Integrated onion proxy into or/

The 'or' process can now be told (by the global_role variable) what
roles this server should play -- connect to all ORs, listen for ORs,
listen for OPs, listen for APs, or any combination.

* everything in /src/op/ is now obsolete.
* connection_ap.c now handles all interactions with application proxies
* "port" is now or_port, op_port, ap_port. But routers are still always
  referenced (say, in conn_get_by_addr_port()) by addr / or_port. We
  should make routers.c actually read these new ports (currently I've
  kludged it so op_port = or_port+10, ap_port=or_port+20)
* circuits currently know if they're at the beginning of the path because
  circ->cpath is set. They use this instead for crypts (both ways),
  if it's set.
* I still obey the "send a 0 back to the AP when you're ready" protocol,
  but I think we should phase it out. I can simply not read from the AP
  socket until I'm ready.

I need to do a lot of cleanup work here, but the code appears to work, so
now's a good time for a checkin.


svn:r22

11 files changed, 1561 insertions, 213 deletions

diff --git a/src/or/Makefile.am b/src/or/Makefile.am
index c401ef79a..d0e78a552 100644
--- a/src/or/Makefile.am
+++ b/src/or/Makefile.am
@@ -4,7 +4,7 @@ bin_PROGRAMS = or
 or_LDADD = -L../common -lor
 
 or_SOURCES = args.c buffers.c cell.c circuit.c command.c connection.c \
-             connection_exit.c connection_op.c connection_or.c config.c \
+             connection_exit.c connection_ap.c connection_op.c connection_or.c config.c \
              main.c onion.c routers.c
 
 noinst_HEADERS = or.h
diff --git a/src/or/circuit.c b/src/or/circuit.c
index 39ca49c86..5f323dd50 100644
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -52,9 +52,6 @@ circuit_t *circuit_new(aci_t p_aci, connection_t *p_conn) {
   circ->p_conn = p_conn;
 
   circ->state = CIRCUIT_STATE_OPEN_WAIT;
-  circ->onion = NULL;
-  circ->onionlen=0;
-  circ->recvlen=0;
 
   /* ACIs */
   circ->p_aci = p_aci;
@@ -72,9 +69,19 @@ void circuit_free(circuit_t *circ) {
 
   if(circ->onion)
     free(circ->onion);
+  if(circ->cpath)
+    circuit_free_cpath(circ->cpath, circ->cpathlen);
 
   free(circ);
+}
+
+void circuit_free_cpath(crypt_path_t **cpath, size_t cpathlen) {
+  int i;
+
+  for(i=0;i<cpathlen;i++)
+    free(cpath[i]);
 
+  free(cpath);
 }
 
 aci_t get_unique_aci_by_addr_port(uint32_t addr, uint16_t port, int aci_type) {
@@ -89,6 +96,7 @@ aci_t get_unique_aci_by_addr_port(uint32_t addr, uint16_t port, int aci_type) {
     test_aci &= htons(0x00FF);
   if(aci_type == ACI_TYPE_HIGHER)
     test_aci &= htons(0xFF00);
+  /* if aci_type == ACI_BOTH, don't filter any of it */
 
   if(test_aci == 0)
     return get_unique_aci_by_addr_port(addr, port, aci_type); /* try again */ 
@@ -110,12 +118,10 @@ int circuit_init(circuit_t *circ, int aci_type) {
   unsigned char digest1[20];
   unsigned char digest2[20];
 
-  if (!circ)
-    return -1;
+  assert(circ);
 
   ol = (onion_layer_t *)circ->onion;
-  if (!ol)
-    return -1;
+  assert(ol);
 
   log(LOG_DEBUG,"circuit_init(): starting");
   circ->n_addr = ol->addr;
@@ -204,6 +210,16 @@ int circuit_init(circuit_t *circ, int aci_type) {
   return 0;
 }
 
+circuit_t *circuit_get_by_naddr_nport(uint32_t naddr, uint16_t nport) {
+  circuit_t *circ;
+
+  for(circ=global_circuitlist;circ;circ = circ->next) {
+    if(circ->n_addr == naddr && circ->n_port == nport)
+       return circ;
+  }
+  return NULL;
+}
+
 circuit_t *circuit_get_by_aci_conn(aci_t aci, connection_t *conn) {
   circuit_t *circ;
 
@@ -244,24 +260,24 @@ int circuit_deliver_data_cell(cell_t *cell, circuit_t *circ, connection_t *conn,
 
   if(conn->type == CONN_TYPE_EXIT) { /* send payload directly */
     log(LOG_DEBUG,"circuit_deliver_data_cell(): Sending to exit.");
-    if(connection_exit_process_data_cell(cell, conn) < 0) {
-      return -1;
-    }
-  } else { /* send it as a cell */
-    log(LOG_DEBUG,"circuit_deliver_data_cell(): Sending to connection.");
-    if(connection_write_cell_to_buf(cell, conn) < 0) {
-      return -1;
-    }
+    return connection_exit_process_data_cell(cell, conn);
   }
-  return 0; /* success */
+  if(conn->type == CONN_TYPE_AP) { /* send payload directly */
+    log(LOG_DEBUG,"circuit_deliver_data_cell(): Sending to AP.");
+    return connection_ap_process_data_cell(cell, conn);
+  }
+  /* else send it as a cell */
+  log(LOG_DEBUG,"circuit_deliver_data_cell(): Sending to connection.");
+  return connection_write_cell_to_buf(cell, conn);
 }
 
 int circuit_crypt(circuit_t *circ, char *in, size_t inlen, char crypt_type) {
   char *out;
   int outlen;
+  int i;
+  crypt_path_t *thishop;
 
-  if(!circ || !in)
-    return -1;
+  assert(circ && in);
 
   out = malloc(inlen);
   if(!out)
@@ -269,24 +285,65 @@ int circuit_crypt(circuit_t *circ, char *in, size_t inlen, char crypt_type) {
 
   if(crypt_type == 'e') {
     log(LOG_DEBUG,"circuit_crypt(): Encrypting %d bytes.",inlen);
-    if(!EVP_EncryptUpdate(&circ->p_ctx,out,&outlen,in,inlen)) {
-      log(LOG_ERR,"circuit_encrypt(): Encryption failed for ACI : %u (%s).",circ->p_aci, ERR_reason_error_string(ERR_get_error()));
-      return -1;
+    if(circ->cpath) { /* we're at the beginning of the circuit. We'll want to do layered crypts. */
+      /* 'e' means we're preparing to send it out. */
+      for (i=0; i < circ->cpathlen; i++) /* moving from last to first hop 
+                                          * Remember : cpath is in reverse order, i.e. last hop first
+                                          */
+      { 
+        log(LOG_DEBUG,"circuit_crypt() : Encrypting via cpath: Processing hop %u",circ->cpathlen-i);
+        thishop = circ->cpath[i];
+    
+        /* encrypt */
+        if(!EVP_EncryptUpdate(&thishop->f_ctx,out,&outlen,in,inlen)) {
+          log(LOG_ERR,"Error performing encryption:%s",ERR_reason_error_string(ERR_get_error()));
+          free(out);
+          return -1;
+        }
+
+        /* copy ciphertext back to buf */
+        memcpy(in,out,inlen);
+      }
+    } else { /* we're in the middle. Just one crypt. */
+      if(!EVP_EncryptUpdate(&circ->p_ctx,out,&outlen,in,inlen)) {
+        log(LOG_ERR,"circuit_encrypt(): Encryption failed for ACI : %u (%s).",
+            circ->p_aci, ERR_reason_error_string(ERR_get_error()));
+        free(out);
+        return -1;
+      }
+      memcpy(in,out,inlen);
     }
   } else if(crypt_type == 'd') {
     log(LOG_DEBUG,"circuit_crypt(): Decrypting %d bytes.",inlen);
-    if(!EVP_DecryptUpdate(&circ->n_ctx,out,&outlen,in,inlen)) {
-      log(LOG_ERR,"circuit_crypt(): Decryption failed for ACI : %u (%s).",circ->n_aci, ERR_reason_error_string(ERR_get_error()));
-      return -1;
+    if(circ->cpath) { /* we're at the beginning of the circuit. We'll want to do layered crypts. */
+      for (i=circ->cpathlen-1; i >= 0; i--) /* moving from first to last hop 
+                                       * Remember : cpath is in reverse order, i.e. last hop first
+                                       */
+      { 
+        log(LOG_DEBUG,"circuit_crypt() : Decrypting via cpath: Processing hop %u",circ->cpathlen-i);
+        thishop = circ->cpath[i];
+
+        /* encrypt */
+        if(!EVP_DecryptUpdate(&thishop->b_ctx,out,&outlen,in,inlen)) {
+          log(LOG_ERR,"Error performing decryption:%s",ERR_reason_error_string(ERR_get_error()));
+          free(out);
+          return -1;
+        }
+
+        /* copy ciphertext back to buf */
+        memcpy(in,out,inlen);
+      }
+    } else { /* we're in the middle. Just one crypt. */
+      if(!EVP_DecryptUpdate(&circ->n_ctx,out,&outlen,in,inlen)) {
+        log(LOG_ERR,"circuit_crypt(): Decryption failed for ACI : %u (%s).",
+            circ->n_aci, ERR_reason_error_string(ERR_get_error()));
+        free(out);
+        return -1;
+      }
+      memcpy(in,out,inlen);
     }
   }
 
-  if(outlen != inlen) {
-    log(LOG_DEBUG,"circuit_crypt(): %d bytes crypted to %d bytes. Weird.",inlen,outlen);
-    return -1;
-  }
-  
-  memcpy(in,out,inlen);
   free(out);
 
   return 0;
@@ -294,8 +351,10 @@ int circuit_crypt(circuit_t *circ, char *in, size_t inlen, char crypt_type) {
 
 void circuit_close(circuit_t *circ) {
   circuit_remove(circ);
-  connection_send_destroy(circ->n_aci, circ->n_conn); 
-  connection_send_destroy(circ->p_aci, circ->p_conn); 
+  if(circ->n_conn)
+    connection_send_destroy(circ->n_aci, circ->n_conn); 
+  if(circ->p_conn)
+    connection_send_destroy(circ->p_aci, circ->p_conn); 
   circuit_free(circ);
 }
 
diff --git a/src/or/command.c b/src/or/command.c
index fddf5cfea..621809677 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -43,7 +43,7 @@ void command_process_create_cell(cell_t *cell, connection_t *conn) {
     memcpy((void *)&circ->onionlen,(void *)cell->payload, 4);
     circ->onionlen = ntohl(circ->onionlen);
     log(LOG_DEBUG,"command_process_create_cell():  Onion length is %u.",circ->onionlen);
-    if(circ->onionlen > 50000) { /* too big */
+    if(circ->onionlen > 50000 || circ->onionlen < 1) { /* too big or too small */
       log(LOG_DEBUG,"That's ludicrous. Closing.");
       circuit_close(circ);
       return;
@@ -172,6 +172,10 @@ void command_process_data_cell(cell_t *cell, connection_t *conn) {
     log(LOG_DEBUG,"command_process_data_cell(): circuit in open_wait. Dropping data cell.");
     return;
   }
+  if(circ->state == CIRCUIT_STATE_OR_WAIT) {
+    log(LOG_DEBUG,"command_process_data_cell(): circuit in or_wait. Dropping data cell.");
+    return;
+  }
 
   /* at this point both circ->n_conn and circ->p_conn are guaranteed to be set */
 
@@ -184,10 +188,18 @@ void command_process_data_cell(cell_t *cell, connection_t *conn) {
     }
   } else { /* it's an ingoing cell */
     cell->aci = circ->p_aci; /* switch it */
-    if(circuit_deliver_data_cell(cell, circ, circ->p_conn, 'e') < 0) {
-      log(LOG_DEBUG,"command_process_data_cell(): circuit_deliver_data_cell (backward) failed. Closing.");
-      circuit_close(circ);
-      return;
+    if(circ->p_conn->type == CONN_TYPE_AP) { /* we want to decrypt, not encrypt */
+      if(circuit_deliver_data_cell(cell, circ, circ->p_conn, 'd') < 0) {
+        log(LOG_DEBUG,"command_process_data_cell(): circuit_deliver_data_cell (backward to AP) failed. Closing.");
+        circuit_close(circ);
+        return;
+      }
+    } else {
+      if(circuit_deliver_data_cell(cell, circ, circ->p_conn, 'e') < 0) {
+        log(LOG_DEBUG,"command_process_data_cell(): circuit_deliver_data_cell (backward) failed. Closing.");
+        circuit_close(circ);
+        return;
+      }
     }
   }
 }
diff --git a/src/or/connection.c b/src/or/connection.c
index 643b1ebb8..b44d72c68 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -61,6 +61,10 @@ void connection_free(connection_t *conn) {
   buf_free(conn->outbuf);
   if(conn->address)
     free(conn->address);
+  if(conn->dest_addr)
+    free(conn->dest_addr);
+  if(conn->dest_port)
+    free(conn->dest_port);
 
  /* FIXME should we do these for all connections, or just ORs, or what */
   if(conn->type == CONN_TYPE_OR ||
@@ -161,18 +165,11 @@ int connection_handle_listener_read(connection_t *conn, int new_type, int new_st
   return 0;
 }
 
-int retry_all_connections(routerinfo_t **router_array, int rarray_len,
-  RSA *prkey, uint16_t or_port, uint16_t op_port, uint16_t ap_port) {
-
-  /* start all connections that should be up but aren't */
-
-  routerinfo_t *router;
-  int i;
-
+/* private function, to create the 'local' variable used below */
+static int learn_local(struct sockaddr_in *local) {
   /* local host information */
   char localhostname[512];
   struct hostent *localhost;
-  struct sockaddr_in local; /* local address */
 
   /* obtain local host information */
   if(gethostname(localhostname,512) < 0) {
@@ -184,31 +181,69 @@ int retry_all_connections(routerinfo_t **router_array, int rarray_len,
     log(LOG_ERR,"Error obtaining local host info.");
     return -1;
   }
-  memset((void *)&local,0,sizeof(local));
-  local.sin_family = AF_INET;
-  local.sin_addr.s_addr = INADDR_ANY;
-  local.sin_port = htons(or_port);
-  memcpy((void *)&local.sin_addr,(void *)localhost->h_addr,sizeof(struct in_addr));
-
-  for (i=0;i<rarray_len;i++) {
-    router = router_array[i];
-    if(!connection_get_by_addr_port(router->addr,router->port)) { /* not in the list */
-      connect_to_router(router, prkey, &local);
+  memset((void *)local,0,sizeof(struct sockaddr_in));
+  local->sin_family = AF_INET;
+  local->sin_addr.s_addr = INADDR_ANY;
+  memcpy((void *)&local->sin_addr,(void *)localhost->h_addr,sizeof(struct in_addr));
+
+  return 0;
+}
+
+int retry_all_connections(int role, routerinfo_t **router_array, int rarray_len,
+  RSA *prkey, uint16_t or_listenport, uint16_t op_listenport, uint16_t ap_listenport) {
+
+  /* start all connections that should be up but aren't */
+
+  routerinfo_t *router;
+  int i;
+  struct sockaddr_in local; /* local address */
+
+  if(learn_local(&local) < 0)
+    return -1;
+
+  local.sin_port = htons(or_listenport);
+  if(role & ROLE_OR_CONNECT_ALL) {
+    for (i=0;i<rarray_len;i++) {
+      router = router_array[i];
+      if(!connection_get_by_addr_port(router->addr,router->or_port)) { /* not in the list */
+        log(LOG_DEBUG,"retry_all_connections(): connecting to OR %s:%u.",router->address,ntohs(router->or_port));
+        connection_or_connect_as_or(router, prkey, &local);
+      }
     }
   }
 
-  if(!connection_get_by_type(CONN_TYPE_OR_LISTENER)) {
-    connection_or_create_listener(prkey, &local);
+  if(role & ROLE_OR_LISTEN) {
+    if(!connection_get_by_type(CONN_TYPE_OR_LISTENER)) {
+      connection_or_create_listener(prkey, &local);
+    }
   }
       
-  local.sin_port = htons(op_port);
-  if(!connection_get_by_type(CONN_TYPE_OP_LISTENER)) {
-    connection_op_create_listener(prkey, &local);
+  if(role & ROLE_OP_LISTEN) {
+    local.sin_port = htons(op_listenport);
+    if(!connection_get_by_type(CONN_TYPE_OP_LISTENER)) {
+      connection_op_create_listener(prkey, &local);
+    }
+  }
+
+  if(role & ROLE_AP_LISTEN) {
+    local.sin_port = htons(ap_listenport);
+    if(!connection_get_by_type(CONN_TYPE_AP_LISTENER)) {
+      connection_ap_create_listener(NULL, &local); /* no need to tell it the private key. */
+    }
   }
  
   return 0;
 }
 
+connection_t *connection_connect_to_router_as_op(routerinfo_t *router, RSA *prkey, uint16_t local_or_port) {
+  struct sockaddr_in local; /* local address */
+
+  if(learn_local(&local) < 0)
+    return NULL;
+  local.sin_port = htons(local_or_port);
+  return connection_or_connect_as_or(router, prkey, &local);
+}
+
 int connection_read_to_buf(connection_t *conn) {
   return read_to_buf(conn->s, &conn->inbuf, &conn->inbuflen, &conn->inbuf_datalen, &conn->inbuf_reached_eof);
 }
@@ -234,6 +269,7 @@ int connection_send_destroy(aci_t aci, connection_t *conn) {
   assert(conn);
 
   if(conn->type == CONN_TYPE_OP ||
+     conn->type == CONN_TYPE_AP ||
      conn->type == CONN_TYPE_EXIT) {
      log(LOG_DEBUG,"connection_send_destroy(): At an edge. Marking connection for close.");
      conn->marked_for_close = 1;
@@ -296,12 +332,66 @@ int connection_process_inbuf(connection_t *conn) {
       return connection_or_process_inbuf(conn);
     case CONN_TYPE_EXIT:
       return connection_exit_process_inbuf(conn);
+    case CONN_TYPE_AP:
+      return connection_ap_process_inbuf(conn);
     default:
       log(LOG_DEBUG,"connection_process_inbuf() got unexpected conn->type.");
       return -1;
   }
 }
 
+int connection_package_raw_inbuf(connection_t *conn) {
+  int amount_to_process;
+  cell_t cell;
+  circuit_t *circ;
+
+  assert(conn);
+  assert(conn->type == CONN_TYPE_EXIT || conn->type == CONN_TYPE_AP);
+
+  amount_to_process = conn->inbuf_datalen;
+
+  if(!amount_to_process)
+    return 0;
+
+  if(amount_to_process > CELL_PAYLOAD_SIZE) {
+    cell.length = CELL_PAYLOAD_SIZE;
+  } else {
+    cell.length = amount_to_process;
+  }
+
+  if(connection_fetch_from_buf(cell.payload, cell.length, conn) < 0)
+    return -1;
+
+  circ = circuit_get_by_conn(conn);
+  if(!circ) {
+    log(LOG_DEBUG,"connection_raw_package_inbuf(): conn has no circuits!");
+    return -1;
+  }
+
+  log(LOG_DEBUG,"connection_raw_package_inbuf(): Packaging %d bytes.",cell.length);
+  if(circ->n_conn == conn) { /* send it backward. we're an exit. */
+    cell.aci = circ->p_aci;
+    cell.command = CELL_DATA;
+    if(circuit_deliver_data_cell(&cell, circ, circ->p_conn, 'e') < 0) {
+      log(LOG_DEBUG,"connection_raw_package_inbuf(): circuit_deliver_data_cell (backward) failed. Closing.");
+      circuit_close(circ);
+      return 0;
+    }
+  } else { /* send it forward. we're an AP */
+    cell.aci = circ->n_aci;
+    cell.command = CELL_DATA;
+    if(circuit_deliver_data_cell(&cell, circ, circ->n_conn, 'e') < 0) {
+      /* yes, we use 'e' here, because the AP connection must *encrypt* its input. */
+      log(LOG_DEBUG,"connection_raw_package_inbuf(): circuit_deliver_data_cell (forward) failed. Closing.");
+      circuit_close(circ);
+      return 0;
+    }
+  }
+  if(amount_to_process > CELL_PAYLOAD_SIZE)
+    return connection_package_raw_inbuf(conn);
+  return 0;
+}
+
 int connection_finished_flushing(connection_t *conn) {
 
   assert(conn);
@@ -309,6 +399,8 @@ int connection_finished_flushing(connection_t *conn) {
   log(LOG_DEBUG,"connection_finished_flushing() entered. Socket %u.", conn->s);
 
   switch(conn->type) {
+    case CONN_TYPE_AP:
+      return connection_ap_finished_flushing(conn);
     case CONN_TYPE_OP:
       return connection_op_finished_flushing(conn);
     case CONN_TYPE_OR:
diff --git a/src/or/connection_ap.c b/src/or/connection_ap.c
new file mode 100644
index 000000000..cd57d90ed
--- /dev/null
+++ b/src/or/connection_ap.c
@@ -0,0 +1,381 @@
+
+#include "or.h"
+
+extern int global_role; /* from main.c */
+
+int connection_ap_process_inbuf(connection_t *conn) {
+
+  assert(conn && conn->type == CONN_TYPE_AP);
+
+  if(conn->inbuf_reached_eof) {
+    /* eof reached, kill it. */
+    log(LOG_DEBUG,"connection_ap_process_inbuf(): conn reached eof. Closing.");
+    return -1;
+  }
+
+  log(LOG_DEBUG,"connection_ap_process_inbuf(): state %d.",conn->state);
+
+  switch(conn->state) {
+    case AP_CONN_STATE_SS_WAIT:
+      return ap_handshake_process_ss(conn);
+    case AP_CONN_STATE_OPEN:
+      return connection_package_raw_inbuf(conn);
+    default:
+      log(LOG_DEBUG,"connection_ap_process_inbuf() called in state where I'm waiting. Ignoring buf for now.");
+  }
+
+  return 0;
+}
+
+int ap_handshake_process_ss(connection_t *conn) {
+  uint16_t len;
+
+  assert(conn);
+
+  log(LOG_DEBUG,"ap_handshake_process_ss() entered.");
+
+  if(!conn->ss_received) { /* try to pull it in */
+
+    if(conn->inbuf_datalen < sizeof(ss_t)) /* entire ss available? */
+      return 0; /* not yet */
+
+    if(connection_fetch_from_buf((char *)&conn->ss,sizeof(ss_t),conn) < 0)
+      return -1;
+
+    conn->ss_received = sizeof(ss_t);
+    log(LOG_DEBUG,"ap_handshake_process_ss(): Successfully read ss.");
+
+    if ((conn->ss.version == 0) || (conn->ss.version != VERSION)) { /* unsupported version */
+      log(LOG_DEBUG,"ap_handshake_process_ss(): ss: Unsupported version.");
+      return -1;
+    }
+    if (conn->ss.addr_fmt != SS_ADDR_FMT_ASCII_HOST_PORT) { /* unrecognized address format */
+      log(LOG_DEBUG,"ap_handshake_process_ss(): ss: Unrecognized address format.");
+      return -1;
+    }
+  }
+
+  if(!conn->dest_addr) { /* no dest_addr found yet */
+
+    if(conn->inbuf_datalen < sizeof(uint16_t))
+      return 0; /* not yet */
+
+    if(connection_fetch_from_buf((char *)&len,sizeof(uint16_t),conn) < 0)
+      return -1;
+
+    len = ntohs(len);
+    if(len > 512) {
+      log(LOG_DEBUG,"ap_handshake_process_ss(): Addr length %d too high.",len);
+      return -1;
+    }
+
+    conn->dest_addr = malloc(len+1);
+    if(!conn->dest_addr) {
+      log(LOG_DEBUG,"ap_handshake_process_ss(): Addr malloc failed");
+      return -1;
+    }
+
+    conn->dest_addr[len] = 0; /* null terminate it */
+    conn->dest_addr_len = len;
+    log(LOG_DEBUG,"Preparing a dest_addr of %d+1 bytes.",len);
+  }
+  if(conn->dest_addr_len != conn->dest_addr_received) { /* try to fetch it all in */
+
+    if(conn->inbuf_datalen < conn->dest_addr_len)
+      return 0; /* not yet */
+
+    if(connection_fetch_from_buf(conn->dest_addr,conn->dest_addr_len,conn) < 0)
+      return -1;
+    log(LOG_DEBUG,"ap_handshake_process_ss(): Read dest_addr '%s'.",conn->dest_addr);
+
+    conn->dest_addr_received = conn->dest_addr_len;
+  }
+  /* now do the same thing for port */
+  if(!conn->dest_port) { /* no dest_port found yet */
+
+    if(conn->inbuf_datalen < sizeof(uint16_t))
+      return 0; /* not yet */
+
+    if(connection_fetch_from_buf((char *)&len,sizeof(uint16_t),conn) < 0)
+      return -1;
+
+    len = ntohs(len);
+    if(len > 10) {
+      log(LOG_DEBUG,"ap_handshake_process_ss(): Port length %d too high.",len);
+      return -1;
+    }
+
+    conn->dest_port = malloc(len+1);
+    if(!conn->dest_port) {
+      log(LOG_DEBUG,"ap_handshake_process_ss(): Port malloc failed");
+      return -1;
+    }
+
+    conn->dest_port[len] = 0; /* null terminate it */
+    conn->dest_port_len = len;
+    log(LOG_DEBUG,"Preparing a dest_port of %d+1 bytes.",len);
+  }
+  if(conn->dest_port_len != conn->dest_port_received) { /* try to fetch it all in */
+
+    if(conn->inbuf_datalen < conn->dest_port_len)
+      return 0; /* not yet */
+
+    if(connection_fetch_from_buf(conn->dest_port,conn->dest_port_len,conn) < 0)
+      return -1;
+    log(LOG_DEBUG,"ap_handshake_process_ss(): Read dest_port (network order) '%s'.",conn->dest_port);
+
+    conn->dest_port_received = conn->dest_port_len;
+  }
+
+  /* now we're all ready to make an onion, etc */
+  return ap_handshake_create_onion(conn);
+}
+
+int ap_handshake_create_onion(connection_t *conn) {
+  int i;
+  int routelen = 0; /* length of the route */
+  unsigned int *route = NULL; /* hops in the route as an array of indexes into rarray */
+  unsigned char *onion = NULL; /* holds the onion */
+  int onionlen = 0; /* onion length in host order */
+  crypt_path_t **cpath = NULL; /* defines the crypt operations that need to be performed on incoming/outgoing data */
+
+  assert(conn);
+
+  /* choose a route */
+  route = (unsigned int *)router_new_route(&routelen);
+  if (!route) { 
+    log(LOG_ERR,"ap_handshake_create_onion(): Error choosing a route through the OR network.");
+    return -1;
+  }
+  log(LOG_DEBUG,"ap_handshake_create_onion(): Chosen a route of length %u : ",routelen);
+#if 0
+  for (i=routelen-1;i>=0;i--)
+  { 
+    log(LOG_DEBUG,"ap_handshake_process_ss() : %u : %s:%u, %u",routelen-i,(routerarray[route[i]])->address,ntohs((routerarray[route[i]])->port),RSA_size((routerarray[route[i]])->pkey));
+  }
+#endif
+
+  /* allocate memory for the crypt path */
+  cpath = malloc(routelen * sizeof(crypt_path_t *));
+  if (!cpath) { 
+    log(LOG_ERR,"ap_handshake_create_onion(): Error allocating memory for cpath.");
+    free(route);
+    return -1;
+  }
+
+  /* create an onion and calculate crypto keys */
+  onion = router_create_onion(route,routelen,&onionlen,cpath);
+  if (!onion) {
+    log(LOG_ERR,"ap_handshake_create_onion(): Error creating an onion.");
+    free(route);
+    free(cpath); /* it's got nothing in it, since !onion */
+    return -1;
+  }
+  log(LOG_DEBUG,"ap_handshake_create_onion(): Created an onion of size %u bytes.",onionlen);
+  log(LOG_DEBUG,"ap_handshake_create_onion(): Crypt path :");
+  for (i=0;i<routelen;i++) {
+    log(LOG_DEBUG,"ap_handshake_create_onion() : %u/%u",(cpath[i])->forwf, (cpath[i])->backf);
+  }
+
+  return ap_handshake_establish_circuit(conn, route, routelen, onion, onionlen, cpath);
+}
+
+int ap_handshake_establish_circuit(connection_t *conn, unsigned int *route, int routelen, char *onion,
+                                   int onionlen, crypt_path_t **cpath) {
+  routerinfo_t *firsthop;
+  connection_t *n_conn;
+  circuit_t *circ;
+
+  /* now see if we're already connected to the first OR in 'route' */
+  firsthop = router_get_first_in_route(route, routelen);
+  assert(firsthop); /* should always be defined */
+  free(route); /* we don't need it anymore */
+
+  circ = circuit_new(0, conn); /* sets circ->p_aci and circ->p_conn */
+  circ->n_addr = firsthop->addr;
+  circ->n_port = firsthop->or_port;
+  circ->state = CIRCUIT_STATE_OR_WAIT;
+  circ->onion = onion;
+  circ->onionlen = onionlen;
+  circ->cpath = cpath;
+  circ->cpathlen = routelen;
+
+  log(LOG_DEBUG,"ap_handshake_establish_circuit(): Looking for firsthop '%s:%u'",
+      firsthop->address,ntohs(firsthop->or_port));
+  n_conn = connection_get_by_addr_port(firsthop->addr,firsthop->or_port);
+  if(!n_conn) { /* not currently connected */
+    if(global_role & ROLE_OR_CONNECT_ALL) { /* we would be connected if he were up. but he's not. */
+      log(LOG_DEBUG,"ap_handshake_establish_circuit(): Route's firsthop isn't connected.");
+      circuit_close(circ); 
+      return -1;
+    }
+    
+    /* ok, launch the connection */
+    n_conn = connect_to_router_as_op(firsthop);
+    /* FIXME react to this somehow */
+    if(!n_conn) { /* connect failed, forget the whole thing */
+      log(LOG_DEBUG,"ap_handshake_establish_circuit(): connect to firsthop failed. Closing.");
+      circuit_close(circ);
+      return -1;
+    }   
+    conn->state = AP_CONN_STATE_OR_WAIT;
+    connection_watch_events(conn, 0); /* Stop listening for input from the AP! */
+    return 0; /* return success. The onion/circuit/etc will be taken care of automatically
+               * (may already have been) whenever n_conn reaches OR_CONN_STATE_OPEN.
+               */ 
+  } else { /* it's already open. use it. */
+    return ap_handshake_send_onion(conn, n_conn, circ);
+  }
+}
+
+/* find the circ that's waiting on me, if any, and get it to send its onion */
+int ap_handshake_n_conn_open(connection_t *or_conn) {
+  circuit_t *circ;
+
+  log(LOG_DEBUG,"ap_handshake_n_conn_open(): Starting.");
+  circ = circuit_get_by_naddr_nport(or_conn->addr, or_conn->port);
+  if(!circ)
+    return 0; /* i'm ok with that */
+
+  if(circ->p_conn->state != AP_CONN_STATE_OR_WAIT) {
+    log(LOG_DEBUG,"Bug: ap_handshake_n_conn_open() got an ap_conn not in OR_WAIT state.");
+  }
+  connection_watch_events(or_conn, POLLIN); /* resume listening for reads */
+  log(LOG_DEBUG,"ap_handshake_n_conn_open(): Found circ, sending onion.");
+  return ap_handshake_send_onion(circ->p_conn, or_conn, circ);
+}
+
+int ap_handshake_send_onion(connection_t *ap_conn, connection_t *n_conn, circuit_t *circ) {
+  cell_t cell;
+  int tmpbuflen, dataleft;
+  char *tmpbuf;
+  char zero=0;
+
+  circ->n_aci = get_unique_aci_by_addr_port(circ->n_addr, circ->n_port, ACI_TYPE_BOTH);
+  circ->n_conn = n_conn;
+  log(LOG_DEBUG,"ap_handshake_send_onion(): n_conn is %s:%u",n_conn->address,ntohs(n_conn->port));
+
+  /* deliver the onion as one or more create cells */
+  cell.command = CELL_CREATE;
+  cell.aci = circ->n_aci;
+
+  tmpbuflen = circ->onionlen+4;
+  tmpbuf = malloc(tmpbuflen);
+  if(!tmpbuf)
+    return -1;
+  circ->onionlen = htonl(circ->onionlen);
+  memcpy(tmpbuf,&circ->onionlen,4);
+  circ->onionlen = ntohl(circ->onionlen);
+  memcpy(tmpbuf+4, circ->onion, circ->onionlen);
+
+  dataleft = tmpbuflen;
+  while(dataleft) {
+    cell.command = CELL_CREATE;
+    cell.aci = circ->n_aci;
+    log(LOG_DEBUG,"ap_handshake_send_onion(): Sending a create cell for the onion...");
+    if(dataleft >= CELL_PAYLOAD_SIZE) {
+      cell.length = CELL_PAYLOAD_SIZE;
+      memcpy(cell.payload, tmpbuf + tmpbuflen - dataleft, CELL_PAYLOAD_SIZE);
+      connection_write_cell_to_buf(&cell, n_conn); /* clobbers cell */
+      dataleft -= CELL_PAYLOAD_SIZE;
+    } else { /* last cell */
+      cell.length = dataleft;
+      memcpy(cell.payload, tmpbuf + tmpbuflen - dataleft, dataleft);
+      connection_write_cell_to_buf(&cell, n_conn); /* clobbers cell */
+      dataleft = 0;
+    }
+  }
+  free(tmpbuf);
+
+  /* deliver the ss in a data cell */
+  cell.command = CELL_DATA;
+  cell.aci = circ->n_aci;
+  cell.length = sizeof(ss_t);
+  memcpy(cell.payload, &ap_conn->ss, sizeof(ss_t));
+  log(LOG_DEBUG,"ap_handshake_send_onion(): Sending a data cell for ss...");
+  if(circuit_deliver_data_cell(&cell, circ, circ->n_conn, 'e') < 0) {
+    log(LOG_DEBUG,"ap_handshake_send_onion(): failed to deliver ss cell. Closing.");
+    circuit_close(circ);
+    return -1;
+  }
+
+  /* deliver the dest_addr in a data cell */
+  cell.command = CELL_DATA;
+  cell.aci = circ->n_aci;
+  cell.length = ap_conn->dest_addr_len+1;
+  strncpy(cell.payload, ap_conn->dest_addr, ap_conn->dest_addr_len+1);
+  log(LOG_DEBUG,"ap_handshake_send_onion(): Sending a data cell for addr...");
+  if(circuit_deliver_data_cell(&cell, circ, circ->n_conn, 'e') < 0) {
+    log(LOG_DEBUG,"ap_handshake_send_onion(): failed to deliver addr cell. Closing.");
+    circuit_close(circ);
+    return -1;
+  }
+
+  /* deliver the dest_port in a data cell */
+  cell.command = CELL_DATA;
+  cell.aci = circ->n_aci;
+  cell.length = ap_conn->dest_port_len+1;
+  strncpy(cell.payload, ap_conn->dest_port, ap_conn->dest_port_len+1);
+  log(LOG_DEBUG,"ap_handshake_send_onion(): Sending a data cell for port...");
+  if(circuit_deliver_data_cell(&cell, circ, circ->n_conn, 'e') < 0) {
+    log(LOG_DEBUG,"ap_handshake_send_onion(): failed to deliver port cell. Closing.");
+    circuit_close(circ);
+    return -1;
+  }
+
+  circ->state = CIRCUIT_STATE_OPEN;
+  ap_conn->state = AP_CONN_STATE_OPEN;
+
+  /* FIXME should set circ->expire to something here */
+
+  /* now we want to give the AP a "0" byte, because it wants to hear
+   * back from us */
+  connection_write_to_buf(&zero, 1, ap_conn);
+
+  return 0;
+}
+
+int connection_ap_process_data_cell(cell_t *cell, connection_t *conn) {
+
+  /* an incoming data cell has arrived */
+
+  assert(conn && conn->type == CONN_TYPE_AP);
+
+  if(conn->state == AP_CONN_STATE_OPEN) {
+    log(LOG_DEBUG,"connection_ap_process_data_cell(): In state 'open', writing to buf.");
+    return connection_write_to_buf(cell->payload, cell->length, conn);
+  }
+
+  /* else we shouldn't have gotten this cell */
+  log(LOG_DEBUG,"connection_ap_process_data_cell(): Got a data cell when not in 'open' state. Closing.");
+  return -1;
+}     
+
+int connection_ap_finished_flushing(connection_t *conn) {
+
+  assert(conn && conn->type == CONN_TYPE_AP);
+
+  switch(conn->state) {
+    case AP_CONN_STATE_OPEN:
+      /* FIXME down the road, we'll clear out circuits that are pending to close */
+      connection_watch_events(conn, POLLIN);
+      return 0;
+    default:
+      log(LOG_DEBUG,"Bug: connection_ap_finished_flushing() called in unexpected state.");
+      return 0;
+  }
+
+  return 0;
+
+}
+
+int connection_ap_create_listener(RSA *prkey, struct sockaddr_in *local) {
+  log(LOG_DEBUG,"connection_create_ap_listener starting");
+  return connection_create_listener(prkey, local, CONN_TYPE_AP_LISTENER);
+}
+
+int connection_ap_handle_listener_read(connection_t *conn) {
+  log(LOG_NOTICE,"AP: Received a connection request. Waiting for keys.");
+  return connection_handle_listener_read(conn, CONN_TYPE_AP, AP_CONN_STATE_SS_WAIT);
+} 
+
diff --git a/src/or/connection_exit.c b/src/or/connection_exit.c
index 99a6760bc..eec917a8e 100644
--- a/src/or/connection_exit.c
+++ b/src/or/connection_exit.c
@@ -18,53 +18,12 @@ int connection_exit_process_inbuf(connection_t *conn) {
       log(LOG_DEBUG,"connection_exit_process_inbuf(): text from server while in 'connecting' state. Leaving it on buffer.");
       return 0;
     case EXIT_CONN_STATE_OPEN:
-      return connection_exit_package_inbuf(conn);
+      return connection_package_raw_inbuf(conn);
   }
   return 0;
 
 }
 
-int connection_exit_package_inbuf(connection_t *conn) {
-  int amount_to_process;
-  cell_t cell;
-  circuit_t *circ;
-
-  assert(conn && conn->type == CONN_TYPE_EXIT);
-
-  amount_to_process = conn->inbuf_datalen;
-
-  if(!amount_to_process)
-    return 0;
-
-  if(amount_to_process > CELL_PAYLOAD_SIZE) {
-    cell.length = CELL_PAYLOAD_SIZE;
-  } else {
-    cell.length = amount_to_process;
-  }
-
-  if(connection_fetch_from_buf(cell.payload, cell.length, conn) < 0) {
-    return -1;
-  }
-
-  circ = circuit_get_by_conn(conn);
-  if(!circ) {
-    log(LOG_DEBUG,"connection_exit_package_inbuf(): conn has no circuits!");
-    return -1;
-  }
-
-  log(LOG_DEBUG,"connection_exit_package_inbuf(): Packaging %d bytes.",cell.length);
-  cell.aci = circ->p_aci;
-  cell.command = CELL_DATA;
-  if(circuit_deliver_data_cell(&cell, circ, circ->p_conn, 'e') < 0) {
-    log(LOG_DEBUG,"connection_exit_package_inbuf(): circuit_deliver_data_cell (backward) failed. Closing.");
-    circuit_close(circ);
-    return 0;
-  }
-  if(amount_to_process > CELL_PAYLOAD_SIZE)
-    return(connection_exit_package_inbuf(conn));
-  return 0;
-}
-
 int connection_exit_finished_flushing(connection_t *conn) {
   int e, len=sizeof(e);
 
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index 37abc8b7a..5e9cae84d 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -41,6 +41,24 @@ int connection_or_finished_flushing(connection_t *conn) {
   assert(conn && conn->type == CONN_TYPE_OR);
 
   switch(conn->state) {
+    case OR_CONN_STATE_OP_CONNECTING:
+      if (getsockopt(conn->s, SOL_SOCKET, SO_ERROR, &e, &len) < 0)  { /* not yet */
+        if(errno != EINPROGRESS){
+          /* yuck. kill it. */
+          log(LOG_DEBUG,"connection_or_finished_flushing(): in-progress connect failed. Removing.");
+          return -1;
+        } else {
+          return 0; /* no change, see if next time is better */
+        }
+      }
+      /* the connect has finished. */
+
+      log(LOG_DEBUG,"connection_or_finished_flushing() : Connection to router %s:%u established.",
+          conn->address,ntohs(conn->port));
+
+      return or_handshake_op_send_keys(conn);
+    case OR_CONN_STATE_OP_SENDING_KEYS:
+      return or_handshake_op_finished_sending_keys(conn);
     case OR_CONN_STATE_CLIENT_CONNECTING:
       if (getsockopt(conn->s, SOL_SOCKET, SO_ERROR, &e, &len) < 0)  { /* not yet */
         if(errno != EINPROGRESS){
@@ -112,28 +130,23 @@ void conn_or_init_crypto(connection_t *conn) {
   
 }
 
-/*
- *
- * auth handshake, as performed by OR *initiating* the connection
- *
+/* helper function for connection_or_connect_as_or and _as_op.
+ * returns NULL if the connection fails. If it succeeds, it sets
+ * *result to 1 if connect() returned before completing, or to 2
+ * if it completed, and returns the new conn.
  */
-
-int connect_to_router(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local) {
+connection_t *connection_or_connect(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local, 
+                                    uint16_t port, int *result) {
   connection_t *conn;
   struct sockaddr_in router_addr;
   int s;
 
-  assert(router && prkey && local);
-
-  if(router->addr == local->sin_addr.s_addr && router->port == local->sin_port) {
-    /* this is me! don't connect to me. */
-    return 0;
-  }
-
   conn = connection_new(CONN_TYPE_OR);
+  if(!conn)
+    return NULL;
 
   /* set up conn so it's got all the data we need to remember */
-  conn->addr = router->addr, conn->port = router->port;
+  conn->addr = router->addr, conn->port = router->or_port; /* NOTE we store or_port here always */
   conn->prkey = prkey;
   conn->min = router->min, conn->max = router->max;
   conn->pkey = router->pkey;
@@ -145,36 +158,37 @@ int connect_to_router(routerinfo_t *router, RSA *prkey, struct sockaddr_in *loca
   { 
     log(LOG_ERR,"Error creating network socket.");
     connection_free(conn);
-    return -1;
+    return NULL;
   }
   fcntl(s, F_SETFL, O_NONBLOCK); /* set s to non-blocking */
 
   memset((void *)&router_addr,0,sizeof(router_addr));
   router_addr.sin_family = AF_INET;
-  router_addr.sin_port = router->port;
+  router_addr.sin_port = port;
   memcpy((void *)&router_addr.sin_addr, &router->addr, sizeof(uint32_t));
 
-  log(LOG_DEBUG,"connect_to_router() : Trying to connect to %s:%u.",inet_ntoa(*(struct in_addr *)&router->addr),ntohs(router->port));
+  log(LOG_DEBUG,"connection_or_connect() : Trying to connect to %s:%u.",inet_ntoa(*(struct in_addr *)&router->addr),ntohs(port));
 
   if(connect(s,(struct sockaddr *)&router_addr,sizeof(router_addr)) < 0){
     if(errno != EINPROGRESS){
       /* yuck. kill it. */
       connection_free(conn);
-      return -1;
+      return NULL;
     } else {
       /* it's in progress. set state appropriately and return. */
       conn->s = s;
 
-      conn->state = OR_CONN_STATE_CLIENT_CONNECTING;
-
       if(connection_add(conn) < 0) { /* no space, forget it */
         connection_free(conn);
-        return -1;
+        return NULL;
       }
+
       /* i think only pollout is needed, but i'm curious if pollin ever gets caught -RD */
-      log(LOG_DEBUG,"connect_to_router() : connect in progress.");
+      log(LOG_DEBUG,"connection_or_connect() : connect in progress.");
       connection_watch_events(conn, POLLOUT | POLLIN);
-      return 0;
+      *result = 1; /* connecting */
+      return conn;
+
     }
   }
 
@@ -183,23 +197,173 @@ int connect_to_router(routerinfo_t *router, RSA *prkey, struct sockaddr_in *loca
 
   if(connection_add(conn) < 0) { /* no space, forget it */
     connection_free(conn);
+    return NULL;
+  }
+
+  log(LOG_DEBUG,"connection_or_connect() : Connection to router %s:%u established.",router->address,ntohs(port));
+
+  *result = 2; /* connection finished */
+  return(conn);
+}
+
+/*
+ *
+ * handshake for connecting to the op_port of an onion router
+ *
+ */
+
+connection_t *connection_or_connect_as_op(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local) {
+  connection_t *conn;
+  int result=0; /* so connection_or_connect() can tell us what happened */
+
+  assert(router && prkey && local);
+
+  if(router->addr == local->sin_addr.s_addr && router->or_port == local->sin_port) {
+    /* this is me! don't connect to me. */
+    return NULL;
+  }
+
+  /* this function should never be called if we're already connected to router, but */
+  /* FIXME we should check here if we're already connected, and return the conn */
+
+  conn = connection_or_connect(router, prkey, local, router->op_port, &result);
+  if(!conn)
+    return NULL;
+
+  assert(result != 0); /* if conn is defined, then it must have set result */
+
+  /* now we know it succeeded */
+  if(result == 1) {
+    conn->state = OR_CONN_STATE_OP_CONNECTING;
+    return conn;
+  }
+
+  if(result == 2) {
+    /* move to the next step in the handshake */
+    if(or_handshake_op_send_keys(conn) < 0) {
+      connection_remove(conn);
+      connection_free(conn);
+      return NULL;
+    }
+    return conn;
+  }
+  return NULL; /* shouldn't get here; to keep gcc happy */
+}
+
+int or_handshake_op_send_keys(connection_t *conn) {
+  int x;
+  uint32_t bandwidth = DEFAULT_BANDWIDTH_OP;
+  unsigned char message[20]; /* bandwidth(32bits), forward key(64bits), backward key(64bits) */
+  unsigned char cipher[128];
+  int retval;
+
+  assert(conn && conn->type == CONN_TYPE_OR);
+
+  /* generate random keys */
+  if(!RAND_bytes(conn->f_session_key,8) ||
+     !RAND_bytes(conn->b_session_key,8)) {
+    log(LOG_ERR,"Cannot generate a secure DES key.");
+    return -1;
+  }
+  log(LOG_DEBUG,"or_handshake_op_send_keys() : Generated DES keys.");
+  /* compose the message */
+  memcpy((void *)message, (void *)&bandwidth, 4);
+  memcpy((void *)(message + 4), (void *)conn->f_session_key, 8);
+  memcpy((void *)(message + 12), (void *)conn->b_session_key, 8);
+  printf("f_session_key: ");
+  for(x=0;x<8;x++) {
+    printf("%d ",conn->f_session_key[x]);
+  }
+  printf("\nb_session_key: ");
+  for(x=0;x<8;x++) {
+    printf("%d ",conn->b_session_key[x]);
+  }
+  printf("\n");
+
+  /* encrypt with RSA */
+  if(RSA_public_encrypt(20, message, cipher, conn->pkey, RSA_PKCS1_PADDING) < 0) {
+    log(LOG_ERR,"or_handshake_op_send_keys(): Public key encryption failed.");
     return -1;
   }
+  log(LOG_DEBUG,"or_handshake_op_send_keys() : Encrypted authentication message.");
 
-  log(LOG_DEBUG,"connect_to_router() : Connection to router %s:%u established.",router->address,ntohs(router->port));
+  /* send message */
 
-  /* move to the next step in the handshake */
-  if(or_handshake_client_send_auth(conn) < 0) {
-    connection_remove(conn);
-    connection_free(conn);
+  if(connection_write_to_buf(cipher, 128, conn) < 0) {
+    log(LOG_DEBUG,"or_handshake_op_send_keys(): my outbuf is full. Oops.");
     return -1;
   }
-  return 0; 
+  retval = connection_flush_buf(conn);
+  if(retval < 0) {
+    log(LOG_DEBUG,"or_handshake_op_send_keys(): bad socket while flushing.");
+    return -1;
+  }
+  if(retval > 0) {
+    /* still stuff on the buffer. */
+    conn->state = OR_CONN_STATE_OP_SENDING_KEYS;
+    connection_watch_events(conn, POLLOUT | POLLIN);
+    return 0;
+  }
+
+  /* it finished sending */
+  log(LOG_DEBUG,"or_handshake_op_send_keys(): Finished sending authentication message.");
+  return or_handshake_op_finished_sending_keys(conn);
+}
+
+int or_handshake_op_finished_sending_keys(connection_t *conn) {
+
+  /* do crypto initialization, etc */
+  conn_or_init_crypto(conn);
+
+  conn->state = OR_CONN_STATE_OPEN;
+  connection_watch_events(conn, POLLIN); /* give it a default, tho the ap_handshake call may change it */
+  ap_handshake_n_conn_open(conn); /* send the pending onion */
+  return 0;
+
+}
+
+/*
+ *
+ * auth handshake, as performed by OR *initiating* the connection
+ *
+ */
+
+connection_t *connection_or_connect_as_or(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local) {
+  connection_t *conn;
+  int result=0; /* so connection_or_connect() can tell us what happened */
+
+  assert(router && prkey && local);
+
+  if(router->addr == local->sin_addr.s_addr && router->or_port == local->sin_port) {
+    /* this is me! don't connect to me. */
+    log(LOG_DEBUG,"connection_or_connect_as_or(): This is me. Skipping.");
+    return NULL;
+  }
+
+  conn = connection_or_connect(router, prkey, local, router->or_port, &result);
+  if(!conn)
+    return NULL;
+
+  /* now we know it succeeded */
+  if(result == 1) {
+    conn->state = OR_CONN_STATE_CLIENT_CONNECTING;
+    return conn;
+  }
+
+  if(result == 2) {
+    /* move to the next step in the handshake */
+    if(or_handshake_client_send_auth(conn) < 0) {
+      connection_remove(conn);
+      connection_free(conn);
+      return NULL;
+    }
+    return conn; 
+  }
+  return NULL; /* shouldn't get here; to keep gcc happy */
 }
 
 int or_handshake_client_send_auth(connection_t *conn) {
   int retval;
-  char keys[16];
   char buf[44];
   char cipher[128];
 
@@ -207,28 +371,25 @@ int or_handshake_client_send_auth(connection_t *conn) {
     return -1;
 
   /* generate random keys */
-  retval = RAND_bytes(keys,16);
-  if (retval != 1) /* error */
-  { 
+  if(!RAND_bytes(conn->f_session_key,8) ||
+     !RAND_bytes(conn->b_session_key,8)) {
     log(LOG_ERR,"Cannot generate a secure DES key.");
     return -1;
   }
   log(LOG_DEBUG,"or_handshake_client_send_auth() : Generated DES keys.");
 
-  /* save keys */
-  memcpy(conn->f_session_key,keys,8);
-  memcpy(conn->b_session_key,keys+8,8);
-
   /* generate first message */
   memcpy(buf,&conn->local.sin_addr,4); /* local address */
   memcpy(buf+4,(void *)&conn->local.sin_port,2); /* local port */
   memcpy(buf+6, (void *)&conn->addr, 4); /* remote address */
   memcpy(buf+10, (void *)&conn->port, 2); /* remote port */
-  memcpy(buf+12,keys,16); /* keys */
+  memcpy(buf+12,conn->f_session_key,8); /* keys */
+  memcpy(buf+20,conn->b_session_key,8);
   *((uint32_t *)(buf+28)) = htonl(conn->min); /* min link utilisation */
   *((uint32_t *)(buf+32)) = htonl(conn->max); /* maximum link utilisation */
   log(LOG_DEBUG,"or_handshake_client_send_auth() : Generated first authentication message.");
 
+
   /* encrypt message */
   retval = RSA_public_encrypt(36,buf,cipher,conn->pkey,RSA_PKCS1_PADDING);
   if (retval == -1) /* error */
@@ -397,8 +558,7 @@ int or_handshake_server_process_auth(connection_t *conn) {
   retval = RSA_private_decrypt(128,cipher,buf,conn->prkey,RSA_PKCS1_PADDING);
   if (retval == -1)
   { 
-    log(LOG_ERR,"Public-key decryption failed during authentication to %s:%u.",
-        conn->address,ntohs(conn->port));
+    log(LOG_ERR,"Public-key decryption failed processing auth message from new client.");
     log(LOG_DEBUG,"or_handshake_server_process_auth() : Reason : %s.",
         ERR_reason_error_string(ERR_get_error()));
     return -1;
@@ -421,7 +581,7 @@ int or_handshake_server_process_auth(connection_t *conn) {
     return -1;
   }
   log(LOG_DEBUG,"or_handshake_server_process_auth() : Router identified as %s:%u.",
-      router->address,ntohs(router->port));
+      router->address,ntohs(router->or_port));
 
   if(connection_get_by_addr_port(addr,port)) {
     log(LOG_DEBUG,"or_handshake_server_process_auth(): That router is already connected. Dropping.");
@@ -447,7 +607,7 @@ int or_handshake_server_process_auth(connection_t *conn) {
     conn->max = max;
 
   /* copy all relevant info to conn */
-  conn->addr = router->addr, conn->port = router->port;
+  conn->addr = router->addr, conn->port = router->or_port;
   conn->pkey = router->pkey;
   conn->address = strdup(router->address);
 
diff --git a/src/or/main.c b/src/or/main.c
index 2cac0819c..543b1ea3f 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -8,20 +8,24 @@ static char *args = "hf:e:n:l:";
 
 int loglevel = LOG_DEBUG;
 
+int global_role = ROLE_OR_LISTEN | ROLE_OR_CONNECT_ALL | ROLE_OP_LISTEN | ROLE_AP_LISTEN;
+/* FIXME defaulting to all roles for now. should make it a config option though */
+
 /* valid config file options */
 config_opt_t options[] =
 {
   {"RouterFile", CONFIG_TYPE_STRING, {0}, 0},
   {"PrivateKeyFile", CONFIG_TYPE_STRING, {0}, 0},
-  {"EntryPort", CONFIG_TYPE_INT, {0}, 0},
-  {"NetworkPort", CONFIG_TYPE_INT, {0}, 0},
+  {"APPort", CONFIG_TYPE_INT, {0}, 0},
+  {"OPPort", CONFIG_TYPE_INT, {0}, 0},
+  {"ORPort", CONFIG_TYPE_INT, {0}, 0},
+  {"CoinWeight", CONFIG_TYPE_DOUBLE, {0}, 0},
   {"MaxConn", CONFIG_TYPE_INT, {0}, 0},
-  {"MaxConnTimeout", CONFIG_TYPE_INT, {0}, 0},
   {"TrafficShaping", CONFIG_TYPE_INT, {0}, 0},
   {0}
 };
 enum opts {
-  RouterFile=0, PrivateKeyFile, EntryPort, NetworkPort, MaxConn, MaxConnTimeout, TrafficShaping
+  RouterFile=0, PrivateKeyFile, APPort, OPPort, ORPort, CoinWeight, MaxConn, TrafficShaping
 };
 
 connection_t *connection_array[MAXCONNECTIONS] =
@@ -138,7 +142,7 @@ routerinfo_t *router_get_by_addr_port(uint32_t addr, uint16_t port) {
   for(i=0;i<rarray_len;i++)
   {
     router = router_array[i];
-    if ((router->addr == addr) && (router->port == port))
+    if ((router->addr == addr) && (router->or_port == port))
       return router;
   }
 
@@ -146,6 +150,24 @@ routerinfo_t *router_get_by_addr_port(uint32_t addr, uint16_t port) {
 
 }
 
+routerinfo_t *router_get_first_in_route(unsigned int *route, size_t routelen) {
+  return router_array[route[routelen-1]];
+}
+
+/* a wrapper around new_route. put all these in routers.c perhaps? */
+unsigned int *router_new_route(size_t *rlen) {
+  return new_route(options[CoinWeight].r.d, router_array,rarray_len, rlen);
+}
+
+/* a wrapper around create_onion */
+unsigned char *router_create_onion(unsigned int *route, size_t routelen, size_t *lenp, crypt_path_t **cpathp) {
+  return create_onion(router_array,rarray_len,route,routelen,lenp,cpathp);
+}
+
+connection_t *connect_to_router_as_op(routerinfo_t *router) {
+  return connection_connect_to_router_as_op(router, prkey, options[ORPort].r.i);
+}
+
 void connection_watch_events(connection_t *conn, short events) {
 
   assert(conn && conn->poll_index < nfds);
@@ -167,6 +189,8 @@ void check_conn_read(int i) {
       retval = connection_op_handle_listener_read(conn);
     } else if (conn->type == CONN_TYPE_OR_LISTENER) {
       retval = connection_or_handle_listener_read(conn);
+    } else if (conn->type == CONN_TYPE_AP_LISTENER) {
+      retval = connection_ap_handle_listener_read(conn);
     } else {
       /* else it's an OP, OR, or exit */
       retval = connection_read_to_buf(conn);
@@ -228,7 +252,10 @@ void check_conn_marked(int i) {
   assert(conn);
   if(conn->marked_for_close) {
     log(LOG_DEBUG,"check_conn_marked(): Cleaning up connection.");
-    connection_flush_buf(conn); /* flush it first */
+    if(conn->s >= 0) { /* might be an incomplete exit connection */
+      /* FIXME there's got to be a better way to check for this -- and make other checks? */
+      connection_flush_buf(conn); /* flush it first */
+    }
     connection_remove(conn);
     connection_free(conn);
     if(i<nfds) { /* we just replaced the one at i with a new one.
@@ -250,7 +277,6 @@ int do_main_loop(void) {
   }
 
   /* load the private key */
-  ERR_load_crypto_strings();
   prkey = load_prkey(options[PrivateKeyFile].r.str);
   if (!prkey)
   {
@@ -258,11 +284,12 @@ int do_main_loop(void) {
     exit(1);
   }
   log(LOG_DEBUG,"core : Loaded private key of size %u bytes.",RSA_size(prkey));
-  ERR_free_strings();
 
-  /* try to connect to all the other ORs, and start the listeners */
-  retry_all_connections(router_array, rarray_len, prkey, 
-		        options[NetworkPort].r.i,options[EntryPort].r.i, 0);
+  /* start-up the necessary connections based on global_role. This is where we
+   * try to connect to all the other ORs, and start the listeners */
+  retry_all_connections(global_role, router_array, rarray_len, prkey, 
+		        options[ORPort].r.i,options[OPPort].r.i,
+			options[APPort].r.i);
 
   for(;;) {
     poll(poll_array, nfds, -1); /* poll until we have an event */
@@ -320,35 +347,32 @@ int main(int argc, char *argv[]) {
     log(LOG_ERR,"PrivateKeyFile option required but not found.");
     exit(1);
   }
-  else if (options[EntryPort].err != 1)
-  { 
-    log(LOG_ERR,"EntryPort option required but not found.");
+  else if (options[CoinWeight].err != 1)
+  {
+    log(LOG_ERR,"Error reading the CoinWeight option.");
     exit(1);
   }
-  else if (options[NetworkPort].err != 1)
+  else if (options[APPort].err != 1)
   { 
-    log(LOG_ERR,"NetworkPort option required but not found.");
+    log(LOG_ERR,"APPort option required but not found.");
     exit(1);
   }
-  else if (options[MaxConn].err != 1)
+  else if (options[OPPort].err != 1)
   { 
-    log(LOG_ERR,"MaxConn option required but not found.");
+    log(LOG_ERR,"OPPort option required but not found.");
     exit(1);
   }
-#if 0
-  else if (options[MaxConnTimeout].err != 1)
+  else if (options[ORPort].err != 1)
   { 
-    conn_tout.tv_sec = OR_DEFAULT_CONN_TIMEOUT;
+    log(LOG_ERR,"ORPort option required but not found.");
+    exit(1);
   }
-  else
+  else if (options[MaxConn].err != 1)
   { 
-    if (!options[MaxConnTimeout].r.i)
-      conn_toutp = NULL;
-    else
-      conn_tout.tv_sec = options[MaxConnTimeout].r.i;
+    log(LOG_ERR,"MaxConn option required but not found.");
+    exit(1);
   }
-  conn_tout.tv_usec = 0;
-
+#if 0
   if (!options[TrafficShaping].err)
   { 
     options[TrafficShaping].r.i = DEFAULT_POLICY;
diff --git a/src/or/onion.c b/src/or/onion.c
index d9c8a9c5d..d659272f2 100644
--- a/src/or/onion.c
+++ b/src/or/onion.c
@@ -60,3 +60,531 @@ int process_onion(circuit_t *circ, connection_t *conn) {
   return 0;
 }
 
+/* uses a weighted coin with weight cw to choose a route length */
+int chooselen(double cw)
+{
+  int len = 2;
+  int retval = 0;
+  unsigned char coin;
+  
+  if ((cw < 0) || (cw >= 1)) /* invalid parameter */
+    return -1;
+  
+  while(1)
+  {
+    retval = RAND_pseudo_bytes(&coin,1);
+    if (retval == -1)
+      return -1;
+    
+    if (coin > cw*255) /* don't extend */
+      break;
+    else
+      len++;
+  }
+  
+  return len;
+}
+
+/* returns an array of pointers to routent that define a new route through the OR network
+ * int cw is the coin weight to use when choosing the route 
+ * order of routers is from last to first
+ */
+unsigned int *new_route(double cw, routerinfo_t **rarray, size_t rarray_len, size_t *rlen)
+{
+  int routelen = 0;
+  int i = 0;
+  int retval = 0;
+  unsigned int *route = NULL;
+  unsigned int oldchoice, choice;
+  
+  if ( (cw >= 0) && (cw < 1) && (rarray) && (rlen) ) /* valid parameters */
+  {
+    routelen = chooselen(cw);
+    if (routelen == -1)
+    {
+      log(LOG_ERR,"Choosing route length failed.");
+      return NULL;
+    }
+    log(LOG_DEBUG,"new_route(): Chosen route length %u.",routelen);
+  
+    /* allocate memory for the new route */
+    route = (unsigned int *)malloc(routelen * sizeof(unsigned int));
+    if (!route)
+    {
+      log(LOG_ERR,"Memory allocation failed.");
+      return NULL;
+    }
+ 
+    oldchoice = rarray_len;
+    for(i=0;i<routelen;i++)
+    {
+      log(LOG_DEBUG,"new_route() : Choosing hop %u.",i);
+      retval = RAND_pseudo_bytes((unsigned char *)&choice,sizeof(unsigned int));
+      if (retval == -1)
+      {
+	free((void *)route);
+	return NULL;
+      }
+
+      choice = choice % (rarray_len);
+      log(LOG_DEBUG,"new_route() : Chosen router %u.",choice);
+      if (choice == oldchoice) /* same router */
+      {
+	/* try again  */
+	i--;
+	continue;
+      }
+      oldchoice = choice;
+      route[i] = choice;
+    }
+   
+    *rlen = routelen;
+    return route;
+  } /* valid parameters */
+  else /* invalid parameters */
+    return NULL;
+}
+
+/* creates a new onion from route, stores it and its length into bufp and lenp respectively */
+unsigned char *create_onion(routerinfo_t **rarray, size_t rarray_len, unsigned int *route, size_t routelen, size_t *lenp, crypt_path_t **cpathp)
+{
+  int i,j;
+  int retval = 0;
+  onion_layer_t *layer = NULL;
+  crypt_path_t *hop = NULL;
+  unsigned char *retbuf = NULL;
+  unsigned char *bufp;
+  routerinfo_t *router;
+
+  if ( (rarray) && (route) && (lenp) ) /* valid parameters */
+  {
+    /* calculate the size of the onion */
+    *lenp = routelen * 28 + 100; /* 28 bytes per layer + 100 bytes padding for the innermost layer */
+    log(LOG_DEBUG,"create_onion() : Size of the onion is %u.",*lenp);
+    
+    /* allocate memory for the onion */
+    bufp = (unsigned char *)malloc(*lenp);
+    if (!bufp)
+    {
+      log(LOG_ERR,"Error allocating memory.");
+      return NULL;
+    }
+    log(LOG_DEBUG,"create_onion() : Allocated memory for the onion.");
+    
+    for (retval=0; retval<routelen;retval++)
+    {
+      log(LOG_DEBUG,"create_onion() : %u : %s:%u, %u/%u",routelen-retval,inet_ntoa(*((struct in_addr *)&((rarray[route[retval]])->addr))),ntohs((rarray[route[retval]])->or_port),(rarray[route[retval]])->pkey,RSA_size((rarray[route[retval]])->pkey));
+    }
+    
+    layer = (onion_layer_t *)(bufp + *lenp - 128); /* pointer to innermost layer */
+    /* create the onion layer by layer, starting with the innermost */
+    for (i=0;i<routelen;i++)
+    {
+      router = rarray[route[i]];
+      
+      log(LOG_DEBUG,"create_onion() : %u",router);
+      log(LOG_DEBUG,"create_onion() : This router is %s:%u",inet_ntoa(*((struct in_addr *)&router->addr)),ntohs(router->or_port));
+      log(LOG_DEBUG,"create_onion() : Key pointer = %u.",router->pkey);
+      log(LOG_DEBUG,"create_onion() : Key size = %u.",RSA_size(router->pkey)); 
+      
+      /* 0 bit */
+      layer->zero = 0;
+      /* version */
+      layer->version = VERSION;
+      /* Back F + Forw F both use DES OFB*/
+      layer->backf = ONION_DEFAULT_CIPHER;
+      layer->forwf = ONION_DEFAULT_CIPHER;
+      /* Dest Port */
+      if (i) /* not last hop */
+	layer->port = rarray[route[i-1]]->or_port;
+      else
+	layer->port = 0;
+      /* Dest Addr */
+      if (i) /* not last hop */
+	layer->addr = rarray[route[i-1]]->addr;
+      else
+	layer->addr = 0;
+      /* Expiration Time */
+      layer->expire = time(NULL) + 3600; /* NOW + 1 hour */
+      /* Key Seed Material */
+      retval = RAND_bytes(layer->keyseed,16);
+      if (retval < 1) /* error */
+      {
+	log(LOG_ERR,"Error generating random data.");
+	free((void *)bufp);
+	if (cpathp)
+	{
+	  for (j=0;j<i;j++)
+	    free((void *)cpathp[i]);
+	}
+	return NULL;
+      }
+      log(LOG_DEBUG,"create_onion() : Onion layer %u built : %u, %u, %u, %s, %u.",i+1,layer->zero,layer->backf,layer->forwf,inet_ntoa(*((struct in_addr *)&layer->addr)),ntohs(layer->port));
+      
+      /* build up the crypt_path */
+      if (cpathp)
+      {
+	cpathp[i] = (crypt_path_t *)malloc(sizeof(crypt_path_t));
+	if (!cpathp[i])
+	{
+	  log(LOG_ERR,"Error allocating memory.");
+	  free((void *)bufp);
+	  for (j=0;j<i;j++)
+	    free((void *)cpathp[i]);
+	}
+      
+	log(LOG_DEBUG,"create_onion() : Building hop %u of crypt path.",i+1);
+	hop = cpathp[i];
+	/* set crypto functions */
+	hop->backf = layer->backf;
+	hop->forwf = layer->forwf;
+	
+	/* calculate keys */
+	SHA1(layer->keyseed,16,hop->digest3);
+	log(LOG_DEBUG,"create_onion() : First SHA pass performed.");
+	SHA1(hop->digest3,20,hop->digest2);
+	log(LOG_DEBUG,"create_onion() : Second SHA pass performed.");
+	SHA1(hop->digest2,20,hop->digest3);
+	log(LOG_DEBUG,"create_onion() : Third SHA pass performed.");
+	log(LOG_DEBUG,"create_onion() : Keys generated.");
+	/* set IVs */
+	memset((void *)hop->f_iv,0,16);
+	memset((void *)hop->b_iv,0,16);
+	
+	/* initialize cipher contexts */
+	EVP_CIPHER_CTX_init(&hop->f_ctx);
+	EVP_CIPHER_CTX_init(&hop->b_ctx);
+	
+	/* initialize cipher engines */
+	switch(layer->forwf)
+	{
+	 case ONION_CIPHER_DES :
+	  retval = EVP_EncryptInit(&hop->f_ctx, EVP_des_ofb(), hop->digest3, hop->f_iv);
+	  break;
+	 case ONION_CIPHER_RC4 :
+	  retval = EVP_EncryptInit(&hop->f_ctx, EVP_rc4(), hop->digest3, hop->f_iv);
+	  break;
+	 case ONION_CIPHER_IDENTITY :
+	  retval = EVP_EncryptInit(&hop->f_ctx, EVP_enc_null(), hop->digest3, hop->f_iv);
+	  break;
+	}
+	if (!retval) /* cipher initialization failed */
+	{
+	  log(LOG_ERR,"Could not initialize crypto engines.");
+	  free((void *)bufp);
+	  for (j=0;j<i;j++)
+	    free((void *)cpathp[i]);
+	  return NULL;
+	}
+	switch(layer->backf)
+	{
+	 case ONION_CIPHER_DES :
+	  retval = EVP_DecryptInit(&hop->b_ctx, EVP_des_ofb(), hop->digest2, hop->b_iv);
+	  break;
+	 case ONION_CIPHER_RC4 :
+	  retval = EVP_DecryptInit(&hop->b_ctx, EVP_rc4(), hop->digest2, hop->b_iv);
+	  break;
+	 case ONION_CIPHER_IDENTITY :
+	  retval = EVP_DecryptInit(&hop->b_ctx, EVP_enc_null(), hop->digest2, hop->b_iv);
+	  break;
+	}
+	if (!retval) /* cipher initialization failed */
+	{
+	  log(LOG_ERR,"Could not initialize crypto engines.");
+	  free((void *)bufp);
+	  for (j=0;j<i;j++)
+	    free((void *)cpathp[i]);
+	  return NULL;
+	}
+	
+	log(LOG_DEBUG,"create_onion() : Built corresponding crypt path hop.");
+      }
+      
+      /* padding if this is the innermost layer */
+      if (!i)
+      {
+	retval=RAND_pseudo_bytes((unsigned char *)layer + 28,100);
+	if (retval == -1) /* error */
+	{
+	  log(LOG_ERR,"Error generating pseudo-random data.");
+	  free((void *)bufp);
+	  if (cpathp)
+	  {
+	    for (j=0;j<i;j++)
+	      free((void *)cpathp[i]);
+	  }
+	  return NULL;
+	}
+	log(LOG_DEBUG,"create_onion() : This is the innermost layer. Adding 100 bytes of padding.");
+      }
+      
+      /* encrypt */
+      retbuf = encrypt_onion(layer,128+(i*28),router->pkey);
+      if (!retbuf)
+      {
+	log(LOG_ERR,"Error encrypting onion layer.");
+	free((void *)bufp);
+	if (cpathp)
+	{
+	  for (j=0;j<i;j++)
+	    free((void *)cpathp[i]);
+	}
+	return NULL;
+      }
+      log(LOG_DEBUG,"create_onion() : Encrypted layer.");
+      
+      /* calculate pointer to next layer */
+      layer = (onion_layer_t *)bufp + (routelen-i-2)*sizeof(onion_layer_t);
+    }
+
+    return bufp;
+  } /* valid parameters */
+  else
+    return NULL;
+}
+
+/* encrypts 128 bytes of the onion with the specified public key, the rest with 
+ * DES OFB with the key as defined in the outter layer */
+unsigned char *encrypt_onion(onion_layer_t *onion, uint32_t onionlen, RSA *pkey)
+{
+  unsigned char *tmpbuf = NULL; /* temporary buffer for crypto operations */
+  unsigned char digest[20]; /* stores SHA1 output - 160 bits */
+  unsigned char *retbuf = NULL;
+  unsigned char iv[8];
+  int retval = 0;
+  int outlen = 0;
+  
+  EVP_CIPHER_CTX ctx; /* cipher context */
+ 
+  if ( (onion) && (pkey) ) /* valid parameters */
+  {
+    memset((void *)iv,0,8);
+    
+    log(LOG_DEBUG,"Onion layer : %u, %u, %u, %s, %u.",onion->zero,onion->backf,onion->forwf,inet_ntoa(*((struct in_addr *)&onion->addr)),ntohs(onion->port));
+    /* allocate space for tmpbuf */
+    tmpbuf = (unsigned char *)malloc(onionlen);
+    if (!tmpbuf)
+    {
+      log(LOG_ERR,"Could not allocate memory.");
+      return NULL;
+    }
+    log(LOG_DEBUG,"encrypt_onion() : allocated %u bytes of memory for the encrypted onion (at %u).",onionlen,tmpbuf);
+  
+    /* get key1 = SHA1(KeySeed) */
+    retbuf = SHA1(((onion_layer_t *)onion)->keyseed,16,digest);
+    if (!retbuf)
+    {
+      log(LOG_ERR,"Error computing SHA1 digest.");
+      free((void *)tmpbuf);
+      return NULL;
+    }
+    log(LOG_DEBUG,"encrypt_onion() : Computed DES key.");
+    
+    log(LOG_DEBUG,"encrypt_onion() : Trying to RSA encrypt.");
+    /* encrypt 128 bytes with RSA *pkey */
+    retval = RSA_public_encrypt(128, (unsigned char *)onion, tmpbuf, pkey, RSA_NO_PADDING); 
+    if (retval == -1) 
+    { 
+      log(LOG_ERR,"Error RSA-encrypting data :%s",ERR_reason_error_string(ERR_get_error())); 
+      free((void *)tmpbuf); 
+      return NULL; 
+    }
+  
+    log(LOG_DEBUG,"encrypt_onion() : RSA encrypted first 128 bytes of the onion."); 
+    
+    /* now encrypt the rest with DES OFB */
+    
+    EVP_CIPHER_CTX_init(&ctx); 
+    retval = EVP_EncryptInit(&ctx,EVP_des_ofb(),digest,iv);
+    if (!retval) /* error */ 
+    { 
+      log(LOG_ERR,"Error initializing DES engine:%s",ERR_reason_error_string(ERR_get_error())); 
+      free((void *)tmpbuf); 
+      return NULL; 
+    } 
+    
+    retval = EVP_EncryptUpdate(&ctx,(unsigned char *)tmpbuf+128,&outlen,(unsigned char *)onion+128,onionlen-128);
+    if (!retval) /* error */
+    { 
+      log(LOG_ERR,"Error performing DES encryption:%s",ERR_reason_error_string(ERR_get_error())); 
+      free((void *)tmpbuf); 
+      return NULL; 
+    }
+    log(LOG_DEBUG,"encrypt_onion() : DES OFB encrypted the rest of the onion.");
+  
+    EVP_CIPHER_CTX_cleanup(&ctx);
+  
+    /* now copy tmpbuf to onion */
+    memcpy((void *)onion,(void *)tmpbuf,onionlen);
+    log(LOG_DEBUG,"encrypt_onion() : Copied cipher to original onion buffer.");
+    free((void *)tmpbuf);
+    return (unsigned char *)onion;
+  } /* valid parameters */
+  else
+    return NULL;
+}
+
+/* decrypts the first 128 bytes using RSA and prkey, decrypts the rest with DES OFB with key1 */
+unsigned char *decrypt_onion(onion_layer_t *onion, uint32_t onionlen, RSA *prkey)
+{
+  void *tmpbuf = NULL; /* temporary buffer for crypto operations */
+  unsigned char digest[20]; /* stores SHA1 output - 160 bits */
+  unsigned char *retbuf = NULL;
+  unsigned char iv[8];
+  int retval = 0;
+  int outlen = 0;
+  
+  EVP_CIPHER_CTX ctx; /* cipher context */
+  
+  if ( (onion) && (prkey) ) /* valid parameters */
+  {
+    memset((void *)iv,0,8);
+    
+    /* allocate space for tmpbuf */
+    tmpbuf = malloc(onionlen);
+    if (!tmpbuf)
+    {
+      log(LOG_ERR,"Could not allocate memory.");
+      return NULL;
+    }
+    log(LOG_DEBUG,"decrypt_onion() : Allocated memory for the temporary buffer.");
+
+    /* decrypt 128 bytes with RSA *prkey */
+    retval = RSA_private_decrypt(128, (unsigned char*)onion, (unsigned char *)tmpbuf, prkey, RSA_NO_PADDING);
+    if (retval == -1)
+    {
+      log(LOG_ERR,"Error RSA-decrypting data :%s",ERR_reason_error_string(ERR_get_error()));
+      free((void *)tmpbuf);
+      return NULL;
+    }
+    log(LOG_DEBUG,"decrypt_onion() : RSA decryption complete.");
+    
+    /* get key1 = SHA1(KeySeed) */
+    retbuf = SHA1(((onion_layer_t *)tmpbuf)->keyseed,16,digest);
+    if (!retbuf)
+    {
+      log(LOG_ERR,"Error computing SHA1 digest.");
+      free((void *)tmpbuf);
+      return NULL;
+    }
+    log(LOG_DEBUG,"decrypt_onion() : Computed DES key.");
+    
+    /* now decrypt the rest with DES OFB */
+    EVP_CIPHER_CTX_init(&ctx);
+    retval = EVP_DecryptInit(&ctx,EVP_des_ofb(),digest,iv);
+    if (!retval) /* error */
+    {
+      log(LOG_ERR,"Error initializing DES engine:%s",ERR_reason_error_string(ERR_get_error()));
+      free((void *)tmpbuf);
+      return NULL;
+    }
+    retval = EVP_DecryptUpdate(&ctx,(unsigned char *)tmpbuf+128,&outlen,(unsigned char *)onion+128,onionlen-128);
+    if (!retval) /* error */
+    {
+      log(LOG_ERR,"Error performing DES decryption:%s",ERR_reason_error_string(ERR_get_error()));
+      free((void *)tmpbuf);
+      return NULL;
+    }
+    
+    EVP_CIPHER_CTX_cleanup(&ctx);
+    log(LOG_DEBUG,"decrypt_onion() : DES decryption complete.");
+    
+    /* now copy tmpbuf to onion */
+    memcpy((void *)onion,(void *)tmpbuf,onionlen);
+    free((void *)tmpbuf);
+    return (unsigned char *)onion;
+  } /* valid parameters */
+  else
+    return NULL;
+}
+
+/* delete first n bytes of the onion and pads the end with n bytes of random data */
+void pad_onion(unsigned char *onion, uint32_t onionlen, size_t n)
+{
+  if (onion) /* valid parameter */
+  {
+    memmove((void *)onion,(void *)(onion+n),onionlen-n);
+    RAND_pseudo_bytes(onion+onionlen-n,n);
+  }
+}
+
+/* create a new tracked_onion entry */
+tracked_onion_t *new_tracked_onion(unsigned char *onion, uint32_t onionlen, tracked_onion_t **tracked_onions, tracked_onion_t **last_tracked_onion)
+{
+  tracked_onion_t *to = NULL;
+  
+  if (!onion || !tracked_onions || !last_tracked_onion) /* invalid parameters */
+    return NULL;
+  
+  to = (tracked_onion_t *)malloc(sizeof(tracked_onion_t));
+  if (!to)
+    return NULL;
+  
+  to->expire = ((onion_layer_t *)onion)->expire; /* set the expiration date */
+  /* compute the SHA digest */
+  SHA1(onion, onionlen, to->digest);
+  if (!to->digest)
+  {
+    log(LOG_DEBUG,"new_tracked_onion() : Failed to compute a SHA1 digest of the onion.");
+    free((void *)to);
+    return NULL;
+  }
+  
+  to->next = NULL;
+  
+  if (!*tracked_onions)
+  {
+    to->prev = NULL;
+    *tracked_onions = to;
+  }
+  else
+  {
+    to->prev = (void *)*last_tracked_onion;
+    (*last_tracked_onion)->next = (void *)to;
+  }
+  *last_tracked_onion = to;
+  
+  return to;
+}
+
+/* delete a tracked onion entry */
+void remove_tracked_onion(tracked_onion_t *to, tracked_onion_t **tracked_onions, tracked_onion_t **last_tracked_onion)
+{
+  if (!*tracked_onions || !*last_tracked_onion || !to)
+    return;
+  
+  if (to->prev)
+    ((tracked_onion_t *)to->prev)->next = to->next;
+  if (to->next)
+    ((tracked_onion_t *)to->next)->prev = to->prev;
+  
+  if (to == *tracked_onions)
+    *tracked_onions = (tracked_onion_t *)to->next;
+  
+  if (to == *last_tracked_onion)
+    *last_tracked_onion = (tracked_onion_t *)to->prev;
+  
+  free((void *)to);
+  
+  return;
+}
+
+/* find a tracked onion in the linked list of tracked onions */
+tracked_onion_t *id_tracked_onion(unsigned char *onion, uint32_t onionlen, tracked_onion_t *tracked_onions)
+{
+  tracked_onion_t *to = tracked_onions;
+  unsigned char digest[20];
+  
+  /* compute the SHA digest of the onion */
+  SHA1(onion,onionlen, digest);
+  
+  while(to)
+  {
+    if (!memcmp((void *)digest, (void *)to->digest, 20))
+      return to;
+    to = (tracked_onion_t *)to->next;
+  }
+  
+  return NULL;
+}
+
diff --git a/src/or/or.h b/src/or/or.h
index 6ab44f29f..0f4647fb2 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -16,8 +16,6 @@
 #include <sys/fcntl.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
 #include <sys/time.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -34,16 +32,24 @@
 #include "../common/config.h"
 #include "../common/key.h"
 #include "../common/log.h"
-#include "../common/onion.h"
 #include "../common/ss.h"
+#include "../common/version.h"
 
 #define MAXCONNECTIONS 200 /* upper bound on max connections.
 			      can be overridden by config file */
 
 #define MAX_BUF_SIZE (64*1024)
+#define DEFAULT_BANDWIDTH_OP 1
 
 #define ACI_TYPE_LOWER 0
 #define ACI_TYPE_HIGHER 1
+#define ACI_TYPE_BOTH 2
+
+/* bitvector of the roles that we might want to play. You can or (|) them together */
+#define ROLE_OR_LISTEN 1
+#define ROLE_OR_CONNECT_ALL 2
+#define ROLE_OP_LISTEN 4
+#define ROLE_AP_LISTEN 8
 
 #define CONN_TYPE_OP_LISTENER 1
 #define CONN_TYPE_OP 2
@@ -66,9 +72,9 @@
  * foo_CONN_STATE_bar_baz:
  * "I am acting as a bar, currently in stage baz of talking with a foo."
  */
-#define OR_CONN_STATE_OP_CONNECTING 0
+#define OR_CONN_STATE_OP_CONNECTING 0 /* an application proxy wants me to connect to this OR */
 #define OR_CONN_STATE_OP_SENDING_KEYS 1
-#define OR_CONN_STATE_CLIENT_CONNECTING 2
+#define OR_CONN_STATE_CLIENT_CONNECTING 2 /* I'm connecting to this OR as an OR */
 #define OR_CONN_STATE_CLIENT_SENDING_AUTH 3 /* sending address and info */
 #define OR_CONN_STATE_CLIENT_AUTH_WAIT 4 /* have sent address and info, waiting */
 #define OR_CONN_STATE_CLIENT_SENDING_NONCE 5 /* sending nonce, last piece of handshake */
@@ -90,12 +96,21 @@
 #define AP_CONN_STATE_OPEN 2
 
 #define CIRCUIT_STATE_OPEN_WAIT 0 /* receiving/processing the onion */
-#define CIRCUIT_STATE_OPEN 1 /* onion processed, ready to send data along the connection */
-#define CIRCUIT_STATE_CLOSE_WAIT1 2 /* sent two "destroy" signals, waiting for acks */
-#define CIRCUIT_STATE_CLOSE_WAIT2 3 /* received one ack, waiting for one more 
+#define CIRCUIT_STATE_OR_WAIT 1 /* I'm at the beginning of the path, my firsthop is still connecting */
+#define CIRCUIT_STATE_OPEN 2 /* onion processed, ready to send data along the connection */
+#define CIRCUIT_STATE_CLOSE_WAIT1 3 /* sent two "destroy" signals, waiting for acks */
+#define CIRCUIT_STATE_CLOSE_WAIT2 4 /* received one ack, waiting for one more 
 				       (or if just one was sent, waiting for that one */
 //#define CIRCUIT_STATE_CLOSE 4 /* both acks received, connection is dead */ /* NOT USED */
 
+/* available cipher functions */
+#define ONION_CIPHER_IDENTITY 0
+#define ONION_CIPHER_DES 1
+#define ONION_CIPHER_RC4 2
+
+/* default cipher function */
+#define ONION_DEFAULT_CIPHER ONION_CIPHER_DES
+
 typedef uint16_t aci_t;
 
 typedef struct
@@ -118,9 +133,7 @@ typedef struct
   size_t outbuflen;
   size_t outbuf_datalen;
 
-/* used by OP and App: */
-
-  uint16_t aci; /* anonymous connection identifier */
+//  uint16_t aci; /* anonymous connection identifier */
 
 /* used by OR and OP: */
 
@@ -142,10 +155,14 @@ typedef struct
   uint32_t addr; /* these two uniquely identify a router */
   uint16_t port;
 
-/* used by exit: */
+/* used by exit and ap: */
 
   ss_t ss; /* standard structure */
   int ss_received; /* size of ss, received so far */
+
+  char *dest_addr, *dest_port;
+  uint16_t dest_addr_len, dest_port_len;
+  uint16_t dest_addr_received, dest_port_received;
   
 /* used by OR, to keep state while connect()ing: Kludge. */
 
@@ -156,7 +173,7 @@ typedef struct
   uint32_t min;
   uint32_t max;
 
-  char *address; /* strdup into this, gets free_connection frees it */
+  char *address; /* strdup into this, because free_connection frees it */
   RSA *pkey; /* public RSA key for the other side */
 
   char nonce[8];
@@ -169,7 +186,9 @@ typedef struct
   char *address;
  
   uint32_t addr;
-  uint16_t port;
+  uint16_t or_port;
+  uint16_t op_port;
+  uint16_t ap_port;
  
   RSA *pkey; /* public RSA key */
  
@@ -187,6 +206,23 @@ typedef struct
   void *next;
 } routerinfo_t;
 
+typedef struct
+{ 
+  unsigned int forwf;
+  unsigned int backf;
+  char digest2[20]; /* second SHA output for onion_layer_t.keyseed */
+  char digest3[20]; /* third SHA output for onion_layer_t.keyseed */
+
+  /* IVs */
+  char f_iv[16];
+  char b_iv[16];
+
+  /* cipher contexts */
+  EVP_CIPHER_CTX f_ctx;
+  EVP_CIPHER_CTX b_ctx;
+  
+} crypt_path_t;
+
 /* per-anonymous-connection struct */
 typedef struct
 {
@@ -205,8 +241,8 @@ typedef struct
   unsigned char p_f; /* crypto functions */
   unsigned char n_f;
 
-  unsigned char p_key[128]; /* crypto keys */
-  unsigned char n_key[128];
+  unsigned char p_key[16]; /* crypto keys */
+  unsigned char n_key[16];
 
   unsigned char p_iv[16]; /* initialization vectors */
   unsigned char n_iv[16];
@@ -214,6 +250,9 @@ typedef struct
   EVP_CIPHER_CTX p_ctx; /* cipher context */
   EVP_CIPHER_CTX n_ctx;
 
+  crypt_path_t **cpath;
+  size_t cpathlen; 
+
   uint32_t expire; /* expiration time for the corresponding onion */
 
   int state;
@@ -225,6 +264,26 @@ typedef struct
   void *next;
 } circuit_t;
 
+typedef struct
+{ 
+  int zero:1;
+  int version:7;
+  int backf:4;
+  int forwf:4;
+  uint16_t port;
+  uint32_t addr;
+  time_t expire;
+  unsigned char keyseed[16];
+} onion_layer_t;
+
+typedef struct
+{ 
+  time_t expire;
+  char digest[20]; /* SHA digest of the onion */
+  void *prev;
+  void *next;
+} tracked_onion_t;
+
 
 
 
@@ -280,12 +339,14 @@ aci_t get_unique_aci_by_addr_port(uint32_t addr, uint16_t port, int aci_type);
 
 circuit_t *circuit_get_by_aci_conn(aci_t aci, connection_t *conn);
 circuit_t *circuit_get_by_conn(connection_t *conn);
+circuit_t *circuit_get_by_naddr_nport(uint32_t naddr, uint16_t nport);
 
 int circuit_deliver_data_cell(cell_t *cell, circuit_t *circ, connection_t *conn, int crypt_type);
 int circuit_crypt(circuit_t *circ, char *in, size_t inlen, char crypt_type);
 
 int circuit_init(circuit_t *circ, int aci_type);
 void circuit_free(circuit_t *circ);
+void circuit_free_cpath(crypt_path_t **cpath, size_t cpathlen);
 
 void circuit_close(circuit_t *circ);
 
@@ -316,8 +377,9 @@ int connection_create_listener(RSA *prkey, struct sockaddr_in *local, int type);
 int connection_handle_listener_read(connection_t *conn, int new_type, int new_state);
 
 /* start all connections that should be up but aren't */
-int retry_all_connections(routerinfo_t **router_array, int rarray_len,
+int retry_all_connections(int role, routerinfo_t **router_array, int rarray_len,
 		  RSA *prkey, uint16_t or_port, uint16_t op_port, uint16_t ap_port);
+connection_t *connection_connect_to_router_as_op(routerinfo_t *router, RSA *prkey, uint16_t local_or_port);
 
 int connection_read_to_buf(connection_t *conn);
 
@@ -331,27 +393,43 @@ int connection_encrypt_cell_header(cell_t *cellp, connection_t *conn);
 int connection_write_cell_to_buf(cell_t *cellp, connection_t *conn);
 
 int connection_process_inbuf(connection_t *conn);
+int connection_package_raw_inbuf(connection_t *conn);
 int connection_process_cell_from_inbuf(connection_t *conn);
 
 int connection_finished_flushing(connection_t *conn);
 
-/********************************* connection_or.c ***************************/
+/********************************* connection_ap.c ****************************/
 
-int connection_or_process_inbuf(connection_t *conn);
-int connection_or_finished_flushing(connection_t *conn);
+int connection_ap_process_inbuf(connection_t *conn);
 
-void conn_or_init_crypto(connection_t *conn);
+int ap_handshake_process_ss(connection_t *conn);
 
-int or_handshake_client_process_auth(connection_t *conn);
-int or_handshake_client_send_auth(connection_t *conn);
+int ap_handshake_create_onion(connection_t *conn);
 
-int or_handshake_server_process_auth(connection_t *conn);
-int or_handshake_server_process_nonce(connection_t *conn);
+int ap_handshake_establish_circuit(connection_t *conn, unsigned int *route, int routelen, char *onion,
+		                                   int onionlen, crypt_path_t **cpath);
 
-int connect_to_router(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local);
+/* find the circ that's waiting on me, if any, and get it to send its onion */
+int ap_handshake_n_conn_open(connection_t *or_conn);
+
+int ap_handshake_send_onion(connection_t *ap_conn, connection_t *or_conn, circuit_t *circ);
+
+int connection_ap_process_data_cell(cell_t *cell, connection_t *conn);
+
+int connection_ap_finished_flushing(connection_t *conn);
+
+int connection_ap_create_listener(RSA *prkey, struct sockaddr_in *local);
+
+int connection_ap_handle_listener_read(connection_t *conn);
+
+/********************************* connection_exit.c ***************************/
+
+int connection_exit_process_inbuf(connection_t *conn);
+int connection_exit_package_inbuf(connection_t *conn);
+int connection_exit_process_data_cell(cell_t *cell, connection_t *conn);
+
+int connection_exit_finished_flushing(connection_t *conn);
 
-int connection_or_create_listener(RSA *prkey, struct sockaddr_in *local);
-int connection_or_handle_listener_read(connection_t *conn);
 
 /********************************* connection_op.c ***************************/
 
@@ -365,13 +443,27 @@ int connection_op_create_listener(RSA *prkey, struct sockaddr_in *local);
 
 int connection_op_handle_listener_read(connection_t *conn);
 
-/********************************* connection_exit.c ***************************/
+/********************************* connection_or.c ***************************/
 
-int connection_exit_process_inbuf(connection_t *conn);
-int connection_exit_package_inbuf(connection_t *conn);
-int connection_exit_process_data_cell(cell_t *cell, connection_t *conn);
+int connection_or_process_inbuf(connection_t *conn);
+int connection_or_finished_flushing(connection_t *conn);
 
-int connection_exit_finished_flushing(connection_t *conn);
+void conn_or_init_crypto(connection_t *conn);
+
+int or_handshake_op_send_keys(connection_t *conn);
+int or_handshake_op_finished_sending_keys(connection_t *conn);
+
+int or_handshake_client_process_auth(connection_t *conn);
+int or_handshake_client_send_auth(connection_t *conn);
+
+int or_handshake_server_process_auth(connection_t *conn);
+int or_handshake_server_process_nonce(connection_t *conn);
+
+connection_t *connect_to_router_as_or(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local);
+connection_t *connection_or_connect_as_or(routerinfo_t *router, RSA *prkey, struct sockaddr_in *local);
+
+int connection_or_create_listener(RSA *prkey, struct sockaddr_in *local);
+int connection_or_handle_listener_read(connection_t *conn);
 
 /********************************* main.c ***************************/
 
@@ -384,6 +476,10 @@ connection_t *connection_get_by_addr_port(uint32_t addr, uint16_t port);
 connection_t *connection_get_by_type(int type);
 
 routerinfo_t *router_get_by_addr_port(uint32_t addr, uint16_t port);
+unsigned int *router_new_route(size_t *rlen);
+unsigned char *router_create_onion(unsigned int *route, size_t routelen, size_t *lenp, crypt_path_t **cpathp);
+routerinfo_t *router_get_first_in_route(unsigned int *route, size_t routelen);
+connection_t *connect_to_router_as_op(routerinfo_t *router);
 
 void connection_watch_events(connection_t *conn, short events);
 
@@ -404,6 +500,37 @@ int decide_aci_type(uint32_t local_addr, uint16_t local_port,
 
 int process_onion(circuit_t *circ, connection_t *conn);
 
+/* uses a weighted coin with weight cw to choose a route length */
+int chooselen(double cw);
+
+/* returns an array of pointers to routent that define a new route through the OR network
+ * int cw is the coin weight to use when choosing the route 
+ * order of routers is from last to first
+ */
+unsigned int *new_route(double cw, routerinfo_t **rarray, size_t rarray_len, size_t *rlen);
+
+/* creates a new onion from route, stores it and its length into bufp and lenp respectively */
+unsigned char *create_onion(routerinfo_t **rarray, size_t rarray_len, unsigned int *route, size_t routelen, size_t *lenp, crypt_path_t **cpathp);
+
+/* encrypts 128 bytes of the onion with the specified public key, the rest with 
+ * DES OFB with the key as defined in the outter layer */
+unsigned char *encrypt_onion(onion_layer_t *onion, uint32_t onionlen, RSA *pkey);
+
+/* decrypts the first 128 bytes using RSA and prkey, decrypts the rest with DES OFB with key1 */
+unsigned char *decrypt_onion(onion_layer_t *onion, uint32_t onionlen, RSA *prkey);
+
+/* delete first n bytes of the onion and pads the end with n bytes of random data */
+void pad_onion(unsigned char *onion, uint32_t onionlen, size_t n);
+
+/* create a new tracked_onion entry */
+tracked_onion_t *new_tracked_onion(unsigned char *onion, uint32_t onionlen, tracked_onion_t **tracked_onions, tracked_onion_t **last_tracked_onion);
+
+/* delete a tracked onion entry */
+void remove_tracked_onion(tracked_onion_t *to, tracked_onion_t **tracked_onions, tracked_onion_t **last_tracked_onion);
+
+/* find a tracked onion in the linked list of tracked onions */
+tracked_onion_t *id_tracked_onion(unsigned char *onion, uint32_t onionlen, tracked_onion_t *tracked_onions);
+
 /********************************* routers.c ***************************/
 
 routerinfo_t **getrouters(char *routerfile, size_t *listlenp);
diff --git a/src/or/routers.c b/src/or/routers.c
index d24d4d1bd..9a673aeef 100644
--- a/src/or/routers.c
+++ b/src/or/routers.c
@@ -163,11 +163,14 @@ routerinfo_t **getrouters(char *routerfile, size_t *lenp)
 	if (token)
 	{
 	  log(LOG_DEBUG,"getrouters():Token :%s",token);
-	  router->port = (uint16_t)strtoul(token,&errtest,0);
+	  router->or_port = (uint16_t)strtoul(token,&errtest,0);
 	  if ((*token != '\0') && (*errtest == '\0')) /* conversion was successful */
 	  {
+/* FIXME patch from RD. We should make it actually read these. */
+            router->op_port = htons(router->or_port + 10);
+            router->ap_port = htons(router->or_port + 20);
 	    /* convert port to network format */
-	    router->port = htons(router->port);
+	    router->or_port = htons(router->or_port);
 	    
 	    /* read min bandwidth */
 	    token = (char *)strtok(NULL,OR_ROUTERLIST_SEPCHARS);
@@ -204,7 +207,8 @@ routerinfo_t **getrouters(char *routerfile, size_t *lenp)
 			  retp=fgets(line,512,rf);
 			  if (!retp)
 			  {
-			    log(LOG_ERR,"Could not find a public key entry for router %s:%u.",router->address,router->port);
+			    log(LOG_ERR,"Could not find a public key entry for router %s:%u.",
+			        router->address,router->or_port);
 			    free((void *)router->address);
 			    free((void *)router);
 			    fclose(rf);
@@ -233,7 +237,8 @@ routerinfo_t **getrouters(char *routerfile, size_t *lenp)
 			}
 			else /* we found something else; this isn't right */
 			{
-			  log(LOG_ERR,"Could not find a public key entry for router %s:%u.",router->address,router->port);
+			  log(LOG_ERR,"Could not find a public key entry for router %s:%u.",
+			      router->address,router->or_port);
 			  free((void *)router->address);
 			  free((void *)router);
 			  fclose(rf);
@@ -247,7 +252,8 @@ routerinfo_t **getrouters(char *routerfile, size_t *lenp)
 			router->pkey = PEM_read_RSAPublicKey(rf,&router->pkey,NULL,NULL);
 			if (!router->pkey) /* something went wrong */
 			{
-			  log(LOG_ERR,"Could not read public key for router %s:%u.",router->address,router->port);
+			  log(LOG_ERR,"Could not read public key for router %s:%u.", 
+			      router->address,router->or_port);
 			  free((void *)router->address);
 			  free((void *)router);
 			  fclose(rf);
@@ -259,7 +265,7 @@ routerinfo_t **getrouters(char *routerfile, size_t *lenp)
 			  log(LOG_DEBUG,"getrouters():Public key size = %u.", RSA_size(router->pkey));
 			  if (RSA_size(router->pkey) != 128) /* keys MUST be 1024 bits in size */
 			  {
-			    log(LOG_ERR,"Key for router %s:%u is not 1024 bits. All keys must be exactly 1024 bits long.",router->address,router->port);
+			    log(LOG_ERR,"Key for router %s:%u is not 1024 bits. All keys must be exactly 1024 bits long.",router->address,router->or_port);
 			    free((void *)router->address);
 			    RSA_free(router->pkey);
 			    free((void *)router);