5QERcX6Mi8NQrWnR0stLExu2LucUXg1aYjnggxIR8TIOGygZVIMV3STKH4UQXD--wz0BUrqaLxPhrm2Eh9Hwc8TdB6Na4ShQUq5Xm8D4elzNUVdpM~RtChEyJWuQvoGAHY3ppX-EJJLkiSr1t77neS4Lc-KofMVmgI9a2tSSpNAagBiNI6Ak9L1T0F9uxeDfEG9bBSQPNMOSUbAoEcNxtt7xOW~cNOAyMyGydwPMnrQ5kIYPY8Pd3XudEko970vE0D6gO19yoBMJpKx6Dh50DGgybLQ9CpRaynh2zPULTHxm8rneOGRcQo8D3mE7FQ92m54~SvfjXjD2TwAVGI~ae~n9HDxt8uxOecAAvjjJ3TD4XM63Q9TmB38RmGNzNLDBQMEmJFpqQU8YeuhnS54IVdUoVQFqui5SfDeLXlSkh4vYoMU66pvBfWbAAAA.i2p/tracker/announce.php=http://crstrack.i2p/tracker/"
 //       ,"Exotrack", "http://blbgywsjubw3d2zih2giokakhe3o2cko7jtte4risb3hohbcoyva.b32.i2p/announce.php=http://exotrack.i2p/"
    };
@ -149,10 +152,28 @@ public class SnarkManager implements Snark.CompleteListener {
        _connectionAcceptor = new ConnectionAcceptor(_util);
        _monitor = new I2PAppThread(new DirMonitor(), "Snark DirMonitor", true);
        _monitor.start();
+        // delay until UpdateManager is there
+        _context.simpleScheduler().addEvent(new Register(), 4*60*1000);
        // Not required, Jetty has a shutdown hook
        //_context.addShutdownTask(new SnarkManagerShutdown());
    }

+    /** @since 0.9.4 */
+    private class Register implements SimpleTimer.TimedEvent {
+        public void timeReached() {
+            if (!_running)
+                return;
+            _umgr = _context.updateManager();
+            if (_umgr != null) {
+                _uhandler = new UpdateHandler(_context, _umgr, SnarkManager.this);
+                _umgr.register(_uhandler, UpdateType.ROUTER_SIGNED, UpdateMethod.TORRENT, 10);
+                _log.warn("Registering with update manager");
+            } else {
+                _log.warn("No update manager to register with");
+            }
+        }
+    }
+    
    /*
     *  Called by the webapp at Jetty shutdown.
     *  Stops all torrents. Does not close the tunnel, so the announces have a chance.
@ -160,6 +181,10 @@ public class SnarkManager implements Snark.CompleteListener {
     *  Runs inline.
     */
    public void stop() {
+        if (_umgr != null && _uhandler != null) {
+            //_uhandler.shutdown();
+            _umgr.unregister(_uhandler, UpdateType.ROUTER_SIGNED, UpdateMethod.TORRENT);
+        }
        _running = false;
        _monitor.interrupt();
        _connectionAcceptor.halt();
@ -200,11 +225,11 @@ public class SnarkManager implements Snark.CompleteListener {
     *  @since 0.8.9
     */
    public boolean areFilesPublic() {
-        return Boolean.valueOf(_config.getProperty(PROP_FILES_PUBLIC)).booleanValue();
+        return Boolean.parseBoolean(_config.getProperty(PROP_FILES_PUBLIC));
    }

    public boolean shouldAutoStart() {
-        return Boolean.valueOf(_config.getProperty(PROP_AUTO_START, DEFAULT_AUTO_START)).booleanValue();
+        return Boolean.parseBoolean(_config.getProperty(PROP_AUTO_START, DEFAULT_AUTO_START));
    }

 /****
@ -384,11 +409,11 @@ public class SnarkManager implements Snark.CompleteListener {
        if (ot != null)
            _util.setOpenTrackers(getOpenTrackers());
        String useOT = _config.getProperty(PROP_USE_OPENTRACKERS);
-        boolean bOT = useOT == null || Boolean.valueOf(useOT).booleanValue();
+        boolean bOT = useOT == null || Boolean.parseBoolean(useOT);
        _util.setUseOpenTrackers(bOT);
        // careful, so we can switch default to true later
-        _util.setUseDHT(Boolean.valueOf(_config.getProperty(PROP_USE_DHT,
-                                          Boolean.toString(I2PSnarkUtil.DEFAULT_USE_DHT))).booleanValue());
+        _util.setUseDHT(Boolean.parseBoolean(_config.getProperty(PROP_USE_DHT,
+                                          Boolean.toString(I2PSnarkUtil.DEFAULT_USE_DHT))));
        getDataDir().mkdirs();
        initTrackerMap();
    }
@ -707,7 +732,7 @@ public class SnarkManager implements Snark.CompleteListener {
    public Properties getConfig() { return _config; }
    
    /** hardcoded for sanity.  perhaps this should be customizable, for people who increase their ulimit, etc. */
-    private static final int MAX_FILES_PER_TORRENT = 512;
+    public static final int MAX_FILES_PER_TORRENT = 512;
    
    /**
     *  Set of canonical .torrent filenames that we are dealing with.
@ -723,6 +748,14 @@ public class SnarkManager implements Snark.CompleteListener {
     */
    public Snark getTorrent(String filename) { synchronized (_snarks) { return _snarks.get(filename); } }

+    /**
+     *  Unmodifiable
+     *  @since 0.9.4
+     */
+    public Collection<Snark> getTorrents() {
+        return Collections.unmodifiableCollection(_snarks.values());
+    }
+
    /**
     * Grab the torrent given the base name of the storage
     * @return Snark or null
@ -853,7 +886,9 @@ public class SnarkManager implements Snark.CompleteListener {
                        }
                    }
                } catch (IOException ioe) {
-                    addMessage(_("Torrent in \"{0}\" is invalid", sfile.getName()) + ": " + ioe.getMessage());
+                    String err = _("Torrent in \"{0}\" is invalid", sfile.getName()) + ": " + ioe.getMessage();
+                    addMessage(err);
+                    _log.error(err, ioe);
                    if (sfile.exists())
                        sfile.delete();
                    return;
@ -889,7 +924,27 @@ public class SnarkManager implements Snark.CompleteListener {
     * @since 0.8.4
     */
    public void addMagnet(String name, byte[] ih, String trackerURL, boolean updateStatus) {
-        Snark torrent = new Snark(_util, name, ih, trackerURL, this,
+        addMagnet(name, ih, trackerURL, updateStatus, shouldAutoStart(), this);
+    }
+    
+    /**
+     * Add a torrent with the info hash alone (magnet / maggot)
+     * External use is for UpdateRunner.
+     *
+     * @param name hex or b32 name from the magnet link
+     * @param ih 20 byte info hash
+     * @param trackerURL may be null
+     * @param updateStatus should we add this magnet to the config file,
+     *                     to save it across restarts, in case we don't get
+     *                     the metadata before shutdown?
+     * @param listener to intercept callbacks, should pass through to this
+     * @return the new Snark or null on failure
+     * @throws RuntimeException via Snark.fatal()
+     * @since 0.9.4
+     */
+    public Snark addMagnet(String name, byte[] ih, String trackerURL, boolean updateStatus,
+                          boolean autoStart, CompleteListener listener) {
+        Snark torrent = new Snark(_util, name, ih, trackerURL, listener,
                                  _peerCoordinatorSet, _connectionAcceptor,
                                  false, getDataDir().getPath());

@ -897,7 +952,7 @@ public class SnarkManager implements Snark.CompleteListener {
            Snark snark = getTorrentByInfoHash(ih);
            if (snark != null) {
                addMessage(_("Torrent with this info hash is already running: {0}", snark.getBaseName()));
-                return;
+                return null;
            }
            // Tell the dir monitor not to delete us
            _magnets.add(name);
@ -905,8 +960,8 @@ public class SnarkManager implements Snark.CompleteListener {
                saveMagnetStatus(ih);
            _snarks.put(name, torrent);
        }
-        if (shouldAutoStart()) {
-            torrent.startTorrent();
+        if (autoStart) {
+            startTorrent(ih);
            addMessage(_("Fetching {0}", name));
            DHT dht = _util.getDHT();
            boolean shouldWarn = _util.connected() &&
@ -918,7 +973,8 @@ public class SnarkManager implements Snark.CompleteListener {
            }
        } else {
            addMessage(_("Adding {0}", name));
-      }
+        }
+        return torrent;
    }

    /**
@ -1370,6 +1426,8 @@ public class SnarkManager implements Snark.CompleteListener {
                    } catch (Exception e) {
                        _log.error("Error in the DirectoryMonitor", e);
                    }
+                    if (!_snarks.isEmpty())
+                        addMessage(_("Up bandwidth limit is {0} KBps", _util.getMaxUpBW()));
                }
                try { Thread.sleep(60*1000); } catch (InterruptedException ie) {}
            }
@ -1469,6 +1527,12 @@ public class SnarkManager implements Snark.CompleteListener {
        addMessage(message);
    }

+    /**
+     * A Snark.CompleteListener method.
+     * @since 0.9.4
+     */
+    public void gotPiece(Snark snark) {}
+
    // End Snark.CompleteListeners

    /**
--- a/apps/i2psnark/java/src/org/klomp/snark/Storage.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/Storage.java
@ -21,6 +21,7 @@
 package org.klomp.snark;

 import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.RandomAccessFile;
 import java.nio.charset.Charset;
@ -32,17 +33,23 @@ import java.util.List;
 import java.util.Map;
 import java.util.StringTokenizer;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicInteger;

+import net.i2p.I2PAppContext;
 import net.i2p.crypto.SHA1;
+import net.i2p.data.ByteArray;
+import net.i2p.data.DataHelper;
+import net.i2p.util.ByteCache;
 import net.i2p.util.Log;
 import net.i2p.util.SecureFile;
+import net.i2p.util.SystemVersion;

 /**
 * Maintains pieces on disk. Can be used to store and retrieve pieces.
 */
 public class Storage
 {
-  private MetaInfo metainfo;
+  private final MetaInfo metainfo;
  private long[] lengths;
  private RandomAccessFile[] rafs;
  private String[] names;
@ -66,6 +73,8 @@ public class Storage
  private final int pieces;
  private final long total_length;
  private boolean changed;
+  private volatile boolean _isChecking;
+  private final AtomicInteger _allocateCount = new AtomicInteger();

  /** The default piece size. */
  private static final int MIN_PIECE_SIZE = 256*1024;
@ -77,23 +86,24 @@ public class Storage

  private static final Map<String, String> _filterNameCache = new ConcurrentHashMap();

-  private static final boolean _isWindows = System.getProperty("os.name").startsWith("Win");
+  private static final boolean _isWindows = SystemVersion.isWindows();
+
+  private static final int BUFSIZE = PeerState.PARTSIZE;
+  private static final ByteCache _cache = ByteCache.getInstance(16, BUFSIZE);

  /**
   * Creates a new storage based on the supplied MetaInfo.  This will
   * try to create and/or check all needed files in the MetaInfo.
   *
-   * @exception IOException when creating and/or checking files fails.
+   * Does not check storage. Caller MUST call check()
   */
  public Storage(I2PSnarkUtil util, MetaInfo metainfo, StorageListener listener)
-    throws IOException
  {
    _util = util;
    _log = util.getContext().logManager().getLog(Storage.class);
    this.metainfo = metainfo;
    this.listener = listener;
    needed = metainfo.getPieces();
-    _probablyComplete = false;
    bitfield = new BitField(needed);
    piece_size = metainfo.getPieceLength(0);
    pieces = needed;
@ -101,14 +111,18 @@ public class Storage
  }

  /**
-   * Creates a storage from the existing file or directory together
-   * with an appropriate MetaInfo file as can be announced on the
-   * given announce String location.
+   * Creates a storage from the existing file or directory.
+   * Creates an in-memory metainfo but does not save it to
+   * a file, caller must do that.
+   *
+   * Creates the metainfo, this may take a LONG time. BLOCKING.
   *
   * @param announce may be null
   * @param listener may be null
+   * @throws IOException when creating and/or checking files fails.
   */
  public Storage(I2PSnarkUtil util, File baseFile, String announce,
+                 List<List<String>> announce_list,
                 boolean privateTorrent, StorageListener listener)
    throws IOException
  {
@ -129,6 +143,8 @@ public class Storage

    if (total <= 0)
        throw new IOException("Torrent contains no data");
+    if (total > MAX_TOTAL_SIZE)
+        throw new IOException("Torrent too big (" + total + " bytes), max is " + MAX_TOTAL_SIZE);

    int pc_size = MIN_PIECE_SIZE;
    int pcs = (int) ((total - 1)/pc_size) + 1;
@ -164,9 +180,11 @@ public class Storage
        lengthsList = null;
      }

+    // TODO thread this so we can return and show something on the UI
    byte[] piece_hashes = fast_digestCreate();
    metainfo = new MetaInfo(announce, baseFile.getName(), null, files,
-                            lengthsList, piece_size, piece_hashes, total, privateTorrent);
+                            lengthsList, piece_size, piece_hashes, total, privateTorrent,
+                            announce_list);

  }

@ -199,6 +217,8 @@ public class Storage

  private void getFiles(File base) throws IOException
  {
+    if (base.getAbsolutePath().equals("/"))
+        throw new IOException("Don't seed root");
    ArrayList files = new ArrayList();
    addFiles(files, base);

@ -227,12 +247,15 @@ public class Storage
      }
  }

-  private void addFiles(List l, File f)
-  {
-    if (!f.isDirectory())
-      l.add(f);
-    else
-      {
+  /**
+   *  @throws IOException if too many total files
+   */
+  private void addFiles(List l, File f) throws IOException {
+    if (!f.isDirectory()) {
+        if (l.size() >= SnarkManager.MAX_FILES_PER_TORRENT)
+            throw new IOException("Too many files, limit is " + SnarkManager.MAX_FILES_PER_TORRENT + ", zip them?");
+        l.add(f);
+    } else {
        File[] files = f.listFiles();
        if (files == null)
          {
@ -278,6 +301,23 @@ public class Storage
      return changed;
  }

+  /**
+   *  File checking in progress.
+   *  @since 0.9.3
+   */
+  public boolean isChecking() {
+      return _isChecking;
+  }
+
+  /**
+   *  Disk allocation (ballooning) in progress.
+   *  Always false on Windows.
+   *  @since 0.9.3
+   */
+  public boolean isAllocating() {
+      return _allocateCount.get() > 0;
+  }
+
  /**
   *  @param file canonical path (non-directory)
   *  @return number of bytes remaining; -1 if unknown file
@ -697,11 +737,25 @@ public class Storage
   * This is called at the beginning, and at presumed completion,
   * so we have to be careful about locking.
   *
+   * TODO thread the checking so we can return and display
+   * something on the UI
+   *
   * @param recheck if true, this is a check after we downloaded the
   *        last piece, and we don't modify the global bitfield unless
   *        the check fails.
   */
-  private void checkCreateFiles(boolean recheck) throws IOException
+  private void checkCreateFiles(boolean recheck) throws IOException {
+      synchronized(this) {
+          _isChecking = true;
+          try {
+              locked_checkCreateFiles(recheck);
+          } finally {
+              _isChecking = false;
+          }
+      }
+  }
+
+  private void locked_checkCreateFiles(boolean recheck) throws IOException
  {
    // Whether we are resuming or not,
    // if any of the files already exists we assume we are resuming.
@ -861,10 +915,19 @@ public class Storage
    final int ZEROBLOCKSIZE = (int) Math.min(remaining, 32*1024);
    byte[] zeros = new byte[ZEROBLOCKSIZE];
    rafs[nr].seek(0);
-    while (remaining > 0) {
-        int size = (int) Math.min(remaining, ZEROBLOCKSIZE);
-        rafs[nr].write(zeros, 0, size);
-        remaining -= size;
+    // don't bother setting flag for small files
+    if (remaining > 20*1024*1024)
+        _allocateCount.incrementAndGet();
+    try {
+        while (remaining > 0) {
+            int size = (int) Math.min(remaining, ZEROBLOCKSIZE);
+            rafs[nr].write(zeros, 0, size);
+            remaining -= size;
+        }
+    } finally {
+        remaining = lengths[nr];
+        if (remaining > 20*1024*1024)
+            _allocateCount.decrementAndGet();
    }
    isSparse[nr] = false;
  }
@ -898,26 +961,34 @@ public class Storage
   * Returns a byte array containing a portion of the requested piece or null if
   * the storage doesn't contain the piece yet.
   */
-  public byte[] getPiece(int piece, int off, int len) throws IOException
+  public ByteArray getPiece(int piece, int off, int len) throws IOException
  {
    if (!bitfield.get(piece))
      return null;

    //Catch a common place for OOMs esp. on 1MB pieces
+    ByteArray rv;
    byte[] bs;
    try {
-      bs = new byte[len];
+        // Will be restored to cache in Message.sendMessage()
+        if (len == BUFSIZE)
+            rv = _cache.acquire();
+        else
+            rv = new ByteArray(new byte[len]);
    } catch (OutOfMemoryError oom) {
      if (_log.shouldLog(Log.WARN))
          _log.warn("Out of memory, can't honor request for piece " + piece, oom);
      return null;
    }
+    bs = rv.getData();
    getUncheckedPiece(piece, bs, off, len);
-    return bs;
+    return rv;
  }

  /**
   * Put the piece in the Storage if it is correct.
+   * Warning - takes a LONG time if complete as it does the recheck here.
+   * TODO thread the recheck?
   *
   * @return true if the piece was correct (sha metainfo hash
   * matches), otherwise false.
@ -935,9 +1006,9 @@ public class Storage
          // TODO alternative - check hash on the fly as we write to the file,
          // to save another I/O pass
          boolean correctHash = metainfo.checkPiece(pp);
-          if (listener != null)
-            listener.storageChecked(this, piece, correctHash);
          if (!correctHash) {
+              if (listener != null)
+                  listener.storageChecked(this, piece, false);
              return false;
          }

@ -999,6 +1070,9 @@ public class Storage
            complete = needed == 0;
          }
      }
+    // tell listener after counts are updated
+    if (listener != null)
+        listener.storageChecked(this, piece, true);

    if (complete) {
      // do we also need to close all of the files and reopen
@ -1136,4 +1210,43 @@ public class Storage
    rafs[i] = null;
  }

+  /**
+   *  Create a metainfo.
+   *  Used in the installer build process; do not comment out.
+   *  @since 0.9.4
+   */
+  public static void main(String[] args) {
+      if (args.length < 1 || args.length > 2) {
+          System.err.println("Usage: Storage file-or-dir [announceURL]");
+          System.exit(1);
+      }
+      File base = new File(args[0]);
+      String announce = args.length == 2 ? args[1] : null;
+      I2PAppContext ctx = I2PAppContext.getGlobalContext();
+      I2PSnarkUtil util = new I2PSnarkUtil(ctx);
+      File file = null;
+      FileOutputStream out = null;
+      try {
+          Storage storage = new Storage(util, base, announce, null, false, null);
+          MetaInfo meta = storage.getMetaInfo();
+          file = new File(storage.getBaseName() + ".torrent");
+          out = new FileOutputStream(file);
+          out.write(meta.getTorrentData());
+          String hex = DataHelper.toString(meta.getInfoHash());
+          System.out.println("Created:     " + file);
+          System.out.println("InfoHash:    " + hex);
+          String basename = base.getName().replace(" ", "%20");
+          String magnet = MagnetURI.MAGNET_FULL + hex + "&dn=" + basename;
+          if (announce != null)
+              magnet += "&tr=" + announce;
+          System.out.println("Magnet:      " + magnet);
+      } catch (IOException ioe) {
+          if (file != null)
+              file.delete();
+          ioe.printStackTrace();
+          System.exit(1);
+      } finally {
+          try { if (out != null) out.close(); } catch (IOException ioe) {}
+      }
+  }
 }
--- a/apps/i2psnark/java/src/org/klomp/snark/TrackerClient.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/TrackerClient.java
@ -20,6 +20,7 @@

 package org.klomp.snark;

+import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@ -30,6 +31,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
@ -39,10 +41,12 @@ import java.util.Set;
 import net.i2p.I2PAppContext;
 import net.i2p.data.DataHelper;
 import net.i2p.data.Hash;
+import net.i2p.util.ConvertToHash;
 import net.i2p.util.I2PAppThread;
 import net.i2p.util.Log;
 import net.i2p.util.SimpleTimer2;

+import org.klomp.snark.bencode.InvalidBEncodingException;
 import org.klomp.snark.dht.DHT;

 /**
@ -70,6 +74,8 @@ public class TrackerClient implements Runnable {
  private static final String COMPLETED_EVENT = "completed";
  private static final String STOPPED_EVENT = "stopped";
  private static final String NOT_REGISTERED  = "torrent not registered"; //bytemonsoon
+  /** this is our equivalent to router.utorrent.com for bootstrap */
+  private static final String DEFAULT_BACKUP_TRACKER = "http://tracker.welterde.i2p/a";

  private final static int SLEEP = 5; // 5 minutes.
  private final static int DELAY_MIN = 2000; // 2 secs.
@ -78,7 +84,7 @@ public class TrackerClient implements Runnable {
  private final static int INITIAL_SLEEP = 90*1000;
  private final static int MAX_CONSEC_FAILS = 5;    // slow down after this
  private final static int LONG_SLEEP = 30*60*1000; // sleep a while after lots of fails
-  private final static long MIN_TRACKER_ANNOUNCE_INTERVAL = 10*60*1000;
+  private final static long MIN_TRACKER_ANNOUNCE_INTERVAL = 15*60*1000;
  private final static long MIN_DHT_ANNOUNCE_INTERVAL = 10*60*1000;

  private final I2PSnarkUtil _util;
@ -105,7 +111,8 @@ public class TrackerClient implements Runnable {
  private boolean completed;
  private volatile boolean _fastUnannounce;
  private long lastDHTAnnounce;
-  private final List<Tracker> trackers;
+  private final List<TCTracker> trackers;
+  private final List<TCTracker> backupTrackers;

  /**
   * Call start() to start it.
@ -131,6 +138,7 @@ public class TrackerClient implements Runnable {
    this.infoHash = urlencode(snark.getInfoHash());
    this.peerID = urlencode(snark.getID());
    this.trackers = new ArrayList(2);
+    this.backupTrackers = new ArrayList(2);
  }

  public synchronized void start() {
@ -233,7 +241,7 @@ public class TrackerClient implements Runnable {
          if (!_initialized) {
              _initialized = true;
              // FIXME only when starting everybody at once, not for a single torrent
-              long delay = I2PAppContext.getGlobalContext().random().nextInt(30*1000);
+              long delay = _util.getContext().random().nextInt(30*1000);
              try {
                  Thread.sleep(delay);
              } catch (InterruptedException ie) {}
@ -264,49 +272,90 @@ public class TrackerClient implements Runnable {
        primary = meta.getAnnounce();
    else if (additionalTrackerURL != null)
        primary = additionalTrackerURL;
+    Set<Hash> trackerHashes = new HashSet(8);
+
+    // primary tracker
    if (primary != null) {
-        if (isValidAnnounce(primary)) {
-            trackers.add(new Tracker(primary, true));
-            _log.debug("Announce: [" + primary + "] infoHash: " + infoHash);
+        if (isNewValidTracker(trackerHashes, primary)) {
+            trackers.add(new TCTracker(primary, true));
+            if (_log.shouldLog(Log.DEBUG))
+                _log.debug("Announce: [" + primary + "] infoHash: " + infoHash);
        } else {
-            _log.warn("Skipping invalid or non-i2p announce: " + primary);
+            if (_log.shouldLog(Log.WARN))
+                _log.warn("Skipping invalid or non-i2p announce: " + primary);
        }
    } else {
        _log.warn("No primary announce");
-        primary = "";
    }
-    List tlist = _util.getOpenTrackers();
-    if (tlist != null && (meta == null || !meta.isPrivate())) {
+
+    // announce list
+    if (meta != null && !meta.isPrivate()) {
+        List<List<String>> list = meta.getAnnounceList();
+        if (list != null) {
+            for (List<String> llist : list) {
+                for (String url : llist) {
+                    if (!isNewValidTracker(trackerHashes, url))
+                        continue;
+                    trackers.add(new TCTracker(url, trackers.isEmpty()));
+                    if (_log.shouldLog(Log.DEBUG))
+                        _log.debug("Additional announce (list): [" + url + "] for infoHash: " + infoHash);
+                }
+            }
+        }
+    }
+
+    // configured open trackers
+    if (meta == null || !meta.isPrivate()) {
+        List<String> tlist = _util.getOpenTrackers();
        for (int i = 0; i < tlist.size(); i++) {
-             String url = (String)tlist.get(i);
-             if (!isValidAnnounce(url)) {
-                _log.error("Bad announce URL: [" + url + "]");
+            String url = tlist.get(i);
+            if (!isNewValidTracker(trackerHashes, url))
                continue;
-             }
-             int slash = url.indexOf('/', 7);
-             if (slash <= 7) {
-                _log.error("Bad announce URL: [" + url + "]");
+            // opentrackers are primary if we don't have primary
+            trackers.add(new TCTracker(url, trackers.isEmpty()));
+            if (_log.shouldLog(Log.DEBUG))
+                _log.debug("Additional announce: [" + url + "] for infoHash: " + infoHash);
+        }
+    }
+
+    // backup trackers if DHT needs bootstrapping
+    if (trackers.isEmpty() && (meta == null || !meta.isPrivate())) {
+        List<String> tlist = _util.getBackupTrackers();
+        for (int i = 0; i < tlist.size(); i++) {
+            String url = tlist.get(i);
+            if (!isNewValidTracker(trackerHashes, url))
                continue;
-             }
-             if (primary.startsWith(url.substring(0, slash)))
-                continue;
-             String dest = _util.lookup(url.substring(7, slash));
-             if (dest == null) {
-                _log.error("Announce host unknown: [" + url.substring(7, slash) + "]");
-                continue;
-             }
-             if (primary.startsWith("http://" + dest))
-                continue;
-             if (primary.startsWith("http://i2p/" + dest))
-                continue;
-             // opentrackers are primary if we don't have primary
-             trackers.add(new Tracker(url, primary.equals("")));
-             _log.debug("Additional announce: [" + url + "] for infoHash: " + infoHash);
+            backupTrackers.add(new TCTracker(url, false));
+            if (_log.shouldLog(Log.DEBUG))
+                _log.debug("Backup announce: [" + url + "] for infoHash: " + infoHash);
+        }
+        if (backupTrackers.isEmpty()) {
+            backupTrackers.add(new TCTracker(DEFAULT_BACKUP_TRACKER, false));
        }
    }
    this.completed = coordinator.getLeft() == 0;
  }

+  /**
+   *  @param existing the ones we already know about
+   *  @param ann an announce URL non-null
+   *  @return true if ann is valid and new; adds to existing if returns true
+   *  @since 0.9.5
+   */
+  private boolean isNewValidTracker(Set<Hash> existing, String ann) {
+      Hash h = getHostHash(ann);
+      if (h == null) {
+         _log.error("Bad announce URL: [" + ann + ']');
+         return false;
+      }
+      boolean rv = existing.add(h);
+      if (!rv) {
+          if (_log.shouldLog(Log.INFO))
+             _log.info("Dup announce URL: [" + ann + ']');
+      }
+      return rv;
+  }
+
  /**
   *  Announce to all the trackers, get peers from PEX and DHT, then queue up a SimpleTimer2 event.
   *  This will take several seconds to several minutes.
@ -315,7 +364,7 @@ public class TrackerClient implements Runnable {
  private void loop() {
    try
      {
-        Random r = I2PAppContext.getGlobalContext().random();
+        // normally this will only go once, then call queueLoop() and return
        while(!stop)
          {
            if (!verifyConnected()) {
@ -325,187 +374,25 @@ public class TrackerClient implements Runnable {

            // Local DHT tracker announce
            DHT dht = _util.getDHT();
-            if (dht != null)
+            if (dht != null && (meta == null || !meta.isPrivate()))
                dht.announce(snark.getInfoHash());

-            long uploaded = coordinator.getUploaded();
-            long downloaded = coordinator.getDownloaded();
-            long left = coordinator.getLeft();   // -1 in magnet mode
-            
-            // First time we got a complete download?
-            String event;
-            if (!completed && left == 0)
-              {
-                completed = true;
-                event = COMPLETED_EVENT;
-              }
-            else
-              event = NO_EVENT;
-            
-            // *** loop once for each tracker
            int maxSeenPeers = 0;
-            for (Tracker tr : trackers) {
-              if ((!stop) && (!tr.stop) &&
-                  (completed || coordinator.needOutboundPeers() || !tr.started) &&
-                  (event.equals(COMPLETED_EVENT) || System.currentTimeMillis() > tr.lastRequestTime + tr.interval))
-              {
-                try
-                  {
-                    if (!tr.started)
-                      event = STARTED_EVENT;
-                    TrackerInfo info = doRequest(tr, infoHash, peerID,
-                                                 uploaded, downloaded, left,
-                                                 event);
-
-                    snark.setTrackerProblems(null);
-                    tr.trackerProblems = null;
-                    tr.registerFails = 0;
-                    tr.consecutiveFails = 0;
-                    if (tr.isPrimary)
-                        consecutiveFails = 0;
-                    runStarted = true;
-                    tr.started = true;
-
-                    Set<Peer> peers = info.getPeers();
-                    tr.seenPeers = info.getPeerCount();
-                    if (snark.getTrackerSeenPeers() < tr.seenPeers) // update rising number quickly
-                        snark.setTrackerSeenPeers(tr.seenPeers);
-
-                    // pass everybody over to our tracker
-                    dht = _util.getDHT();
-                    if (dht != null) {
-                        for (Peer peer : peers) {
-                            dht.announce(snark.getInfoHash(), peer.getPeerID().getDestHash());
-                        }
-                    }
-
-                    if (coordinator.needOutboundPeers()) {
-                        // we only want to talk to new people if we need things
-                        // from them (duh)
-                        List<Peer> ordered = new ArrayList(peers);
-                        Collections.shuffle(ordered, r);
-                        Iterator<Peer> it = ordered.iterator();
-                        while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
-                          Peer cur = it.next();
-                          // FIXME if id == us || dest == us continue;
-                          // only delay if we actually make an attempt to add peer
-                          if(coordinator.addPeer(cur) && it.hasNext()) {
-                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
-                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
-                          }
-                        }
-                    }
-                  }
-                catch (IOException ioe)
-                  {
-                    // Probably not fatal (if it doesn't last to long...)
-                    if (_log.shouldLog(Log.WARN))
-                        _log.warn
-                      ("WARNING: Could not contact tracker at '"
-                       + tr.announce + "': " + ioe);
-                    tr.trackerProblems = ioe.getMessage();
-                    // don't show secondary tracker problems to the user
-                    if (tr.isPrimary)
-                      snark.setTrackerProblems(tr.trackerProblems);
-                    if (tr.trackerProblems.toLowerCase(Locale.US).startsWith(NOT_REGISTERED)) {
-                      // Give a guy some time to register it if using opentrackers too
-                      if (trackers.size() == 1) {
-                        stop = true;
-                        snark.stopTorrent();
-                      } else { // hopefully each on the opentrackers list is really open
-                        if (tr.registerFails++ > MAX_REGISTER_FAILS)
-                          tr.stop = true;
-                      }
-                    }
-                    if (++tr.consecutiveFails == MAX_CONSEC_FAILS) {
-                        tr.seenPeers = 0;
-                        if (tr.interval < LONG_SLEEP)
-                            tr.interval = LONG_SLEEP;  // slow down
-                    }
-                  }
-              } else {
-                  if (_log.shouldLog(Log.INFO))
-                      _log.info("Not announcing to " + tr.announce + " last announce was " +
-                               new Date(tr.lastRequestTime) + " interval is " + DataHelper.formatDuration(tr.interval));
-              }
-              if ((!tr.stop) && maxSeenPeers < tr.seenPeers)
-                  maxSeenPeers = tr.seenPeers;
-            }  // *** end of trackers loop here
-
-            // Get peers from PEX
-            if (coordinator.needOutboundPeers() && (meta == null || !meta.isPrivate()) && !stop) {
-                Set<PeerID> pids = coordinator.getPEXPeers();
-                if (!pids.isEmpty()) {
-                    if (_log.shouldLog(Log.INFO))
-                        _log.info("Got " + pids.size() + " from PEX");
-                    List<Peer> peers = new ArrayList(pids.size());
-                    for (PeerID pID : pids) {
-                        peers.add(new Peer(pID, snark.getID(), snark.getInfoHash(), snark.getMetaInfo()));
-                    }
-                    Collections.shuffle(peers, r);
-                    Iterator<Peer> it = peers.iterator();
-                    while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
-                        Peer cur = it.next();
-                        if (coordinator.addPeer(cur) && it.hasNext()) {
-                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
-                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
-                         }
-                    }
-                }
-            } else {
-                if (_log.shouldLog(Log.INFO))
-                    _log.info("Not getting PEX peers");
+            if (!trackers.isEmpty())
+                maxSeenPeers = getPeersFromTrackers(trackers);
+            int p = getPeersFromPEX();
+            if (p > maxSeenPeers)
+                maxSeenPeers = p;
+            p = getPeersFromDHT();
+            if (p > maxSeenPeers)
+                maxSeenPeers = p;
+            // backup if DHT needs bootstrapping
+            if (trackers.isEmpty() && !backupTrackers.isEmpty() && dht != null && dht.size() < 16) {
+                p = getPeersFromTrackers(backupTrackers);
+                if (p > maxSeenPeers)
+                    maxSeenPeers = p;
            }

-            // Get peers from DHT
-            // FIXME this needs to be in its own thread
-            dht = _util.getDHT();
-            if (dht != null && (meta == null || !meta.isPrivate()) && (!stop) &&
-                _util.getContext().clock().now() >  lastDHTAnnounce + MIN_DHT_ANNOUNCE_INTERVAL) {
-                int numwant;
-                if (event.equals(STOPPED_EVENT) || !coordinator.needOutboundPeers())
-                    numwant = 1;
-                else
-                    numwant = _util.getMaxConnections();
-                Collection<Hash> hashes = dht.getPeers(snark.getInfoHash(), numwant, 2*60*1000);
-                if (!hashes.isEmpty()) {
-                    runStarted = true;
-                    lastDHTAnnounce = _util.getContext().clock().now();
-                }
-                if (_log.shouldLog(Log.INFO))
-                    _log.info("Got " + hashes + " from DHT");
-                // announce  ourselves while the token is still good
-                // FIXME this needs to be in its own thread
-                if (!stop) {
-                    // announce only to the 1 closest
-                    int good = dht.announce(snark.getInfoHash(), 1, 5*60*1000);
-                    if (_log.shouldLog(Log.INFO))
-                        _log.info("Sent " + good + " good announces to DHT");
-                }
-
-                // now try these peers
-                if ((!stop) && !hashes.isEmpty()) {
-                    List<Peer> peers = new ArrayList(hashes.size());
-                    for (Hash h : hashes) {
-                        PeerID pID = new PeerID(h.getData(), _util);
-                        peers.add(new Peer(pID, snark.getID(), snark.getInfoHash(), snark.getMetaInfo()));
-                    }
-                    Collections.shuffle(peers, r);
-                    Iterator<Peer> it = peers.iterator();
-                    while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
-                        Peer cur = it.next();
-                        if (coordinator.addPeer(cur) && it.hasNext()) {
-                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
-                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
-                         }
-                    }
-                }
-            } else {
-                if (_log.shouldLog(Log.INFO))
-                    _log.info("Not getting DHT peers");
-            }
-
-
            // we could try and total the unique peers but that's too hard for now
            snark.setTrackerSeenPeers(maxSeenPeers);

@ -516,6 +403,7 @@ public class TrackerClient implements Runnable {
                // Sleep some minutes...
                // Sleep the minimum interval for all the trackers, but 60s minimum
                int delay;
+                Random r = _util.getContext().random();
                int random = r.nextInt(120*1000);
                if (completed && runStarted)
                  delay = 3*SLEEP*60*1000 + random;
@ -547,6 +435,213 @@ public class TrackerClient implements Runnable {
      }
  }

+  /**
+   *  @return max peers seen
+   */
+  private int getPeersFromTrackers(List<TCTracker> trckrs) {
+            long uploaded = coordinator.getUploaded();
+            long downloaded = coordinator.getDownloaded();
+            long left = coordinator.getLeft();   // -1 in magnet mode
+            
+            // First time we got a complete download?
+            String event;
+            if (!completed && left == 0)
+              {
+                completed = true;
+                event = COMPLETED_EVENT;
+              }
+            else
+              event = NO_EVENT;
+
+            // *** loop once for each tracker
+            int maxSeenPeers = 0;
+            for (TCTracker tr : trckrs) {
+              if ((!stop) && (!tr.stop) &&
+                  (completed || coordinator.needOutboundPeers() || !tr.started) &&
+                  (event.equals(COMPLETED_EVENT) || System.currentTimeMillis() > tr.lastRequestTime + tr.interval))
+              {
+                try
+                  {
+                    if (!tr.started)
+                      event = STARTED_EVENT;
+                    TrackerInfo info = doRequest(tr, infoHash, peerID,
+                                                 uploaded, downloaded, left,
+                                                 event);
+
+                    snark.setTrackerProblems(null);
+                    tr.trackerProblems = null;
+                    tr.registerFails = 0;
+                    tr.consecutiveFails = 0;
+                    if (tr.isPrimary)
+                        consecutiveFails = 0;
+                    runStarted = true;
+                    tr.started = true;
+
+                    Set<Peer> peers = info.getPeers();
+                    tr.seenPeers = info.getPeerCount();
+                    if (snark.getTrackerSeenPeers() < tr.seenPeers) // update rising number quickly
+                        snark.setTrackerSeenPeers(tr.seenPeers);
+
+                    // pass everybody over to our tracker
+                    DHT dht = _util.getDHT();
+                    if (dht != null) {
+                        for (Peer peer : peers) {
+                            dht.announce(snark.getInfoHash(), peer.getPeerID().getDestHash());
+                        }
+                    }
+
+                    if (coordinator.needOutboundPeers()) {
+                        // we only want to talk to new people if we need things
+                        // from them (duh)
+                        List<Peer> ordered = new ArrayList(peers);
+                        Random r = _util.getContext().random();
+                        Collections.shuffle(ordered, r);
+                        Iterator<Peer> it = ordered.iterator();
+                        while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
+                          Peer cur = it.next();
+                          // FIXME if id == us || dest == us continue;
+                          // only delay if we actually make an attempt to add peer
+                          if(coordinator.addPeer(cur) && it.hasNext()) {
+                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
+                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
+                          }
+                        }
+                    }
+                  }
+                catch (IOException ioe)
+                  {
+                    // Probably not fatal (if it doesn't last to long...)
+                    if (_log.shouldLog(Log.WARN))
+                        _log.warn
+                      ("WARNING: Could not contact tracker at '"
+                       + tr.announce + "': " + ioe);
+                    tr.trackerProblems = ioe.getMessage();
+                    // don't show secondary tracker problems to the user
+                    if (tr.isPrimary)
+                      snark.setTrackerProblems(tr.trackerProblems);
+                    if (tr.trackerProblems.toLowerCase(Locale.US).startsWith(NOT_REGISTERED)) {
+                      // Give a guy some time to register it if using opentrackers too
+                      //if (trckrs.size() == 1) {
+                      //  stop = true;
+                      //  snark.stopTorrent();
+                      //} else { // hopefully each on the opentrackers list is really open
+                        if (tr.registerFails++ > MAX_REGISTER_FAILS)
+                          tr.stop = true;
+                      //
+                    }
+                    if (++tr.consecutiveFails == MAX_CONSEC_FAILS) {
+                        tr.seenPeers = 0;
+                        if (tr.interval < LONG_SLEEP)
+                            tr.interval = LONG_SLEEP;  // slow down
+                    }
+                  }
+              } else {
+                  if (_log.shouldLog(Log.INFO))
+                      _log.info("Not announcing to " + tr.announce + " last announce was " +
+                               new Date(tr.lastRequestTime) + " interval is " + DataHelper.formatDuration(tr.interval));
+              }
+              if ((!tr.stop) && maxSeenPeers < tr.seenPeers)
+                  maxSeenPeers = tr.seenPeers;
+            }  // *** end of trackers loop here
+
+            return maxSeenPeers;
+  }
+
+  /**
+   *  @return max peers seen
+   */
+  private int getPeersFromPEX() {
+            // Get peers from PEX
+            int rv = 0;
+            if (coordinator.needOutboundPeers() && (meta == null || !meta.isPrivate()) && !stop) {
+                Set<PeerID> pids = coordinator.getPEXPeers();
+                if (!pids.isEmpty()) {
+                    if (_log.shouldLog(Log.INFO))
+                        _log.info("Got " + pids.size() + " from PEX");
+                    List<Peer> peers = new ArrayList(pids.size());
+                    for (PeerID pID : pids) {
+                        peers.add(new Peer(pID, snark.getID(), snark.getInfoHash(), snark.getMetaInfo()));
+                    }
+                    Random r = _util.getContext().random();
+                    Collections.shuffle(peers, r);
+                    Iterator<Peer> it = peers.iterator();
+                    while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
+                        Peer cur = it.next();
+                        if (coordinator.addPeer(cur) && it.hasNext()) {
+                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
+                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
+                         }
+                    }
+                    rv = pids.size();
+                    pids.clear();
+                }
+            } else {
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Not getting PEX peers");
+            }
+            return rv;
+    }
+
+  /**
+   *  @return max peers seen
+   */
+  private int getPeersFromDHT() {
+            // Get peers from DHT
+            // FIXME this needs to be in its own thread
+            int rv = 0;
+            DHT dht = _util.getDHT();
+            if (dht != null && (meta == null || !meta.isPrivate()) && (!stop) &&
+                _util.getContext().clock().now() >  lastDHTAnnounce + MIN_DHT_ANNOUNCE_INTERVAL) {
+                int numwant;
+                if (!coordinator.needOutboundPeers())
+                    numwant = 1;
+                else
+                    numwant = _util.getMaxConnections();
+                Collection<Hash> hashes = dht.getPeers(snark.getInfoHash(), numwant, 2*60*1000);
+                if (!hashes.isEmpty()) {
+                    runStarted = true;
+                    lastDHTAnnounce = _util.getContext().clock().now();
+                    rv = hashes.size();
+                }
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Got " + hashes + " from DHT");
+                // announce  ourselves while the token is still good
+                // FIXME this needs to be in its own thread
+                if (!stop) {
+                    // announce only to the 1 closest
+                    int good = dht.announce(snark.getInfoHash(), 1, 5*60*1000);
+                    if (_log.shouldLog(Log.INFO))
+                        _log.info("Sent " + good + " good announces to DHT");
+                }
+
+                // now try these peers
+                if ((!stop) && !hashes.isEmpty()) {
+                    List<Peer> peers = new ArrayList(hashes.size());
+                    for (Hash h : hashes) {
+                        try {
+                            PeerID pID = new PeerID(h.getData(), _util);
+                            peers.add(new Peer(pID, snark.getID(), snark.getInfoHash(), snark.getMetaInfo()));
+                        } catch (InvalidBEncodingException ibe) {}
+                    }
+                    Random r = _util.getContext().random();
+                    Collections.shuffle(peers, r);
+                    Iterator<Peer> it = peers.iterator();
+                    while ((!stop) && it.hasNext() && coordinator.needOutboundPeers()) {
+                        Peer cur = it.next();
+                        if (coordinator.addPeer(cur) && it.hasNext()) {
+                            int delay = r.nextInt(DELAY_RAND) + DELAY_MIN;
+                            try { Thread.sleep(delay); } catch (InterruptedException ie) {}
+                         }
+                    }
+                }
+            } else {
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Not getting DHT peers");
+            }
+            return rv;
+  }
+
+
  /**
   *  Creates a thread for each tracker in parallel if tunnel is still open
   *  @since 0.9.1
@ -557,7 +652,7 @@ public class TrackerClient implements Runnable {
      if (dht != null)
          dht.unannounce(snark.getInfoHash());
      int i = 0;
-      for (Tracker tr : trackers) {
+      for (TCTracker tr : trackers) {
          if (_util.connected() &&
              tr.started && (!tr.stop) && tr.trackerProblems == null) {
              try {
@ -577,9 +672,9 @@ public class TrackerClient implements Runnable {
   *  @since 0.9.1
   */
  private class Unannouncer implements Runnable {
-     private final Tracker tr;
+     private final TCTracker tr;

-     public Unannouncer(Tracker tr) {
+     public Unannouncer(TCTracker tr) {
         this.tr = tr;
     }

@ -603,7 +698,7 @@ public class TrackerClient implements Runnable {
     }
  }
  
-  private TrackerInfo doRequest(Tracker tr, String infoHash,
+  private TrackerInfo doRequest(TCTracker tr, String infoHash,
                                String peerID, long uploaded,
                                long downloaded, long left, String event)
    throws IOException
@ -630,7 +725,8 @@ public class TrackerClient implements Runnable {
    if (! event.equals(NO_EVENT))
        buf.append("&event=").append(event);
    buf.append("&numwant=");
-    if (left == 0 || event.equals(STOPPED_EVENT) || !coordinator.needOutboundPeers())
+    boolean small = left == 0 || event.equals(STOPPED_EVENT) || !coordinator.needOutboundPeers();
+    if (small)
        buf.append('0');
    else
        buf.append(_util.getMaxConnections());
@ -641,14 +737,12 @@ public class TrackerClient implements Runnable {
    tr.lastRequestTime = System.currentTimeMillis();
    // Don't wait for a response to stopped when shutting down
    boolean fast = _fastUnannounce && event.equals(STOPPED_EVENT);
-    File fetched = _util.get(s, true, fast ? -1 : 0);
+    byte[] fetched = _util.get(s, true, fast ? -1 : 0, small ? 128 : 1024, small ? 1024 : 8*1024);
    if (fetched == null) {
        throw new IOException("Error fetching " + s);
    }
    
-    InputStream in = null;
-    try {
-        in = new FileInputStream(fetched);
+        InputStream in = new ByteArrayInputStream(fetched);

        TrackerInfo info = new TrackerInfo(in, snark.getID(),
                                           snark.getInfoHash(), snark.getMetaInfo(), _util);
@ -661,10 +755,6 @@ public class TrackerClient implements Runnable {

        tr.interval = Math.max(MIN_TRACKER_ANNOUNCE_INTERVAL, info.getInterval() * 1000l);
        return info;
-    } finally {
-        if (in != null) try { in.close(); } catch (IOException ioe) {}
-        fetched.delete();
-    }
  }

  /**
@ -698,6 +788,7 @@ public class TrackerClient implements Runnable {
  }

  /**
+   *  @param ann an announce URL
   *  @return true for i2p hosts only
   *  @since 0.7.12
   */
@ -713,10 +804,38 @@ public class TrackerClient implements Runnable {
           url.getPort() < 0;
  }

-  private static class Tracker
+  /**
+   *  @param ann an announce URL non-null
+   *  @return a Hash for i2p hosts only, null otherwise
+   *  @since 0.9.5
+   */
+  private static Hash getHostHash(String ann) {
+    URL url;
+    try {
+        url = new URL(ann);
+    } catch (MalformedURLException mue) {
+        return null;
+    }
+    if (url.getPort() >= 0 || !url.getProtocol().equals("http"))
+        return null;
+    String host = url.getHost();
+    if (host.endsWith(".i2p"))
+        return ConvertToHash.getHash(host);
+    if (host.equals("i2p")) {
+        String path = url.getPath();
+        if (path == null || path.length() < 517 ||
+            !path.startsWith("/"))
+            return null;
+        String[] parts = path.substring(1).split("/?&;", 2);
+        return ConvertToHash.getHash(parts[0]);
+    }
+    return null;
+  }
+
+  private static class TCTracker
  {
-      String announce;
-      boolean isPrimary;
+      final String announce;
+      final boolean isPrimary;
      long interval;
      long lastRequestTime;
      String trackerProblems;
@ -726,7 +845,7 @@ public class TrackerClient implements Runnable {
      int consecutiveFails;
      int seenPeers;

-      public Tracker(String a, boolean p)
+      public TCTracker(String a, boolean p)
      {
          announce = a;
          isPrimary = p;
--- a/apps/i2psnark/java/src/org/klomp/snark/UpdateHandler.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/UpdateHandler.java
@ -0,0 +1,52 @@
+package org.klomp.snark;
+
+import java.net.URI;
+import java.util.List;
+
+import net.i2p.I2PAppContext;
+import net.i2p.update.*;
+
+/**
+ * <p>Handles the request to update the router by firing up a magnet.
+ * {@link net.i2p.util.EepGet} calls to download the latest signed update file
+ * and displaying the status to anyone who asks.
+ * </p>
+ * <p>After the download completes the signed update file is verified with
+ * {@link net.i2p.crypto.TrustedUpdate}, and if it's authentic the payload
+ * of the signed update file is unpacked and the router is restarted to complete
+ * the update process.
+ * </p>
+ *
+ * This does not do any checking, that is handled by the NewsFetcher.
+ *
+ * @since 0.9.4
+ */
+class UpdateHandler implements Updater {
+    private final I2PAppContext _context;
+    private final UpdateManager _umgr;
+    private final SnarkManager _smgr;
+    
+    public UpdateHandler(I2PAppContext ctx, UpdateManager umgr, SnarkManager smgr) {
+        _context = ctx;
+        _umgr = umgr;
+        _smgr = smgr;
+    }
+    
+    /**
+     *  Start a download and return a handle to the download task.
+     *  Should not block.
+     *
+     *  @param id plugin name or ignored
+     *  @param maxTime how long you have
+     *  @return active task or null if unable to download
+     */
+    public UpdateTask update(UpdateType type, UpdateMethod method, List<URI> updateSources,
+                             String id, String newVersion, long maxTime) {
+        if (type != UpdateType.ROUTER_SIGNED ||
+            method != UpdateMethod.TORRENT || updateSources.isEmpty())
+            return null;
+        UpdateRunner update = new UpdateRunner(_context, _umgr, _smgr, updateSources, newVersion);
+        _umgr.notifyProgress(update, "<b>" + _smgr.util().getString("Updating") + "</b>");
+        return update;
+    }
+}
--- a/apps/i2psnark/java/src/org/klomp/snark/UpdateRunner.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/UpdateRunner.java
@ -0,0 +1,302 @@
+package org.klomp.snark;
+
+import java.io.File;
+import java.net.URI;
+import java.util.List;
+
+import net.i2p.I2PAppContext;
+import net.i2p.crypto.TrustedUpdate;
+import net.i2p.data.DataHelper;
+import net.i2p.update.*;
+import net.i2p.util.Log;
+import net.i2p.util.SimpleTimer2;
+import net.i2p.util.VersionComparator;
+
+/**
+ *  The downloader for router signed updates.
+ *
+ *  @since 0.9.4
+ */
+class UpdateRunner implements UpdateTask, CompleteListener {
+    private final I2PAppContext _context;
+    private final Log _log;
+    private final UpdateManager _umgr;
+    private final SnarkManager _smgr;
+    private final List<URI> _urls;
+    private volatile boolean _isRunning;
+    private volatile boolean _hasMetaInfo;
+    private volatile boolean _isComplete;
+    private final String _newVersion;
+    private URI _currentURI;
+    private Snark _snark;
+
+    private static final long MAX_LENGTH = 30*1024*1024;
+    private static final long METAINFO_TIMEOUT = 30*60*1000;
+    private static final long COMPLETE_TIMEOUT = 3*60*60*1000;
+    private static final long CHECK_INTERVAL = 3*60*1000;
+
+    public UpdateRunner(I2PAppContext ctx, UpdateManager umgr, SnarkManager smgr,
+                        List<URI> uris, String newVersion) { 
+        _context = ctx;
+        _log = ctx.logManager().getLog(getClass());
+        _umgr = umgr;
+        _smgr = smgr;
+        _urls = uris;
+        _newVersion = newVersion;
+    }
+
+    //////// begin UpdateTask methods
+
+    public boolean isRunning() { return _isRunning; }
+
+    public void shutdown() {
+        _isRunning = false;
+        if (_snark != null) {
+
+        }
+    }
+
+    public UpdateType getType() { return UpdateType.ROUTER_SIGNED; }
+
+    public UpdateMethod getMethod() { return UpdateMethod.TORRENT; }
+
+    public URI getURI() { return _currentURI; }
+
+    public String getID() { return ""; }
+
+    //////// end UpdateTask methods
+
+    public void start() {
+        _isRunning = true;
+        update();
+    }
+
+    /**
+     *  Loop through the entire list of update URLs.
+     *  For each one, first get the version from the first 56 bytes and see if
+     *  it is newer than what we are running now.
+     *  If it is, get the whole thing.
+     */
+    private void update() {
+        for (URI uri : _urls) {
+            _currentURI = uri;
+            String updateURL = uri.toString();
+            try {
+                MagnetURI magnet = new MagnetURI(_smgr.util(), updateURL);
+                byte[] ih = magnet.getInfoHash();
+                // do we already have it?
+                _snark = _smgr.getTorrentByInfoHash(ih);
+                if (_snark != null) {
+                    if (_snark.getMetaInfo() != null) {
+                         _hasMetaInfo = true;
+                         Storage storage = _snark.getStorage();
+                         if (storage != null && storage.complete())
+                             processComplete(_snark);
+                    }
+                    if (!_isComplete) {
+                        if (_snark.isStopped() && !_snark.isStarting())
+                            _snark.startTorrent();
+                        // we aren't a listener so we must poll
+                        new Watcher();
+                    }
+                    break;
+                }
+                String name = magnet.getName();
+                String trackerURL = magnet.getTrackerURL();
+                if (trackerURL == null && !_smgr.util().shouldUseDHT() &&
+                    !_smgr.util().shouldUseOpenTrackers()) {
+                    // but won't we use OT as a failsafe even if disabled?
+                    _umgr.notifyAttemptFailed(this, "No tracker, no DHT, no OT", null);
+                    continue;
+                }
+                _snark = _smgr.addMagnet(name, ih, trackerURL, true, true, this);
+                if (_snark != null) {
+                    updateStatus("<b>" + _smgr.util().getString("Updating from {0}", updateURL) + "</b>");
+                    new Timeout();
+                    break;
+                }
+            } catch (IllegalArgumentException iae) {
+                _log.error("Invalid update URL", iae);
+            }
+        }
+        if (_snark == null)
+            fatal("No valid URLs");
+    }
+
+    /**
+     *  This will run twice, once at the metainfo timeout and
+     *  once at the complete timeout.
+     */
+    private class Timeout extends SimpleTimer2.TimedEvent {
+        private final long _start = _context.clock().now();
+
+        public Timeout() {
+            super(_context.simpleTimer2(), METAINFO_TIMEOUT);
+        }
+
+        public void timeReached() {
+            if (_isComplete || !_isRunning)
+                return;
+            if (!_hasMetaInfo) {
+                fatal("Metainfo timeout");
+                return;
+            }
+            if (_context.clock().now() - _start >= COMPLETE_TIMEOUT) {
+                fatal("Complete timeout");
+                return;
+            }
+            reschedule(COMPLETE_TIMEOUT - METAINFO_TIMEOUT);
+        }
+    }
+
+    /**
+     *  Rarely used - only if the user added the torrent, so
+     *  we aren't a complete listener.
+     *  This will periodically until the complete timeout.
+     */
+    private class Watcher extends SimpleTimer2.TimedEvent {
+        private final long _start = _context.clock().now();
+
+        public Watcher() {
+            super(_context.simpleTimer2(), CHECK_INTERVAL);
+        }
+
+        public void timeReached() {
+            if (_hasMetaInfo && _snark.getRemainingLength() == 0 && !_isComplete)
+                processComplete(_snark);
+            if (_isComplete || !_isRunning)
+                return;
+            if (_context.clock().now() - _start >= METAINFO_TIMEOUT && !_hasMetaInfo) {
+                fatal("Metainfo timeout");
+                return;
+            }
+            if (_context.clock().now() - _start >= COMPLETE_TIMEOUT) {
+                fatal("Complete timeout");
+                return;
+            }
+            notifyProgress();
+            reschedule(CHECK_INTERVAL);
+        }
+    }
+
+    private void fatal(String error) {
+            if (_snark != null) {
+                if (_hasMetaInfo) {
+                    _smgr.stopTorrent(_snark, true);
+                    String file = _snark.getName();
+                    _smgr.removeTorrent(file);
+                    // delete torrent file
+                    File f = new File(_smgr.getDataDir(), file);
+                    f.delete();
+                    // delete data
+                    file = _snark.getBaseName();
+                    f = new File(_smgr.getDataDir(), file);
+                    f.delete();
+                } else {
+                    _smgr.deleteMagnet(_snark);
+                }
+            }
+            _umgr.notifyTaskFailed(this, error, null);
+            _log.error(error);
+            _isRunning = false;
+            // stop the tunnel if we were the only one running
+            if (_smgr.util().connected() && !_smgr.util().isConnecting()) {
+                for (Snark s : _smgr.getTorrents()) {
+                    if (!s.isStopped())
+                        return;
+                }
+                _smgr.util().disconnect();
+            }
+    }
+
+    private void processComplete(Snark snark) {
+        String dataFile = snark.getBaseName();
+        File f = new File(_smgr.getDataDir(), dataFile);
+        String sudVersion = TrustedUpdate.getVersionString(f);
+        if (_newVersion.equals(sudVersion))
+            _umgr.notifyComplete(this, _newVersion, f);
+        else
+            fatal("version mismatch");
+        _isComplete = true;
+    }
+
+    private void notifyProgress() {
+        if (_hasMetaInfo) {
+            long total = _snark.getTotalLength();
+            long remaining = _snark.getRemainingLength(); 
+            String status = "<b>" + _smgr.util().getString("Updating") + "</b>";
+            _umgr.notifyProgress(this, status, total - remaining, total);
+        }
+    }
+
+    //////// begin CompleteListener methods
+    //////// all pass through to SnarkManager
+
+    public void torrentComplete(Snark snark) {
+        processComplete(snark);
+        _smgr.torrentComplete(snark);
+    }
+
+    /**
+     *  This is called by stopTorrent() among others
+     */
+    public void updateStatus(Snark snark) {
+        if (snark.isStopped()) {
+            if (!_isComplete)
+                fatal("stopped by user");
+        }
+        _smgr.updateStatus(snark);
+    }
+
+    public String gotMetaInfo(Snark snark) {
+        MetaInfo info = snark.getMetaInfo();
+        if (info.getFiles() != null) {
+            fatal("more than 1 file");
+            return null;
+        }
+        if (info.isPrivate()) {
+            fatal("private torrent");
+            return null;
+        }
+        if (info.getTotalLength() > MAX_LENGTH) {
+            fatal("too big");
+            return null;
+        }
+        _hasMetaInfo = true;
+        notifyProgress();
+        return _smgr.gotMetaInfo(snark);
+    }
+
+    public void fatal(Snark snark, String error) {
+         fatal(error);
+        _smgr.fatal(snark, error);
+    }
+
+    public void addMessage(Snark snark, String message) {
+        _smgr.addMessage(snark, message);
+    }
+
+    public void gotPiece(Snark snark) {
+        notifyProgress();
+        _smgr.gotPiece(snark);
+    }
+
+    public long getSavedTorrentTime(Snark snark) {
+        return _smgr.getSavedTorrentTime(snark);
+    }
+
+    public BitField getSavedTorrentBitField(Snark snark) {
+        return _smgr.getSavedTorrentBitField(snark);
+    }
+
+    //////// end CompleteListener methods
+
+    private void updateStatus(String s) {
+        _umgr.notifyProgress(this, s);
+    }
+
+    @Override
+    public String toString() {
+        return getClass().getName() + ' ' + getType() + ' ' + getID() + ' ' + getMethod() + ' ' + getURI();
+    }
+}
--- a/apps/i2psnark/java/src/org/klomp/snark/dht/DHTNodes.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/dht/DHTNodes.java
@ -69,6 +69,9 @@ class DHTNodes {

    // begin ConcurrentHashMap methods

+    /**
+     *  @return known nodes, not total net size
+     */
    public int size() {
        return _nodeMap.size();
    }
@ -86,8 +89,13 @@ class DHTNodes {
     *  @return the old value if present, else null
     */
    public NodeInfo putIfAbsent(NodeInfo nInfo) {
-        _kad.add(nInfo.getNID());
-        return _nodeMap.putIfAbsent(nInfo.getNID(), nInfo);
+        NodeInfo rv = _nodeMap.putIfAbsent(nInfo.getNID(), nInfo);
+        // ensure same object in both places
+        if (rv != null)
+            _kad.add(rv.getNID());
+        else
+            _kad.add(nInfo.getNID());
+        return rv;
    }

    public NodeInfo remove(NID nid) {
@ -128,11 +136,19 @@ class DHTNodes {
        return _kad.getExploreKeys(MAX_BUCKET_AGE);
    }

+    /**
+     * Debug info, HTML formatted
+     * @since 0.9.4
+     */
+    public void renderStatusHTML(StringBuilder buf) {
+        buf.append(_kad.toString().replace("\n", "<br>\n"));
+    }
+
    /** */
    private class Cleaner extends SimpleTimer2.TimedEvent {

        public Cleaner() {
-            super(SimpleTimer2.getInstance(), CLEAN_TIME);
+            super(SimpleTimer2.getInstance(), 5 * CLEAN_TIME);
        }

        public void timeReached() {
--- a/apps/i2psnark/java/src/org/klomp/snark/dht/DHTTracker.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/dht/DHTTracker.java
@ -39,6 +39,8 @@ class DHTTracker {
    private static final long DELTA_EXPIRE_TIME = 3*60*1000;
    private static final int MAX_PEERS = 2000;
    private static final int MAX_PEERS_PER_TORRENT = 150;
+    private static final int ABSOLUTE_MAX_PER_TORRENT = MAX_PEERS_PER_TORRENT * 2;
+    private static final int MAX_TORRENTS = 400;

    DHTTracker(I2PAppContext ctx) {
        _context = ctx;
@ -62,17 +64,29 @@ class DHTTracker {
            _log.debug("Announce " + hash + " for " + ih);
        Peers peers = _torrents.get(ih);
        if (peers == null) {
+            if (_torrents.size() >= MAX_TORRENTS)
+                return;
            peers = new Peers();
            Peers peers2 = _torrents.putIfAbsent(ih, peers);
            if (peers2 != null)
                peers = peers2;
        }

-        Peer peer = new Peer(hash.getData());
-        Peer peer2 = peers.putIfAbsent(peer, peer);
-        if (peer2 != null)
-            peer = peer2;
-        peer.setLastSeen(_context.clock().now());
+        if (peers.size() < ABSOLUTE_MAX_PER_TORRENT) {
+            Peer peer = new Peer(hash.getData());
+            Peer peer2 = peers.putIfAbsent(peer, peer);
+            if (peer2 != null)
+                peer = peer2;
+            peer.setLastSeen(_context.clock().now());
+        } else {
+            // We could update setLastSeen if he is already
+            // in there, but that would tend to keep
+            // the same set of peers.
+            // So let it expire so new ones can come in.
+            //Peer peer = peers.get(hash);
+            //if (peer != null)
+            //    peer.setLastSeen(_context.clock().now());
+        }
    }

    void unannounce(InfoHash ih, Hash hash) {
@ -113,7 +127,7 @@ class DHTTracker {
    private class Cleaner extends SimpleTimer2.TimedEvent {

        public Cleaner() {
-            super(SimpleTimer2.getInstance(), CLEAN_TIME);
+            super(SimpleTimer2.getInstance(), 2 * CLEAN_TIME);
        }

        public void timeReached() {
@ -122,6 +136,7 @@ class DHTTracker {
            long now = _context.clock().now();
            int torrentCount = 0;
            int peerCount = 0;
+            boolean tooMany = false;
            for (Iterator<Peers> iter = _torrents.values().iterator(); iter.hasNext(); ) {
                Peers p = iter.next();
                int recent = 0;
@ -136,6 +151,7 @@ class DHTTracker {
                }
                if (recent > MAX_PEERS_PER_TORRENT) {
                    // too many, delete at random
+                    // TODO sort and remove oldest?
                    // TODO per-torrent adjustable expiration?
                    for (Iterator<Peer> iterp = p.values().iterator(); iterp.hasNext() && p.size() > MAX_PEERS_PER_TORRENT; ) {
                         iterp.next();
@ -143,6 +159,7 @@ class DHTTracker {
                         peerCount--;
                    }
                    torrentCount++;
+                    tooMany = true;
                } else if (recent <= 0) {
                    iter.remove();
                } else {
@ -151,6 +168,8 @@ class DHTTracker {
            }

            if (peerCount > MAX_PEERS)
+                tooMany = true;
+            if (tooMany)
                _expireTime = Math.max(_expireTime - DELTA_EXPIRE_TIME, MIN_EXPIRE_TIME);
            else
                _expireTime = Math.min(_expireTime + DELTA_EXPIRE_TIME, MAX_EXPIRE_TIME);
@ -162,7 +181,7 @@ class DHTTracker {
                         DataHelper.formatDuration(_expireTime) + " expiration");
            _peerCount = peerCount;
            _torrentCount = torrentCount;
-            schedule(CLEAN_TIME);
+            schedule(tooMany ? CLEAN_TIME / 3 : CLEAN_TIME);
        }
    }
 }
--- a/apps/i2psnark/java/src/org/klomp/snark/dht/KRPC.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/dht/KRPC.java
@ -38,6 +38,7 @@ import net.i2p.data.DataHelper;
 import net.i2p.data.Destination;
 import net.i2p.data.Hash;
 import net.i2p.data.SimpleDataStructure;
+import net.i2p.util.ConcurrentHashSet;
 import net.i2p.util.I2PAppThread;
 import net.i2p.util.Log;
 import net.i2p.util.SimpleTimer2;
@ -97,6 +98,8 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
    private final ConcurrentHashMap<Token, NodeInfo> _outgoingTokens;
    /** index to incoming opaque tokens, received in a peers or nodes reply */
    private final ConcurrentHashMap<NID, Token> _incomingTokens;
+    /** recently unreachable, with lastSeen() as the added-to-blacklist time  */
+    private final Set<NID> _blacklist;

    /** hook to inject and receive datagrams */
    private final I2PSession _session;
@ -140,6 +143,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
    /** how long since generated do we delete - BEP 5 says 10 minutes */
    private static final long MAX_TOKEN_AGE = 10*60*1000;
    private static final long MAX_INBOUND_TOKEN_AGE = MAX_TOKEN_AGE - 2*60*1000;
+    private static final int MAX_OUTBOUND_TOKENS = 5000;
    /** how long since sent do we wait for a reply */
    private static final long MAX_MSGID_AGE = 2*60*1000;
    /** how long since sent do we wait for a reply */
@ -147,6 +151,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
    /** stagger with other cleaners */
    private static final long CLEAN_TIME = 63*1000;
    private static final long EXPLORE_TIME = 877*1000;
+    private static final long BLACKLIST_CLEAN_TIME = 17*60*1000;
    private static final String DHT_FILE = "i2psnark.dht.dat";

    private static final int SEND_CRYPTO_TAGS = 8;
@ -161,6 +166,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
        _sentQueries = new ConcurrentHashMap();
        _outgoingTokens = new ConcurrentHashMap();
        _incomingTokens = new ConcurrentHashMap();
+        _blacklist = new ConcurrentHashSet();

        // Construct my NodeInfo
        // Pick ports over a big range to marginally increase security
@ -262,13 +268,13 @@ public class KRPC implements I2PSessionMuxedListener, DHT {

            int replyType = waiter.getReplyCode();
            if (replyType == REPLY_NONE) {
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got no reply");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got no reply");
            } else if (replyType == REPLY_NODES) {
                 List<NodeInfo> reply = (List<NodeInfo>) waiter.getReplyObject();
                 // It seems like we are just going to get back ourselves all the time
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got " + reply.size() + " nodes");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got " + reply.size() + " nodes");
                 for (NodeInfo ni : reply) {
                     if (! (ni.equals(_myNodeInfo) || (toTry.contains(ni) && tried.contains(ni))))
                         toTry.add(ni);
@ -348,14 +354,14 @@ public class KRPC implements I2PSessionMuxedListener, DHT {

            int replyType = waiter.getReplyCode();
            if (replyType == REPLY_NONE) {
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got no reply");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got no reply");
            } else if (replyType == REPLY_PONG) {
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got pong");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got pong");
            } else if (replyType == REPLY_PEERS) {
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got peers");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got peers");
                 List<Hash> reply = (List<Hash>) waiter.getReplyObject();
                 if (!reply.isEmpty()) {
                     for (int j = 0; j < reply.size() && rv.size() < max; j++) {
@ -367,8 +373,8 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
                 }
            } else if (replyType == REPLY_NODES) {
                 List<NodeInfo> reply = (List<NodeInfo>) waiter.getReplyObject();
-                 if (_log.shouldLog(Log.INFO))
-                     _log.info("Got " + reply.size() + " nodes");
+                 if (_log.shouldLog(Log.DEBUG))
+                     _log.debug("Got " + reply.size() + " nodes");
                 for (NodeInfo ni : reply) {
                     if (! (ni.equals(_myNodeInfo) || tried.contains(ni) || toTry.contains(ni)))
                         toTry.add(ni);
@ -567,7 +573,9 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
        _session.removeListener(I2PSession.PROTO_DATAGRAM_RAW, _rPort);
        // clear the DHT and tracker
        _tracker.stop();
-        PersistDHT.saveDHT(_knownNodes, _dhtFile);
+        // don't lose all our peers if we didn't have time to check them
+        boolean saveAll = _context.clock().now() - _started < 20*60*1000;
+        PersistDHT.saveDHT(_knownNodes, saveAll, _dhtFile);
        _knownNodes.stop();
        for (Iterator<ReplyWaiter> iter = _sentQueries.values().iterator(); iter.hasNext(); ) {
            ReplyWaiter waiter = iter.next();
@ -576,6 +584,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
        }
        _outgoingTokens.clear();
        _incomingTokens.clear();
+        _blacklist.clear();
    }

    /**
@ -592,7 +601,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
     */
    public String renderStatusHTML() {
        long uptime = Math.max(1000, _context.clock().now() - _started);
-        StringBuilder buf = new StringBuilder();
+        StringBuilder buf = new StringBuilder(256);
        buf.append("<br><b>DHT DEBUG</b><br>TX: ").append(_txPkts.get()).append(" pkts / ")
           .append(DataHelper.formatSize2(_txBytes.get())).append("B / ")
           .append(DataHelper.formatSize2(_txBytes.get() * 1000 / uptime)).append("Bps<br>" +
@ -600,10 +609,12 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
           .append(DataHelper.formatSize2(_rxBytes.get())).append("B / ")
           .append(DataHelper.formatSize2(_rxBytes.get() * 1000 / uptime)).append("Bps<br>" +
                   "DHT Peers: ").append( _knownNodes.size()).append("<br>" +
+                   "Blacklisted: ").append(_blacklist.size()).append("<br>" +
                   "Sent tokens: ").append(_outgoingTokens.size()).append("<br>" +
                   "Rcvd tokens: ").append(_incomingTokens.size()).append("<br>" +
                   "Pending queries: ").append(_sentQueries.size()).append("<br>");
        _tracker.renderStatusHTML(buf);
+        _knownNodes.renderStatusHTML(buf);
        return buf.toString();
    }

@ -1079,7 +1090,12 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
            if (oldInfo.getDestination() == null && nInfo.getDestination() != null)
                oldInfo.setDestination(nInfo.getDestination());
        }
-        oldInfo.getNID().setLastSeen();
+        nID = oldInfo.getNID();
+        nID.setLastSeen();
+        if (_blacklist.remove(nID)) {
+            if (_log.shouldLog(Log.INFO))
+                _log.info("UN-blacklisted: " + nID);
+        }
        return oldInfo;
    }

@ -1093,8 +1109,12 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
        if (nInfo.equals(_myNodeInfo))
            return _myNodeInfo;
        NodeInfo rv = _knownNodes.putIfAbsent(nInfo);
-        if (rv == null)
+        if (rv == null) {
            rv = nInfo;
+            // if we didn't know about it before, set the timestamp
+            // so it isn't immediately removed by the DHTNodes cleaner
+            rv.getNID().setLastSeen();
+        }
        return rv;
    }

@ -1109,6 +1129,13 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
                if (_log.shouldLog(Log.INFO))
                    _log.info("Removed after consecutive timeouts: " + nInfo);
            }
+            if (!_blacklist.contains(nid)) {
+                // used as when-added time
+                nid.setLastSeen();
+                _blacklist.add(nid);
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Blacklisted: " + nid);
+            }
        }
    }

@ -1182,7 +1209,8 @@ public class KRPC implements I2PSessionMuxedListener, DHT {

    /**
     *  Handle and respond to the query.
-     *  We have no node info here, it came on response port, we have to get it from the token
+     *  We have no node info here, it came on response port, we have to get it from the token.
+     *  So we can't verify that it came from the same peer, as BEP 5 specifies.
     */
    private void receiveAnnouncePeer(MsgID msgID, InfoHash ih, byte[] tok) throws InvalidBEncodingException {
        Token token = new Token(tok);
@ -1190,8 +1218,8 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
        if (nInfo == null) {
            if (_log.shouldLog(Log.WARN))
                _log.warn("Unknown token in announce_peer: " + token);
-            if (_log.shouldLog(Log.INFO))
-                _log.info("Current known tokens: " + _outgoingTokens.keySet());
+            //if (_log.shouldLog(Log.INFO))
+            //    _log.info("Current known tokens: " + _outgoingTokens.keySet());
            return;
        }
        if (_log.shouldLog(Log.INFO))
@ -1223,11 +1251,11 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
                byte[] tok = btok.getBytes();
                Token token = new Token(_context, tok);
                _incomingTokens.put(nInfo.getNID(), token);
-                if (_log.shouldLog(Log.INFO))
-                    _log.info("Got token: " + token + ", must be a response to get_peers");
+                if (_log.shouldLog(Log.DEBUG))
+                    _log.debug("Got token: " + token + ", must be a response to get_peers");
            } else {
-                if (_log.shouldLog(Log.INFO))
-                    _log.info("No token and saved infohash, must be a response to find_node");
+                if (_log.shouldLog(Log.DEBUG))
+                    _log.debug("No token and saved infohash, must be a response to find_node");
            }
        }

@ -1256,9 +1284,15 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
     *  @throws NPE, IllegalArgumentException, and others too
     */
    private List<NodeInfo> receiveNodes(NodeInfo nInfo, byte[] ids) throws InvalidBEncodingException {
-        List<NodeInfo> rv = new ArrayList(ids.length / NodeInfo.LENGTH);
-        for (int off = 0; off < ids.length; off += NodeInfo.LENGTH) {
+        int max = Math.min(K, ids.length / NodeInfo.LENGTH);
+        List<NodeInfo> rv = new ArrayList(max);
+        for (int off = 0; off < ids.length && rv.size() < max; off += NodeInfo.LENGTH) {
            NodeInfo nInf = new NodeInfo(ids, off);
+            if (_blacklist.contains(nInf.getNID())) {
+                if (_log.shouldLog(Log.INFO))
+                    _log.info("Ignoring blacklisted " + nInf.getNID() + " from: " + nInfo);
+                continue;
+            }
            nInf = heardAbout(nInf);
            rv.add(nInf);
        }
@ -1274,12 +1308,15 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
    private List<Hash> receivePeers(NodeInfo nInfo, List<BEValue> peers) throws InvalidBEncodingException {
        if (_log.shouldLog(Log.INFO))
             _log.info("Rcvd peers from: " + nInfo);
-        List<Hash> rv = new ArrayList(peers.size());
+        int max = Math.min(MAX_WANT, peers.size());
+        List<Hash> rv = new ArrayList(max);
        for (BEValue bev : peers) {
            byte[] b = bev.getBytes();
            //Hash h = new Hash(b);
            Hash h = Hash.create(b);
            rv.add(h);
+            if (rv.size() >= max)
+                break;
        }
        if (_log.shouldLog(Log.INFO))
             _log.info("Rcvd peers from: " + nInfo + ": " + DataHelper.toString(rv));
@ -1492,7 +1529,7 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
    private class Cleaner extends SimpleTimer2.TimedEvent {

        public Cleaner() {
-            super(SimpleTimer2.getInstance(), CLEAN_TIME);
+            super(SimpleTimer2.getInstance(), 7 * CLEAN_TIME);
        }

        public void timeReached() {
@ -1501,21 +1538,37 @@ public class KRPC implements I2PSessionMuxedListener, DHT {
            long now = _context.clock().now();
            if (_log.shouldLog(Log.DEBUG))
                _log.debug("KRPC cleaner starting with " +
+                          _blacklist.size() + " in blacklist, " +
                          _outgoingTokens.size() + " sent Tokens, " +
                          _incomingTokens.size() + " rcvd Tokens");
+            int cnt = 0;
+            long expire = now - MAX_TOKEN_AGE;
            for (Iterator<Token> iter = _outgoingTokens.keySet().iterator(); iter.hasNext(); ) {
                Token tok = iter.next();
-                if (tok.lastSeen() < now - MAX_TOKEN_AGE)
+                // just delete at random if we have too many
+                // TODO reduce the expire time and iterate again?
+                if (tok.lastSeen() < expire || cnt >= MAX_OUTBOUND_TOKENS)
                    iter.remove();
+                else
+                    cnt++;
            }
+            expire = now - MAX_INBOUND_TOKEN_AGE;
            for (Iterator<Token> iter = _incomingTokens.values().iterator(); iter.hasNext(); ) {
                Token tok = iter.next();
-                if (tok.lastSeen() < now - MAX_INBOUND_TOKEN_AGE)
+                if (tok.lastSeen() < expire)
+                    iter.remove();
+            }
+            expire = now - BLACKLIST_CLEAN_TIME;
+            for (Iterator<NID> iter = _blacklist.iterator(); iter.hasNext(); ) {
+                NID nid = iter.next();
+                // lastSeen() is actually when-added
+                if (nid.lastSeen() < expire)
                    iter.remove();
            }
            // TODO sent queries?
            if (_log.shouldLog(Log.DEBUG))
                _log.debug("KRPC cleaner done, now with " +
+                          _blacklist.size() + " in blacklist, " +
                          _outgoingTokens.size() + " sent Tokens, " +
                          _incomingTokens.size() + " rcvd Tokens, " +
                          _knownNodes.size() + " known peers, " +
--- a/apps/i2psnark/java/src/org/klomp/snark/dht/NID.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/dht/NID.java
@ -18,7 +18,7 @@ public class NID extends SHA1Hash {
    private long lastSeen;
    private int fails;

-    private static final int MAX_FAILS = 3;
+    private static final int MAX_FAILS = 2;

    public NID() {
        super(null);
@ -41,6 +41,6 @@ public class NID extends SHA1Hash {
     *  @return if more than max timeouts
     */
    public boolean timeout() {
-        return fails++ > MAX_FAILS;
+        return ++fails > MAX_FAILS;
    }
 }
--- a/apps/i2psnark/java/src/org/klomp/snark/dht/PersistDHT.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/dht/PersistDHT.java
@ -56,12 +56,15 @@ abstract class PersistDHT {
            log.info("Loaded " + count + " nodes from " + file);
    }

-    public static synchronized void saveDHT(DHTNodes nodes, File file) {
+    /**
+     *  @param saveAll if true, don't check last seen time
+     */
+    public static synchronized void saveDHT(DHTNodes nodes, boolean saveAll, File file) {
        if (nodes.size() <= 0)
            return;
        Log log = I2PAppContext.getGlobalContext().logManager().getLog(PersistDHT.class);
        int count = 0;
-        long maxAge = I2PAppContext.getGlobalContext().clock().now() - MAX_AGE;
+        long maxAge = saveAll ? 0 : I2PAppContext.getGlobalContext().clock().now() - MAX_AGE;
        PrintWriter out = null;
        try {
            out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(new SecureFileOutputStream(file), "ISO-8859-1")));
--- a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
@ -28,13 +28,13 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import net.i2p.I2PAppContext;
-import net.i2p.data.Base32;
 import net.i2p.data.Base64;
 import net.i2p.data.DataHelper;
 import net.i2p.util.I2PAppThread;
 import net.i2p.util.Log;

 import org.klomp.snark.I2PSnarkUtil;
+import org.klomp.snark.MagnetURI;
 import org.klomp.snark.MetaInfo;
 import org.klomp.snark.Peer;
 import org.klomp.snark.Snark;
@ -61,14 +61,9 @@ public class I2PSnarkServlet extends DefaultServlet {
    private Resource _resourceBase;
    private String _themePath;
    private String _imgPath;
-    private String _lastAnnounceURL = "";
+    private String _lastAnnounceURL;
    
    public static final String PROP_CONFIG_FILE = "i2psnark.configFile";
-    /** BEP 9 */
-    private static final String MAGNET = "magnet:";
-    private static final String MAGNET_FULL = MAGNET + "?xt=urn:btih:";
-    /** http://sponge.i2p/files/maggotspec.txt */
-    private static final String MAGGOT = "maggot://";
 
    @Override
    public void init(ServletConfig cfg) throws ServletException {
@ -193,10 +188,14 @@ public class I2PSnarkServlet extends DefaultServlet {
                } else {
                    String base = URIUtil.addPaths(req.getRequestURI(), "/");
                    String listing = getListHTML(resource, base, true, method.equals("POST") ? req.getParameterMap() : null);
-                    if (listing != null)
+                    if (method.equals("POST")) {
+                        // P-R-G
+                        sendRedirect(req, resp, "");
+                    } else if (listing != null) {
                        resp.getWriter().write(listing);
-                    else // shouldn't happen
+                    } else { // shouldn't happen
                        resp.sendError(404);
+                    }
                }
            } else {
                super.service(req, resp);
@ -214,6 +213,9 @@ public class I2PSnarkServlet extends DefaultServlet {
                processRequest(req);
            else  // nonce is constant, shouldn't happen
                _manager.addMessage("Please retry form submission (bad nonce)");
+            // P-R-G (or G-R-G to hide the params from the address bar)
+            sendRedirect(req, resp, peerString);
+            return;	
        }
        
        PrintWriter out = resp.getWriter();
@ -564,12 +566,13 @@ public class I2PSnarkServlet extends DefaultServlet {
                if (newURL.startsWith("http://")) {
                    FetchAndAdd fetch = new FetchAndAdd(_context, _manager, newURL);
                    _manager.addDownloader(fetch);
-                } else if (newURL.startsWith(MAGNET) || newURL.startsWith(MAGGOT)) {
+                } else if (newURL.startsWith(MagnetURI.MAGNET) || newURL.startsWith(MagnetURI.MAGGOT)) {
                    addMagnet(newURL);
                } else if (newURL.length() == 40 && newURL.replaceAll("[a-fA-F0-9]", "").length() == 0) {
-                    addMagnet(MAGNET_FULL + newURL);
+                    addMagnet(MagnetURI.MAGNET_FULL + newURL);
                } else {
-                    _manager.addMessage(_("Invalid URL: Must start with \"http://\", \"{0}\", or \"{1}\"", MAGNET, MAGGOT));
+                    _manager.addMessage(_("Invalid URL: Must start with \"http://\", \"{0}\", or \"{1}\"",
+                                          MagnetURI.MAGNET, MagnetURI.MAGGOT));
                }
            } else {
                // no file or URL specified
@ -609,6 +612,7 @@ public class I2PSnarkServlet extends DefaultServlet {
                            MetaInfo meta = snark.getMetaInfo();
                            if (meta == null) {
                                // magnet - remove and delete are the same thing
+                                // Remove not shown on UI so we shouldn't get here
                                _manager.deleteMagnet(snark);
                                _manager.addMessage(_("Magnet deleted: {0}", name));
                                return;
@ -637,7 +641,10 @@ public class I2PSnarkServlet extends DefaultServlet {
                            if (meta == null) {
                                // magnet - remove and delete are the same thing
                                _manager.deleteMagnet(snark);
-                                _manager.addMessage(_("Magnet deleted: {0}", name));
+                                if (snark instanceof FetchAndAdd)
+                                    _manager.addMessage(_("Download deleted: {0}", name));
+                                else
+                                    _manager.addMessage(_("Magnet deleted: {0}", name));
                                return;
                            }
                            _manager.stopTorrent(snark, true);
@ -730,17 +737,54 @@ public class I2PSnarkServlet extends DefaultServlet {
                //if ( (announceURLOther != null) && (announceURLOther.trim().length() > "http://.i2p/announce".length()) )
                //    announceURL = announceURLOther;

-                if (announceURL == null || announceURL.length() <= 0)
-                    _manager.addMessage(_("Error creating torrent - you must select a tracker"));
-                else if (baseFile.exists()) {
-                    _lastAnnounceURL = announceURL;
+                if (baseFile.exists()) {
                    if (announceURL.equals("none"))
                        announceURL = null;
+                    _lastAnnounceURL = announceURL;
+                    List<String> backupURLs = new ArrayList();
+                    Enumeration e = req.getParameterNames();
+                    while (e.hasMoreElements()) {
+                         Object o = e.nextElement();
+                         if (!(o instanceof String))
+                             continue;
+                         String k = (String) o;
+                        if (k.startsWith("backup_")) {
+                            String url = k.substring(7);
+                            if (!url.equals(announceURL))
+                                backupURLs.add(url);
+                        }
+                    }
+                    List<List<String>> announceList = null;
+                    if (!backupURLs.isEmpty()) {
+                        // BEP 12 - Put primary first, then the others, each as the sole entry in their own list
+                        if (announceURL == null) {
+                            _manager.addMessage(_("Error - Cannot include alternate trackers without a primary tracker"));
+                            return;
+                        }
+                        backupURLs.add(0, announceURL);
+                        boolean hasPrivate = false;
+                        boolean hasPublic = false;
+                        for (String url : backupURLs) {
+                            if (_manager.getPrivateTrackers().contains(announceURL))
+                                hasPrivate = true;
+                            else
+                                hasPublic = true;
+                        }
+                        if (hasPrivate && hasPublic) {
+                            _manager.addMessage(_("Error - Cannot mix private and public trackers in a torrent"));
+                            return;
+                        }
+                        announceList = new ArrayList(backupURLs.size());
+                        for (String url : backupURLs) {
+                            announceList.add(Collections.singletonList(url));
+                        }
+                    }
                    try {
                        // This may take a long time to check the storage, but since it already exists,
                        // it shouldn't be THAT bad, so keep it in this thread.
+                        // TODO thread it for big torrents, perhaps a la FetchAndAdd
                        boolean isPrivate = _manager.getPrivateTrackers().contains(announceURL);
-                        Storage s = new Storage(_manager.util(), baseFile, announceURL, isPrivate, null);
+                        Storage s = new Storage(_manager.util(), baseFile, announceURL, announceList, isPrivate, null);
                        s.close(); // close the files... maybe need a way to pass this Storage to addTorrent rather than starting over
                        MetaInfo info = s.getMetaInfo();
                        File torrentFile = new File(_manager.getDataDir(), s.getBaseName() + ".torrent");
@ -770,6 +814,22 @@ public class I2PSnarkServlet extends DefaultServlet {
        }
    }

+    /**
+     *  Redirect a POST to a GET (P-R-G), preserving the peer string
+     *  @since 0.9.5
+     */
+    private void sendRedirect(HttpServletRequest req, HttpServletResponse resp, String p) throws IOException {
+        String url = req.getRequestURL().toString();
+        StringBuilder buf = new StringBuilder(128);
+        if (url.endsWith("_post"))
+            url = url.substring(0, url.length() - 5);
+        buf.append(url);
+        if (p.length() > 0)
+            buf.append('?').append(p);
+        resp.setHeader("Location", buf.toString());
+        resp.sendError(302, "Moved");
+    }
+
    /** @since 0.9 */
    private void processTrackerForm(String action, HttpServletRequest req) {
        if (action.equals(_("Delete selected")) || action.equals(_("Save tracker configuration"))) {
@ -988,14 +1048,24 @@ public class I2PSnarkServlet extends DefaultServlet {
        
        String rowClass = (row % 2 == 0 ? "snarkTorrentEven" : "snarkTorrentOdd");
        String statusString;
-        if (err != null) {
-            if (isRunning && curPeers > 0 && !showPeers)
-                statusString = "<img alt=\"\" border=\"0\" src=\"" + _imgPath + "trackererror.png\" title=\"" + err + "\"></td>" +
-                               "<td class=\"snarkTorrentStatus " + rowClass + "\">" + _("Tracker Error") +
-                               ": <a href=\"" + uri + "?p=" + Base64.encode(snark.getInfoHash()) + "\">" +
-                               curPeers + thinsp(noThinsp) +
-                               ngettext("1 peer", "{0} peers", knownPeers) + "</a>";
-            else if (isRunning)
+        if (snark.isChecking()) {
+            statusString = "<img alt=\"\" border=\"0\" src=\"" + _imgPath + "stalled.png\" title=\"" + _("Checking") + "\"></td>" +
+                           "<td class=\"snarkTorrentStatus " + rowClass + "\">" + _("Checking");
+        } else if (snark.isAllocating()) {
+            statusString = "<img alt=\"\" border=\"0\" src=\"" + _imgPath + "stalled.png\" title=\"" + _("Allocating") + "\"></td>" +
+                           "<td class=\"snarkTorrentStatus " + rowClass + "\">" + _("Allocating");
+        } else if (err != null && curPeers == 0) {
+            // Also don't show if seeding... but then we won't see the not-registered error
+            //       && remaining != 0 && needed != 0) {
+            // let's only show this if we have no peers, otherwise PEX and DHT should bail us out, user doesn't care
+            //if (isRunning && curPeers > 0 && !showPeers)
+            //    statusString = "<img alt=\"\" border=\"0\" src=\"" + _imgPath + "trackererror.png\" title=\"" + err + "\"></td>" +
+            //                   "<td class=\"snarkTorrentStatus " + rowClass + "\">" + _("Tracker Error") +
+            //                   ": <a href=\"" + uri + "?p=" + Base64.encode(snark.getInfoHash()) + "\">" +
+            //                   curPeers + thinsp(noThinsp) +
+            //                   ngettext("1 peer", "{0} peers", knownPeers) + "</a>";
+            //else if (isRunning)
+            if (isRunning)
                statusString = "<img alt=\"\" border=\"0\" src=\"" + _imgPath + "trackererror.png\" title=\"" + err + "\"></td>" +
                               "<td class=\"snarkTorrentStatus " + rowClass + "\">" + _("Tracker Error") +
                               ": " + curPeers + thinsp(noThinsp) +
@ -1142,7 +1212,7 @@ public class I2PSnarkServlet extends DefaultServlet {
            out.write("</a>");

        out.write("<td align=\"right\" class=\"snarkTorrentETA " + rowClass + "\">");
-        if(isRunning && remainingSeconds > 0)
+        if(isRunning && remainingSeconds > 0 && !snark.isChecking())
            out.write(DataHelper.formatDuration2(Math.max(remainingSeconds, 10) * 1000)); // (eta 6h)
        out.write("</td>\n\t");
        out.write("<td align=\"right\" class=\"snarkTorrentDownloaded " + rowClass + "\">");
@ -1170,7 +1240,9 @@ public class I2PSnarkServlet extends DefaultServlet {
        String b64 = Base64.encode(snark.getInfoHash());
        if (showPeers)
            parameters = parameters + "&p=1";
-        if (isRunning) {
+        if (snark.isChecking()) {
+            // show no buttons
+        } else if (isRunning) {
            // Stop Button
            if (isDegraded)
                out.write("<a href=\"/i2psnark/?action=Stop_" + b64 + "&amp;nonce=" + _nonce + "\"><img title=\"");
@ -1361,6 +1433,7 @@ public class I2PSnarkServlet extends DefaultServlet {
    }

    /**
+     *  Start of anchor only, caller must add anchor text or img and close anchor
     *  @return string or null
     *  @since 0.8.4
     */
@ -1388,6 +1461,7 @@ public class I2PSnarkServlet extends DefaultServlet {
    }

    /**
+     *  Full anchor with img
     *  @return string or null
     *  @since 0.8.4
     */
@ -1403,6 +1477,29 @@ public class I2PSnarkServlet extends DefaultServlet {
        return null;
    }

+    /**
+     *  Full anchor with shortened URL as anchor text
+     *  @return string, non-null
+     *  @since 0.9.5
+     */
+    private String getShortTrackerLink(String announce, byte[] infohash) {
+        StringBuilder buf = new StringBuilder(128);
+        String trackerLinkUrl = getTrackerLinkUrl(announce, infohash);
+        if (trackerLinkUrl != null)
+            buf.append(trackerLinkUrl);
+        if (announce.startsWith("http://"))
+            announce = announce.substring(7);
+        int slsh = announce.indexOf('/');
+        if (slsh > 0)
+            announce = announce.substring(0, slsh);
+        if (announce.length() > 67)
+            announce = announce.substring(0, 40) + "&hellip;" + announce.substring(announce.length() - 8);
+        buf.append(announce);
+        if (trackerLinkUrl != null)
+            buf.append("</a>");
+        return buf.toString();
+    }
+
    private void writeAddForm(PrintWriter out, HttpServletRequest req) throws IOException {
        // display incoming parameter if a GET so links will work
        String newURL = req.getParameter("newURL");
@ -1471,33 +1568,43 @@ public class I2PSnarkServlet extends DefaultServlet {
                  + "\" title=\"");
        out.write(_("File or directory to seed (must be within the specified path)"));
        out.write("\" ><tr><td>\n");
-        out.write(_("Tracker"));
-        out.write(":<td><select name=\"announceURL\"><option value=\"\">");
-        out.write(_("Select a tracker"));
-        out.write("</option>\n");
-        // todo remember this one with _lastAnnounceURL also
-        out.write("<option value=\"none\">");
-        //out.write(_("Open trackers and DHT only"));
-        out.write(_("Open trackers only"));
-        out.write("</option>\n");
+        out.write(_("Trackers"));
+        out.write(":<td><table style=\"width: 30%;\"><tr><td></td><td align=\"center\">");
+        out.write(_("Primary"));
+        out.write("</td><td align=\"center\">");
+        out.write(_("Alternates"));
+        out.write("</td><td rowspan=\"0\">" +
+                  " <input type=\"submit\" class=\"create\" value=\"");
+        out.write(_("Create torrent"));
+        out.write("\" name=\"foo\" >" +
+                  "</td></tr>\n");
        for (Tracker t : sortedTrackers) {
            String name = t.name;
            String announceURL = t.announceURL.replace("&#61;", "=");
+            out.write("<tr><td>");
+            out.write(name);
+            out.write("</td><td align=\"center\"><input type=\"radio\" name=\"announceURL\" value=\"");
+            out.write(announceURL);
+            out.write("\"");
            if (announceURL.equals(_lastAnnounceURL))
-                announceURL += "\" selected=\"selected";
-            out.write("\t<option value=\"" + announceURL + "\">" + name + "</option>\n");
+                out.write(" checked");
+            out.write("></td><td align=\"center\"><input type=\"checkbox\" name=\"backup_");
+            out.write(announceURL);
+            out.write("\" value=\"foo\"></td></tr>\n");
        }
-        out.write("</select>\n");
+        out.write("<tr><td><i>");
+        out.write(_("none"));
+        out.write("</i></td><td align=\"center\"><input type=\"radio\" name=\"announceURL\" value=\"none\"");
+        if (_lastAnnounceURL == null)
+            out.write(" checked");
+        out.write("></td><td></td></tr></table>\n");
        // make the user add a tracker on the config form now
        //out.write(_("or"));
        //out.write("&nbsp;<input type=\"text\" name=\"announceURLOther\" size=\"57\" value=\"http://\" " +
        //          "title=\"");
        //out.write(_("Specify custom tracker announce URL"));
        //out.write("\" > " +
-        out.write(" <input type=\"submit\" class=\"create\" value=\"");
-        out.write(_("Create torrent"));
-        out.write("\" name=\"foo\" >\n" +
-                  "</td></tr>" +
+        out.write("</td></tr>" +
                  "</table>\n" +
                  "</form></div></div>");        
    }
@ -1627,7 +1734,7 @@ public class I2PSnarkServlet extends DefaultServlet {
        out.write("\" ></td></tr>\n" +
        
                  "<tr><td>");
-        out.write(_("Enable DHT") + " (**BETA**)");
+        out.write(_("Enable DHT"));
        out.write(": <td><input type=\"checkbox\" class=\"optbox\" name=\"useDHT\" value=\"true\" " 
                  + (useDHT ? "checked " : "") 
                  + "title=\"");
@ -1684,10 +1791,11 @@ public class I2PSnarkServlet extends DefaultServlet {
        out.write(_("I2CP options"));
        out.write(": <td><textarea name=\"i2cpOpts\" cols=\"60\" rows=\"1\" wrap=\"off\" spellcheck=\"false\" >"
                  + opts.toString() + "</textarea><br>\n" +
-
+                  "<tr><td colspan=\"2\">&nbsp;\n" +  // spacer
                  "<tr><td>&nbsp;<td><input type=\"submit\" class=\"accept\" value=\"");
        out.write(_("Save configuration"));
        out.write("\" name=\"foo\" >\n" +
+                  "<tr><td colspan=\"2\">&nbsp;\n" +  // spacer
                  "</table></div></div></form>");
    }
    
@ -1753,6 +1861,7 @@ public class I2PSnarkServlet extends DefaultServlet {
                   "<td><input type=\"checkbox\" class=\"optbox\" name=\"_add_open_\"></td>" +
                   "<td><input type=\"checkbox\" class=\"optbox\" name=\"_add_private_\"></td>" +
                   "<td><input type=\"text\" class=\"trackerannounce\" name=\"taurl\"></td></tr>\n" +
+                   "<tr><td colspan=\"6\">&nbsp;</td></tr>\n" +  // spacer
                   "<tr><td colspan=\"2\"></td><td colspan=\"4\">\n" +
                   "<input type=\"submit\" name=\"taction\" class=\"default\" value=\"").append(_("Add tracker")).append("\">\n" +
                   "<input type=\"submit\" name=\"taction\" class=\"delete\" value=\"").append(_("Delete selected")).append("\">\n" +
@ -1760,7 +1869,9 @@ public class I2PSnarkServlet extends DefaultServlet {
                   // "<input type=\"reset\" class=\"cancel\" value=\"").append(_("Cancel")).append("\">\n" +
                   "<input type=\"submit\" name=\"taction\" class=\"reload\" value=\"").append(_("Restore defaults")).append("\">\n" +
                   "<input type=\"submit\" name=\"taction\" class=\"add\" value=\"").append(_("Add tracker")).append("\">\n" +
-                   "</td></tr></table></div></div></form>\n");
+                   "</td></tr>" +
+                   "<tr><td colspan=\"6\">&nbsp;</td></tr>\n" +  // spacer
+                   "</table></div></div></form>\n");
        out.write(buf.toString());
    }

@ -1777,165 +1888,15 @@ public class I2PSnarkServlet extends DefaultServlet {
     *  @since 0.8.4
     */
    private void addMagnet(String url) {
-        String ihash;
-        String name;
-        String trackerURL = null;
-        if (url.startsWith(MAGNET)) {
-            // magnet:?xt=urn:btih:0691e40aae02e552cfcb57af1dca56214680c0c5&tr=http://tracker2.postman.i2p/announce.php
-            String xt = getParam("xt", url);
-            if (xt == null || !xt.startsWith("urn:btih:")) {
-                _manager.addMessage(_("Invalid magnet URL {0}", url));
-                return;
-            }
-            ihash = xt.substring("urn:btih:".length());
-            trackerURL = getTrackerParam(url);
-            name = _("Magnet") + ' ' + ihash;
-            String dn = getParam("dn", url);
-            if (dn != null)
-                name += " (" + Storage.filterName(dn) + ')';
-        } else if (url.startsWith(MAGGOT)) {
-            // maggot://0691e40aae02e552cfcb57af1dca56214680c0c5:0b557bbdf8718e95d352fbe994dec3a383e2ede7
-            ihash = url.substring(MAGGOT.length()).trim();
-            int col = ihash.indexOf(':');
-            if (col >= 0)
-                ihash = ihash.substring(0, col);
-            name = _("Magnet") + ' ' + ihash;
-        } else {
-            return;
+        try {
+            MagnetURI magnet = new MagnetURI(_manager.util(), url);
+            String name = magnet.getName();
+            byte[] ih = magnet.getInfoHash();
+            String trackerURL = magnet.getTrackerURL();
+            _manager.addMagnet(name, ih, trackerURL, true);
+        } catch (IllegalArgumentException iae) {
+            _manager.addMessage(_("Invalid magnet URL {0}", url));
        }
-        byte[] ih = null;
-        if (ihash.length() == 32) {
-            ih = Base32.decode(ihash);
-        } else if (ihash.length() == 40) {
-            //  Like DataHelper.fromHexString() but ensures no loss of leading zero bytes
-            ih = new byte[20];
-            try {
-                for (int i = 0; i < 20; i++) {
-                    ih[i] = (byte) (Integer.parseInt(ihash.substring(i*2, (i*2) + 2), 16) & 0xff);
-                }
-            } catch (NumberFormatException nfe) {
-                ih = null;
-            }
-        }
-        if (ih == null || ih.length != 20) {
-            _manager.addMessage(_("Invalid info hash in magnet URL {0}", url));
-            return;
-        }
-        _manager.addMagnet(name, ih, trackerURL, true);
-    }
-
-    /**
-     *  @return first decoded parameter or null
-     */
-    private static String getParam(String key, String uri) {
-        int idx = uri.indexOf('?' + key + '=');
-        if (idx >= 0) {
-            idx += key.length() + 2;
-        } else {
-            idx = uri.indexOf('&' + key + '=');
-            if (idx >= 0)
-                idx += key.length() + 2;
-        }
-        if (idx < 0 || idx > uri.length())
-            return null;
-        String rv = uri.substring(idx);
-        idx = rv.indexOf('&');
-        if (idx >= 0)
-            rv = rv.substring(0, idx);
-        else
-            rv = rv.trim();
-        return decode(rv);
-    }
-
-    /**
-     *  @return all decoded parameters or null
-     *  @since 0.9.1
-     */
-    private static List<String> getMultiParam(String key, String uri) {
-        int idx = uri.indexOf('?' + key + '=');
-        if (idx >= 0) {
-            idx += key.length() + 2;
-        } else {
-            idx = uri.indexOf('&' + key + '=');
-            if (idx >= 0)
-                idx += key.length() + 2;
-        }
-        if (idx < 0 || idx > uri.length())
-            return null;
-        List<String> rv = new ArrayList();
-        while (true) {
-            String p = uri.substring(idx);
-            uri = p;
-            idx = p.indexOf('&');
-            if (idx >= 0)
-                p = p.substring(0, idx);
-            else
-                p = p.trim();
-            rv.add(decode(p));
-            idx = uri.indexOf('&' + key + '=');
-            if (idx < 0)
-                break;
-            idx += key.length() + 2;
-        }
-        return rv;
-    }
-
-    /**
-     *  @return first valid I2P tracker or null
-     *  @since 0.9.1
-     */
-    private static String getTrackerParam(String uri) {
-        List<String> trackers = getMultiParam("tr", uri);
-        if (trackers == null)
-            return null;
-        for (String t : trackers) {
-            try {
-                URI u = new URI(t);
-                String protocol = u.getScheme();
-                String host = u.getHost();
-                if (protocol == null || host == null ||
-                    !protocol.toLowerCase(Locale.US).equals("http") ||
-                    !host.toLowerCase(Locale.US).endsWith(".i2p"))
-                    continue;
-                return t;
-            } catch(URISyntaxException use) {}
-        }
-        return null;
-    }
-
-    /**
-     *  Decode %xx encoding, convert to UTF-8 if necessary
-     *  Copied from i2ptunnel LocalHTTPServer
-     *  @since 0.9.1
-     */
-    private static String decode(String s) {
-        if (!s.contains("%"))
-            return s;
-        StringBuilder buf = new StringBuilder(s.length());
-        boolean utf8 = false;
-        for (int i = 0; i < s.length(); i++) {
-            char c = s.charAt(i);
-            if (c != '%') {
-                buf.append(c);
-            } else {
-                try {
-                    int val = Integer.parseInt(s.substring(++i, (++i) + 1), 16);
-                    if ((val & 0x80) != 0)
-                        utf8 = true;
-                    buf.append((char) val);
-                } catch (IndexOutOfBoundsException ioobe) {
-                    break;
-                } catch (NumberFormatException nfe) {
-                    break;
-                }
-            }
-        }
-        if (utf8) {
-            try {
-                return new String(buf.toString().getBytes("ISO-8859-1"), "UTF-8");
-            } catch (UnsupportedEncodingException uee) {}
-        }
-        return buf.toString();
    }

    /** copied from ConfigTunnelsHelper */
@ -2067,7 +2028,7 @@ public class I2PSnarkServlet extends DefaultServlet {
     * @param base The base URL
     * @param parent True if the parent directory should be included
     * @param postParams map of POST parameters or null if not a POST
-     * @return String of HTML
+     * @return String of HTML or null if postParams != null
     * @since 0.7.14
     */
    private String getListHTML(Resource r, String base, boolean parent, Map postParams)
@ -2079,8 +2040,6 @@ public class I2PSnarkServlet extends DefaultServlet {
            Arrays.sort(ls, Collator.getInstance());
        }  // if r is not a directory, we are only showing torrent info section
        
-        StringBuilder buf=new StringBuilder(4096);
-        buf.append(DOCTYPE + "<HTML><HEAD><TITLE>");
        String title = URIUtil.decodePath(base);
        if (title.startsWith("/i2psnark/"))
            title = title.substring("/i2psnark/".length());
@ -2094,9 +2053,14 @@ public class I2PSnarkServlet extends DefaultServlet {
            torrentName = title;
        Snark snark = _manager.getTorrentByBaseName(torrentName);

-        if (snark != null && postParams != null)
+        if (snark != null && postParams != null) {
+            // caller must P-R-G
            savePriorities(snark, postParams);
+            return null;
+        }

+        StringBuilder buf=new StringBuilder(4096);
+        buf.append(DOCTYPE).append("<HTML><HEAD><TITLE>");
        if (title.endsWith("/"))
            title = title.substring(0, title.length() - 1);
        String directory = title;
@ -2137,20 +2101,26 @@ public class I2PSnarkServlet extends DefaultServlet {
                    String trackerLink = getTrackerLink(announce, snark.getInfoHash());
                    if (trackerLink != null)
                        buf.append(trackerLink).append(' ');
-                    buf.append("<b>").append(_("Tracker")).append(":</b> ");
-                    String trackerLinkUrl = getTrackerLinkUrl(announce, snark.getInfoHash());
-                    if (trackerLinkUrl != null)
-                        buf.append(trackerLinkUrl);
-                    if (announce.startsWith("http://"))
-                        announce = announce.substring(7);
-                    int slsh = announce.indexOf('/');
-                    if (slsh > 0)
-                        announce = announce.substring(0, slsh);
-                    if (announce.length() > 67)
-                        announce = announce.substring(0, 40) + "&hellip;" + announce.substring(announce.length() - 8);
-                    buf.append(announce);
-                    if (trackerLinkUrl != null)
-                        buf.append("</a>");
+                    buf.append("<b>").append(_("Primary Tracker")).append(":</b> ");
+                    buf.append(getShortTrackerLink(announce, snark.getInfoHash()));
+                    buf.append("</td></tr>");
+                }
+                List<List<String>> alist = meta.getAnnounceList();
+                if (alist != null) {
+                    buf.append("<tr><td><b>");
+                    buf.append(_("Tracker List")).append(":</b> ");
+                    for (List<String> alist2 : alist) {
+                        buf.append('[');
+                        boolean more = false;
+                        for (String s : alist2) {
+                            if (more)
+                                buf.append(' ');
+                            else
+                                more = true;
+                            buf.append(getShortTrackerLink(s, snark.getInfoHash()));
+                        }
+                        buf.append("] ");
+                    }
                    buf.append("</td></tr>");
                }
            }
@ -2158,11 +2128,11 @@ public class I2PSnarkServlet extends DefaultServlet {
            String hex = I2PSnarkUtil.toHex(snark.getInfoHash());
            if (meta == null || !meta.isPrivate()) {
                buf.append("<tr><td><a href=\"")
-                   .append(MAGNET_FULL).append(hex).append("\">")
+                   .append(MagnetURI.MAGNET_FULL).append(hex).append("\">")
                   .append(toImg("magnet", _("Magnet link")))
                   .append("</a> <b>Magnet:</b> <a href=\"")
-                   .append(MAGNET_FULL).append(hex).append("\">")
-                   .append(MAGNET_FULL).append(hex).append("</a>")
+                   .append(MagnetURI.MAGNET_FULL).append(hex).append("\">")
+                   .append(MagnetURI.MAGNET_FULL).append(hex).append("</a>")
                   .append("</td></tr>\n");
            } else {
                buf.append("<tr><td>")
--- a/apps/i2psnark/locale/messages_de.po
+++ b/apps/i2psnark/locale/messages_de.po
--- a/apps/i2psnark/locale/messages_en.po
+++ b/apps/i2psnark/locale/messages_en.po
--- a/apps/i2psnark/locale/messages_es.po
+++ b/apps/i2psnark/locale/messages_es.po
--- a/apps/i2psnark/locale/messages_fr.po
+++ b/apps/i2psnark/locale/messages_fr.po
--- a/apps/i2psnark/locale/messages_hu.po
+++ b/apps/i2psnark/locale/messages_hu.po
--- a/apps/i2psnark/locale/messages_it.po
+++ b/apps/i2psnark/locale/messages_it.po
--- a/apps/i2psnark/locale/messages_nb.po
+++ b/apps/i2psnark/locale/messages_nb.po
--- a/apps/i2psnark/locale/messages_pl.po
+++ b/apps/i2psnark/locale/messages_pl.po
--- a/apps/i2psnark/locale/messages_pt.po
+++ b/apps/i2psnark/locale/messages_pt.po
--- a/apps/i2psnark/locale/messages_ru.po
+++ b/apps/i2psnark/locale/messages_ru.po
--- a/apps/i2psnark/locale/messages_sv.po
+++ b/apps/i2psnark/locale/messages_sv.po
--- a/apps/i2psnark/locale/messages_zh.po
+++ b/apps/i2psnark/locale/messages_zh.po
--- a/apps/i2ptunnel/java/.classpath
+++ b/apps/i2ptunnel/java/.classpath
@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="src" path="src"/>
+	<classpathentry kind="src" path="test/junit"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/i2p_sdk"/>
+	<classpathentry combineaccessrules="false" kind="src" path="/ministreaming"/>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
+	<classpathentry kind="con" path="org.eclipse.jdt.junit.JUNIT_CONTAINER/4"/>
+	<classpathentry kind="output" path="build/obj"/>
+</classpath>
--- a/apps/i2ptunnel/java/.project
+++ b/apps/i2ptunnel/java/.project
@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>i2ptunnel</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+	</natures>
+</projectDescription>
--- a/apps/i2ptunnel/java/build.xml
+++ b/apps/i2ptunnel/java/build.xml
@ -21,6 +21,9 @@
        </depend>
    </target>

+    <condition property="no.bundle">
+        <isfalse value="${require.gettext}" />
+    </condition>
    <property name="javac.compilerargs" value="" />
    <property name="require.gettext" value="true" />

@ -84,7 +87,7 @@
        </condition>
    </target>

-    <target name="bundle" depends="compile, precompilejsp">
+    <target name="bundle" depends="compile, precompilejsp" unless="no.bundle">
        <!-- Update the messages_*.po files.
             We need to supply the bat file for windows, and then change the fail property to true -->
        <exec executable="sh" osfamily="unix" failifexecutionfails="true" failonerror="${require.gettext}" >
@ -179,6 +182,7 @@
                <pathelement location="${ant.home}/lib/ant.jar" />
                <pathelement location="build/i2ptunnel.jar" />
                <pathelement location="build/temp-beans.jar" />
+                <pathelement location="../../../core/java/build/i2p.jar" />
            </classpath>
            <arg value="-d" />
            <arg value="../jsp/WEB-INF/classes" />
@ -202,6 +206,7 @@
                <pathelement location="../../jetty/jettylib/jsp-api.jar" />
                <pathelement location="build/i2ptunnel.jar" />
                <pathelement location="build/temp-beans.jar" />
+                <pathelement location="../../../core/java/build/i2p.jar" />
            </classpath>
        </javac>
        <copy file="../jsp/web.xml" tofile="../jsp/web-out.xml" />
@ -213,6 +218,7 @@

    <uptodate property="precompilejsp.uptodate" targetfile="../jsp/web-out.xml">
        <srcfiles dir= "../jsp" includes="*.jsp, *.html, web.xml"/>
+        <srcfiles dir= "src/net/i2p/i2ptunnel/web" includes="*.java"/>
    </uptodate>

    <target name="javadoc">
@ -230,7 +236,7 @@
        <mkdir dir="./build" />
        <mkdir dir="./build/obj" />
        <!-- We need the ant runtime, as it includes junit -->
-        <javac srcdir="./src:./test" debug="true" source="1.5" target="1.5"
+        <javac srcdir="./src:./test/junit" debug="true" source="1.5" target="1.5"
               includeAntRuntime="true"
               deprecation="on" destdir="./build/obj" >
            <compilerarg line="${javac.compilerargs}" />
@ -248,7 +254,7 @@
                <pathelement location="../../../core/java/build/i2p.jar" />
            </classpath>
            <batchtest>
-                <fileset dir="./test/">
+                <fileset dir="./test/junit/">
                    <include name="**/*Test.java" />
                </fileset>
            </batchtest>
--- a/apps/i2ptunnel/java/bundle-messages.sh
+++ b/apps/i2ptunnel/java/bundle-messages.sh
@ -1,4 +1,5 @@
-#
+#!/bin/sh
+
 # Update messages_xx.po and messages_xx.class files,
 # from both java and jsp sources.
 # Requires installed programs xgettext, msgfmt, msgmerge, and find.
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java
@ -54,9 +54,7 @@ class HTTPResponseOutputStream extends FilterOutputStream {
    public HTTPResponseOutputStream(OutputStream raw) {
        super(raw);
        _context = I2PAppContext.getGlobalContext();
-        _context.statManager().createRateStat("i2ptunnel.httpCompressionRatio", "ratio of compressed size to decompressed size after transfer", "I2PTunnel", new long[] { 60*60*1000 });
-        _context.statManager().createRateStat("i2ptunnel.httpCompressed", "compressed size transferred", "I2PTunnel", new long[] { 60*60*1000 });
-        _context.statManager().createRateStat("i2ptunnel.httpExpanded", "size transferred after expansion", "I2PTunnel", new long[] { 60*60*1000 });
+        // all createRateStat in I2PTunnelHTTPClient.startRunning()
        _log = _context.logManager().getLog(getClass());
        _headerBuffer = _cache.acquire();
        _buf1 = new byte[1];
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnel.java
@ -694,7 +694,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
    public void runClient(String args[], Logging l) {
        boolean isShared = true;
        if (args.length >= 3)
-            isShared = Boolean.valueOf(args[2].trim()).booleanValue();
+            isShared = Boolean.parseBoolean(args[2].trim());
        if (args.length >= 2) {
            int portNum = -1;
            try {
@ -717,7 +717,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
                addtask(task);
                notifyEvent("clientTaskId", Integer.valueOf(task.getId()));
            } catch (IllegalArgumentException iae) {
-                String msg = "Invalid I2PTunnel configuration to create an HTTP Proxy connecting to the router at " + host + ':'+ port +
+                String msg = "Invalid I2PTunnel configuration to create a standard client tunnel connecting to the router at " + host + ':'+ port +
                             " and listening on " + listenHost + ':' + portNum;
                _log.error(getPrefix() + msg, iae);
                l.log(msg);
@ -766,7 +766,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
            String proxy = "";
            boolean isShared = true;
            if (args.length > 1) {
-                if (Boolean.valueOf(args[1].trim()).booleanValue()) {
+                if (Boolean.parseBoolean(args[1].trim())) {
                    isShared = true;
                    if (args.length == 3)
                        proxy = args[2];
@ -835,7 +835,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
            String proxy = "";
            boolean isShared = true;
            if (args.length > 1) {
-                if (Boolean.valueOf(args[1].trim()).booleanValue()) {
+                if (Boolean.parseBoolean(args[1].trim())) {
                    isShared = true;
                    if (args.length == 3)
                        proxy = args[2];
@ -906,7 +906,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {
            
            boolean isShared = true;
            if (args.length > 2) {
-                if (Boolean.valueOf(args[2].trim()).booleanValue()) {
+                if (Boolean.parseBoolean(args[2].trim())) {
                    isShared = true;
                } else if ("false".equalsIgnoreCase(args[2].trim())) {
                    _log.warn("args[2] == [" + args[2] + "] and rejected explicitly");
@ -973,7 +973,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {

            boolean isShared = false;
            if (args.length > 1)
-                isShared = Boolean.valueOf(args[1].trim()).booleanValue();
+                isShared = Boolean.parseBoolean(args[1].trim());

            ownDest = !isShared;
            try {
@ -1017,7 +1017,7 @@ public class I2PTunnel extends EventDispatcherImpl implements Logging {

            boolean isShared = false;
            if (args.length == 2)
-                isShared = Boolean.valueOf(args[1].trim()).booleanValue();
+                isShared = Boolean.parseBoolean(args[1].trim());

            ownDest = !isShared;
            String privateKeyFile = null;
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelClientBase.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelClientBase.java
@ -190,11 +190,11 @@ public abstract class I2PTunnelClientBase extends I2PTunnelTask implements Runna
        // no need to load the netDb with leaseSets for destinations that will never 
        // be looked up
        boolean dccEnabled = (this instanceof I2PTunnelIRCClient) &&
-                      Boolean.valueOf(tunnel.getClientOptions().getProperty(I2PTunnelIRCClient.PROP_DCC)).booleanValue();
+                      Boolean.parseBoolean(tunnel.getClientOptions().getProperty(I2PTunnelIRCClient.PROP_DCC));
        if (!dccEnabled)
            tunnel.getClientOptions().setProperty("i2cp.dontPublishLeaseSet", "true");
        
-        boolean openNow = !Boolean.valueOf(tunnel.getClientOptions().getProperty("i2cp.delayOpen")).booleanValue();
+        boolean openNow = !Boolean.parseBoolean(tunnel.getClientOptions().getProperty("i2cp.delayOpen"));
        if (openNow) {
            while (sockMgr == null) {
                verifySocketManager();
@ -258,8 +258,8 @@ public abstract class I2PTunnelClientBase extends I2PTunnelTask implements Runna
                if (sess == null) {
                    newManager = true;
                } else if (sess.isClosed() &&
-                           Boolean.valueOf(getTunnel().getClientOptions().getProperty("i2cp.closeOnIdle")).booleanValue() &&
-                           Boolean.valueOf(getTunnel().getClientOptions().getProperty("i2cp.newDestOnResume")).booleanValue()) {
+                           Boolean.parseBoolean(getTunnel().getClientOptions().getProperty("i2cp.closeOnIdle")) &&
+                           Boolean.parseBoolean(getTunnel().getClientOptions().getProperty("i2cp.newDestOnResume"))) {
                    // build a new socket manager and a new dest if the session is closed.
                    getTunnel().removeSession(sess);
                    if (_log.shouldLog(Log.WARN))
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelConnectClient.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelConnectClient.java
@ -13,6 +13,7 @@ import java.util.Locale;
 import java.util.Properties;
 import java.util.StringTokenizer;

+import net.i2p.I2PAppContext;
 import net.i2p.I2PException;
 import net.i2p.client.streaming.I2PSocket;
 import net.i2p.client.streaming.I2PSocketOptions;
@ -20,7 +21,6 @@ import net.i2p.data.Base64;
 import net.i2p.data.DataHelper;
 import net.i2p.data.Destination;
 import net.i2p.util.EventDispatcher;
-import net.i2p.util.FileUtil;
 import net.i2p.util.Log;
 import net.i2p.util.PortMapper;

@ -58,6 +58,8 @@ import net.i2p.util.PortMapper;
 */
 public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements Runnable {

+    public static final String AUTH_REALM = "I2P SSL Proxy";
+
    private final static byte[] ERR_DESTINATION_UNKNOWN =
        ("HTTP/1.1 503 Service Unavailable\r\n"+
         "Content-Type: text/html; charset=iso-8859-1\r\n"+
@ -89,17 +91,6 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
         "Your browser is misconfigured. Do not use the proxy to access the router console or other localhost destinations.<BR>")
        .getBytes();
    
-    private final static byte[] ERR_AUTH =
-        ("HTTP/1.1 407 Proxy Authentication Required\r\n"+
-         "Content-Type: text/html; charset=UTF-8\r\n"+
-         "Cache-control: no-cache\r\n"+
-         "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.5\r\n" +         // try to get a UTF-8-encoded response back for the password
-         "Proxy-Authenticate: Basic realm=\"I2P SSL Proxy\"\r\n" +
-         "\r\n"+
-         "<html><body><H1>I2P ERROR: PROXY AUTHENTICATION REQUIRED</H1>"+
-         "This proxy is configured to require authentication.<BR>")
-        .getBytes();
-
    private final static byte[] SUCCESS_RESPONSE =
        ("HTTP/1.1 200 Connection Established\r\n"+
         "Proxy-agent: I2P\r\n"+
@ -165,6 +156,11 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
        return super.close(forced);
    }

+    /** @since 0.9.4 */
+    protected String getRealm() {
+        return AUTH_REALM;
+    }
+
    protected void clientConnectionRun(Socket s) {
        InputStream in = null;
        OutputStream out = null;
@ -237,10 +233,10 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
                        _log.debug(getPrefix(requestId) + "REST  :" + restofline + ":");
                        _log.debug(getPrefix(requestId) + "DEST  :" + destination + ":");
                    }
-                } else if (line.toLowerCase(Locale.US).startsWith("proxy-authorization: basic ")) {
+                } else if (line.toLowerCase(Locale.US).startsWith("proxy-authorization: ")) {
                    // strip Proxy-Authenticate from the response in HTTPResponseOutputStream
                    // save for auth check below
-                    authorization = line.substring(27);  // "proxy-authorization: basic ".length()
+                    authorization = line.substring(21);  // "proxy-authorization: ".length()
                    line = null;
                } else if (line.length() > 0) {
                    // Additional lines - shouldn't be too many. Firefox sends:
@ -253,7 +249,7 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
                    line = null;
                } else {
                    // Add Proxy-Authentication header for next hop (outproxy)
-                    if (usingWWWProxy && Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_AUTH)).booleanValue()) {
+                    if (usingWWWProxy && Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_AUTH))) {
                        // specific for this proxy
                        String user = getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_USER_PREFIX + currentProxy);
                        String pw = getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_PW_PREFIX + currentProxy);
@ -281,30 +277,26 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
            }
            
            // Authorization
-            if (!authorize(s, requestId, authorization)) {
+            AuthResult result = authorize(s, requestId, method, authorization);
+            if (result != AuthResult.AUTH_GOOD) {
                if (_log.shouldLog(Log.WARN)) {
                    if (authorization != null)
                        _log.warn(getPrefix(requestId) + "Auth failed, sending 407 again");
                    else
                        _log.warn(getPrefix(requestId) + "Auth required, sending 407");
                }
-                writeErrorMessage(ERR_AUTH, out);
+                out.write(getAuthError(result == AuthResult.AUTH_STALE).getBytes());
                s.close();
                return;
            }

            Destination clientDest = _context.namingService().lookup(destination);
            if (clientDest == null) {
-                String str;
                byte[] header;
                if (usingWWWProxy)
-                    str = FileUtil.readTextFile((new File(_errorDir, "dnfp-header.ht")).getAbsolutePath(), 100, true);
+                    header = getErrorPage("dnfp-header.ht", ERR_DESTINATION_UNKNOWN);
                else
-                    str = FileUtil.readTextFile((new File(_errorDir, "dnfh-header.ht")).getAbsolutePath(), 100, true);
-                if (str != null)
-                    header = str.getBytes();
-                else
-                    header = ERR_DESTINATION_UNKNOWN;
+                    header = getErrorPage("dnfh-header.ht", ERR_DESTINATION_UNKNOWN);
                writeErrorMessage(header, out, targetRequest, usingWWWProxy, destination);
                s.close();
                return;
@ -341,12 +333,13 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
    }

    private static class OnTimeout implements Runnable {
-        private Socket _socket;
-        private OutputStream _out;
-        private String _target;
-        private boolean _usingProxy;
-        private String _wwwProxy;
-        private long _requestId;
+        private final Socket _socket;
+        private final OutputStream _out;
+        private final String _target;
+        private final boolean _usingProxy;
+        private final String _wwwProxy;
+        private final long _requestId;
+
        public OnTimeout(Socket s, OutputStream out, String target, boolean usingProxy, String wwwProxy, long id) {
            _socket = s;
            _out = out;
@ -355,6 +348,7 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
            _wwwProxy = wwwProxy;
            _requestId = id;
        }
+
        public void run() {
            //if (_log.shouldLog(Log.DEBUG))
            //    _log.debug("Timeout occured requesting " + _target);
@ -391,17 +385,12 @@ public class I2PTunnelConnectClient extends I2PTunnelHTTPClientBase implements R
                                                  boolean usingWWWProxy, String wwwProxy, long requestId) {
        if (out == null)
            return;
+        byte[] header;
+        if (usingWWWProxy)
+            header = getErrorPage(I2PAppContext.getGlobalContext(), "dnfp-header.ht", ERR_DESTINATION_UNKNOWN);
+        else
+            header = getErrorPage(I2PAppContext.getGlobalContext(), "dnf-header.ht", ERR_DESTINATION_UNKNOWN);
        try {
-            String str;
-            byte[] header;
-            if (usingWWWProxy)
-                str = FileUtil.readTextFile((new File(_errorDir, "dnfp-header.ht")).getAbsolutePath(), 100, true);
-            else
-                str = FileUtil.readTextFile((new File(_errorDir, "dnf-header.ht")).getAbsolutePath(), 100, true);
-            if (str != null)
-                header = str.getBytes();
-            else
-                header = ERR_DESTINATION_UNKNOWN;
            writeErrorMessage(header, out, targetRequest, usingWWWProxy, wwwProxy);
        } catch (IOException ioe) {}
    }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPBidirProxy.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPBidirProxy.java
@ -1,17 +1,9 @@
 /**
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ *                    WTFPL
 *                    Version 2, December 2004
 *
 * Copyright (C) sponge
 *   Planet Earth
- * Everyone is permitted to copy and distribute verbatim or modified
- * copies of this license document, and changing it is allowed as long
- * as the name is changed.
- *
- *            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
- *   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- *
- *  0. You just DO WHAT THE FUCK YOU WANT TO.
 *
 * See...
 *
@ -19,9 +11,8 @@
 *	and
 *	http://en.wikipedia.org/wiki/WTFPL
 *
- * ...for any additional details and liscense questions.
+ * ...for any additional details and license questions.
 */
-
 package net.i2p.i2ptunnel;

 // import java.util.ArrayList;
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
@ -3,9 +3,7 @@
 */
 package net.i2p.i2ptunnel;

-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@ -73,10 +71,14 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
     *  via address helper links
     */
    private final ConcurrentHashMap<String, String> addressHelpers = new ConcurrentHashMap(8);
+
    /**
     *  Used to protect actions via http://proxy.i2p/
     */
    private final String _proxyNonce;
+
+    public static final String AUTH_REALM = "I2P HTTP Proxy";
+
    /**
     *  These are backups if the xxx.ht error page is missing.
     */
@ -167,15 +169,6 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            "\r\n" +
            "<html><body><H1>I2P ERROR: REQUEST DENIED</H1>" +
            "Your browser is misconfigured. Do not use the proxy to access the router console or other localhost destinations.<BR>").getBytes();
-    private final static byte[] ERR_AUTH =
-                                ("HTTP/1.1 407 Proxy Authentication Required\r\n" +
-            "Content-Type: text/html; charset=UTF-8\r\n" +
-            "Cache-control: no-cache\r\n" +
-            "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.5\r\n" + // try to get a UTF-8-encoded response back for the password
-            "Proxy-Authenticate: Basic realm=\"I2P HTTP Proxy\"\r\n" +
-            "\r\n" +
-            "<html><body><H1>I2P ERROR: PROXY AUTHENTICATION REQUIRED</H1>" +
-            "This proxy is configured to require authentication.<BR>").getBytes();

    /**
     *  This constructor always starts the tunnel (ignoring the i2cp.delayOpen option).
@ -280,6 +273,10 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
     */
    @Override
    public void startRunning() {
+        // following are for HTTPResponseOutputStream
+        _context.statManager().createRateStat("i2ptunnel.httpCompressionRatio", "ratio of compressed size to decompressed size after transfer", "I2PTunnel", new long[] { 60*60*1000 });
+        _context.statManager().createRateStat("i2ptunnel.httpCompressed", "compressed size transferred", "I2PTunnel", new long[] { 60*60*1000 });
+        _context.statManager().createRateStat("i2ptunnel.httpExpanded", "size transferred after expansion", "I2PTunnel", new long[] { 60*60*1000 });
        super.startRunning();
        this.isr = new InternalSocketRunner(this);
        _context.portMapper().register(PortMapper.SVC_HTTP_PROXY, getLocalPort());
@ -300,6 +297,12 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
        }
        return rv;
    }
+
+    /** @since 0.9.4 */
+    protected String getRealm() {
+        return AUTH_REALM;
+    }
+
    private static final String HELPER_PARAM = "i2paddresshelper";
    public static final String LOCAL_SERVER = "proxy.i2p";
    private static final boolean DEFAULT_GZIP = true;
@ -337,6 +340,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            String userAgent = null;
            String authorization = null;
            int remotePort = 0;
+            String referer = null;
            while((line = reader.readLine(method)) != null) {
                line = line.trim();
                if(_log.shouldLog(Log.DEBUG)) {
@ -521,7 +525,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                            // Try to find an address helper in the query
                            String[] helperStrings = removeHelper(query);
                            if(helperStrings != null &&
-                                    !Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER)).booleanValue()) {
+                                    !Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER))) {
                                query = helperStrings[0];
                                if(query.equals("")) {
                                    query = null;
@ -736,7 +740,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                    } else if(lowercaseLine.startsWith("user-agent: ")) {
                        // save for deciding whether to offer address book form
                        userAgent = lowercaseLine.substring(12);
-                        if(!Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_USER_AGENT)).booleanValue()) {
+                        if(!Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_USER_AGENT))) {
                            line = null;
                            continue;
                        }
@ -745,14 +749,17 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                        // browser to browser
                        line = null;
                        continue;
-                    } else if(lowercaseLine.startsWith("referer: ") &&
-                            !Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_REFERER)).booleanValue()) {
-                        // Shouldn't we be more specific, like accepting in-site referers ?
-                        //line = "Referer: i2p";
-                        line = null;
-                        continue; // completely strip the line
+                    } else if (lowercaseLine.startsWith("referer: ")) {
+                        // save for address helper form below
+                        referer = line.substring(9);
+                        if (!Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_REFERER))) {
+                            // Shouldn't we be more specific, like accepting in-site referers ?
+                            //line = "Referer: i2p";
+                            line = null;
+                            continue; // completely strip the line
+                        }
                    } else if(lowercaseLine.startsWith("via: ") &&
-                            !Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_VIA)).booleanValue()) {
+                            !Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_VIA))) {
                        //line = "Via: i2p";
                        line = null;
                        continue; // completely strip the line
@ -769,10 +776,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                        // hop-by-hop header, and we definitely want to block Windows NTLM after a far-end 407.
                        // Response to far-end shouldn't happen, as we
                        // strip Proxy-Authenticate from the response in HTTPResponseOutputStream
-                        if(lowercaseLine.startsWith("proxy-authorization: basic ")) // save for auth check below
-                        {
-                            authorization = line.substring(27);  // "proxy-authorization: basic ".length()
-                        }
+                        authorization = line.substring(21);  // "proxy-authorization: ".length()
                        line = null;
                        continue;
                    } else if(lowercaseLine.startsWith("icy")) {
@ -786,7 +790,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                    String ok = getTunnel().getClientOptions().getProperty("i2ptunnel.gzip");
                    boolean gzip = DEFAULT_GZIP;
                    if(ok != null) {
-                        gzip = Boolean.valueOf(ok).booleanValue();
+                        gzip = Boolean.parseBoolean(ok);
                    }
                    if(gzip && !usingInternalServer) {
                        // according to rfc2616 s14.3, this *should* force identity, even if
@ -796,7 +800,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                        newRequest.append("X-Accept-Encoding: x-i2p-gzip;q=1.0, identity;q=0.5, deflate;q=0, gzip;q=0, *;q=0\r\n");
                    }
                    if(!shout) {
-                        if(!Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_USER_AGENT)).booleanValue()) {
+                        if(!Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_USER_AGENT))) {
                            // let's not advertise to external sites that we are from I2P
                            if(usingWWWProxy) {
                                newRequest.append("User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6\r\n");
@ -806,7 +810,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                        }
                    }
                    // Add Proxy-Authentication header for next hop (outproxy)
-                    if(usingWWWProxy && Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_AUTH)).booleanValue()) {
+                    if(usingWWWProxy && Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_AUTH))) {
                        // specific for this proxy
                        String user = getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_USER_PREFIX + currentProxy);
                        String pw = getTunnel().getClientOptions().getProperty(PROP_OUTPROXY_PW_PREFIX + currentProxy);
@ -850,7 +854,8 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            }

            // Authorization
-            if(!authorize(s, requestId, authorization)) {
+            AuthResult result = authorize(s, requestId, method, authorization);
+            if (result != AuthResult.AUTH_GOOD) {
                if(_log.shouldLog(Log.WARN)) {
                    if(authorization != null) {
                        _log.warn(getPrefix(requestId) + "Auth failed, sending 407 again");
@ -858,7 +863,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
                        _log.warn(getPrefix(requestId) + "Auth required, sending 407");
                    }
                }
-                out.write(getErrorPage("auth", ERR_AUTH));
+                out.write(getAuthError(result == AuthResult.AUTH_STALE).getBytes());
                writeFooter(out);
                s.close();
                return;
@ -869,7 +874,7 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            if(usingInternalServer) {
                // disable the add form if address helper is disabled
                if(internalPath.equals("/add") &&
-                        Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER)).booleanValue()) {
+                        Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER))) {
                    out.write(ERR_HELPER_DISABLED);
                } else {
                    LocalHTTPServer.serveLocalFile(out, method, internalPath, internalRawQuery, _proxyNonce);
@ -949,8 +954,8 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            // Don't do this for eepget, which uses a user-agent of "Wget"
            if(ahelperNew && "GET".equals(method) &&
                    (userAgent == null || !userAgent.startsWith("Wget")) &&
-                    !Boolean.valueOf(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER)).booleanValue()) {
-                writeHelperSaveForm(out, destination, ahelperKey, targetRequest);
+                    !Boolean.parseBoolean(getTunnel().getClientOptions().getProperty(PROP_DISABLE_HELPER))) {
+                writeHelperSaveForm(out, destination, ahelperKey, targetRequest, referer);
                s.close();
                return;
            }
@ -1014,7 +1019,8 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
    }

    /** @since 0.8.7 */
-    private void writeHelperSaveForm(OutputStream out, String destination, String ahelperKey, String targetRequest) throws IOException {
+    private void writeHelperSaveForm(OutputStream out, String destination, String ahelperKey,
+                                     String targetRequest, String referer) throws IOException {
        if(out == null) {
            return;
        }
@ -1045,6 +1051,10 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
            out.write(("<br><button type=\"submit\" name=\"master\" value=\"master\">" + _("Save {0} to master address book and continue to eepsite", destination) + "</button><br>\n").getBytes("UTF-8"));
            out.write(("<button type=\"submit\" name=\"private\" value=\"private\">" + _("Save {0} to private address book and continue to eepsite", destination) + "</button>\n").getBytes("UTF-8"));
        }
+        // Firefox (and others?) don't send referer to meta refresh target, which is
+        // what the jump servers use, so this isn't that useful.
+        if (referer != null)
+            out.write(("<input type=\"hidden\" name=\"referer\" value=\"" + referer + "\">\n").getBytes("UTF-8"));
        out.write(("<input type=\"hidden\" name=\"url\" value=\"" + targetRequest + "\">\n" +
                "</form></div></div>").getBytes());
        writeFooter(out);
@ -1095,61 +1105,6 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn
        return Base32.encode(_dest.calculateHash().getData()) + ".b32.i2p";
    }

-    /**
-     *  foo => errordir/foo-header_xx.ht for lang xx, or errordir/foo-header.ht,
-     *  or the backup byte array on fail.
-     *
-     *  .ht files must be UTF-8 encoded and use \r\n terminators so the
-     *  HTTP headers are conformant.
-     *  We can't use FileUtil.readFile() because it strips \r
-     *
-     *  @return non-null
-     */
-    private byte[] getErrorPage(String base, byte[] backup) {
-        return getErrorPage(_context, base, backup);
-    }
-
-    private static byte[] getErrorPage(I2PAppContext ctx, String base, byte[] backup) {
-        File errorDir = new File(ctx.getBaseDir(), "docs");
-        String lang = ctx.getProperty("routerconsole.lang", Locale.getDefault().getLanguage());
-        if(lang != null && lang.length() > 0 && !lang.equals("en")) {
-            File file = new File(errorDir, base + "-header_" + lang + ".ht");
-            try {
-                return readFile(file);
-            } catch(IOException ioe) {
-                // try the english version now
-            }
-        }
-        File file = new File(errorDir, base + "-header.ht");
-        try {
-            return readFile(file);
-        } catch(IOException ioe) {
-            return backup;
-        }
-    }
-
-    private static byte[] readFile(File file) throws IOException {
-        FileInputStream fis = null;
-        byte[] buf = new byte[512];
-        ByteArrayOutputStream baos = new ByteArrayOutputStream(2048);
-        try {
-            int len = 0;
-            fis = new FileInputStream(file);
-            while((len = fis.read(buf)) > 0) {
-                baos.write(buf, 0, len);
-            }
-            return baos.toByteArray();
-        } finally {
-            try {
-                if(fis != null) {
-                    fis.close();
-                }
-            } catch(IOException foo) {
-            }
-        }
-    // we won't ever get here
-    }
-
    /**
     *  Public only for LocalHTTPServer, not for general use
     */
@ -1163,12 +1118,12 @@ public class I2PTunnelHTTPClient extends I2PTunnelHTTPClientBase implements Runn

    private static class OnTimeout implements Runnable {

-        private Socket _socket;
-        private OutputStream _out;
-        private String _target;
-        private boolean _usingProxy;
-        private String _wwwProxy;
-        private long _requestId;
+        private final Socket _socket;
+        private final OutputStream _out;
+        private final String _target;
+        private final boolean _usingProxy;
+        private final String _wwwProxy;
+        private final long _requestId;

        public OnTimeout(Socket s, OutputStream out, String target, boolean usingProxy, String wwwProxy, long id) {
            _socket = s;
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClientBase.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClientBase.java
@ -3,19 +3,26 @@
 */
 package net.i2p.i2ptunnel;

+import java.io.ByteArrayOutputStream;
+import java.io.FileInputStream;
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.Socket;
 import java.util.ArrayList;
 import java.io.File;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;

 import net.i2p.I2PAppContext;
 import net.i2p.client.streaming.I2PSocketManager;
 import net.i2p.data.Base64;
+import net.i2p.data.DataHelper;
 import net.i2p.util.EventDispatcher;
 import net.i2p.util.InternalSocket;
 import net.i2p.util.Log;
+import net.i2p.util.PasswordManager;

 /**
 * Common things for HTTPClient and ConnectClient
@ -25,6 +32,25 @@ import net.i2p.util.Log;
 */
 public abstract class I2PTunnelHTTPClientBase extends I2PTunnelClientBase implements Runnable {

+    private static final int PROXYNONCE_BYTES = 8;
+    private static final int MD5_BYTES = 16;
+    /** 24 */
+    private static final int NONCE_BYTES = DataHelper.DATE_LENGTH + MD5_BYTES;
+    private static final long MAX_NONCE_AGE = 30*24*60*60*1000L;
+
+    private static final String ERR_AUTH1 =
+            "HTTP/1.1 407 Proxy Authentication Required\r\n" +
+            "Content-Type: text/html; charset=UTF-8\r\n" +
+            "Cache-control: no-cache\r\n" +
+            "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.5\r\n" + // try to get a UTF-8-encoded response back for the password
+            "Proxy-Authenticate: ";
+    // put the auth type and realm in between
+    private static final String ERR_AUTH2 =
+            "\r\n" +
+            "\r\n" +
+            "<html><body><H1>I2P ERROR: PROXY AUTHENTICATION REQUIRED</H1>" +
+            "This proxy is configured to require authentication.";
+
    protected final List<String> _proxyList;

    protected final static byte[] ERR_NO_OUTPROXY =
@ -40,7 +66,7 @@ public abstract class I2PTunnelHTTPClientBase extends I2PTunnelClientBase implem
    /** used to assign unique IDs to the threads / clients.  no logic or functionality */
    protected static volatile long __clientId = 0;

-    protected static final File _errorDir = new File(I2PAppContext.getGlobalContext().getBaseDir(), "docs");
+    private final byte[] _proxyNonce;

    protected String getPrefix(long requestId) { return "Client[" + _clientId + "/" + requestId + "]: "; }
    
@ -63,6 +89,8 @@ public abstract class I2PTunnelHTTPClientBase extends I2PTunnelClientBase implem
                               I2PTunnel tunnel) throws IllegalArgumentException {
        super(localPort, ownDest, l, notifyThis, handlerName, tunnel);
        _proxyList = new ArrayList(4);
+        _proxyNonce = new byte[PROXYNONCE_BYTES];
+        _context.random().nextBytes(_proxyNonce);
    }

    /**
@ -76,8 +104,12 @@ public abstract class I2PTunnelHTTPClientBase extends I2PTunnelClientBase implem
            throws IllegalArgumentException {
        super(localPort, l, sktMgr, tunnel, notifyThis, clientId);
        _proxyList = new ArrayList(4);
+        _proxyNonce = new byte[PROXYNONCE_BYTES];
+        _context.random().nextBytes(_proxyNonce);
    }

+    //////// Authorization stuff
+
    /** all auth @since 0.8.2 */
    public static final String PROP_AUTH = "proxyAuth";
    public static final String PROP_USER = "proxyUsername";
@ -90,68 +122,349 @@ public abstract class I2PTunnelHTTPClientBase extends I2PTunnelClientBase implem
    /** passwords for specific outproxies may be added with outproxyUsername.fooproxy.i2p=user and outproxyPassword.fooproxy.i2p=pw */
    public static final String PROP_OUTPROXY_USER_PREFIX = PROP_OUTPROXY_USER + '.';
    public static final String PROP_OUTPROXY_PW_PREFIX = PROP_OUTPROXY_PW + '.';
+    /** new style MD5 auth */
+    public static final String PROP_PROXY_DIGEST_PREFIX = "proxy.auth.";
+    public static final String PROP_PROXY_DIGEST_SUFFIX = ".md5";
+    public static final String BASIC_AUTH = "basic";
+    public static final String DIGEST_AUTH = "digest";
+
+    protected abstract String getRealm();
+
+    protected enum AuthResult {AUTH_BAD_REQ, AUTH_BAD, AUTH_STALE, AUTH_GOOD}

    /**
-     *  @param authorization may be null
+     *  @since 0.9.4
+     */
+    protected boolean isDigestAuthRequired() {
+        String authRequired = getTunnel().getClientOptions().getProperty(PROP_AUTH);
+        if (authRequired == null)
+            return false;
+        return authRequired.toLowerCase(Locale.US).equals("digest");
+    }
+
+    /**
+     *  Authorization
+     *  Ref: RFC 2617
+     *  If the socket is an InternalSocket, no auth required.
+     *
+     *  @param method GET, POST, etc.
+     *  @param authorization may be null, the full auth line e.g. "Basic lskjlksjf"
     *  @return success
     */
-    protected boolean authorize(Socket s, long requestId, String authorization) {
-        // Authorization
-        // Ref: RFC 2617
-        // If the socket is an InternalSocket, no auth required.
+    protected AuthResult authorize(Socket s, long requestId, String method, String authorization) {
        String authRequired = getTunnel().getClientOptions().getProperty(PROP_AUTH);
-        if (Boolean.valueOf(authRequired).booleanValue() ||
-            (authRequired != null && "basic".equals(authRequired.toLowerCase(Locale.US)))) {
-            if (s instanceof InternalSocket) {
-                if (_log.shouldLog(Log.INFO))
-                    _log.info(getPrefix(requestId) + "Internal access, no auth required");
-                return true;
-            } else if (authorization != null) {
-                // hmm safeDecode(foo, true) to use standard alphabet is private in Base64
-                byte[] decoded = Base64.decode(authorization.replace("/", "~").replace("+", "="));
-                if (decoded != null) {
-                    // We send Accept-Charset: UTF-8 in the 407 so hopefully it comes back that way inside the B64 ?
-                    try {
-                        String dec = new String(decoded, "UTF-8");
-                        String[] parts = dec.split(":");
-                        String user = parts[0];
-                        String pw = parts[1];
-                        // first try pw for that user
-                        String configPW = getTunnel().getClientOptions().getProperty(PROP_PW_PREFIX + user);
-                        if (configPW == null) {
-                            // if not, look at default user and pw
-                            String configUser = getTunnel().getClientOptions().getProperty(PROP_USER);
-                            if (user.equals(configUser))
-                                configPW = getTunnel().getClientOptions().getProperty(PROP_PW);
-                        }
-                        if (configPW != null) {
-                            if (pw.equals(configPW)) {
-                                if (_log.shouldLog(Log.INFO))
-                                    _log.info(getPrefix(requestId) + "Good auth - user: " + user + " pw: " + pw);
-                                return true;
-                            } else {
-                                if (_log.shouldLog(Log.WARN))
-                                    _log.warn(getPrefix(requestId) + "Bad auth, pw mismatch - user: " + user + " pw: " + pw + " expected: " + configPW);
-                            }
-                        } else {
-                            if (_log.shouldLog(Log.WARN))
-                                _log.warn(getPrefix(requestId) + "Bad auth, no stored pw for user: " + user + " pw: " + pw);
-                        }
-                    } catch (UnsupportedEncodingException uee) {
-                        _log.error(getPrefix(requestId) + "No UTF-8 support? B64: " + authorization, uee);
-                    } catch (ArrayIndexOutOfBoundsException aioobe) {
-                        // no ':' in response
-                        if (_log.shouldLog(Log.WARN))
-                            _log.warn(getPrefix(requestId) + "Bad auth B64: " + authorization, aioobe);
+        if (authRequired == null)
+            return AuthResult.AUTH_GOOD;
+        authRequired = authRequired.toLowerCase(Locale.US);
+        if (authRequired.equals("false"))
+            return AuthResult.AUTH_GOOD;
+        if (s instanceof InternalSocket) {
+            if (_log.shouldLog(Log.INFO))
+                _log.info(getPrefix(requestId) + "Internal access, no auth required");
+            return AuthResult.AUTH_GOOD;
+        }
+        if (authorization == null)
+            return AuthResult.AUTH_BAD;
+        if (_log.shouldLog(Log.INFO))
+            _log.info(getPrefix(requestId) + "Auth: " + authorization);
+        String authLC = authorization.toLowerCase(Locale.US);
+        if (authRequired.equals("true") || authRequired.equals(BASIC_AUTH)) {
+            if (!authLC.startsWith("basic "))
+                return AuthResult.AUTH_BAD;
+            authorization = authorization.substring(6);
+
+            // hmm safeDecode(foo, true) to use standard alphabet is private in Base64
+            byte[] decoded = Base64.decode(authorization.replace("/", "~").replace("+", "="));
+            if (decoded != null) {
+                // We send Accept-Charset: UTF-8 in the 407 so hopefully it comes back that way inside the B64 ?
+                try {
+                    String dec = new String(decoded, "UTF-8");
+                    String[] parts = dec.split(":");
+                    String user = parts[0];
+                    String pw = parts[1];
+                    // first try pw for that user
+                    String configPW = getTunnel().getClientOptions().getProperty(PROP_PW_PREFIX + user);
+                    if (configPW == null) {
+                        // if not, look at default user and pw
+                        String configUser = getTunnel().getClientOptions().getProperty(PROP_USER);
+                        if (user.equals(configUser))
+                            configPW = getTunnel().getClientOptions().getProperty(PROP_PW);
                    }
-                } else {
+                    if (configPW != null) {
+                        if (pw.equals(configPW)) {
+                            if (_log.shouldLog(Log.INFO))
+                                _log.info(getPrefix(requestId) + "Good auth - user: " + user + " pw: " + pw);
+                            return AuthResult.AUTH_GOOD;
+                        }
+                    }
+                    _log.logAlways(Log.WARN, "PROXY AUTH FAILURE: user " + user);
+                } catch (UnsupportedEncodingException uee) {
+                    _log.error(getPrefix(requestId) + "No UTF-8 support? B64: " + authorization, uee);
+                } catch (ArrayIndexOutOfBoundsException aioobe) {
+                    // no ':' in response
                    if (_log.shouldLog(Log.WARN))
-                        _log.warn(getPrefix(requestId) + "Bad auth B64: " + authorization);
+                        _log.warn(getPrefix(requestId) + "Bad auth B64: " + authorization, aioobe);
+                    return AuthResult.AUTH_BAD_REQ;
                }
+                return AuthResult.AUTH_BAD;
+            } else {
+                if (_log.shouldLog(Log.WARN))
+                    _log.warn(getPrefix(requestId) + "Bad auth B64: " + authorization);
+                return AuthResult.AUTH_BAD_REQ;
            }
-            return false;
+        } else if (authRequired.equals(DIGEST_AUTH)) {
+            if (!authLC.startsWith("digest "))
+                return AuthResult.AUTH_BAD;
+            authorization = authorization.substring(7);
+            Map<String, String> args = parseArgs(authorization);
+            AuthResult rv = validateDigest(method, args);
+            return rv;
        } else {
-            return true;
+            _log.error("Unknown proxy authorization type configured: " + authRequired);
+            return AuthResult.AUTH_BAD_REQ;
        }
    }
+
+    /**
+     *  Verify all of it.
+     *  Ref: RFC 2617
+     *  @since 0.9.4
+     */
+    private AuthResult validateDigest(String method, Map<String, String> args) {
+        String user = args.get("username");
+        String realm = args.get("realm");
+        String nonce = args.get("nonce");
+        String qop = args.get("qop");
+        String uri = args.get("uri");
+        String cnonce = args.get("cnonce");
+        String nc = args.get("nc");
+        String response = args.get("response");
+        if (user == null || realm == null || nonce == null || qop == null ||
+            uri == null || cnonce == null || nc == null || response == null) {
+            if (_log.shouldLog(Log.INFO))
+                _log.info("Bad digest request: " + DataHelper.toString(args));
+            return AuthResult.AUTH_BAD_REQ;
+        }
+        // nonce check
+        AuthResult check = verifyNonce(nonce);
+        if (check != AuthResult.AUTH_GOOD) {
+            if (_log.shouldLog(Log.INFO))
+                _log.info("Bad digest nonce: " + check + ' ' + DataHelper.toString(args));
+            return check;
+        }
+        // get H(A1) == stored password
+        String ha1 = getTunnel().getClientOptions().getProperty(PROP_PROXY_DIGEST_PREFIX + user +
+                                                                PROP_PROXY_DIGEST_SUFFIX);
+        if (ha1 == null) {
+            _log.logAlways(Log.WARN, "PROXY AUTH FAILURE: user " + user);
+            return AuthResult.AUTH_BAD;
+        }
+        // get H(A2)
+        String a2 = method + ':' + uri;
+        String ha2 = PasswordManager.md5Hex(a2);
+        // response check
+        String kd = ha1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + qop + ':' + ha2;
+        String hkd = PasswordManager.md5Hex(kd);
+        if (!response.equals(hkd)) {
+            _log.logAlways(Log.WARN, "PROXY AUTH FAILURE: user " + user);
+            if (_log.shouldLog(Log.INFO))
+                _log.info("Bad digest auth: " + DataHelper.toString(args));
+            return AuthResult.AUTH_BAD;
+        }
+        if (_log.shouldLog(Log.INFO))
+            _log.info("Good digest auth - user: " + user);
+        return AuthResult.AUTH_GOOD;
+    }
+
+    /**
+     *  The Base 64 of 24 bytes: (now, md5 of (now, proxy nonce))
+     *  @since 0.9.4
+     */
+    private String getNonce() {
+        byte[] b = new byte[DataHelper.DATE_LENGTH + PROXYNONCE_BYTES];
+        byte[] n = new byte[NONCE_BYTES];
+        long now = _context.clock().now();
+        DataHelper.toLong(b, 0, DataHelper.DATE_LENGTH, now);
+        System.arraycopy(_proxyNonce, 0, b, DataHelper.DATE_LENGTH, PROXYNONCE_BYTES);
+        System.arraycopy(b, 0, n, 0, DataHelper.DATE_LENGTH);
+        byte[] md5 = PasswordManager.md5Sum(b);
+        System.arraycopy(md5, 0, n, DataHelper.DATE_LENGTH, MD5_BYTES);
+        return Base64.encode(n);
+    }
+
+    /**
+     *  Verify the Base 64 of 24 bytes: (now, md5 of (now, proxy nonce))
+     *  @since 0.9.4
+     */
+    private AuthResult verifyNonce(String b64) {
+        byte[] n = Base64.decode(b64);
+        if (n == null || n.length != NONCE_BYTES)
+            return AuthResult.AUTH_BAD;
+        long now = _context.clock().now();
+        long stamp = DataHelper.fromLong(n, 0, DataHelper.DATE_LENGTH);
+        if (now - stamp > MAX_NONCE_AGE)
+            return AuthResult.AUTH_STALE;
+        byte[] b = new byte[DataHelper.DATE_LENGTH + PROXYNONCE_BYTES];
+        System.arraycopy(n, 0, b, 0, DataHelper.DATE_LENGTH);
+        System.arraycopy(_proxyNonce, 0, b, DataHelper.DATE_LENGTH, PROXYNONCE_BYTES);
+        byte[] md5 = PasswordManager.md5Sum(b);
+        if (!DataHelper.eq(md5, 0, n, DataHelper.DATE_LENGTH, MD5_BYTES))
+            return AuthResult.AUTH_BAD;
+        return AuthResult.AUTH_GOOD;
+    }
+
+    /**
+     *  What to send if digest auth fails
+     *  @since 0.9.4
+     */
+    protected String getAuthError(boolean isStale) {
+        boolean isDigest = isDigestAuthRequired();
+        return
+            ERR_AUTH1 +
+            (isDigest ? "Digest" : "Basic") +
+            " realm=\"" + getRealm() + '"' +
+            (isDigest ? ", nonce=\"" + getNonce() + "\"," +
+                        " algorithm=MD5," +
+                        " qop=\"auth\"" +
+                        (isStale ? ", stale=true" : "")
+                      : "") +
+            ERR_AUTH2;
+    }
+
+    /**
+     *  Modified from LoadClientAppsJob.
+     *  All keys are mapped to lower case.
+     *  Ref: RFC 2617
+     *
+     *  @param args non-null
+     *  @since 0.9.4
+     */
+    private static Map<String, String> parseArgs(String args) {
+        Map<String, String> rv = new HashMap(8);
+        char data[] = args.toCharArray();
+        StringBuilder buf = new StringBuilder(32);
+        boolean isQuoted = false;
+        String key = null;
+        for (int i = 0; i < data.length; i++) {
+            switch (data[i]) {
+                case '\"':
+                    if (isQuoted) {
+                        // keys never quoted
+                        if (key != null) {
+                            rv.put(key, buf.toString().trim());
+                            key = null;
+                        }
+                        buf.setLength(0);
+                    }
+                    isQuoted = !isQuoted;
+                    break;
+
+                case ' ':
+                case '\r':
+                case '\n':
+                case '\t':
+                case ',':
+                    // whitespace - if we're in a quoted section, keep this as part of the quote,
+                    // otherwise use it as a delim
+                    if (isQuoted) {
+                        buf.append(data[i]);
+                    } else {
+                        if (key != null) {
+                            rv.put(key, buf.toString().trim());
+                            key = null;
+                        }
+                        buf.setLength(0);
+                    }
+                    break;
+
+                case '=':
+                    if (isQuoted) {
+                        buf.append(data[i]);
+                    } else {
+                        key = buf.toString().trim().toLowerCase(Locale.US);
+                        buf.setLength(0);
+                    }
+                    break;
+
+                default:
+                    buf.append(data[i]);
+                    break;
+            }
+        }
+        if (key != null)
+            rv.put(key, buf.toString().trim());
+        return rv;
+    }
+
+    //////// Error page stuff
+
+    /**
+     *  foo => errordir/foo-header_xx.ht for lang xx, or errordir/foo-header.ht,
+     *  or the backup byte array on fail.
+     *
+     *  .ht files must be UTF-8 encoded and use \r\n terminators so the
+     *  HTTP headers are conformant.
+     *  We can't use FileUtil.readFile() because it strips \r
+     *
+     *  @return non-null
+     *  @since 0.9.4 moved from I2PTunnelHTTPClient
+     */
+    protected byte[] getErrorPage(String base, byte[] backup) {
+        return getErrorPage(_context, base, backup);
+    }
+
+    /**
+     *  foo => errordir/foo-header_xx.ht for lang xx, or errordir/foo-header.ht,
+     *  or the backup byte array on fail.
+     *
+     *  .ht files must be UTF-8 encoded and use \r\n terminators so the
+     *  HTTP headers are conformant.
+     *  We can't use FileUtil.readFile() because it strips \r
+     *
+     *  @return non-null
+     *  @since 0.9.4 moved from I2PTunnelHTTPClient
+     */
+    protected static byte[] getErrorPage(I2PAppContext ctx, String base, byte[] backup) {
+        File errorDir = new File(ctx.getBaseDir(), "docs");
+        String lang = ctx.getProperty("routerconsole.lang", Locale.getDefault().getLanguage());
+        if(lang != null && lang.length() > 0 && !lang.equals("en")) {
+            File file = new File(errorDir, base + "-header_" + lang + ".ht");
+            try {
+                return readFile(file);
+            } catch(IOException ioe) {
+                // try the english version now
+            }
+        }
+        File file = new File(errorDir, base + "-header.ht");
+        try {
+            return readFile(file);
+        } catch(IOException ioe) {
+            return backup;
+        }
+    }
+
+    /**
+     *  @since 0.9.4 moved from I2PTunnelHTTPClient
+     */
+    private static byte[] readFile(File file) throws IOException {
+        FileInputStream fis = null;
+        byte[] buf = new byte[2048];
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(2048);
+        try {
+            int len = 0;
+            fis = new FileInputStream(file);
+            while((len = fis.read(buf)) > 0) {
+                baos.write(buf, 0, len);
+            }
+            return baos.toByteArray();
+        } finally {
+            try {
+                if(fis != null) {
+                    fis.close();
+                }
+            } catch(IOException foo) {
+            }
+        }
+        // we won't ever get here
+    }
 }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java
@ -45,7 +45,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
    private static final String[] CLIENT_SKIPHEADERS = {HASH_HEADER, DEST64_HEADER, DEST32_HEADER};
    private static final String SERVER_HEADER = "Server";
    private static final String[] SERVER_SKIPHEADERS = {SERVER_HEADER};
-    private static final long HEADER_TIMEOUT = 60*1000;
+    private static final long HEADER_TIMEOUT = 15*1000;
+    private static final long TOTAL_HEADER_TIMEOUT = 2 * HEADER_TIMEOUT;
    private static final long START_INTERVAL = (60 * 1000) * 3;
    private long _startedOn = 0L;

@ -154,7 +155,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
            boolean allowGZIP = true;
            if (opts != null) {
                String val = opts.getProperty("i2ptunnel.gzip");
-                if ( (val != null) && (!Boolean.valueOf(val).booleanValue()) ) 
+                if ( (val != null) && (!Boolean.parseBoolean(val)) ) 
                    allowGZIP = false;
            }
            if (_log.shouldLog(Log.INFO))
@ -492,7 +493,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
    	}
    }

-    protected static Map<String, List<String>> readHeaders(InputStream in, StringBuilder command, String[] skipHeaders, I2PAppContext ctx) throws IOException {
+    protected static Map<String, List<String>> readHeaders(InputStream in, StringBuilder command,
+                                                           String[] skipHeaders, I2PAppContext ctx) throws IOException {
    	HashMap<String, List<String>> headers = new HashMap<String, List<String>>();
        StringBuilder buf = new StringBuilder(128);
        
@ -516,6 +518,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
        if (trimmed > 0)
            ctx.statManager().addRateData("i2ptunnel.httpNullWorkaround", trimmed, 0);
        
+        // slowloris / darkloris
+        long expire = ctx.clock().now() + TOTAL_HEADER_TIMEOUT;
        int i = 0;
        while (true) {
            if (++i > MAX_HEADERS)
@ -528,6 +532,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer {
                // end of headers reached
                return headers;
            } else {
+                if (ctx.clock().now() > expire)
+                    throw new IOException("Headers took too long [" + buf.toString() + "]");
                int split = buf.indexOf(":");
                if (split <= 0) throw new IOException("Invalid HTTP header, missing colon [" + buf.toString() + "]");
                String name = buf.substring(0, split).trim();
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelIRCClient.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelIRCClient.java
@ -87,7 +87,7 @@ public class I2PTunnelIRCClient extends I2PTunnelClientBase {
        
        setName("IRC Client on " + tunnel.listenHost + ':' + localPort);

-        _dccEnabled = Boolean.valueOf(tunnel.getClientOptions().getProperty(PROP_DCC)).booleanValue();
+        _dccEnabled = Boolean.parseBoolean(tunnel.getClientOptions().getProperty(PROP_DCC));
        // TODO add some prudent tunnel options (or is it too late?)

        startRunning();
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelIRCServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelIRCServer.java
@ -62,7 +62,8 @@ public class I2PTunnelIRCServer extends I2PTunnelServer implements Runnable {
 	public static final String PROP_WEBIRC_SPOOF_IP_DEFAULT="127.0.0.1";
    public static final String PROP_HOSTNAME="ircserver.fakeHostname";
    public static final String PROP_HOSTNAME_DEFAULT="%f.b32.i2p";
-    private static final long HEADER_TIMEOUT = 60*1000;
+    private static final long HEADER_TIMEOUT = 15*1000;
+    private static final long TOTAL_HEADER_TIMEOUT = 2 * HEADER_TIMEOUT;
    
    private final static byte[] ERR_UNAVAILABLE =
        (":ircserver.i2p 499 you :" +
@ -78,11 +79,9 @@ public class I2PTunnelIRCServer extends I2PTunnelServer implements Runnable {

    public I2PTunnelIRCServer(InetAddress host, int port, File privkey, String privkeyname, Logging l, EventDispatcher notifyThis, I2PTunnel tunnel) {
        super(host, port, privkey, privkeyname, l, notifyThis, tunnel);
-        initCloak(tunnel);
-    }

-    /** generate a random 32 bytes, or the hash of the passphrase */
-    private void initCloak(I2PTunnel tunnel) {
+        // generate a random 32 bytes, or the hash of the passphrase
+
        // get the properties of this server-tunnel
        Properties opts = tunnel.getClientOptions();
        
@ -188,12 +187,16 @@ public class I2PTunnelIRCServer extends I2PTunnelServer implements Runnable {
        StringBuilder buf = new StringBuilder(128);
        int lineCount = 0;
        
+        // slowloris / darkloris
+        long expire = System.currentTimeMillis() + TOTAL_HEADER_TIMEOUT;
        while (true) {
            String s = DataHelper.readLine(in);
            if (s == null)
                throw new IOException("EOF reached before the end of the headers [" + buf.toString() + "]");
            if (++lineCount > 10)
                throw new IOException("Too many lines before USER or SERVER, giving up");
+            if (System.currentTimeMillis() > expire)
+                throw new IOException("Headers took too long [" + buf.toString() + "]");
            s = s.trim();
            //if (_log.shouldLog(Log.DEBUG))
            //    _log.debug("Got line: " + s);
@ -231,9 +234,9 @@ public class I2PTunnelIRCServer extends I2PTunnelServer implements Runnable {
        return buf.toString();
    }
    
-    private byte[] cloakKey; // 32 bytes of stuff to scramble the dest with
-    private String hostname;
-    private String method;
-    private String webircPassword;
-	private String webircSpoofIP;
+    private final byte[] cloakKey; // 32 bytes of stuff to scramble the dest with
+    private final String hostname;
+    private final String method;
+    private final String webircPassword;
+    private final String webircSpoofIP;
 }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelServer.java
@ -49,8 +49,8 @@ public class I2PTunnelServer extends I2PTunnelTask implements Runnable {

    protected Logging l;

-    private static final long DEFAULT_READ_TIMEOUT = -1; // 3*60*1000;
-    /** default timeout to 3 minutes - override if desired */
+    private static final long DEFAULT_READ_TIMEOUT = 5*60*1000;
+    /** default timeout to 5 minutes - override if desired */
    protected long readTimeout = DEFAULT_READ_TIMEOUT;

    /** do we use threads? default true (ignored for standard servers, always false) */
@ -191,7 +191,7 @@ public class I2PTunnelServer extends I2PTunnelTask implements Runnable {
        if (_usePool) {
            String usePool = getTunnel().getClientOptions().getProperty(PROP_USE_POOL);
            if (usePool != null)
-                _usePool = Boolean.valueOf(usePool).booleanValue();
+                _usePool = Boolean.parseBoolean(usePool);
            else
                _usePool = DEFAULT_USE_POOL;
        }
@ -207,7 +207,7 @@ public class I2PTunnelServer extends I2PTunnelTask implements Runnable {
            if (sockMgr == null) {
                // try to make this error sensible as it will happen...
                String msg = "Unable to connect to the router at " + getTunnel().host + ':' + portNum +
-                             " and build tunnels for the server at " + getTunnel().listenHost + ':' + port;
+                             " and build tunnels for the server at " + host.getHostAddress() + ':' + port;
                if (++retries < MAX_RETRIES) {
                    this.l.log(msg + ", retrying in " + (RETRY_DELAY / 1000) + " seconds");
                    _log.error(msg + ", retrying in " + (RETRY_DELAY / 1000) + " seconds");
@ -223,7 +223,7 @@ public class I2PTunnelServer extends I2PTunnelTask implements Runnable {

        sockMgr.setName("Server");
        getTunnel().addSession(sockMgr.getSession());
-        l.log("Tunnels ready for server at " + getTunnel().listenHost + ':' + port);
+        l.log("Tunnels ready for server at " + host.getHostAddress() + ':' + port);
        notifyEvent("openServerResult", "ok");
        open = true;
    }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/TunnelController.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/TunnelController.java
@ -19,8 +19,10 @@ import net.i2p.client.I2PSession;
 import net.i2p.data.Base32;
 import net.i2p.data.Destination;
 import net.i2p.i2ptunnel.socks.I2PSOCKSTunnel;
+import net.i2p.util.FileUtil;
 import net.i2p.util.I2PAppThread;
 import net.i2p.util.Log;
+import net.i2p.util.SecureFile;
 import net.i2p.util.SecureFileOutputStream;

 /**
@ -43,6 +45,8 @@ public class TunnelController implements Logging {
    private boolean _running;
    private boolean _starting;
    
+    public static final String KEY_BACKUP_DIR = "i2ptunnel-keyBackup";
+
    /**
     * Create a new controller for a tunnel out of the specific config options.
     * The config may contain a large number of options - only ones that begin in
@ -102,8 +106,17 @@ public class TunnelController implements Logging {
            Destination dest = client.createDestination(fos);
            String destStr = dest.toBase64();
            log("Private key created and saved in " + keyFile.getAbsolutePath());
+            log("You should backup this file in a secure place.");
            log("New destination: " + destStr);
-            log("Base32: " + Base32.encode(dest.calculateHash().getData()) + ".b32.i2p");
+            String b32 = Base32.encode(dest.calculateHash().getData()) + ".b32.i2p";
+            log("Base32: " + b32);
+            File backupDir = new SecureFile(I2PAppContext.getGlobalContext().getConfigDir(), KEY_BACKUP_DIR);
+            if (backupDir.isDirectory() || backupDir.mkdir()) {
+                String name = b32 + '-' + I2PAppContext.getGlobalContext().clock().now() + ".dat";
+                File backup = new File(backupDir, name);
+                if (FileUtil.copy(keyFile, backup, false, true))
+                    log("Private key backup saved to " + backup.getAbsolutePath());
+            }
        } catch (I2PException ie) {
            if (_log.shouldLog(Log.ERROR))
                _log.error("Error creating new destination", ie);
@ -307,7 +320,9 @@ public class TunnelController implements Logging {
                I2PSession session = sessions.get(i);
                if (_log.shouldLog(Log.INFO))
                    _log.info("Acquiring session " + session);
-                TunnelControllerGroup.getInstance().acquire(this, session);
+                TunnelControllerGroup group = TunnelControllerGroup.getInstance();
+                if (group != null)
+                    group.acquire(this, session);
            }
            _sessions = sessions;
        } else {
@ -326,7 +341,9 @@ public class TunnelController implements Logging {
                I2PSession s = _sessions.get(i);
                if (_log.shouldLog(Log.INFO))
                    _log.info("Releasing session " + s);
-                TunnelControllerGroup.getInstance().release(this, s);
+                TunnelControllerGroup group = TunnelControllerGroup.getInstance();
+                if (group != null)
+                    group.release(this, s);
            }
            // _sessions.clear() ????
        } else {
@ -536,8 +553,8 @@ public class TunnelController implements Logging {
    /** default true */
    public String getSharedClient() { return _config.getProperty("sharedClient", "true"); }
    /** default true */
-    public boolean getStartOnLoad() { return Boolean.valueOf(_config.getProperty("startOnLoad", "true")).booleanValue(); }
-    public boolean getPersistentClientKey() { return Boolean.valueOf(_config.getProperty("option.persistentClientKey")).booleanValue(); }
+    public boolean getStartOnLoad() { return Boolean.parseBoolean(_config.getProperty("startOnLoad", "true")); }
+    public boolean getPersistentClientKey() { return Boolean.parseBoolean(_config.getProperty("option.persistentClientKey")); }

    public String getMyDestination() {
        if (_tunnel != null) {
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/TunnelControllerGroup.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/TunnelControllerGroup.java
@ -12,27 +12,35 @@ import java.util.Properties;
 import java.util.Set;

 import net.i2p.I2PAppContext;
+import net.i2p.app.*;
+import static net.i2p.app.ClientAppState.*;
 import net.i2p.client.I2PSession;
 import net.i2p.client.I2PSessionException;
 import net.i2p.data.DataHelper;
 import net.i2p.util.I2PAppThread;
 import net.i2p.util.Log;
 import net.i2p.util.OrderedProperties;
+import net.i2p.util.SystemVersion;

 /**
 * Coordinate a set of tunnels within the JVM, loading and storing their config
 * to disk, and building new ones as requested.
 *
- * Warning - this is a singleton. Todo: fix
+ * This is the entry point from clients.config.
 */
-public class TunnelControllerGroup {
-    private Log _log;
-    private static TunnelControllerGroup _instance;
+public class TunnelControllerGroup implements ClientApp {
+    private final Log _log;
+    private volatile ClientAppState _state;
+    private final I2PAppContext _context;
+    private final ClientAppManager _mgr;
+    private static volatile TunnelControllerGroup _instance;
    static final String DEFAULT_CONFIG_FILE = "i2ptunnel.config";
    
    private final List<TunnelController> _controllers;
-    private String _configFile = DEFAULT_CONFIG_FILE;
+    private final String _configFile;
    
+    private static final String REGISTERED_NAME = "i2ptunnel";
+
    /** 
     * Map of I2PSession to a Set of TunnelController objects 
     * using the session (to prevent closing the session until
@ -41,48 +49,143 @@ public class TunnelControllerGroup {
     */
    private final Map<I2PSession, Set<TunnelController>> _sessions;
    
+    /**
+     *  In I2PAppContext will instantiate if necessary and always return non-null.
+     *  As of 0.9.4, when in RouterContext, will return null (except in Android)
+     *  if the TCG has not yet been started by the router.
+     *
+     *  @throws IllegalArgumentException if unable to load from i2ptunnel.config
+     */
    public static TunnelControllerGroup getInstance() { 
        synchronized (TunnelControllerGroup.class) {
-            if (_instance == null)
-                _instance = new TunnelControllerGroup(DEFAULT_CONFIG_FILE);
+            if (_instance == null) {
+                I2PAppContext ctx = I2PAppContext.getGlobalContext();
+                if (SystemVersion.isAndroid() || !ctx.isRouterContext()) {
+                    _instance = new TunnelControllerGroup(ctx, null, null);
+                    _instance.startup();
+                } // else wait for the router to start it
+            }
            return _instance; 
        }
    }

-    private TunnelControllerGroup(String configFile) {
-        _log = I2PAppContext.getGlobalContext().logManager().getLog(TunnelControllerGroup.class);
-        _controllers = Collections.synchronizedList(new ArrayList());
-        _configFile = configFile;
+    /**
+     *  Instantiation only. Caller must call startup().
+     *  Config file problems will not throw exception until startup().
+     *
+     *  @param mgr may be null
+     *  @param args one arg, the config file, if not absolute will be relative to the context's config dir,
+     *              if empty or null, the default is i2ptunnel.config
+     *  @since 0.9.4
+     */
+    public TunnelControllerGroup(I2PAppContext context, ClientAppManager mgr, String[] args) {
+        _state = UNINITIALIZED;
+        _context = context;
+        _mgr = mgr;
+        _log = _context.logManager().getLog(TunnelControllerGroup.class);
+        _controllers = new ArrayList();
+        if (args == null || args.length <= 0)
+            _configFile = DEFAULT_CONFIG_FILE;
+        else if (args.length == 1)
+            _configFile = args[0];
+        else
+            throw new IllegalArgumentException("Usage: TunnelControllerGroup [filename]");
        _sessions = new HashMap(4);
-        loadControllers(_configFile);
-        I2PAppContext.getGlobalContext().addShutdownTask(new Shutdown());
+        synchronized (TunnelControllerGroup.class) {
+            if (_instance == null)
+                _instance = this;
+        }
+        if (_instance != this) {
+            _log.logAlways(Log.WARN, "New TunnelControllerGroup, now you have two");
+            if (_log.shouldLog(Log.WARN))
+                _log.warn("I did it", new Exception());
+        }
+        _state = INITIALIZED;
    }

+    /**
+     *  @param args one arg, the config file, if not absolute will be relative to the context's config dir,
+     *              if no args, the default is i2ptunnel.config
+     *  @throws IllegalArgumentException if unable to load from config from file
+     */
    public static void main(String args[]) {
        synchronized (TunnelControllerGroup.class) {
            if (_instance != null) return; // already loaded through the web
-            
-            if ( (args == null) || (args.length <= 0) ) {
-                _instance = new TunnelControllerGroup(DEFAULT_CONFIG_FILE);
-            } else if (args.length == 1) {
-                _instance = new TunnelControllerGroup(args[0]);
-            } else {
-                System.err.println("Usage: TunnelControllerGroup [filename]");
-                return;
-            }
+            _instance = new TunnelControllerGroup(I2PAppContext.getGlobalContext(), null, args);
+            _instance.startup();
        }
    }

+    /**
+     *  ClientApp interface
+     *  @throws IllegalArgumentException if unable to load config from file
+     *  @since 0.9.4
+     */
+    public void startup() {
+        loadControllers(_configFile);
+        if (_mgr != null)
+            _mgr.register(this);
+        _context.addShutdownTask(new Shutdown());
+    }
+
+    /**
+     *  ClientApp interface
+     *  @since 0.9.4
+     */
+    public ClientAppState getState() {
+        return _state;
+    }
+
+    /**
+     *  ClientApp interface
+     *  @since 0.9.4
+     */
+    public String getName() {
+        return REGISTERED_NAME;
+    }
+
+    /**
+     *  ClientApp interface
+     *  @since 0.9.4
+     */
+    public String getDisplayName() {
+        return REGISTERED_NAME;
+    }
+
+    /**
+     *  @since 0.9.4
+     */
+    private void changeState(ClientAppState state) {
+        changeState(state, null);
+    }
+
+    /**
+     *  @since 0.9.4
+     */
+    private synchronized void changeState(ClientAppState state, Exception e) {
+        _state = state;
+        if (_mgr != null)
+            _mgr.notify(this, state, null, e);
+    }
+
    /**
     *  Warning - destroys the singleton!
     *  @since 0.8.8
     */
-    private static class Shutdown implements Runnable {
+    private class Shutdown implements Runnable {
        public void run() {
            shutdown();
        }
    }

+    /**
+     *  ClientApp interface
+     *  @since 0.9.4
+     */
+    public void shutdown(String[] args) {
+        shutdown();
+    }
+
    /**
     *  Warning - destroys the singleton!
     *  Caller must root a new context before calling instance() or main() again.
@ -91,28 +194,31 @@ public class TunnelControllerGroup {
     *
     *  @since 0.8.8
     */
-    public static void shutdown() {
+    public void shutdown() {
+        changeState(STOPPING);
+        if (_mgr != null)
+            _mgr.unregister(this);
+        unloadControllers();
        synchronized (TunnelControllerGroup.class) {
-            if (_instance == null) return;
-            _instance.unloadControllers();
-            _instance._log = null;
-            _instance = null;
+            if (_instance == this)
+                _instance = null;
        }
+/// fixme static
        I2PTunnelClientBase.killClientExecutor();
+        changeState(STOPPED);
    }
    
    /**
     * Load up all of the tunnels configured in the given file (but do not start
     * them)
     *
+     * DEPRECATED for use outside this class. Use startup() or getInstance().
+     *
+     * @throws IllegalArgumentException if unable to load from file
     */
-    public void loadControllers(String configFile) {
+    public synchronized void loadControllers(String configFile) {
+        changeState(STARTING);
        Properties cfg = loadConfig(configFile);
-        if (cfg == null) {
-            if (_log.shouldLog(Log.WARN))
-                _log.warn("Unable to load the config from " + configFile);
-            return;
-        }
        int i = 0; 
        while (true) {
            String type = cfg.getProperty("tunnel." + i + ".type");
@ -127,20 +233,28 @@ public class TunnelControllerGroup {
        
        if (_log.shouldLog(Log.INFO))
            _log.info(i + " controllers loaded from " + configFile);
+        changeState(RUNNING);
    }
    
    private class StartControllers implements Runnable {
        public void run() {
-            for (int i = 0; i < _controllers.size(); i++) {
-                TunnelController controller = _controllers.get(i);
-                if (controller.getStartOnLoad())
-                    controller.startTunnel();
+            synchronized(TunnelControllerGroup.this) {
+                for (int i = 0; i < _controllers.size(); i++) {
+                    TunnelController controller = _controllers.get(i);
+                    if (controller.getStartOnLoad())
+                        controller.startTunnel();
+                }
            }
        }
    }
    
-    
-    public void reloadControllers() {
+    /**
+     * Stop all tunnels, reload config, and restart those configured to do so.
+     * WARNING - Does NOT simply reload the configuration!!! This is probably not what you want.
+     *
+     * @throws IllegalArgumentException if unable to reload config file
+     */
+    public synchronized void reloadControllers() {
        unloadControllers();
        loadControllers(_configFile);
    }
@ -150,7 +264,7 @@ public class TunnelControllerGroup {
     * file or do other silly things)
     *
     */
-    public void unloadControllers() {
+    public synchronized void unloadControllers() {
        stopAllControllers();
        _controllers.clear();
        if (_log.shouldLog(Log.INFO))
@ -162,14 +276,14 @@ public class TunnelControllerGroup {
     * a config file or start it or anything)
     *
     */
-    public void addController(TunnelController controller) { _controllers.add(controller); }
+    public synchronized void addController(TunnelController controller) { _controllers.add(controller); }
    
    /**
     * Stop and remove the given tunnel
     *
     * @return list of messages from the controller as it is stopped
     */
-    public List<String> removeController(TunnelController controller) {
+    public synchronized List<String> removeController(TunnelController controller) {
        if (controller == null) return new ArrayList();
        controller.stopTunnel();
        List<String> msgs = controller.clearMessages();
@ -183,7 +297,7 @@ public class TunnelControllerGroup {
     *
     * @return list of messages the tunnels generate when stopped
     */
-    public List<String> stopAllControllers() {
+    public synchronized List<String> stopAllControllers() {
        List<String> msgs = new ArrayList();
        for (int i = 0; i < _controllers.size(); i++) {
            TunnelController controller = _controllers.get(i);
@ -200,7 +314,7 @@ public class TunnelControllerGroup {
     *
     * @return list of messages the tunnels generate when started
     */
-    public List<String> startAllControllers() {
+    public synchronized List<String> startAllControllers() {
        List<String> msgs = new ArrayList();
        for (int i = 0; i < _controllers.size(); i++) {
            TunnelController controller = _controllers.get(i);
@ -218,7 +332,7 @@ public class TunnelControllerGroup {
     *
     * @return list of messages the tunnels generate when restarted
     */
-    public List<String> restartAllControllers() {
+    public synchronized List<String> restartAllControllers() {
        List<String> msgs = new ArrayList();
        for (int i = 0; i < _controllers.size(); i++) {
            TunnelController controller = _controllers.get(i);
@ -235,7 +349,7 @@ public class TunnelControllerGroup {
     *
     * @return list of messages the tunnels have generated
     */
-    public List<String> clearAllMessages() {
+    public synchronized List<String> clearAllMessages() {
        List<String> msgs = new ArrayList();
        for (int i = 0; i < _controllers.size(); i++) {
            TunnelController controller = _controllers.get(i);
@ -257,8 +371,7 @@ public class TunnelControllerGroup {
     * Save the configuration of all known tunnels to the given file
     *
     */
-    public void saveConfig(String configFile) throws IOException {
-        _configFile = configFile;
+    public synchronized void saveConfig(String configFile) throws IOException {
        File cfgFile = new File(configFile);
        if (!cfgFile.isAbsolute())
            cfgFile = new File(I2PAppContext.getGlobalContext().getConfigDir(), configFile);
@ -279,16 +392,17 @@ public class TunnelControllerGroup {
    /**
     * Load up the config data from the file
     *
-     * @return properties loaded or null if there was an error
+     * @return properties loaded
+     * @throws IllegalArgumentException if unable to load from file
     */
-    private Properties loadConfig(String configFile) {
+    private synchronized Properties loadConfig(String configFile) {
        File cfgFile = new File(configFile);
        if (!cfgFile.isAbsolute())
            cfgFile = new File(I2PAppContext.getGlobalContext().getConfigDir(), configFile);
        if (!cfgFile.exists()) {
            if (_log.shouldLog(Log.ERROR))
                _log.error("Unable to load the controllers from " + cfgFile.getAbsolutePath());
-            return null;
+            throw new IllegalArgumentException("Unable to load the controllers from " + cfgFile.getAbsolutePath());
        }
        
        Properties props = new Properties();
@ -298,7 +412,7 @@ public class TunnelControllerGroup {
        } catch (IOException ioe) {
            if (_log.shouldLog(Log.ERROR))
                _log.error("Error reading the controllers from " + cfgFile.getAbsolutePath(), ioe);
-            return null;
+            throw new IllegalArgumentException("Error reading the controllers from " + cfgFile.getAbsolutePath(), ioe);
        }
    }
    
@ -307,7 +421,9 @@ public class TunnelControllerGroup {
     *
     * @return list of TunnelController objects
     */
-    public List<TunnelController> getControllers() { return _controllers; }
+    public synchronized List<TunnelController> getControllers() {
+        return new ArrayList(_controllers);
+    }
    
    
    /** 
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/localServer/LocalHTTPServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/localServer/LocalHTTPServer.java
@ -17,6 +17,7 @@ import net.i2p.data.DataFormatException;
 import net.i2p.data.Destination;
 import net.i2p.i2ptunnel.I2PTunnelHTTPClient;
 import net.i2p.util.FileUtil;
+import net.i2p.util.Log;
 import net.i2p.util.Translate;

 /**
@ -133,6 +134,7 @@ public abstract class LocalHTTPServer {
            String host = opts.get("host");
            String b64Dest = opts.get("dest");
            String nonce = opts.get("nonce");
+            String referer = opts.get("referer");
            String book = "privatehosts.txt";
            if (opts.get("master") != null)
                book = "userhosts.txt";
@ -156,7 +158,12 @@ public abstract class LocalHTTPServer {
                    NamingService ns = I2PAppContext.getGlobalContext().namingService();
                    Properties nsOptions = new Properties();
                    nsOptions.setProperty("list", book);
-                    nsOptions.setProperty("s", _("Added via address helper"));
+                    if (referer != null && referer.startsWith("http")) {
+                        String from = "<a href=\"" + referer + "\">" + referer + "</a>";
+                        nsOptions.setProperty("s", _("Added via address helper from {0}", from));
+                    } else {
+                        nsOptions.setProperty("s", _("Added via address helper"));
+                    }
                    boolean success = ns.put(host, dest, nsOptions);
                    writeRedirectPage(out, success, host, book, url);
                    return;
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/I2PSOCKSIRCTunnel.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/I2PSOCKSIRCTunnel.java
@ -15,6 +15,7 @@ import net.i2p.i2ptunnel.irc.IrcOutboundFilter;
 import net.i2p.i2ptunnel.Logging;
 import net.i2p.util.EventDispatcher;
 import net.i2p.util.I2PAppThread;
+import net.i2p.util.Log;

 /*
 * Pipe SOCKS IRC connections through I2PTunnelIRCClient filtering,
@ -56,7 +57,8 @@ public class I2PSOCKSIRCTunnel extends I2PSOCKSTunnel {
                                          "SOCKS IRC Client " + __clientId + " out", true);
            out.start();
        } catch (SOCKSException e) {
-            _log.error("Error from SOCKS connection", e);
+            if (_log.shouldLog(Log.WARN))
+                _log.warn("Error from SOCKS connection", e);
            closeSocket(s);
        }
    }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/I2PSOCKSTunnel.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/I2PSOCKSTunnel.java
@ -22,6 +22,7 @@ import net.i2p.i2ptunnel.I2PTunnelClientBase;
 import net.i2p.i2ptunnel.I2PTunnelRunner;
 import net.i2p.i2ptunnel.Logging;
 import net.i2p.util.EventDispatcher;
+import net.i2p.util.Log;

 public class I2PSOCKSTunnel extends I2PTunnelClientBase {

@ -55,7 +56,8 @@ public class I2PSOCKSTunnel extends I2PTunnelClientBase {
            I2PSocket destSock = serv.getDestinationI2PSocket(this);
            new I2PTunnelRunner(clientSock, destSock, sockLock, null, mySockets);
        } catch (SOCKSException e) {
-            _log.error("Error from SOCKS connection", e);
+            if (_log.shouldLog(Log.WARN))
+                _log.warn("Error from SOCKS connection", e);
            closeSocket(s);
        }
    }
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS4aServer.java
@ -46,9 +46,11 @@ public class SOCKS4aServer extends SOCKSServer {
     * client socket.
     *
     * @param clientSock client socket
+     * @param props non-null
     */
-    public SOCKS4aServer(Socket clientSock) {
+    public SOCKS4aServer(Socket clientSock, Properties props) {
        this.clientSock = clientSock;
+        this.props = props;
    }

    public Socket getClientSocket() throws SOCKSException {
@ -116,6 +118,13 @@ public class SOCKS4aServer extends SOCKSServer {
            }
        }

+        // Check if the requested IP should be mapped to a domain name
+        String mappedDomainName = getMappedDomainNameForIP(connHostName);
+        if (mappedDomainName != null) {
+            _log.debug("IPV4 address " + connHostName + " was mapped to domain name " + mappedDomainName);
+            connHostName = mappedDomainName;
+        }
+
        // discard user name
        readString(in);

--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS5Server.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKS5Server.java
@ -42,7 +42,6 @@ public class SOCKS5Server extends SOCKSServer {
    private static final int SOCKS_VERSION_5 = 0x05;

    private final Socket clientSock;
-    private final Properties props;
    private boolean setupCompleted = false;
    private final boolean authRequired;

@ -61,7 +60,7 @@ public class SOCKS5Server extends SOCKSServer {
        this.clientSock = clientSock;
        this.props = props;
        this.authRequired =
-                    Boolean.valueOf(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH)).booleanValue() &&
+                    Boolean.parseBoolean(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH)) &&
                    props.containsKey(I2PTunnelHTTPClientBase.PROP_USER) &&
                    props.containsKey(I2PTunnelHTTPClientBase.PROP_PW);
    }
@ -181,7 +180,7 @@ public class SOCKS5Server extends SOCKSServer {
            sendRequestReply(Reply.COMMAND_NOT_SUPPORTED, AddressType.DOMAINNAME, null, "0.0.0.0", 0, out);
            throw new SOCKSException("BIND command not supported");
        case Command.UDP_ASSOCIATE:
-          /*** if(!Boolean.valueOf(tunnel.getOptions().getProperty("i2ptunnel.socks.allowUDP")).booleanValue()) {
+          /*** if(!Boolean.parseBoolean(tunnel.getOptions().getProperty("i2ptunnel.socks.allowUDP"))) {
            _log.debug("UDP ASSOCIATE command is not supported!");
            sendRequestReply(Reply.COMMAND_NOT_SUPPORTED, AddressType.DOMAINNAME, null, "0.0.0.0", 0, out);
            throw new SOCKSException("UDP ASSOCIATE command not supported");
@ -207,7 +206,13 @@ public class SOCKS5Server extends SOCKSServer {
                    connHostName += ".";
                }
            }
-            if (command != Command.UDP_ASSOCIATE)
+            // Check if the requested IP should be mapped to a domain name
+            String mappedDomainName = getMappedDomainNameForIP(connHostName);
+            if (mappedDomainName != null) {
+                _log.debug("IPV4 address " + connHostName + " was mapped to domain name " + mappedDomainName);
+                addressType = AddressType.DOMAINNAME;
+                connHostName = mappedDomainName;
+            } else if (command != Command.UDP_ASSOCIATE)
                _log.warn("IPV4 address type in request: " + connHostName + ". Is your client secure?");
            break;
        case AddressType.DOMAINNAME:
@ -463,7 +468,7 @@ public class SOCKS5Server extends SOCKSServer {
        I2PSocket destSock = tun.createI2PSocket(I2PAppContext.getGlobalContext().namingService().lookup(proxy), proxyOpts);
        try {
            DataOutputStream out = new DataOutputStream(destSock.getOutputStream());
-            boolean authAvail = Boolean.valueOf(props.getProperty(I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH)).booleanValue();
+            boolean authAvail = Boolean.parseBoolean(props.getProperty(I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH));
            String configUser =  null;
            String configPW = null;
            if (authAvail) {
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServer.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServer.java
@ -7,6 +7,7 @@
 package net.i2p.i2ptunnel.socks;

 import java.net.Socket;
+import java.util.Properties;

 import net.i2p.client.streaming.I2PSocket;
 import net.i2p.util.Log;
@ -19,11 +20,29 @@ import net.i2p.util.Log;
 public abstract class SOCKSServer {
    private static final Log _log = new Log(SOCKSServer.class);

+    private static final String PROP_MAPPING_PREFIX = "ipmapping.";
+
    /* Details about the connection requested by client */
    protected String connHostName;
    protected int connPort;
    protected int addressType;

+    protected Properties props;
+
+    /**
+     * IP to domain name mapping support. This matches the given IP string
+     * against a user-set list of mappings. This enables applications which do
+     * not properly support the SOCKS5 DOMAINNAME feature to be used with I2P.
+     * @param ip The IP address to check.
+     * @return   The domain name if a mapping is found, or null otherwise.
+     * @since 0.9.5
+     */
+    protected String getMappedDomainNameForIP(String ip) {
+        if (props.containsKey(PROP_MAPPING_PREFIX + ip))
+            return props.getProperty(PROP_MAPPING_PREFIX + ip);
+        return null;
+    }
+
    /**
     * Perform server initialization (expecially regarding protected
     * variables).
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java
@ -49,12 +49,12 @@ public class SOCKSServerFactory {
            switch (socksVer) {
            case 0x04:
                // SOCKS version 4/4a
-                if (Boolean.valueOf(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH)).booleanValue() &&
+                if (Boolean.parseBoolean(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH)) &&
                    props.containsKey(I2PTunnelHTTPClientBase.PROP_USER) &&
                    props.containsKey(I2PTunnelHTTPClientBase.PROP_PW)) {
                    throw new SOCKSException("SOCKS 4/4a not supported when authorization is required");
                }
-                serv = new SOCKS4aServer(s);
+                serv = new SOCKS4aServer(s, props);
                break;
            case 0x05:
                // SOCKS version 5
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java
@ -29,8 +29,8 @@ import net.i2p.util.Addresses;
 /**
 * Ugly little accessor for the edit page
 *
- * Warning - This class is not part of the i2ptunnel API, and at some point
- * it will be moved from the jar to the war.
+ * Warning - This class is not part of the i2ptunnel API,
+ * it has been moved from the jar to the war.
 * Usage by classes outside of i2ptunnel.war is deprecated.
 */
 public class EditBean extends IndexBean {
@ -38,6 +38,8 @@ public class EditBean extends IndexBean {
    
    public static boolean staticIsClient(int tunnel) {
        TunnelControllerGroup group = TunnelControllerGroup.getInstance();
+        if (group == null)
+            return false;
        List controllers = group.getControllers();
        if (controllers.size() > tunnel) {
            TunnelController cur = (TunnelController)controllers.get(tunnel);
@ -55,6 +57,7 @@ public class EditBean extends IndexBean {
        else
            return "127.0.0.1";
    }
+
    public String getTargetPort(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null && tun.getTargetPort() != null)
@ -62,6 +65,7 @@ public class EditBean extends IndexBean {
        else
            return "";
    }
+
    public String getSpoofedHost(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null && tun.getSpoofedHost() != null)
@ -69,12 +73,13 @@ public class EditBean extends IndexBean {
        else
            return "";
    }
+
    public String getPrivateKeyFile(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null && tun.getPrivKeyFile() != null)
            return tun.getPrivKeyFile();
        if (tunnel < 0)
-            tunnel = _group.getControllers().size();
+            tunnel = _group == null ? 999 : _group.getControllers().size();
        return "i2ptunnel" + tunnel + "-privKeys.dat";
    }
    
@ -114,7 +119,7 @@ public class EditBean extends IndexBean {
    public boolean isSharedClient(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null)
-            return Boolean.valueOf(tun.getSharedClient()).booleanValue();
+            return Boolean.parseBoolean(tun.getSharedClient());
        else
            return false;
    }
@ -221,19 +226,7 @@ public class EditBean extends IndexBean {
    
    /** all proxy auth @since 0.8.2 */
    public boolean getProxyAuth(int tunnel) {
-        return getBooleanProperty(tunnel, I2PTunnelHTTPClientBase.PROP_AUTH) &&
-               getProxyUsername(tunnel).length() > 0 &&
-               getProxyPassword(tunnel).length() > 0;
-    }
-    
-    public String getProxyUsername(int tunnel) {
-        return getProperty(tunnel, I2PTunnelHTTPClientBase.PROP_USER, "");
-    }
-    
-    public String getProxyPassword(int tunnel) {
-        if (getProxyUsername(tunnel).length() <= 0)
-            return "";
-        return getProperty(tunnel, I2PTunnelHTTPClientBase.PROP_PW, "");
+        return getProperty(tunnel, I2PTunnelHTTPClientBase.PROP_AUTH, "false") != "false";
    }
    
    public boolean getOutproxyAuth(int tunnel) {
@ -312,7 +305,7 @@ public class EditBean extends IndexBean {
        if (tun != null) {
            Properties opts = getOptions(tun);
            if (opts != null)
-                return Boolean.valueOf(opts.getProperty(prop)).booleanValue();
+                return Boolean.parseBoolean(opts.getProperty(prop));
        }
        return false;
    }
@ -354,10 +347,17 @@ public class EditBean extends IndexBean {
            if (opts == null) return "";
            StringBuilder buf = new StringBuilder(64);
            int i = 0;
+            boolean isMD5Proxy = "httpclient".equals(tun.getType()) ||
+                                 "connectclient".equals(tun.getType());
            for (Iterator iter = opts.keySet().iterator(); iter.hasNext(); ) {
                String key = (String)iter.next();
                if (_noShowSet.contains(key))
                    continue;
+                // leave in for HTTP and Connect so it can get migrated to MD5
+                // hide for SOCKS until migrated to MD5
+                if ((!isMD5Proxy) &&
+                    _nonProxyNoShowSet.contains(key))
+                    continue;
                String val = opts.getProperty(key);
                if (i != 0) buf.append(' ');
                buf.append(key).append('=').append(val);
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java
@ -27,26 +27,31 @@ import net.i2p.data.Certificate;
 import net.i2p.data.Destination;
 import net.i2p.data.PrivateKeyFile;
 import net.i2p.data.SessionKey;
+import net.i2p.i2ptunnel.I2PTunnelConnectClient;
 import net.i2p.i2ptunnel.I2PTunnelHTTPClient;
 import net.i2p.i2ptunnel.I2PTunnelHTTPClientBase;
 import net.i2p.i2ptunnel.I2PTunnelIRCClient;
 import net.i2p.i2ptunnel.TunnelController;
 import net.i2p.i2ptunnel.TunnelControllerGroup;
+import net.i2p.util.Addresses;
 import net.i2p.util.ConcurrentHashSet;
 import net.i2p.util.FileUtil;
 import net.i2p.util.Log;
+import net.i2p.util.PasswordManager;
+import net.i2p.util.SecureFile;

 /**
 * Simple accessor for exposing tunnel info, but also an ugly form handler
 *
- * Warning - This class is not part of the i2ptunnel API, and at some point
- * it will be moved from the jar to the war.
+ * Warning - This class is not part of the i2ptunnel API,
+ * it has been moved from the jar to the war.
 * Usage by classes outside of i2ptunnel.war is deprecated.
 */
 public class IndexBean {
    protected final I2PAppContext _context;
    protected final Log _log;
    protected final TunnelControllerGroup _group;
+    private final String _fatalError;
    private String _action;
    private int _tunnel;
    //private long _prevNonce;
@ -82,15 +87,14 @@ public class IndexBean {
    private int _hashCashValue;
    private int _certType;
    private String _certSigner;
+    private String _newProxyUser;
+    private String _newProxyPW;
    
    public static final int RUNNING = 1;
    public static final int STARTING = 2;
    public static final int NOT_RUNNING = 3;
    public static final int STANDBY = 4;
    
-    /** deprecated unimplemented, now using routerconsole realm */
-    //public static final String PROP_TUNNEL_PASSPHRASE = "i2ptunnel.passphrase";
-    public static final String PROP_TUNNEL_PASSPHRASE = "consolePassword";
    //static final String PROP_NONCE = IndexBean.class.getName() + ".nonce";
    //static final String PROP_NONCE_OLD = PROP_NONCE + '2';
    /** 3 wasn't enough for some browsers. They are reloading the page for some reason - maybe HEAD? @since 0.8.1 */
@ -103,11 +107,23 @@ public class IndexBean {
    public static final String DEFAULT_THEME = "light";
    public static final String PROP_CSS_DISABLED = "routerconsole.css.disabled";
    public static final String PROP_JS_DISABLED = "routerconsole.javascript.disabled";
+    private static final String PROP_PW_ENABLE = "routerconsole.auth.enable";
    
    public IndexBean() {
        _context = I2PAppContext.getGlobalContext();
        _log = _context.logManager().getLog(IndexBean.class);
-        _group = TunnelControllerGroup.getInstance();
+        TunnelControllerGroup tcg;
+        String error;
+        try {
+            tcg = TunnelControllerGroup.getInstance();
+            error = tcg == null ? _("Tunnels are not initialized yet, please reload in two minutes.")
+                                : null;
+        } catch (IllegalArgumentException iae) {
+            tcg = null;
+            error = iae.toString();
+        }
+        _group = tcg;
+        _fatalError = error;
        _tunnel = -1;
        _curNonce = "-1";
        addNonce();
@ -115,6 +131,13 @@ public class IndexBean {
        _otherOptions = new ConcurrentHashMap(4);
    }
    
+    /**
+     *  @since 0.9.4
+     */
+    public boolean isInitialized() {
+        return _group != null;
+    }
+
    public static String getNextNonce() {
        synchronized (_nonces) {
            return _nonces.get(0);
@ -144,14 +167,11 @@ public class IndexBean {
        }
    }

-    /** deprecated unimplemented, now using routerconsole realm */
-    public void setPassphrase(String phrase) {
-    }
-    
    public void setAction(String action) {
        if ( (action == null) || (action.trim().length() <= 0) ) return;
        _action = action;
    }
+
    public void setTunnel(String tunnel) {
        if ( (tunnel == null) || (tunnel.trim().length() <= 0) ) return;
        try {
@ -161,17 +181,17 @@ public class IndexBean {
        }
    }
    
-    /** just check if console password option is set, jetty will do auth */
-    private boolean validPassphrase() {
-        String pass = _context.getProperty(PROP_TUNNEL_PASSPHRASE);
-        return pass != null && pass.trim().length() > 0;
-    }
-    
    private String processAction() {
        if ( (_action == null) || (_action.trim().length() <= 0) || ("Cancel".equals(_action)))
            return "";
-        if ( (!haveNonce(_curNonce)) && (!validPassphrase()) )
-            return _("Invalid form submission, probably because you used the 'back' or 'reload' button on your browser. Please resubmit.");
+        if (_group == null)
+            return "Error - tunnels are not initialized yet";
+        // If passwords are turned on, all is assumed good
+        if (!_context.getBooleanProperty(PROP_PW_ENABLE) &&
+            !haveNonce(_curNonce))
+            return _("Invalid form submission, probably because you used the 'back' or 'reload' button on your browser. Please resubmit.")
+                   + ' ' +
+                   _("If the problem persists, verify that you have cookies enabled in your browser.");
        if ("Stop all".equals(_action)) 
            return stopAll();
        else if ("Start all".equals(_action))
@ -199,33 +219,33 @@ public class IndexBean {
        else
            return "Action " + _action + " unknown";
    }
+
    private String stopAll() {
-        if (_group == null) return "";
        List<String> msgs = _group.stopAllControllers();
        return getMessages(msgs);
    }
+
    private String startAll() {
-        if (_group == null) return "";
        List<String> msgs = _group.startAllControllers();
        return getMessages(msgs);
    }
+
    private String restartAll() {
-        if (_group == null) return "";
        List<String> msgs = _group.restartAllControllers();
        return getMessages(msgs);
    }
+
    private String reloadConfig() {
-        if (_group == null) return "";
-        
        _group.reloadControllers();
        return _("Configuration reloaded for all tunnels");
    }
+
    private String start() {
        if (_tunnel < 0) return "Invalid tunnel";
        
-        List controllers = _group.getControllers();
+        List<TunnelController> controllers = _group.getControllers();
        if (_tunnel >= controllers.size()) return "Invalid tunnel";
-        TunnelController controller = (TunnelController)controllers.get(_tunnel);
+        TunnelController controller = controllers.get(_tunnel);
        controller.startTunnelBackground();
        // give the messages a chance to make it to the window
        try { Thread.sleep(1000); } catch (InterruptedException ie) {}
@ -236,9 +256,9 @@ public class IndexBean {
    private String stop() {
        if (_tunnel < 0) return "Invalid tunnel";
        
-        List controllers = _group.getControllers();
+        List<TunnelController> controllers = _group.getControllers();
        if (_tunnel >= controllers.size()) return "Invalid tunnel";
-        TunnelController controller = (TunnelController)controllers.get(_tunnel);
+        TunnelController controller = controllers.get(_tunnel);
        controller.stopTunnel();
        // give the messages a chance to make it to the window
        try { Thread.sleep(1000); } catch (InterruptedException ie) {}
@ -265,19 +285,19 @@ public class IndexBean {
        }
        // Only modify other shared tunnels
        // if the current tunnel is shared, and of supported type
-        if (Boolean.valueOf(cur.getSharedClient()).booleanValue() && isClient(cur.getType())) {
+        if (Boolean.parseBoolean(cur.getSharedClient()) && isClient(cur.getType())) {
            // all clients use the same I2CP session, and as such, use the same I2CP options
-            List controllers = _group.getControllers();
+            List<TunnelController> controllers = _group.getControllers();

            for (int i = 0; i < controllers.size(); i++) {
-                TunnelController c = (TunnelController)controllers.get(i);
+                TunnelController c = controllers.get(i);

                // Current tunnel modified by user, skip
                if (c == cur) continue;

                // Only modify this non-current tunnel
                // if it belongs to a shared destination, and is of supported type
-                if (Boolean.valueOf(c.getSharedClient()).booleanValue() && isClient(c.getType())) {
+                if (Boolean.parseBoolean(c.getSharedClient()) && isClient(c.getType())) {
                    Properties cOpt = c.getConfig("");
                    if (_tunnelQuantity != null) {
                        cOpt.setProperty("option.inbound.quantity", _tunnelQuantity);
@ -354,10 +374,13 @@ public class IndexBean {
                            name = Long.toString(_context.clock().now());
                    }
                }
-                name = "i2ptunnel-deleted-" + name.replace(' ', '_') + "-privkeys.dat";
-                File to = new File(_context.getConfigDir(), name);
-                if (to.exists())
-                    to = new File(_context.getConfigDir(), name + '-' + _context.clock().now());
+                name = "i2ptunnel-deleted-" + name.replace(' ', '_') + '-' + _context.clock().now() + "-privkeys.dat";
+                File backupDir = new SecureFile(_context.getConfigDir(), TunnelController.KEY_BACKUP_DIR);
+                File to;
+                if (backupDir.isDirectory() || backupDir.mkdir())
+                    to = new File(backupDir, name);
+                else
+                    to = new File(_context.getConfigDir(), name);
                boolean success = FileUtil.rename(pkf, to);
                if (success)
                    msgs.add("Private key file " + pkf.getAbsolutePath() +
@ -374,7 +397,7 @@ public class IndexBean {
     */
    public String getMessages() {
        if (_group == null)
-            return "";
+            return _fatalError;
        
        StringBuilder buf = new StringBuilder(512);
        if (_action != null) {
@ -436,6 +459,9 @@ public class IndexBean {
            return _("New Tunnel");
    }
    
+    /**
+     *  No validation
+     */
    public String getClientPort(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null && tun.getListenPort() != null)
@ -444,6 +470,28 @@ public class IndexBean {
            return "";
    }
    
+    /**
+     *  Returns error message if blank or invalid
+     *  @since 0.9.3
+     */
+    public String getClientPort2(int tunnel) {
+        TunnelController tun = getController(tunnel);
+        if (tun != null && tun.getListenPort() != null) {
+            String port = tun.getListenPort();
+            if (port.length() == 0)
+                return "<font color=\"red\">" + _("Port not set") + "</font>";
+            int iport = Addresses.getPort(port);
+            if (iport == 0)
+                return "<font color=\"red\">" + _("Invalid port") + ' ' + port + "</font>";
+            if (iport < 1024)
+                return "<font color=\"red\">" +
+                       _("Warning - ports less than 1024 are not recommended") +
+                       ": " + port + "</font>";
+            return port;
+        }
+        return "<font color=\"red\">" + _("Port not set") + "</font>";
+    }
+    
    public String getTunnelType(int tunnel) {
        TunnelController tun = getController(tunnel);
        if (tun != null)
@ -551,12 +599,16 @@ public class IndexBean {
            else
                host = tun.getTargetHost();
            String port = tun.getTargetPort();
-            if (host == null)
+            if (host == null || host.length() == 0)
                host = "<font color=\"red\">" + _("Host not set") + "</font>";
+            else if (Addresses.getIP(host) == null)
+                host = "<font color=\"red\">" + _("Invalid address") + ' ' + host + "</font>";
            else if (host.indexOf(':') >= 0)
                host = '[' + host + ']';
-            if (port == null)
+            if (port == null || port.length() == 0)
                port = "<font color=\"red\">" + _("Port not set") + "</font>";
+            else if (Addresses.getPort(port) == 0)
+                port = "<font color=\"red\">" + _("Invalid port") + ' ' + port + "</font>";
            return host + ':' + port;
       }  else
            return "";
@ -774,21 +826,22 @@ public class IndexBean {

    /** all proxy auth @since 0.8.2 */
    public void setProxyAuth(String s) {
-        _booleanOptions.add(I2PTunnelHTTPClientBase.PROP_AUTH);
+        if (s != null)
+            _otherOptions.put(I2PTunnelHTTPClientBase.PROP_AUTH, I2PTunnelHTTPClientBase.DIGEST_AUTH);
    }
    
    public void setProxyUsername(String s) {
        if (s != null)
-            _otherOptions.put(I2PTunnelHTTPClientBase.PROP_USER, s.trim());
+            _newProxyUser = s.trim();
    }
    
    public void setProxyPassword(String s) {
        if (s != null)
-            _otherOptions.put(I2PTunnelHTTPClientBase.PROP_PW, s.trim());
+            _newProxyPW = s.trim();
    }
    
    public void setOutproxyAuth(String s) {
-        _booleanOptions.add(I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH);
+        _otherOptions.put(I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH, I2PTunnelHTTPClientBase.DIGEST_AUTH);
    }
    
    public void setOutproxyUsername(String s) {
@ -1010,6 +1063,45 @@ public class IndexBean {
                config.setProperty("proxyList", _proxyList);
        }

+        // Proxy auth including migration to MD5
+        if ("httpclient".equals(_type) || "connectclient".equals(_type)) {
+            // Migrate even if auth is disabled
+            // go get the old from custom options that updateConfigGeneric() put in there
+            String puser = "option." + I2PTunnelHTTPClientBase.PROP_USER;
+            String user = config.getProperty(puser);
+            String ppw = "option." + I2PTunnelHTTPClientBase.PROP_PW;
+            String pw = config.getProperty(ppw);
+            if (user != null && pw != null && user.length() > 0 && pw.length() > 0) {
+                String pmd5 = "option." + I2PTunnelHTTPClientBase.PROP_PROXY_DIGEST_PREFIX +
+                              user + I2PTunnelHTTPClientBase.PROP_PROXY_DIGEST_SUFFIX;
+                if (config.getProperty(pmd5) == null) {
+                    // not in there, migrate
+                    String realm = _type.equals("httpclient") ? I2PTunnelHTTPClient.AUTH_REALM
+                                                              : I2PTunnelConnectClient.AUTH_REALM;
+                    String hex = PasswordManager.md5Hex(realm, user, pw);
+                    if (hex != null) {
+                        config.setProperty(pmd5, hex);
+                        config.remove(puser);
+                        config.remove(ppw);
+                    }
+                }
+            }
+            // New user/password
+            String auth = _otherOptions.get(I2PTunnelHTTPClientBase.PROP_AUTH);
+            if (auth != null && !auth.equals("false")) {
+                if (_newProxyUser != null && _newProxyPW != null &&
+                    _newProxyUser.length() > 0 && _newProxyPW.length() > 0) {
+                    String pmd5 = "option." + I2PTunnelHTTPClientBase.PROP_PROXY_DIGEST_PREFIX +
+                                  _newProxyUser + I2PTunnelHTTPClientBase.PROP_PROXY_DIGEST_SUFFIX;
+                    String realm = _type.equals("httpclient") ? I2PTunnelHTTPClient.AUTH_REALM
+                                                              : I2PTunnelConnectClient.AUTH_REALM;
+                    String hex = PasswordManager.md5Hex(realm, _newProxyUser, _newProxyPW);
+                    if (hex != null)
+                        config.setProperty(pmd5, hex);
+                }
+            }
+        }
+
        if ("ircclient".equals(_type) || "client".equals(_type) || "streamrclient".equals(_type)) {
            if (_targetDestination != null)
                config.setProperty("targetDestination", _targetDestination);
@ -1054,15 +1146,16 @@ public class IndexBean {
        "i2cp.reduceOnIdle", "i2cp.closeOnIdle", "i2cp.newDestOnResume", "persistentClientKey", "i2cp.delayOpen"
        };
    private static final String _booleanProxyOpts[] = {
-        I2PTunnelHTTPClientBase.PROP_AUTH, I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH
+        I2PTunnelHTTPClientBase.PROP_OUTPROXY_AUTH
        };
    private static final String _booleanServerOpts[] = {
        "i2cp.reduceOnIdle", "i2cp.encryptLeaseSet", PROP_ENABLE_ACCESS_LIST, PROP_ENABLE_BLACKLIST
        };
    private static final String _otherClientOpts[] = {
        "i2cp.reduceIdleTime", "i2cp.reduceQuantity", "i2cp.closeIdleTime",
-        "proxyUsername", "proxyPassword", "outproxyUsername", "outproxyPassword",
-        I2PTunnelHTTPClient.PROP_JUMP_SERVERS
+        "outproxyUsername", "outproxyPassword",
+        I2PTunnelHTTPClient.PROP_JUMP_SERVERS,
+        I2PTunnelHTTPClientBase.PROP_AUTH
        };
    private static final String _otherServerOpts[] = {
        "i2cp.reduceIdleTime", "i2cp.reduceQuantity", "i2cp.leaseSetKey", "i2cp.accessList",
@ -1071,7 +1164,17 @@ public class IndexBean {
         PROP_MAX_STREAMS
        };

+    /**
+     *  do NOT add these to noShoOpts, we must leave them in for HTTPClient and ConnectCLient
+     *  so they will get migrated to MD5
+     *  TODO migrate socks to MD5
+     */
+    private static final String _otherProxyOpts[] = {
+        "proxyUsername", "proxyPassword"
+        };
+
    protected static final Set _noShowSet = new HashSet(64);
+    protected static final Set _nonProxyNoShowSet = new HashSet(4);
    static {
        _noShowSet.addAll(Arrays.asList(_noShowOpts));
        _noShowSet.addAll(Arrays.asList(_booleanClientOpts));
@ -1079,6 +1182,7 @@ public class IndexBean {
        _noShowSet.addAll(Arrays.asList(_booleanServerOpts));
        _noShowSet.addAll(Arrays.asList(_otherClientOpts));
        _noShowSet.addAll(Arrays.asList(_otherServerOpts));
+        _nonProxyNoShowSet.addAll(Arrays.asList(_otherProxyOpts));
    }

    private void updateConfigGeneric(Properties config) {
@ -1109,6 +1213,12 @@ public class IndexBean {
                String key = pair.substring(0, eq);
                if (_noShowSet.contains(key))
                    continue;
+                // leave in for HTTP and Connect so it can get migrated to MD5
+                // hide for SOCKS until migrated to MD5
+                if ((!"httpclient".equals(_type)) &&
+                    (! "connectclient".equals(_type)) &&
+                    _nonProxyNoShowSet.contains(key))
+                    continue;
                String val = pair.substring(eq+1);
                config.setProperty("option." + key, val);
            }
@ -1160,9 +1270,9 @@ public class IndexBean {
    protected TunnelController getController(int tunnel) {
        if (tunnel < 0) return null;
        if (_group == null) return null;
-        List controllers = _group.getControllers();
+        List<TunnelController> controllers = _group.getControllers();
        if (controllers.size() > tunnel)
-            return (TunnelController)controllers.get(tunnel); 
+            return controllers.get(tunnel); 
        else
            return null;
    }
--- a/apps/i2ptunnel/java/test/junit/net/i2p/i2ptunnel/I2PTunnelHTTPServerTest.java
+++ b/apps/i2ptunnel/java/test/junit/net/i2p/i2ptunnel/I2PTunnelHTTPServerTest.java
--- a/apps/i2ptunnel/jsp/editClient.jsp
+++ b/apps/i2ptunnel/jsp/editClient.jsp
@ -31,7 +31,11 @@
 <body id="tunnelEditPage">
    <div id="pageHeader">
    </div>
+<%

+  if (editBean.isInitialized()) {
+
+%>
    <form method="post" action="list">

        <div id="tunnelEditPanel" class="panel">
@ -244,7 +248,7 @@
                    <option value="2"<%=(tunnelQuantity == 2 ? " selected=\"selected\"" : "") %>><%=intl._("2 inbound, 2 outbound tunnels (standard bandwidth usage, standard reliability)")%></option>
                    <option value="3"<%=(tunnelQuantity == 3 ? " selected=\"selected\"" : "") %>><%=intl._("3 inbound, 3 outbound tunnels (higher bandwidth usage, higher reliability)")%></option>
                <% if (tunnelQuantity > 3) {
-                %>    <option value="<%=tunnelQuantity%>" selected="selected"><%=tunnelQuantity%> <%=intl._("tunnels")%></option>
+                %>    <option value="<%=tunnelQuantity%>" selected="selected"><%=tunnelQuantity%>&nbsp;<%=intl._("tunnels")%></option>
                <% }
              %></select>                
            </div>
@ -429,19 +433,19 @@
                <label>
                    <%=intl._("Enable")%>:
                </label>
-                <input value="1" type="checkbox" id="proxyAuth" name="proxyAuth" title="Check to require authorization for this service"<%=(editBean.getProxyAuth(curTunnel) ? " checked=\"checked\"" : "")%> class="tickbox" />                
+                <input value="1" type="checkbox" id="startOnLoad" name="proxyAuth" title="Check to require authorization for this service"<%=(editBean.getProxyAuth(curTunnel) ? " checked=\"checked\"" : "")%> class="tickbox" />                
            </div>
            <div id="portField" class="rowItem">
                <label>
                    <%=intl._("Username")%>:
                </label>
-                <input type="text" id="clientPort" name="proxyUsername" title="Set username for this service" value="<%=editBean.getProxyUsername(curTunnel)%>" class="freetext" />                
+                <input type="text" id="clientPort" name="proxyUsername" title="Set username for this service" value="" class="freetext" />                
            </div>
            <div id="portField" class="rowItem">
                <label>
                    <%=intl._("Password")%>:
                </label>
-                <input type="password" id="clientPort" name="proxyPassword" title="Set password for this service" value="<%=editBean.getProxyPassword(curTunnel)%>" class="freetext" />                
+                <input type="password" id="clientPort" name="proxyPassword" title="Set password for this service" value="" class="freetext" />                
            </div>
            <div class="subdivider">
                <hr />
@ -453,7 +457,7 @@
                <label>
                    <%=intl._("Enable")%>:
                </label>
-                <input value="1" type="checkbox" id="outproxyAuth" name="outproxyAuth" title="Check if the outproxy requires authorization"<%=(editBean.getOutproxyAuth(curTunnel) ? " checked=\"checked\"" : "")%> class="tickbox" />                
+                <input value="1" type="checkbox" id="startOnLoad" name="outproxyAuth" title="Check if the outproxy requires authorization"<%=(editBean.getOutproxyAuth(curTunnel) ? " checked=\"checked\"" : "")%> class="tickbox" />                
            </div>
            <div id="portField" class="rowItem">
                <label>
@ -508,5 +512,12 @@
    </form>
    <div id="pageFooter">
        </div>
+<%
+
+  } else {
+     %>Tunnels are not initialized yet, please reload in two minutes.<%
+  }  // isInitialized()
+
+%>
    </body>
 </html>
--- a/Show More
+++ b/Show More