diff --git a/ChangeLog b/ChangeLog
index 2468f808..d2bfe7bf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,23 @@
 # for this file format description,
 # see https://github.com/olivierlacan/keep-a-changelog
 
+## [2.18.0] - 2018-01-30
+### Added
+- Show tunnel nicknames for I2CP destination in WebUI
+- Re-create HTTP and SOCKS proxy by tunnel reload
+- Graceful shutdown as soon as no more transit tunnels
+### Changed
+- Regenerate shared local destination by tunnel reload
+- Use transient local destination by default if not specified
+- Return correct code if pid file can't be created
+- Timing and number of attempts for adressbook requests
+- Certificates list
+### Fixed
+- Malformed addressbook subsctiption request
+- Build with boost 1.66
+- Few race conditions for SAM
+- Check LeaseSet's signature before update
+
 ## [2.17.0] - 2017-12-04
 ### Added
 - Reseed through HTTP and SOCKS proxy
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 4931a709..00000000
--- a/Dockerfile
+++ /dev/null
@@ -1,54 +0,0 @@
-FROM alpine:latest
-
-MAINTAINER Mikal Villa <mikal@sigterm.no>
-
-ENV GIT_BRANCH="master"
-ENV I2PD_PREFIX="/opt/i2pd-${GIT_BRANCH}"
-ENV PATH=${I2PD_PREFIX}/bin:$PATH
-
-ENV GOSU_VERSION=1.7
-ENV GOSU_SHASUM="34049cfc713e8b74b90d6de49690fa601dc040021980812b2f1f691534be8a50  /usr/local/bin/gosu"
-
-RUN mkdir /user && adduser -S -h /user i2pd && chown -R i2pd:nobody /user
-
-
-#
-# Each RUN is a layer, adding the dependencies and building i2pd in one layer takes around 8-900Mb, so to keep the
-# image under 20mb we need to remove all the build dependencies in the same "RUN" / layer.
-#
-
-# 1. install deps, clone and build.
-# 2. strip binaries.
-# 3. Purge all dependencies and other unrelated packages, including build directory.
-RUN apk --no-cache --virtual build-dependendencies add make gcc g++ libtool boost-dev build-base openssl-dev openssl git \
-    && mkdir -p /tmp/build \
-    && cd /tmp/build && git clone -b ${GIT_BRANCH} https://github.com/PurpleI2P/i2pd.git \
-    && cd i2pd \
-    && make -j4 \
-    && mkdir -p ${I2PD_PREFIX}/bin \
-    && mv i2pd ${I2PD_PREFIX}/bin/ \
-    && cd ${I2PD_PREFIX}/bin \
-    && strip i2pd \
-    && rm -fr /tmp/build && apk --purge del build-dependendencies build-base fortify-headers boost-dev zlib-dev openssl-dev \
-    boost-python3 python3 gdbm boost-unit_test_framework boost-python linux-headers boost-prg_exec_monitor \
-    boost-serialization boost-signals boost-wave boost-wserialization boost-math boost-graph boost-regex git pcre \
-    libtool g++ gcc pkgconfig
-
-# 2. Adding required libraries to run i2pd to ensure it will run.
-RUN apk --no-cache add boost-filesystem boost-system boost-program_options boost-date_time boost-thread boost-iostreams openssl musl-utils libstdc++
-
-# Gosu is a replacement for su/sudo in docker and not a backdoor :) See https://github.com/tianon/gosu
-RUN wget -O /usr/local/bin/gosu https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-amd64 \
-    && echo "${GOSU_SHASUM}" | sha256sum -c && chmod +x /usr/local/bin/gosu
-
-COPY entrypoint.sh /entrypoint.sh
-
-RUN chmod a+x /entrypoint.sh
-RUN echo "export PATH=${PATH}" >> /etc/profile
-
-VOLUME [ "/var/lib/i2pd" ]
-
-EXPOSE 7070 4444 4447 7656 2827 7654 7650
-
-ENTRYPOINT [ "/entrypoint.sh" ]
-
diff --git a/Makefile b/Makefile
index 460b16e4..6d56ec7d 100644
--- a/Makefile
+++ b/Makefile
@@ -30,12 +30,12 @@ ifneq (, $(findstring darwin, $(SYS)))
 	else
 		include Makefile.osx
 	endif
+else ifneq (, $(findstring linux, $(SYS))$(findstring gnu, $(SYS)))
+	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
+	include Makefile.linux
 else ifneq (, $(findstring freebsd, $(SYS))$(findstring openbsd, $(SYS)))
 	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	include Makefile.bsd
-else ifneq (, $(findstring linux, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	include Makefile.linux
 else ifneq (, $(findstring mingw, $(SYS))$(findstring cygwin, $(SYS)))
 	DAEMON_SRC += Win32/DaemonWin32.cpp Win32/Win32Service.cpp Win32/Win32App.cpp
 	include Makefile.mingw
diff --git a/Makefile.homebrew b/Makefile.homebrew
index b3105c56..a6e645ee 100644
--- a/Makefile.homebrew
+++ b/Makefile.homebrew
@@ -33,10 +33,13 @@ endif
 # http://www.hutsby.net/2011/08/macs-with-aes-ni.html
 # Seems like all recent Mac's have AES-NI, after firmware upgrade 2.2
 # Found no good way to detect it from command line. TODO: Might be some osx sysinfo magic
-# note from psi: 2009 macbook does not have aesni
-#ifeq ($(USE_AESNI),yes)
-#	CXXFLAGS += -maes -DAESNI
-#endif
+ifeq ($(USE_AESNI),yes)
+	CXXFLAGS += -maes -DAESNI
+endif
+ifeq ($(USE_AVX),1)
+	CXXFLAGS += -mavx
+endif
+
 
 # Disabled, since it will be the default make rule. I think its better
 # to define the default rule in Makefile and not Makefile.<ostype> - torkel
diff --git a/README.md b/README.md
index 546cea64..8fc8393a 100644
--- a/README.md
+++ b/README.md
@@ -3,27 +3,27 @@ i2pd
 
 [Русская версия](https://github.com/PurpleI2P/i2pd_docs_ru/blob/master/README.md)
 
-i2pd (I2P Daemon) is a full-featured C++ implementation of I2P client.
+i2pd (I2P Daemon) is a full-featured C++ implementation of I2P client.  
 
-I2P (Invisible Internet Protocol) is a universal anonymous network layer.
+I2P (Invisible Internet Protocol) is a universal anonymous network layer.  
 All communications over I2P are anonymous and end-to-end encrypted, participants
-don't reveal their real IP addresses.
+don't reveal their real IP addresses.  
 
 I2P client is a software used for building and using anonymous I2P
 networks. Such networks are commonly used for anonymous peer-to-peer
 applications (filesharing, cryptocurrencies) and anonymous client-server
-applications (websites, instant messengers, chat-servers).
+applications (websites, instant messengers, chat-servers).  
 
 I2P allows people from all around the world to communicate and share information
-without restrictions.
+without restrictions.  
 
 Features
 --------
 
-* Distributed anonymous networking framework
-* End-to-end encrypted communications
-* Small footprint, simple dependencies, fast performance
-* Rich set of APIs for developers of secure applications
+* Distributed anonymous networking framework  
+* End-to-end encrypted communications  
+* Small footprint, simple dependencies, fast performance  
+* Rich set of APIs for developers of secure applications  
 
 Resources
 ---------
@@ -41,7 +41,7 @@ Installing
 The easiest way to install i2pd is by using
 [precompiled binaries](https://github.com/PurpleI2P/i2pd/releases/latest).
 See [documentation](https://i2pd.readthedocs.io/en/latest/) for how to build
-i2pd from source on your OS.
+i2pd from source on your OS.  
 
 
 Build instructions:
@@ -57,6 +57,8 @@ Build instructions:
 * GNU/Linux x86/x64		- [![Build Status](https://travis-ci.org/PurpleI2P/i2pd.svg?branch=openssl)](https://travis-ci.org/PurpleI2P/i2pd)
 * Windows				- [![Build status](https://ci.appveyor.com/api/projects/status/1908qe4p48ff1x23?svg=true)](https://ci.appveyor.com/project/PurpleI2P/i2pd)
 * Mac OS X				- [![Build Status](https://travis-ci.org/PurpleI2P/i2pd.svg?branch=openssl)](https://travis-ci.org/PurpleI2P/i2pd)
+* CentOS / Fedora		- [![Build Status](https://copr.fedorainfracloud.org/coprs/supervillain/i2pd/package/i2pd-git/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/supervillain/i2pd/package/i2pd-git/)
+* Docker image     - [![Build Status](https://dockerbuildbadges.quelltext.eu/status.svg?organization=meeh&repository=i2pd)](https://hub.docker.com/r/meeh/i2pd/builds/)
 * FreeBSD
 * Android
 * iOS
@@ -70,16 +72,15 @@ See [documentation](https://i2pd.readthedocs.io/en/latest/user-guide/run/) and
 Donations
 ---------
 
-BTC: 1K7Ds6KUeR8ya287UC4rYTjvC96vXyZbDY
-ZEC: t1cTckLuXsr1dwVrK4NDzfhehss4NvMadAJ
-DASH: Xw8YUrQpYzP9tZBmbjqxS3M97Q7v3vJKUF
-LTC: LKQirrYrDeTuAPnpYq5y7LVKtywfkkHi59
-DOGE: DNXLQKziRPAsD9H3DFNjk4fLQrdaSX893Y
-ANC: AQJYweYYUqM1nVfLqfoSMpUMfzxvS4Xd7z
-GST: GbD2JSQHBHCKLa9WTHmigJRpyFgmBj4woG
+BTC: 3MDoGJW9TLMTCDGrR9bLgWXfm6sjmgy86f  
+LTC: LKQirrYrDeTuAPnpYq5y7LVKtywfkkHi59  
+ETH: 0x9e5bac70d20d1079ceaa111127f4fb3bccce379d  
+DASH: Xw8YUrQpYzP9tZBmbjqxS3M97Q7v3vJKUF  
+ZEC: t1cTckLuXsr1dwVrK4NDzfhehss4NvMadAJ  
+GST: GbD2JSQHBHCKLa9WTHmigJRpyFgmBj4woG  
 
 License
 -------
 
 This project is licensed under the BSD 3-clause license, which can be found in the file
-LICENSE in the root of the project source code.
+LICENSE in the root of the project source code.  
diff --git a/Win32/DaemonWin32.cpp b/Win32/DaemonWin32.cpp
index 3f9226d1..822af30c 100644
--- a/Win32/DaemonWin32.cpp
+++ b/Win32/DaemonWin32.cpp
@@ -21,6 +21,7 @@ namespace util
 		SetConsoleCP(1251);
 		SetConsoleOutputCP(1251);
 		setlocale(LC_ALL, "Russian");
+		setlocale(LC_TIME, "C");
 
 		if (!Daemon_Singleton::init(argc, argv))
 			return false;
@@ -68,6 +69,7 @@ namespace util
 		SetConsoleCP(1251);
 		SetConsoleOutputCP(1251);
 		setlocale(LC_ALL, "Russian");
+		setlocale(LC_TIME, "C");
 #ifdef WIN32_APP
 		if (!i2p::win32::StartWin32App ()) return false;
 
diff --git a/Win32/installer.iss b/Win32/installer.iss
index 03b0842b..15ce4372 100644
--- a/Win32/installer.iss
+++ b/Win32/installer.iss
@@ -1,5 +1,5 @@
 #define I2Pd_AppName "i2pd"
-#define I2Pd_ver "2.17.0"
+#define I2Pd_ver "2.18.0"
 #define I2Pd_Publisher "PurpleI2P"
 
 [Setup]
diff --git a/android/.gitignore b/android/.gitignore
index d9fa5a57..90cd315e 100644
--- a/android/.gitignore
+++ b/android/.gitignore
@@ -5,4 +5,11 @@ ant.properties
 local.properties
 build.sh
 bin
-log*
\ No newline at end of file
+log*
+.gradle
+android.iml
+build
+gradle
+gradlew
+gradlew.bat
+
diff --git a/android/AndroidManifest.xml b/android/AndroidManifest.xml
index 1f9d3b91..cfc9d55b 100755
--- a/android/AndroidManifest.xml
+++ b/android/AndroidManifest.xml
@@ -1,26 +1,56 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-      package="org.purplei2p.i2pd"
-      android:versionCode="1"
-      android:versionName="2.17.0"
-	  android:installLocation="auto">
-    <uses-sdk android:minSdkVersion="14" android:targetSdkVersion="25"/>
-	<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
-    <uses-permission android:name="android.permission.INTERNET"/>
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
-	<application android:label="@string/app_name" android:allowBackup="true" android:icon="@drawable/icon">
-	    <receiver android:name=".NetworkStateChangeReceiver">
-	        <intent-filter>
-	            <action android:name="android.net.conn.CONNECTIVITY_CHANGE"/>
-	        </intent-filter>
-	    </receiver>
-	    <activity android:name=".I2PD"
-                  android:label="@string/app_name">
+    package="org.purplei2p.i2pd"
+    android:installLocation="auto"
+    android:versionCode="1"
+    android:versionName="2.18.0">
+
+    <uses-sdk
+        android:minSdkVersion="14"
+        android:targetSdkVersion="25" />
+
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.INTERNET" /> <!-- normal perm, per https://developer.android.com/guide/topics/permissions/normal-permissions.html -->
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" /> <!-- normal perm -->
+    <application
+        android:allowBackup="true"
+        android:icon="@drawable/icon"
+        android:label="@string/app_name"
+        android:theme="@android:style/Theme.Holo.Light.DarkActionBar"
+        >
+        <receiver android:name=".NetworkStateChangeReceiver">
+            <intent-filter>
+                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
+            </intent-filter>
+        </receiver>
+
+        <activity
+            android:name=".I2PDPermsAskerActivity"
+            android:label="@string/app_name">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
+
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
         </activity>
-        <service android:enabled="true" android:name=".ForegroundService"/>
+        <activity
+            android:name=".I2PDActivity"
+            android:label="@string/app_name" />
+
+        <service
+            android:name=".ForegroundService"
+            android:enabled="true" />
+
+        <activity
+            android:name=".I2PDPermsExplanationActivity"
+            android:label="@string/title_activity_i2_pdperms_asker_prompt"
+            android:parentActivityName=".I2PDPermsAskerActivity">
+            <meta-data
+                android:name="android.support.PARENT_ACTIVITY"
+                android:value="org.purplei2p.i2pd.I2PDPermsAskerActivity" />
+        </activity>
     </application>
-</manifest>
+
+</manifest>
\ No newline at end of file
diff --git a/android/build.gradle b/android/build.gradle
index a88403fd..4fe17d88 100644
--- a/android/build.gradle
+++ b/android/build.gradle
@@ -1,33 +1,44 @@
 buildscript {
-        repositories {
-                mavenCentral()
-                jcenter()
-        }
-        dependencies {
-                classpath 'com.android.tools.build:gradle:2.1.2'
-        }
+    repositories {
+        mavenCentral()
+        jcenter()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:2.3.3'
+    }
 }
 
 apply plugin: 'com.android.application'
 
+repositories {
+    jcenter()
+    maven {
+        url 'https://maven.google.com'
+    }
+}
+
 android {
-        compileSdkVersion 25
-        buildToolsVersion "25.0.2"
-        defaultConfig {
-                applicationId "org.purplei2p.i2pd"
-                targetSdkVersion 25
-                minSdkVersion 14
-                versionCode 1
-                versionName "2.17.1"
+    compileSdkVersion 25
+    buildToolsVersion "25.0.2"
+    defaultConfig {
+        applicationId "org.purplei2p.i2pd"
+        targetSdkVersion 25
+        minSdkVersion 14
+        versionCode 1
+        versionName "2.18.0"
+        ndk {
+            abiFilters 'armeabi-v7a'
+            //abiFilters 'x86'
         }
+    }
     sourceSets {
         main {
             manifest.srcFile 'AndroidManifest.xml'
             java.srcDirs = ['src']
-                        res.srcDirs = ['res']
-                        jniLibs.srcDirs = ['libs']
-        }
+            res.srcDirs = ['res']
+            jniLibs.srcDirs = ['libs']
         }
+    }
     signingConfigs {
         orignal {
             storeFile file("i2pdapk.jks")
@@ -37,11 +48,17 @@ android {
         }
     }
     buildTypes {
-                release {
-                        minifyEnabled false
-                        signingConfig signingConfigs.orignal
-                        proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-project.txt'
-                }
+        release {
+            minifyEnabled false
+            signingConfig signingConfigs.orignal
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-project.txt'
+        }
+    }
+    externalNativeBuild {
+        ndkBuild {
+            path './jni/Android.mk'
+        }
     }
 }
 
+
diff --git a/android/res/layout/activity_perms_asker.xml b/android/res/layout/activity_perms_asker.xml
new file mode 100644
index 00000000..d2d12cb6
--- /dev/null
+++ b/android/res/layout/activity_perms_asker.xml
@@ -0,0 +1,27 @@
+<LinearLayout android:id="@+id/main_layout"
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:orientation="vertical"
+    android:paddingBottom="@dimen/vertical_page_margin"
+    android:paddingLeft="@dimen/horizontal_page_margin"
+    android:paddingRight="@dimen/horizontal_page_margin"
+    android:paddingTop="@dimen/vertical_page_margin"
+    tools:context=".I2PDPermsAskerActivity">
+
+    <TextView
+        android:id="@+id/textview_retry"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:layout_marginBottom="@dimen/horizontal_page_margin"
+        android:visibility="gone"
+        />
+
+    <Button
+        android:id="@+id/button_request_write_ext_storage_perms"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="Retry requesting the SD card write permissions"
+        android:visibility="gone"/>
+</LinearLayout>
\ No newline at end of file
diff --git a/android/res/layout/activity_perms_explanation.xml b/android/res/layout/activity_perms_explanation.xml
new file mode 100644
index 00000000..1c9cce82
--- /dev/null
+++ b/android/res/layout/activity_perms_explanation.xml
@@ -0,0 +1,27 @@
+<LinearLayout android:id="@+id/layout_prompt"
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:orientation="vertical"
+    android:paddingBottom="@dimen/vertical_page_margin"
+    android:paddingLeft="@dimen/horizontal_page_margin"
+    android:paddingRight="@dimen/horizontal_page_margin"
+    android:paddingTop="@dimen/vertical_page_margin"
+    tools:context=".I2PDPermsAskerActivity">
+
+    <TextView
+        android:id="@+id/textview_explanation"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:layout_marginBottom="@dimen/horizontal_page_margin"
+        android:text="SD card write access is required to write the keys and other files to the I2PD folder on SD card."
+        />
+
+    <Button
+        android:id="@+id/button_ok"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="OK"
+        />
+</LinearLayout>
\ No newline at end of file
diff --git a/android/res/menu/options_main.xml b/android/res/menu/options_main.xml
index f66caa2a..aef67c51 100644
--- a/android/res/menu/options_main.xml
+++ b/android/res/menu/options_main.xml
@@ -2,15 +2,15 @@
     xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:app="http://schemas.android.com/apk/res-auto"
     xmlns:tools="http://schemas.android.com/tools"
-    tools:context=".I2PD">
+    tools:context=".I2PDActivity">
     <item
-        android:id="@+id/action_graceful_quit"
-        android:title="@string/action_graceful_quit"
+        android:id="@+id/action_graceful_stop"
+        android:title="@string/action_graceful_stop"
         android:orderInCategory="98"
         />
     <item
-        android:id="@+id/action_quit"
-        android:title="@string/action_quit"
+        android:id="@+id/action_stop"
+        android:title="@string/action_stop"
         android:orderInCategory="99"
         />
 </menu>
diff --git a/android/res/values/strings.xml b/android/res/values/strings.xml
index 0b8bef38..a0cc264c 100755
--- a/android/res/values/strings.xml
+++ b/android/res/values/strings.xml
@@ -1,11 +1,18 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
     <string name="app_name">i2pd</string>
-    <string name="i2pd_started">i2pd started</string>
-    <string name="i2pd_service_started">i2pd service started</string>
-    <string name="i2pd_service_stopped">i2pd service stopped</string>
-    <string name="action_quit">Quit</string>
-    <string name="action_graceful_quit">Graceful Quit</string>
-    <string name="graceful_quit_is_already_in_progress">Graceful quit is already in progress</string>
-    <string name="graceful_quit_is_in_progress">Graceful quit is in progress</string>
+    <string name="action_stop">Stop</string>
+    <string name="action_graceful_stop">Graceful Stop</string>
+    <string name="graceful_stop_is_already_in_progress">Graceful stop is already in progress</string>
+    <string name="graceful_stop_is_in_progress">Graceful stop is in progress</string>
+    <string name="already_stopped">Already stopped</string>
+    <string name="uninitialized">i2pd initializing</string>
+    <string name="starting">i2pd is starting</string>
+    <string name="jniLibraryLoaded">i2pd: loaded JNI libraries</string>
+    <string name="startedOkay">i2pd started</string>
+    <string name="startFailed">i2pd start failed</string>
+    <string name="gracefulShutdownInProgress">i2pd: graceful shutdown in progress</string>
+    <string name="stopped">i2pd has stopped</string>
+    <string name="remaining">remaining</string>
+    <string name="title_activity_i2_pdperms_asker_prompt">Prompt</string>
 </resources>
diff --git a/android/res/values/template-dimens.xml b/android/res/values/template-dimens.xml
new file mode 100644
index 00000000..36847c97
--- /dev/null
+++ b/android/res/values/template-dimens.xml
@@ -0,0 +1,16 @@
+<resources>
+
+    <!-- Define standard dimensions to comply with Holo-style grids and rhythm. -->
+
+    <dimen name="margin_tiny">4dp</dimen>
+    <dimen name="margin_small">8dp</dimen>
+    <dimen name="margin_medium">16dp</dimen>
+    <dimen name="margin_large">32dp</dimen>
+    <dimen name="margin_huge">64dp</dimen>
+
+    <!-- Semantic definitions -->
+
+    <dimen name="horizontal_page_margin">@dimen/margin_medium</dimen>
+    <dimen name="vertical_page_margin">@dimen/margin_medium</dimen>
+
+</resources>
\ No newline at end of file
diff --git a/android/src/org/purplei2p/i2pd/DaemonSingleton.java b/android/src/org/purplei2p/i2pd/DaemonSingleton.java
index 65afd0f5..4f3e62f7 100644
--- a/android/src/org/purplei2p/i2pd/DaemonSingleton.java
+++ b/android/src/org/purplei2p/i2pd/DaemonSingleton.java
@@ -8,8 +8,8 @@ import android.util.Log;
 public class DaemonSingleton {
 	private static final String TAG="i2pd";
 	private static final DaemonSingleton instance = new DaemonSingleton();
-	public static interface StateUpdateListener { void daemonStateUpdate(); }
-	private final Set<StateUpdateListener> stateUpdateListeners = new HashSet<StateUpdateListener>();
+	public interface StateUpdateListener { void daemonStateUpdate(); }
+	private final Set<StateUpdateListener> stateUpdateListeners = new HashSet<>();
 
 	public static DaemonSingleton getInstance() {
 		return instance;
@@ -18,63 +18,72 @@ public class DaemonSingleton {
 	public synchronized void addStateChangeListener(StateUpdateListener listener) { stateUpdateListeners.add(listener); }
 	public synchronized void removeStateChangeListener(StateUpdateListener listener) { stateUpdateListeners.remove(listener); }
 
+	private synchronized void setState(State newState) {
+		if(newState==null)throw new NullPointerException();
+		State oldState = state;
+		if(oldState==null)throw new NullPointerException();
+		if(oldState.equals(newState))return;
+		state=newState;
+		fireStateUpdate1();
+	}
 	public synchronized void stopAcceptingTunnels() {
 		if(isStartedOkay()){
-			state=State.gracefulShutdownInProgress;
-			fireStateUpdate();
+			setState(State.gracefulShutdownInProgress);
 			I2PD_JNI.stopAcceptingTunnels();
 		}
 	}
 
-	public void onNetworkStateChange(boolean isConnected) {
-		I2PD_JNI.onNetworkStateChanged(isConnected);
-	}
+	private volatile boolean startedOkay;
+
+	public enum State {
+        uninitialized(R.string.uninitialized),
+        starting(R.string.starting),
+        jniLibraryLoaded(R.string.jniLibraryLoaded),
+        startedOkay(R.string.startedOkay),
+        startFailed(R.string.startFailed),
+        gracefulShutdownInProgress(R.string.gracefulShutdownInProgress),
+        stopped(R.string.stopped);
 
-	private boolean startedOkay;
+        State(int statusStringResourceId) {
+            this.statusStringResourceId = statusStringResourceId;
+        }
 
-	public static enum State {uninitialized,starting,jniLibraryLoaded,startedOkay,startFailed,gracefulShutdownInProgress};
+        private final int statusStringResourceId;
 
-	private State state = State.uninitialized;
+        public int getStatusStringResourceId() {
+            return statusStringResourceId;
+        }
+    };
+
+	private volatile State state = State.uninitialized;
 
 	public State getState() { return state; }
 
-	public synchronized void start() {
-		if(state != State.uninitialized)return;
-		state = State.starting;
-		fireStateUpdate();
+	{
+		setState(State.starting);
 		new Thread(new Runnable(){
 
 			@Override
 			public void run() {
 				try {
 					I2PD_JNI.loadLibraries();
-					synchronized (DaemonSingleton.this) {
-						state = State.jniLibraryLoaded;
-						fireStateUpdate();
-					}
+					setState(State.jniLibraryLoaded);
 				} catch (Throwable tr) {
 					lastThrowable=tr;
-					synchronized (DaemonSingleton.this) {
-						state = State.startFailed;
-						fireStateUpdate();
-					}
+					setState(State.startFailed);
 					return;
 				}
 				try {
 					synchronized (DaemonSingleton.this) {
 						daemonStartResult = I2PD_JNI.startDaemon();
 						if("ok".equals(daemonStartResult)){
-							state=State.startedOkay;
+							setState(State.startedOkay);
 							setStartedOkay(true);
-						}else state=State.startFailed;
-						fireStateUpdate();
+						}else setState(State.startFailed);
 					}
 				} catch (Throwable tr) {
 					lastThrowable=tr;
-					synchronized (DaemonSingleton.this) {
-						state = State.startFailed;
-						fireStateUpdate();
-					}
+					setState(State.startFailed);
 					return;
 				}
 			}
@@ -84,7 +93,7 @@ public class DaemonSingleton {
 	private Throwable lastThrowable;
 	private String daemonStartResult="N/A";
 
-	private synchronized void fireStateUpdate() {
+	private void fireStateUpdate1() {
 		Log.i(TAG, "daemon state change: "+state);
 		for(StateUpdateListener listener : stateUpdateListeners) {
 			try {
@@ -121,6 +130,7 @@ public class DaemonSingleton {
 		if(isStartedOkay()){
 			try {I2PD_JNI.stopDaemon();}catch(Throwable tr){Log.e(TAG, "", tr);}
 			setStartedOkay(false);
+			setState(State.stopped);
 		}
 	}
 }
diff --git a/android/src/org/purplei2p/i2pd/ForegroundService.java b/android/src/org/purplei2p/i2pd/ForegroundService.java
index bfd650c8..6116b982 100644
--- a/android/src/org/purplei2p/i2pd/ForegroundService.java
+++ b/android/src/org/purplei2p/i2pd/ForegroundService.java
@@ -11,11 +11,32 @@ import android.util.Log;
 import android.widget.Toast;
 
 public class ForegroundService extends Service {
+    private static final String TAG="FgService";
+
+    private volatile boolean shown;
+
+    private final DaemonSingleton.StateUpdateListener daemonStateUpdatedListener =
+            new DaemonSingleton.StateUpdateListener() {
+
+                @Override
+                public void daemonStateUpdate() {
+                    try {
+                        synchronized (ForegroundService.this) {
+                            if (shown) cancelNotification();
+                            showNotification();
+                        }
+                    } catch (Throwable tr) {
+                        Log.e(TAG,"error ignored",tr);
+                    }
+                }
+            };
+
+
     private NotificationManager notificationManager;
 
     // Unique Identification Number for the Notification.
     // We use it on Notification start, and to cancel it.
-    private int NOTIFICATION = R.string.i2pd_started;
+    private int NOTIFICATION = 1;
 
     /**
      * Class for clients to access.  Because we know this service always
@@ -32,29 +53,35 @@ public class ForegroundService extends Service {
     public void onCreate() {
         notificationManager = (NotificationManager)getSystemService(NOTIFICATION_SERVICE);
 
-        // Display a notification about us starting.  We put an icon in the status bar.
-        showNotification();
-        daemon.start();
+        synchronized (this) {
+            DaemonSingleton.getInstance().addStateChangeListener(daemonStateUpdatedListener);
+            if (!shown) daemonStateUpdatedListener.daemonStateUpdate();
+        }
         // Tell the user we started.
-        Toast.makeText(this, R.string.i2pd_service_started, Toast.LENGTH_SHORT).show();
+//        Toast.makeText(this, R.string.i2pd_service_started, Toast.LENGTH_SHORT).show();
     }
 
     @Override
     public int onStartCommand(Intent intent, int flags, int startId) {
         Log.i("ForegroundService", "Received start id " + startId + ": " + intent);
-        daemon.start();
         return START_STICKY;
     }
 
     @Override
     public void onDestroy() {
+        DaemonSingleton.getInstance().removeStateChangeListener(daemonStateUpdatedListener);
+        cancelNotification();
+    }
+
+    private synchronized void cancelNotification() {
         // Cancel the persistent notification.
         notificationManager.cancel(NOTIFICATION);
 
         stopForeground(true);
 
         // Tell the user we stopped.
-        Toast.makeText(this, R.string.i2pd_service_stopped, Toast.LENGTH_SHORT).show();
+//        Toast.makeText(this, R.string.i2pd_service_stopped, Toast.LENGTH_SHORT).show();
+        shown=false;
     }
 
     @Override
@@ -69,13 +96,13 @@ public class ForegroundService extends Service {
     /**
      * Show a notification while this service is running.
      */
-    private void showNotification() {
+    private synchronized void showNotification() {
         // In this sample, we'll use the same text for the ticker and the expanded notification
-        CharSequence text = getText(R.string.i2pd_started);
+        CharSequence text = getText(DaemonSingleton.getInstance().getState().getStatusStringResourceId());
 
         // The PendingIntent to launch our activity if the user selects this notification
         PendingIntent contentIntent = PendingIntent.getActivity(this, 0,
-                new Intent(this, I2PD.class), 0);
+                new Intent(this, I2PDActivity.class), 0);
 
         // Set the info for the views that show in the notification panel.
         Notification notification = new Notification.Builder(this)
@@ -90,8 +117,9 @@ public class ForegroundService extends Service {
         // Send the notification.
         //mNM.notify(NOTIFICATION, notification);
         startForeground(NOTIFICATION, notification);
+        shown=true;
     }
 
-	private final DaemonSingleton daemon = DaemonSingleton.getInstance();
+	private static final DaemonSingleton daemon = DaemonSingleton.getInstance();
 }
 
diff --git a/android/src/org/purplei2p/i2pd/I2PD.java b/android/src/org/purplei2p/i2pd/I2PD.java
deleted file mode 100755
index a2494b2b..00000000
--- a/android/src/org/purplei2p/i2pd/I2PD.java
+++ /dev/null
@@ -1,245 +0,0 @@
-package org.purplei2p.i2pd;
-
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.util.Timer;
-import java.util.TimerTask;
-
-import android.annotation.SuppressLint;
-import android.app.Activity;
-import android.content.ComponentName;
-import android.content.Context;
-import android.content.Intent;
-import android.content.ServiceConnection;
-import android.os.Build;
-import android.os.Bundle;
-import android.os.IBinder;
-import android.util.Log;
-import android.view.Menu;
-import android.view.MenuItem;
-import android.widget.TextView;
-import android.widget.Toast;
-
-public class I2PD extends Activity {
-	private static final String TAG = "i2pd";
-
-	private TextView textView;
-
-	private final DaemonSingleton daemon = DaemonSingleton.getInstance();
-
-	private DaemonSingleton.StateUpdateListener daemonStateUpdatedListener =
-			new DaemonSingleton.StateUpdateListener() {
-
-		@Override
-		public void daemonStateUpdate() {
-			runOnUiThread(new Runnable(){
-
-				@Override
-				public void run() {
-					try {
-						if(textView==null)return;
-						Throwable tr = daemon.getLastThrowable();
-						if(tr!=null) {
-							textView.setText(throwableToString(tr));
-							return;
-						}
-						DaemonSingleton.State state = daemon.getState();
-						textView.setText(String.valueOf(state)+
-								(DaemonSingleton.State.startFailed.equals(state)?": "+daemon.getDaemonStartResult():""));
-					} catch (Throwable tr) {
-						Log.e(TAG,"error ignored",tr);
-					}
-				}
-			});
-		}
-	};
-
-    @Override
-    public void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-
-        textView = new TextView(this);
-        setContentView(textView);
-        DaemonSingleton.getInstance().addStateChangeListener(daemonStateUpdatedListener);
-        daemonStateUpdatedListener.daemonStateUpdate();
-
-        //set the app be foreground
-        doBindService();
-    }
-
-    @Override
-	protected void onDestroy() {
-		super.onDestroy();
-		localDestroy();
-	}
-
-	private void localDestroy() {
-		textView = null;
-		DaemonSingleton.getInstance().removeStateChangeListener(daemonStateUpdatedListener);
-		Timer gracefulQuitTimer = getGracefulQuitTimer();
-		if(gracefulQuitTimer!=null) {
-			gracefulQuitTimer.cancel();
-			setGracefulQuitTimer(null);
-		}
-		try{
-            doUnbindService();
-		}catch(Throwable tr){
-			Log.e(TAG, "", tr);
-		}
-	}
-
-	private CharSequence throwableToString(Throwable tr) {
-    	StringWriter sw = new StringWriter(8192);
-    	PrintWriter pw = new PrintWriter(sw);
-    	tr.printStackTrace(pw);
-    	pw.close();
-    	return sw.toString();
-	}
-
-//	private LocalService mBoundService;
-
-    private ServiceConnection mConnection = new ServiceConnection() {
-        public void onServiceConnected(ComponentName className, IBinder service) {
-            // This is called when the connection with the service has been
-            // established, giving us the service object we can use to
-            // interact with the service.  Because we have bound to a explicit
-            // service that we know is running in our own process, we can
-            // cast its IBinder to a concrete class and directly access it.
-//	        mBoundService = ((LocalService.LocalBinder)service).getService();
-
-            // Tell the user about this for our demo.
-//	        Toast.makeText(Binding.this, R.string.local_service_connected,
-//	                Toast.LENGTH_SHORT).show();
-        }
-
-        public void onServiceDisconnected(ComponentName className) {
-            // This is called when the connection with the service has been
-            // unexpectedly disconnected -- that is, its process crashed.
-            // Because it is running in our same process, we should never
-            // see this happen.
-//	        mBoundService = null;
-//	        Toast.makeText(Binding.this, R.string.local_service_disconnected,
-//	                Toast.LENGTH_SHORT).show();
-        }
-    };
-
-
-    private boolean mIsBound;
-
-    private void doBindService() {
-        // Establish a connection with the service.  We use an explicit
-        // class name because we want a specific service implementation that
-        // we know will be running in our own process (and thus won't be
-        // supporting component replacement by other applications).
-        bindService(new Intent(this,
-                ForegroundService.class), mConnection, Context.BIND_AUTO_CREATE);
-        mIsBound = true;
-    }
-
-    private void doUnbindService() {
-        if (mIsBound) {
-            // Detach our existing connection.
-            unbindService(mConnection);
-            mIsBound = false;
-        }
-    }
-
-	@Override
-	public boolean onCreateOptionsMenu(Menu menu) {
-		// Inflate the menu; this adds items to the action bar if it is present.
-		getMenuInflater().inflate(R.menu.options_main, menu);
-		return true;
-	}
-
-	@Override
-	public boolean onOptionsItemSelected(MenuItem item) {
-		// Handle action bar item clicks here. The action bar will
-		// automatically handle clicks on the Home/Up button, so long
-		// as you specify a parent activity in AndroidManifest.xml.
-		int id = item.getItemId();
-
-		switch(id){
-        case R.id.action_quit:
-            quit();
-            return true;
-        case R.id.action_graceful_quit:
-            gracefulQuit();
-            return true;
-        }
-
-		return super.onOptionsItemSelected(item);
-	}
-
-    @SuppressLint("NewApi")
-	private void quit() {
-        try {
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
-                finishAndRemoveTask();
-            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
-                finishAffinity();
-            } else {
-                //moveTaskToBack(true);
-                finish();
-            }
-        }catch (Throwable tr) {
-            Log.e(TAG, "", tr);
-        }
-        try{
-            daemon.stopDaemon();
-	    }catch (Throwable tr) {
-	        Log.e(TAG, "", tr);
-	    }
-        System.exit(0);
-    }
-
-    private Timer gracefulQuitTimer;
-    private final Object gracefulQuitTimerLock = new Object();
-    private void gracefulQuit() {
-    	if(getGracefulQuitTimer()!=null){
-	        Toast.makeText(this, R.string.graceful_quit_is_already_in_progress,
-	        		Toast.LENGTH_SHORT).show();
-    		return;
-    	}
-        Toast.makeText(this, R.string.graceful_quit_is_in_progress,
-        		Toast.LENGTH_SHORT).show();
-        new Thread(new Runnable(){
-
-			@Override
-			public void run() {
-				try{
-					Log.d(TAG, "grac stopping");
-			        if(daemon.isStartedOkay()) {
-			        	daemon.stopAcceptingTunnels();
-			            Timer gracefulQuitTimer = new Timer(true);
-						setGracefulQuitTimer(gracefulQuitTimer);
-						gracefulQuitTimer.schedule(new TimerTask(){
-
-			    			@Override
-			    			public void run() {
-			    				quit();
-			    			}
-
-			            }, 10*60*1000/*milliseconds*/);
-			        }else{
-			        	quit();
-			        }
-				} catch(Throwable tr) {
-					Log.e(TAG,"",tr);
-				}
-			}
-
-        },"gracQuitInit").start();
-    }
-
-	private Timer getGracefulQuitTimer() {
-		synchronized (gracefulQuitTimerLock) {
-			return gracefulQuitTimer;
-		}
-	}
-
-	private void setGracefulQuitTimer(Timer gracefulQuitTimer) {
-    	synchronized (gracefulQuitTimerLock) {
-    		this.gracefulQuitTimer = gracefulQuitTimer;
-    	}
-	}
-}
diff --git a/android/src/org/purplei2p/i2pd/I2PDActivity.java b/android/src/org/purplei2p/i2pd/I2PDActivity.java
new file mode 100755
index 00000000..99672eb7
--- /dev/null
+++ b/android/src/org/purplei2p/i2pd/I2PDActivity.java
@@ -0,0 +1,285 @@
+package org.purplei2p.i2pd;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.util.Timer;
+import java.util.TimerTask;
+
+import android.app.Activity;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.ServiceConnection;
+import android.os.Bundle;
+import android.os.IBinder;
+import android.util.Log;
+import android.view.Menu;
+import android.view.MenuItem;
+import android.widget.TextView;
+import android.widget.Toast;
+
+public class I2PDActivity extends Activity {
+    private static final String TAG = "i2pdActvt";
+    public static final int GRACEFUL_DELAY_MILLIS = 10 * 60 * 1000;
+
+    private TextView textView;
+
+	private static final DaemonSingleton daemon = DaemonSingleton.getInstance();
+
+	private final DaemonSingleton.StateUpdateListener daemonStateUpdatedListener =
+			new DaemonSingleton.StateUpdateListener() {
+
+		@Override
+		public void daemonStateUpdate() {
+			runOnUiThread(new Runnable(){
+
+				@Override
+				public void run() {
+					try {
+						if(textView==null)return;
+						Throwable tr = daemon.getLastThrowable();
+						if(tr!=null) {
+							textView.setText(throwableToString(tr));
+							return;
+						}
+						DaemonSingleton.State state = daemon.getState();
+						textView.setText(
+						        String.valueOf(state)+
+                                    (DaemonSingleton.State.startFailed.equals(state)?": "+daemon.getDaemonStartResult():"")+
+                                    (DaemonSingleton.State.gracefulShutdownInProgress.equals(state)?":  "+formatGraceTimeRemaining()+" "+getText(R.string.remaining):"")
+                        );
+					} catch (Throwable tr) {
+						Log.e(TAG,"error ignored",tr);
+					}
+				}
+			});
+		}
+	};
+    private static volatile long graceStartedMillis;
+    private static final Object graceStartedMillis_LOCK=new Object();
+
+    private static String formatGraceTimeRemaining() {
+        long remainingSeconds;
+        synchronized (graceStartedMillis_LOCK){
+            remainingSeconds=Math.round(Math.max(0,graceStartedMillis+GRACEFUL_DELAY_MILLIS-System.currentTimeMillis())/1000.0D);
+        }
+        long remainingMinutes=(long)Math.floor(remainingSeconds/60.0D);
+        long remSec=remainingSeconds-remainingMinutes*60;
+        return remainingMinutes+":"+(remSec/10)+remSec%10;
+    }
+
+    @Override
+    public void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        textView = new TextView(this);
+        setContentView(textView);
+        daemon.addStateChangeListener(daemonStateUpdatedListener);
+        daemonStateUpdatedListener.daemonStateUpdate();
+
+        //set the app be foreground
+        doBindService();
+
+        final Timer gracefulQuitTimer = getGracefulQuitTimer();
+        if(gracefulQuitTimer!=null){
+            long gracefulStopAtMillis;
+            synchronized (graceStartedMillis_LOCK) {
+                gracefulStopAtMillis = graceStartedMillis + GRACEFUL_DELAY_MILLIS;
+            }
+            rescheduleGraceStop(gracefulQuitTimer, gracefulStopAtMillis);
+        }
+    }
+
+    @Override
+	protected void onDestroy() {
+		super.onDestroy();
+        textView = null;
+        daemon.removeStateChangeListener(daemonStateUpdatedListener);
+        //cancelGracefulStop();
+		try{
+            doUnbindService();
+		}catch(Throwable tr){
+			Log.e(TAG, "", tr);
+		}
+	}
+
+    private static void cancelGracefulStop() {
+        Timer gracefulQuitTimer = getGracefulQuitTimer();
+        if(gracefulQuitTimer!=null) {
+            gracefulQuitTimer.cancel();
+            setGracefulQuitTimer(null);
+        }
+    }
+
+    private CharSequence throwableToString(Throwable tr) {
+    	StringWriter sw = new StringWriter(8192);
+    	PrintWriter pw = new PrintWriter(sw);
+    	tr.printStackTrace(pw);
+    	pw.close();
+    	return sw.toString();
+	}
+
+//	private LocalService mBoundService;
+
+    private ServiceConnection mConnection = new ServiceConnection() {
+        public void onServiceConnected(ComponentName className, IBinder service) {
+            // This is called when the connection with the service has been
+            // established, giving us the service object we can use to
+            // interact with the service.  Because we have bound to a explicit
+            // service that we know is running in our own process, we can
+            // cast its IBinder to a concrete class and directly access it.
+//	        mBoundService = ((LocalService.LocalBinder)service).getService();
+
+            // Tell the user about this for our demo.
+//	        Toast.makeText(Binding.this, R.string.local_service_connected,
+//	                Toast.LENGTH_SHORT).show();
+        }
+
+        public void onServiceDisconnected(ComponentName className) {
+            // This is called when the connection with the service has been
+            // unexpectedly disconnected -- that is, its process crashed.
+            // Because it is running in our same process, we should never
+            // see this happen.
+//	        mBoundService = null;
+//	        Toast.makeText(Binding.this, R.string.local_service_disconnected,
+//	                Toast.LENGTH_SHORT).show();
+        }
+    };
+
+
+    private static volatile boolean mIsBound;
+
+    private void doBindService() {
+        synchronized (I2PDActivity.class) {
+            if (mIsBound) return;
+            // Establish a connection with the service.  We use an explicit
+            // class name because we want a specific service implementation that
+            // we know will be running in our own process (and thus won't be
+            // supporting component replacement by other applications).
+            bindService(new Intent(this, ForegroundService.class), mConnection, Context.BIND_AUTO_CREATE);
+            mIsBound = true;
+        }
+    }
+
+    private void doUnbindService() {
+        synchronized (I2PDActivity.class) {
+            if (mIsBound) {
+                // Detach our existing connection.
+                unbindService(mConnection);
+                mIsBound = false;
+            }
+        }
+    }
+
+	@Override
+	public boolean onCreateOptionsMenu(Menu menu) {
+		// Inflate the menu; this adds items to the action bar if it is present.
+		getMenuInflater().inflate(R.menu.options_main, menu);
+		return true;
+	}
+
+	@Override
+	public boolean onOptionsItemSelected(MenuItem item) {
+		// Handle action bar item clicks here. The action bar will
+		// automatically handle clicks on the Home/Up button, so long
+		// as you specify a parent activity in AndroidManifest.xml.
+		int id = item.getItemId();
+
+		switch(id){
+        case R.id.action_stop:
+            i2pdStop();
+            return true;
+        case R.id.action_graceful_stop:
+            i2pdGracefulStop();
+            return true;
+        }
+
+		return super.onOptionsItemSelected(item);
+	}
+
+	private void i2pdStop() {
+        cancelGracefulStop();
+        new Thread(new Runnable(){
+
+            @Override
+            public void run() {
+                Log.d(TAG, "stopping");
+                try{
+                    daemon.stopDaemon();
+                }catch (Throwable tr) {
+                    Log.e(TAG, "", tr);
+                }
+            }
+
+        },"stop").start();
+    }
+
+    private static volatile Timer gracefulQuitTimer;
+
+    private void i2pdGracefulStop() {
+        if(daemon.getState()==DaemonSingleton.State.stopped){
+            Toast.makeText(this, R.string.already_stopped,
+                    Toast.LENGTH_SHORT).show();
+            return;
+        }
+    	if(getGracefulQuitTimer()!=null){
+	        Toast.makeText(this, R.string.graceful_stop_is_already_in_progress,
+	        		Toast.LENGTH_SHORT).show();
+    		return;
+    	}
+        Toast.makeText(this, R.string.graceful_stop_is_in_progress,
+        		Toast.LENGTH_SHORT).show();
+        new Thread(new Runnable(){
+
+			@Override
+			public void run() {
+				try{
+					Log.d(TAG, "grac stopping");
+			        if(daemon.isStartedOkay()) {
+			        	daemon.stopAcceptingTunnels();
+                        long gracefulStopAtMillis;
+                        synchronized (graceStartedMillis_LOCK) {
+                            graceStartedMillis = System.currentTimeMillis();
+                            gracefulStopAtMillis = graceStartedMillis + GRACEFUL_DELAY_MILLIS;
+                        }
+                        rescheduleGraceStop(null,gracefulStopAtMillis);
+			        }else{
+			        	i2pdStop();
+			        }
+				} catch(Throwable tr) {
+					Log.e(TAG,"",tr);
+				}
+			}
+
+        },"gracInit").start();
+    }
+
+    private void rescheduleGraceStop(Timer gracefulQuitTimerOld, long gracefulStopAtMillis) {
+        if(gracefulQuitTimerOld!=null)gracefulQuitTimerOld.cancel();
+        final Timer gracefulQuitTimer = new Timer(true);
+        setGracefulQuitTimer(gracefulQuitTimer);
+        gracefulQuitTimer.schedule(new TimerTask(){
+
+            @Override
+            public void run() {
+                i2pdStop();
+            }
+
+        }, Math.max(0,gracefulStopAtMillis-System.currentTimeMillis()));
+        final TimerTask tickerTask = new TimerTask() {
+            @Override
+            public void run() {
+                daemonStateUpdatedListener.daemonStateUpdate();
+            }
+        };
+        gracefulQuitTimer.scheduleAtFixedRate(tickerTask,0/*start delay*/,1000/*millis period*/);
+    }
+
+    private static Timer getGracefulQuitTimer() {
+        return gracefulQuitTimer;
+	}
+
+	private static void setGracefulQuitTimer(Timer gracefulQuitTimer) {
+   		I2PDActivity.gracefulQuitTimer = gracefulQuitTimer;
+	}
+}
diff --git a/android/src/org/purplei2p/i2pd/I2PDPermsAskerActivity.java b/android/src/org/purplei2p/i2pd/I2PDPermsAskerActivity.java
new file mode 100644
index 00000000..3e364949
--- /dev/null
+++ b/android/src/org/purplei2p/i2pd/I2PDPermsAskerActivity.java
@@ -0,0 +1,171 @@
+package org.purplei2p.i2pd;
+
+import android.Manifest;
+import android.app.Activity;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.os.Bundle;
+import android.view.View;
+import android.widget.Button;
+import android.widget.TextView;
+
+import java.lang.reflect.Method;
+
+//dangerous perms, per https://developer.android.com/guide/topics/permissions/normal-permissions.html :
+//android.permission.WRITE_EXTERNAL_STORAGE
+public class I2PDPermsAskerActivity extends Activity {
+
+    private static final int PERMISSION_WRITE_EXTERNAL_STORAGE = 0;
+
+    private Button button_request_write_ext_storage_perms;
+    private TextView textview_retry;
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        //if less than Android 6, no runtime perms req system present
+        if (android.os.Build.VERSION.SDK_INT < 23) {
+            startMainActivity();
+            return;
+        }
+
+
+        setContentView(R.layout.activity_perms_asker);
+        button_request_write_ext_storage_perms = (Button) findViewById(R.id.button_request_write_ext_storage_perms);
+        textview_retry = (TextView) findViewById(R.id.textview_retry);
+
+        button_request_write_ext_storage_perms.setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View view) {
+                request_write_ext_storage_perms();
+            }
+        });
+        request_write_ext_storage_perms();
+    }
+
+    private void request_write_ext_storage_perms() {
+
+        textview_retry.setVisibility(TextView.GONE);
+        button_request_write_ext_storage_perms.setVisibility(Button.GONE);
+
+        Method methodCheckPermission;
+        Method method_shouldShowRequestPermissionRationale;
+        Method method_requestPermissions;
+        try {
+            methodCheckPermission = getClass().getMethod("checkSelfPermission", String.class);
+            method_shouldShowRequestPermissionRationale =
+                    getClass().getMethod("shouldShowRequestPermissionRationale", String.class);
+            method_requestPermissions =
+                    getClass().getMethod("requestPermissions", String[].class, int.class);
+        } catch (NoSuchMethodException e) {
+            throw new RuntimeException(e);
+        }
+        Integer resultObj;
+        try {
+            resultObj = (Integer) methodCheckPermission.invoke(
+                    this, Manifest.permission.WRITE_EXTERNAL_STORAGE);
+        } catch (Throwable e) {
+            throw new RuntimeException(e);
+        }
+
+        if (resultObj != PackageManager.PERMISSION_GRANTED) {
+
+            // Should we show an explanation?
+            Boolean aBoolean;
+            try {
+                aBoolean = (Boolean) method_shouldShowRequestPermissionRationale.invoke(this,
+                        Manifest.permission.WRITE_EXTERNAL_STORAGE);
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+            if (aBoolean) {
+
+                // Show an explanation to the user *asynchronously* -- don't block
+                // this thread waiting for the user's response! After the user
+                // sees the explanation, try again to request the permission.
+
+                showExplanation();
+
+            } else {
+
+                // No explanation needed, we can request the permission.
+
+                try {
+                    method_requestPermissions.invoke(this,
+                            new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE},
+                            PERMISSION_WRITE_EXTERNAL_STORAGE);
+                } catch (Exception e) {
+                    throw new RuntimeException(e);
+                }
+            }
+        } else startMainActivity();
+    }
+
+    @Override
+    public void onRequestPermissionsResult(int requestCode,
+                                           String permissions[], int[] grantResults) {
+        switch (requestCode) {
+            case PERMISSION_WRITE_EXTERNAL_STORAGE: {
+                // If request is cancelled, the result arrays are empty.
+                if (grantResults.length > 0
+                        && grantResults[0] == PackageManager.PERMISSION_GRANTED) {
+
+                    // permission was granted, yay! Do the
+                    // contacts-related task you need to do.
+
+                    startMainActivity();
+
+                } else {
+
+                    // permission denied, boo! Disable the
+                    // functionality that depends on this permission.
+                    textview_retry.setText("SD card write permission denied, you need to allow this to continue");
+                    textview_retry.setVisibility(TextView.VISIBLE);
+                    button_request_write_ext_storage_perms.setVisibility(Button.VISIBLE);
+                }
+                return;
+            }
+
+            // other 'case' lines to check for other
+            // permissions this app might request.
+        }
+    }
+
+    private void startMainActivity() {
+        startActivity(new Intent(this, I2PDActivity.class));
+        finish();
+    }
+
+    private static final int SHOW_EXPLANATION_REQUEST = 1;  // The request code
+    private void showExplanation() {
+        Intent intent = new Intent(this, I2PDPermsExplanationActivity.class);
+        startActivityForResult(intent, SHOW_EXPLANATION_REQUEST);
+    }
+
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        // Check which request we're responding to
+        if (requestCode == SHOW_EXPLANATION_REQUEST) {
+            // Make sure the request was successful
+            if (resultCode == RESULT_OK) {
+                // Request the permission
+                Method method_requestPermissions;
+                try {
+                    method_requestPermissions =
+                            getClass().getMethod("requestPermissions", String[].class, int.class);
+                } catch (NoSuchMethodException e) {
+                    throw new RuntimeException(e);
+                }
+                try {
+                    method_requestPermissions.invoke(this,
+                            new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE},
+                            PERMISSION_WRITE_EXTERNAL_STORAGE);
+                } catch (Exception e) {
+                    throw new RuntimeException(e);
+                }
+            } else {
+                finish(); //close the app
+            }
+        }
+    }
+}
diff --git a/android/src/org/purplei2p/i2pd/I2PDPermsExplanationActivity.java b/android/src/org/purplei2p/i2pd/I2PDPermsExplanationActivity.java
new file mode 100644
index 00000000..d1641e78
--- /dev/null
+++ b/android/src/org/purplei2p/i2pd/I2PDPermsExplanationActivity.java
@@ -0,0 +1,38 @@
+package org.purplei2p.i2pd;
+
+import android.app.ActionBar;
+import android.content.Intent;
+import android.os.Bundle;
+import android.app.Activity;
+import android.view.View;
+import android.widget.Button;
+
+public class I2PDPermsExplanationActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_perms_explanation);
+        ActionBar actionBar = getActionBar();
+        if(actionBar!=null)actionBar.setHomeButtonEnabled(false);
+        Button button_ok = (Button) findViewById(R.id.button_ok);
+        button_ok.setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View view) {
+                returnFromActivity();
+            }
+        });
+    }
+
+    private void returnFromActivity() {
+        Intent data = new Intent();
+        Activity parent = getParent();
+        if (parent == null) {
+            setResult(Activity.RESULT_OK, data);
+        } else {
+            parent.setResult(Activity.RESULT_OK, data);
+        }
+        finish();
+    }
+
+}
diff --git a/appveyor.yml b/appveyor.yml
index 6c0470d1..f663c86a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,4 +1,4 @@
-version: 2.17.{build}
+version: 2.18.{build}
 pull_requests:
   do_not_increment_build_number: true
 branches:
@@ -17,8 +17,8 @@ environment:
   - MSYSTEM: MINGW32
 
 install:
-- c:\msys64\usr\bin\bash -lc "pacman --noconfirm -Rns gcc-fortran gcc"
-- c:\msys64\usr\bin\bash -lc "pacman --noconfirm -Syuu"
+- c:\msys64\usr\bin\bash -lc "pacman --noconfirm -Rns gcc-fortran gcc catgets"
+- c:\msys64\usr\bin\bash -lc "pacman --noconfirm -Syuu "
 
 - c:\msys64\usr\bin\bash -lc "pacman --noconfirm -Syuu"
 
diff --git a/build/CMakeLists.txt b/build/CMakeLists.txt
index 4d462700..364c3304 100644
--- a/build/CMakeLists.txt
+++ b/build/CMakeLists.txt
@@ -39,6 +39,7 @@ include_directories(${LIBI2PD_CLIENT_SRC_DIR})
 set (LIBI2PD_SRC
   "${LIBI2PD_SRC_DIR}/BloomFilter.cpp"
   "${LIBI2PD_SRC_DIR}/Config.cpp"
+  "${LIBI2PD_SRC_DIR}/CPU.cpp"  
   "${LIBI2PD_SRC_DIR}/Crypto.cpp"
   "${LIBI2PD_SRC_DIR}/CryptoKey.cpp"
   "${LIBI2PD_SRC_DIR}/Garlic.cpp"
@@ -96,6 +97,7 @@ set_target_properties(libi2pd PROPERTIES PREFIX "")
 install(TARGETS libi2pd
   EXPORT libi2pd
   ARCHIVE DESTINATION lib
+  LIBRARY DESTINATION lib
   COMPONENT Libraries)
 # TODO Make libi2pd available to 3rd party projects via CMake as imported target
 # FIXME This pulls stdafx
@@ -118,7 +120,13 @@ set (CLIENT_SRC
 if(WITH_WEBSOCKETS)
   list (APPEND CLIENT_SRC "${LIBI2PD_CLIENT_SRC_DIR}/Websocket.cpp")
 endif ()
-add_library(i2pdclient ${CLIENT_SRC})
+add_library(libi2pdclient ${CLIENT_SRC})
+set_target_properties(libi2pdclient PROPERTIES PREFIX "")
+install(TARGETS libi2pdclient
+  EXPORT libi2pdclient
+  ARCHIVE DESTINATION lib
+  LIBRARY DESTINATION lib
+  COMPONENT Libraries)
 
 set(DAEMON_SRC_DIR ../daemon)
 
@@ -184,6 +192,8 @@ if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
 elseif (CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
   # more tweaks
   if (NOT (MSVC OR MSYS OR APPLE))
+    set (CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -stdlib=libstdc++" ) # required for <atomic>
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "stdc++") # required to link with -stdlib=libstdc++
     set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-unused-const-variable -Wno-overloaded-virtual -Wno-c99-extensions" )
   endif()
 endif ()
@@ -257,8 +267,6 @@ if(THREADS_HAVE_PTHREAD_ARG) # compile time flag
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread")
 endif()
 
-include(CheckLibcxxAtomic)
-
 if (WITH_STATIC)
   set(Boost_USE_STATIC_LIBS ON)
   set(Boost_USE_STATIC_RUNTIME ON)
@@ -302,7 +310,7 @@ if (WITH_PCH)
       WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
       )
     target_compile_options(libi2pd PRIVATE /FIstdafx.h /Yustdafx.h /Zm155 "/Fp${CMAKE_BINARY_DIR}/stdafx.dir/$<CONFIG>/stdafx.pch")
-    target_compile_options(i2pdclient PRIVATE /FIstdafx.h /Yustdafx.h /Zm155 "/Fp${CMAKE_BINARY_DIR}/stdafx.dir/$<CONFIG>/stdafx.pch")
+    target_compile_options(libi2pdclient PRIVATE /FIstdafx.h /Yustdafx.h /Zm155 "/Fp${CMAKE_BINARY_DIR}/stdafx.dir/$<CONFIG>/stdafx.pch")
   else()
     string(TOUPPER ${CMAKE_BUILD_TYPE} BTU)
     get_directory_property(DEFS DEFINITIONS)
@@ -311,12 +319,12 @@ if (WITH_PCH)
       COMMAND ${CMAKE_CXX_COMPILER} ${FLAGS} -c ${CMAKE_CURRENT_SOURCE_DIR}/../libi2pd/stdafx.h -o ${CMAKE_BINARY_DIR}/stdafx.h.gch
     )
     target_compile_options(libi2pd PRIVATE -include libi2pd/stdafx.h)
-    target_compile_options(i2pdclient PRIVATE -include libi2pd/stdafx.h)
+    target_compile_options(libi2pdclient PRIVATE -include libi2pd/stdafx.h)
   endif()
   target_link_libraries(libi2pd stdafx)
 endif()
 
-target_link_libraries(i2pdclient libi2pd)
+target_link_libraries(libi2pdclient libi2pd)
 
 find_package ( Boost COMPONENTS system filesystem program_options date_time REQUIRED )
 if(NOT DEFINED Boost_INCLUDE_DIRS)
@@ -326,10 +334,6 @@ endif()
 find_package ( OpenSSL REQUIRED )
 if(NOT DEFINED OPENSSL_INCLUDE_DIR)
   message(SEND_ERROR "Could not find OpenSSL. Please download and install it first!")
-else()
-  if(NOT (OPENSSL_VERSION VERSION_LESS 1.1))
-    message(WARNING "Your OpenSSL version ${OPENSSL_VERSION} >=1.1 is experimental: build with v1.0 when possible.")
-  endif()
 endif()
 
 if (WITH_UPNP)
@@ -384,11 +388,7 @@ if (WITH_MESHNET)
   message(WARNING "This build will NOT work on mainline i2p")
 endif()
 
-if (ARCHITECTURE MATCHES "arm")
-  set(ATOMIC_LIB -latomic)
-else()
-  set(ATMOIC_LIB "")
-endif()
+include(CheckAtomic)
 
 
 # show summary
@@ -457,7 +457,7 @@ if (WITH_BINARY)
   if (WITH_STATIC)
     set(DL_LIB ${CMAKE_DL_LIBS})
   endif()
-  target_link_libraries( "${PROJECT_NAME}" libi2pd i2pdclient ${DL_LIB} ${Boost_LIBRARIES} ${OPENSSL_LIBRARIES} ${ZLIB_LIBRARY} ${CMAKE_THREAD_LIBS_INIT} ${MINGW_EXTRA} ${DL_LIB} ${ATOMIC_LIB})
+  target_link_libraries( "${PROJECT_NAME}" libi2pd libi2pdclient ${DL_LIB} ${Boost_LIBRARIES} ${OPENSSL_LIBRARIES} ${ZLIB_LIBRARY} ${CMAKE_THREAD_LIBS_INIT} ${MINGW_EXTRA} ${DL_LIB} ${CMAKE_REQUIRED_LIBRARIES})
 
   install(TARGETS "${PROJECT_NAME}" RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT Runtime)
   set (APPS "\${CMAKE_INSTALL_PREFIX}/bin/${PROJECT_NAME}${CMAKE_EXECUTABLE_SUFFIX}")
diff --git a/build/build_mingw.cmd b/build/build_mingw.cmd
index 6763b63e..cc6a15fa 100644
--- a/build/build_mingw.cmd
+++ b/build/build_mingw.cmd
@@ -58,6 +58,7 @@ pause
 exit /b 0
 
 :BUILDING
+%xSH% "make clean" >> nul
 echo Building i2pd %tag% for win%bitness%:
 echo Build AVX+AESNI...
 %xSH% "make USE_UPNP=yes USE_AVX=1 USE_AESNI=1 -j%threads% && zip -r9 build/i2pd_%tag%_win%bitness%_mingw_avx_aesni.zip i2pd.exe README.txt contrib/i2pd.conf contrib/tunnels.conf contrib/certificates && make clean" > build/build_win%bitness%_avx_aesni.log 2>&1
diff --git a/build/cmake_modules/CheckAtomic.cmake b/build/cmake_modules/CheckAtomic.cmake
new file mode 100644
index 00000000..b8296a1c
--- /dev/null
+++ b/build/cmake_modules/CheckAtomic.cmake
@@ -0,0 +1,106 @@
+# atomic builtins are required for threading support.
+
+INCLUDE(CheckCXXSourceCompiles)
+
+# Sometimes linking against libatomic is required for atomic ops, if
+# the platform doesn't support lock-free atomics.
+
+function(check_working_cxx_atomics varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  set(CMAKE_REQUIRED_FLAGS "-std=c++11")
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+std::atomic<int> x;
+int main() {
+  return x;
+}
+" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics)
+
+function(check_working_cxx_atomics64 varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  set(CMAKE_REQUIRED_FLAGS "-std=c++11 ${CMAKE_REQUIRED_FLAGS}")
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+#include <cstdint>
+std::atomic<uint64_t> x (0);
+int main() {
+  uint64_t i = x.load(std::memory_order_relaxed);
+  return 0;
+}
+" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics64)
+
+
+# This isn't necessary on MSVC, so avoid command-line switch annoyance
+# by only running on GCC-like hosts.
+if (LLVM_COMPILER_IS_GCC_COMPATIBLE)
+  # First check if atomics work without the library.
+  check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITHOUT_LIB)
+  # If not, check if the library exists, and atomics work with it.
+  if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB)
+    check_library_exists(atomic __atomic_fetch_add_4 "" HAVE_LIBATOMIC)
+    if( HAVE_LIBATOMIC )
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+      check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITH_LIB)
+      if (NOT HAVE_CXX_ATOMICS_WITH_LIB)
+        message(FATAL_ERROR "Host compiler must support std::atomic!")
+      endif()
+    else()
+      message(FATAL_ERROR "Host compiler appears to require libatomic, but cannot find it.")
+    endif()
+  endif()
+endif()
+
+# Check for 64 bit atomic operations.
+if(MSVC)
+  set(HAVE_CXX_ATOMICS64_WITHOUT_LIB True)
+else()
+  check_working_cxx_atomics64(HAVE_CXX_ATOMICS64_WITHOUT_LIB)
+endif()
+
+# If not, check if the library exists, and atomics work with it.
+if(NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB)
+  check_library_exists(atomic __atomic_load_8 "" HAVE_CXX_LIBATOMICS64)
+  if(HAVE_CXX_LIBATOMICS64)
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+    check_working_cxx_atomics64(HAVE_CXX_ATOMICS64_WITH_LIB)
+    if (NOT HAVE_CXX_ATOMICS64_WITH_LIB)
+      message(FATAL_ERROR "Host compiler must support std::atomic!")
+    endif()
+  else()
+    message(FATAL_ERROR "Host compiler appears to require libatomic, but cannot find it.")
+  endif()
+endif()
+
+## TODO: This define is only used for the legacy atomic operations in
+## llvm's Atomic.h, which should be replaced.  Other code simply
+## assumes C++11 <atomic> works.
+CHECK_CXX_SOURCE_COMPILES("
+#ifdef _MSC_VER
+#include <Intrin.h> /* Workaround for PR19898. */
+#include <windows.h>
+#endif
+int main() {
+#ifdef _MSC_VER
+        volatile LONG val = 1;
+        MemoryBarrier();
+        InterlockedCompareExchange(&val, 0, 1);
+        InterlockedIncrement(&val);
+        InterlockedDecrement(&val);
+#else
+        volatile unsigned long val = 1;
+        __sync_synchronize();
+        __sync_val_compare_and_swap(&val, 1, 0);
+        __sync_add_and_fetch(&val, 1);
+        __sync_sub_and_fetch(&val, 1);
+#endif
+        return 0;
+      }
+" LLVM_HAS_ATOMICS)
+
+if( NOT LLVM_HAS_ATOMICS )
+  message(STATUS "Warning: LLVM will be built thread-unsafe because atomic builtins are missing")
+endif()
diff --git a/build/cmake_modules/CheckLibcxxAtomic.cmake b/build/cmake_modules/CheckLibcxxAtomic.cmake
deleted file mode 100644
index a7ae667a..00000000
--- a/build/cmake_modules/CheckLibcxxAtomic.cmake
+++ /dev/null
@@ -1,47 +0,0 @@
-INCLUDE(CheckCXXSourceCompiles)
-
-# Sometimes linking against libatomic is required for atomic ops, if
-# the platform doesn't support lock-free atomics.
-#
-# We could modify LLVM's CheckAtomic module and have it check for 64-bit
-# atomics instead. However, we would like to avoid careless uses of 64-bit
-# atomics inside LLVM over time on 32-bit platforms.
-
-function(check_cxx_atomics varname)
-  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS "-nodefaultlibs -std=c++11 -nostdinc++ -isystem ${LIBCXX_SOURCE_DIR}/include")
-  if (${LIBCXX_GCC_TOOLCHAIN})
-    set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} --gcc-toolchain=${LIBCXX_GCC_TOOLCHAIN}")
-  endif()
-  if (CMAKE_C_FLAGS MATCHES -fsanitize OR CMAKE_CXX_FLAGS MATCHES -fsanitize)
-    set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -fno-sanitize=all")
-  endif()
-  if (CMAKE_C_FLAGS MATCHES -fsanitize-coverage OR CMAKE_CXX_FLAGS MATCHES -fsanitize-coverage)
-    set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -fno-sanitize-coverage=edge,trace-cmp,indirect-calls,8bit-counters")
-  endif()
-  check_cxx_source_compiles("
-#include <cstdint>
-#include <atomic>
-std::atomic<uintptr_t> x;
-std::atomic<uintmax_t> y;
-int main() {
-  return x + y;
-}
-" ${varname})
-  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
-endfunction(check_cxx_atomics)
-
-check_cxx_atomics(LIBCXX_HAVE_CXX_ATOMICS_WITHOUT_LIB)
-check_library_exists(atomic __atomic_fetch_add_8 "" LIBCXX_HAS_ATOMIC_LIB)
-# If not, check if the library exists, and atomics work with it.
-if(NOT LIBCXX_HAVE_CXX_ATOMICS_WITHOUT_LIB)
-  if(LIBCXX_HAS_ATOMIC_LIB)
-    list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
-    check_cxx_atomics(LIBCXX_HAVE_CXX_ATOMICS_WITH_LIB)
-    if (NOT LIBCXX_HAVE_CXX_ATOMICS_WITH_LIB)
-      message(WARNING "Host compiler must support std::atomic!")
-    endif()
-  else()
-    message(WARNING "Host compiler appears to require libatomic, but cannot find it.")
-  endif()
-endif()
diff --git a/contrib/apparmor/usr.sbin.i2pd b/contrib/apparmor/usr.sbin.i2pd
index f0dea839..4349e07b 100644
--- a/contrib/apparmor/usr.sbin.i2pd
+++ b/contrib/apparmor/usr.sbin.i2pd
@@ -21,10 +21,14 @@
 
   # path specific (feel free to modify if you have another paths)
   /etc/i2pd/** r,
+  /run/i2pd/i2pd.pid rw,
   /var/lib/i2pd/** rw,
-  /var/log/i2pd.log w,
+  /var/log/i2pd/i2pd.log w,
   /var/run/i2pd/i2pd.pid rw,
   /usr/sbin/i2pd mr,
+  /usr/share/i2pd/** r,
 
-
+  # user homedir (if started not by init.d or systemd)
+  owner @{HOME}/.i2pd/   rw,
+  owner @{HOME}/.i2pd/** rwk,
 }
diff --git a/contrib/debian/i2pd.service b/contrib/debian/i2pd.service
deleted file mode 100644
index 89562ff5..00000000
--- a/contrib/debian/i2pd.service
+++ /dev/null
@@ -1,27 +0,0 @@
-[Unit]
-Description=I2P Router written in C++
-After=network.target
-
-[Service]
-User=i2pd
-Group=i2pd
-RuntimeDirectory=i2pd
-RuntimeDirectoryMode=0700
-Type=simple
-ExecStart=/usr/sbin/i2pd --conf=/etc/i2pd/i2pd.conf --pidfile=/var/run/i2pd/i2pd.pid --logfile=/var/log/i2pd/i2pd.log --daemon --service
-ExecReload=/bin/kill -HUP $MAINPID
-PIDFile=/var/run/i2pd/i2pd.pid
-### Uncomment, if auto restart needed
-#Restart=on-failure
-
-### Use SIGINT for graceful stop daemon.
-# i2pd stops accepting new tunnels and waits ~10 min while old ones do not die.
-KillSignal=SIGINT
-TimeoutStopSec=10m
-
-# If you have problems with hunging i2pd, you can try enable this
-#LimitNOFILE=4096
-PrivateDevices=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/contrib/debian/i2pd.service b/contrib/debian/i2pd.service
new file mode 120000
index 00000000..ca477e3b
--- /dev/null
+++ b/contrib/debian/i2pd.service
@@ -0,0 +1 @@
+../i2pd.service
\ No newline at end of file
diff --git a/contrib/docker/Dockerfile b/contrib/docker/Dockerfile
index 5ca03f4c..e7e60f37 100644
--- a/contrib/docker/Dockerfile
+++ b/contrib/docker/Dockerfile
@@ -35,7 +35,7 @@ RUN apk --no-cache --virtual build-dependendencies add make gcc g++ libtool boos
     && mv i2pd /usr/local/bin \
     && cd /usr/local/bin \
     && strip i2pd \
-    && rm -fr /tmp/build && apk --purge del build-dependendencies build-base fortify-headers boost-dev zlib-dev openssl-dev \
+    && rm -fr /tmp/build && apk --no-cache --purge del build-dependendencies build-base fortify-headers boost-dev zlib-dev openssl-dev \
     boost-python3 python3 gdbm boost-unit_test_framework boost-python linux-headers boost-prg_exec_monitor \
     boost-serialization boost-signals boost-wave boost-wserialization boost-math boost-graph boost-regex git pcre \
     libtool g++ gcc pkgconfig
diff --git a/contrib/i2pd.service b/contrib/i2pd.service
new file mode 100644
index 00000000..9af96c37
--- /dev/null
+++ b/contrib/i2pd.service
@@ -0,0 +1,31 @@
+[Unit]
+Description=I2P Router written in C++
+Documentation=man:i2pd(1) https://i2pd.readthedocs.io/en/latest/
+After=network.target
+
+[Service]
+User=i2pd
+Group=i2pd
+RuntimeDirectory=i2pd
+RuntimeDirectoryMode=0700
+LogsDirectory=i2pd
+LogsDirectoryMode=0700
+Type=simple
+ExecStart=/usr/sbin/i2pd --conf=/etc/i2pd/i2pd.conf --tunconf=/etc/i2pd/tunnels.conf --pidfile=/var/run/i2pd/i2pd.pid --logfile=/var/log/i2pd/i2pd.log --daemon --service
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/var/run/i2pd/i2pd.pid
+### Uncomment, if auto restart needed
+#Restart=on-failure
+
+KillSignal=SIGQUIT
+# If you have the patience waiting 10 min on restarting/stopping it, uncomment this.
+# i2pd stops accepting new tunnels and waits ~10 min while old ones do not die.
+#KillSignal=SIGINT
+#TimeoutStopSec=10m
+
+# If you have problems with hanging i2pd, you can try enable this
+#LimitNOFILE=4096
+PrivateDevices=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/contrib/rpm/i2pd-git.spec b/contrib/rpm/i2pd-git.spec
new file mode 100644
index 00000000..6e02779d
--- /dev/null
+++ b/contrib/rpm/i2pd-git.spec
@@ -0,0 +1,102 @@
+%define git_hash %(git rev-parse HEAD | cut -c -7)
+
+Name:           i2pd-git
+Version:        2.18.0
+Release:        git%{git_hash}%{?dist}
+Summary:        I2P router written in C++
+Conflicts:      i2pd
+
+License:        BSD
+URL:            https://github.com/PurpleI2P/i2pd
+Source0:        https://github.com/PurpleI2P/i2pd/archive/openssl/i2pd-openssl.tar.gz
+
+%if 0%{?rhel}  == 7
+BuildRequires:  cmake3
+%else
+BuildRequires:  cmake
+%endif
+
+BuildRequires:  chrpath
+BuildRequires:  gcc-c++
+BuildRequires:  zlib-devel
+BuildRequires:  boost-devel
+BuildRequires:  openssl-devel
+BuildRequires:  miniupnpc-devel
+BuildRequires:  systemd-units
+
+Requires:	systemd
+Requires(pre):  %{_sbindir}/useradd %{_sbindir}/groupadd
+
+%description
+C++ implementation of I2P.
+
+%prep
+%setup -q
+
+
+%build
+cd build
+%if 0%{?rhel} == 7
+%cmake3 \
+    -DWITH_LIBRARY=OFF \
+    -DWITH_UPNP=ON \
+    -DWITH_HARDENING=ON \
+    -DBUILD_SHARED_LIBS:BOOL=OFF
+%else
+%cmake \
+    -DWITH_LIBRARY=OFF \
+    -DWITH_UPNP=ON \
+    -DWITH_HARDENING=ON \
+    -DBUILD_SHARED_LIBS:BOOL=OFF
+%endif
+
+make %{?_smp_mflags}
+
+
+%install
+cd build
+chrpath -d i2pd
+install -D -m 755 i2pd %{buildroot}%{_sbindir}/i2pd
+install -D -m 755 %{_builddir}/%{name}-%{version}/contrib/i2pd.conf %{buildroot}%{_sysconfdir}/i2pd/i2pd.conf
+install -D -m 755 %{_builddir}/%{name}-%{version}/contrib/tunnels.conf %{buildroot}%{_sysconfdir}/i2pd/tunnels.conf
+install -d -m 755 %{buildroot}%{_datadir}/i2pd
+%{__cp} -r %{_builddir}/%{name}-%{version}/contrib/certificates/ %{buildroot}%{_datadir}/i2pd/certificates
+install -D -m 644 %{_builddir}/%{name}-%{version}/contrib/rpm/i2pd.service %{buildroot}%{_unitdir}/i2pd.service
+install -d -m 700 %{buildroot}%{_sharedstatedir}/i2pd
+install -d -m 700 %{buildroot}%{_localstatedir}/log/i2pd
+ln -s %{_datadir}/%{name}/certificates %{buildroot}%{_sharedstatedir}/i2pd/certificates
+
+
+%pre
+getent group i2pd >/dev/null || %{_sbindir}/groupadd -r i2pd
+getent passwd i2pd >/dev/null || \
+  %{_sbindir}/useradd -r -g i2pd -s %{_sbindir}/nologin \
+                      -d %{_sharedstatedir}/i2pd -c 'I2P Service' i2pd
+
+
+%post
+%systemd_post i2pd.service
+
+
+%preun
+%systemd_preun i2pd.service
+
+
+%postun
+%systemd_postun_with_restart i2pd.service
+
+
+%files
+%doc LICENSE README.md
+%{_sbindir}/i2pd
+%{_datadir}/i2pd/certificates
+%config(noreplace) %{_sysconfdir}/i2pd/*
+/%{_unitdir}/i2pd.service
+%dir %attr(0700,i2pd,i2pd) %{_localstatedir}/log/i2pd
+%dir %attr(0700,i2pd,i2pd) %{_sharedstatedir}/i2pd
+%{_sharedstatedir}/i2pd/certificates
+
+
+%changelog
+* Thu Feb 01 2018 r4sas <r4sas@i2pmail.org> - 2.18.0
+- Initial i2pd-git based on i2pd 2.18.0-1 spec
\ No newline at end of file
diff --git a/contrib/rpm/i2pd.service b/contrib/rpm/i2pd.service
deleted file mode 100644
index b14af025..00000000
--- a/contrib/rpm/i2pd.service
+++ /dev/null
@@ -1,16 +0,0 @@
-[Unit]
-Description=I2P router
-After=network.target
-
-[Service]
-User=i2pd
-Group=i2pd
-Type=simple
-ExecStart=/usr/bin/i2pd --service
-PIDFile=/var/lib/i2pd/i2pd.pid
-Restart=always
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-
diff --git a/contrib/rpm/i2pd.service b/contrib/rpm/i2pd.service
new file mode 120000
index 00000000..ca477e3b
--- /dev/null
+++ b/contrib/rpm/i2pd.service
@@ -0,0 +1 @@
+../i2pd.service
\ No newline at end of file
diff --git a/contrib/rpm/i2pd.spec b/contrib/rpm/i2pd.spec
index 0b6fa463..22c31192 100644
--- a/contrib/rpm/i2pd.spec
+++ b/contrib/rpm/i2pd.spec
@@ -1,9 +1,8 @@
-%define build_timestamp %(date +"%Y%m%d")
-
 Name:           i2pd
-Version:        2.17.0
-Release:        %{build_timestamp}git%{?dist}
+Version:        2.18.0
+Release:        2%{?dist}
 Summary:        I2P router written in C++
+Conflicts:      i2pd-git
 
 License:        BSD
 URL:            https://github.com/PurpleI2P/i2pd
@@ -23,25 +22,12 @@ BuildRequires:  openssl-devel
 BuildRequires:  miniupnpc-devel
 BuildRequires:  systemd-units
 
-%description
-C++ implementation of I2P.
-
-
-%package systemd
-Summary:        Files to run I2P router under systemd
-Requires:	i2pd
 Requires:	systemd
 Requires(pre):  %{_sbindir}/useradd %{_sbindir}/groupadd
-Obsoletes:      %{name}-daemon
-
 
-%description systemd
+%description
 C++ implementation of I2P.
 
-This package contains systemd unit file to run i2pd as a system service
-using dedicated user's permissions.
-
-
 %prep
 %setup -q
 
@@ -68,114 +54,84 @@ make %{?_smp_mflags}
 %install
 cd build
 chrpath -d i2pd
-install -D -m 755 i2pd %{buildroot}%{_bindir}/i2pd
-install -D -m 644 %{_builddir}/%{name}-%{version}/contrib/rpm/i2pd.service %{buildroot}/%{_unitdir}/i2pd.service
-install -d -m 700 %{buildroot}/%{_sharedstatedir}/i2pd
-
-
-%pre systemd
+install -D -m 755 i2pd %{buildroot}%{_sbindir}/i2pd
+install -D -m 755 %{_builddir}/%{name}-%{version}/contrib/i2pd.conf %{buildroot}%{_sysconfdir}/i2pd/i2pd.conf
+install -D -m 755 %{_builddir}/%{name}-%{version}/contrib/tunnels.conf %{buildroot}%{_sysconfdir}/i2pd/tunnels.conf
+install -d -m 755 %{buildroot}%{_datadir}/i2pd
+%{__cp} -r %{_builddir}/%{name}-%{version}/contrib/certificates/ %{buildroot}%{_datadir}/i2pd/certificates
+install -D -m 644 %{_builddir}/%{name}-%{version}/contrib/rpm/i2pd.service %{buildroot}%{_unitdir}/i2pd.service
+install -d -m 700 %{buildroot}%{_sharedstatedir}/i2pd
+install -d -m 700 %{buildroot}%{_localstatedir}/log/i2pd
+ln -s %{_datadir}/%{name}/certificates %{buildroot}%{_sharedstatedir}/i2pd/certificates
+
+
+%pre
 getent group i2pd >/dev/null || %{_sbindir}/groupadd -r i2pd
 getent passwd i2pd >/dev/null || \
   %{_sbindir}/useradd -r -g i2pd -s %{_sbindir}/nologin \
                       -d %{_sharedstatedir}/i2pd -c 'I2P Service' i2pd
 
 
-%post systemd
+%post
 %systemd_post i2pd.service
 
 
-%preun systemd
+%preun
 %systemd_preun i2pd.service
 
 
-%postun systemd
+%postun
 %systemd_postun_with_restart i2pd.service
 
 
 %files
 %doc LICENSE README.md
-%_bindir/i2pd
+%{_sbindir}/i2pd
+%{_datadir}/i2pd/certificates
+%config(noreplace) %{_sysconfdir}/i2pd/*
+/%{_unitdir}/i2pd.service
+%dir %attr(0700,i2pd,i2pd) %{_localstatedir}/log/i2pd
+%dir %attr(0700,i2pd,i2pd) %{_sharedstatedir}/i2pd
+%{_sharedstatedir}/i2pd/certificates
 
 
-%files systemd
-/%_unitdir/i2pd.service
-%dir %attr(0700,i2pd,i2pd) %_sharedstatedir/i2pd
+%changelog
+* Mon Feb 05 2018 r4sas <r4sas@i2pmail.org> - 2.18.0-2
+- Fixed blocking system shutdown for 10 minutes (#1089)
 
+* Thu Feb 01 2018 r4sas <r4sas@i2pmail.org> - 2.18.0-1
+- Added to conflicts i2pd-git package
+- Fixed release versioning
+- Fixed paths with double slashes
+
+* Tue Jan 30 2018 orignal <i2porignal@yandex.ru> - 2.18.0
+- update to 2.18.0
+
+* Sat Jan 27 2018 l-n-s <supervillain@riseup.net> - 2.17.0-1
+- Added certificates and default configuration files
+- Merge i2pd with i2pd-systemd package
+- Fixed package changelogs to comply with guidelines
 
-%changelog
 * Mon Dec 04 2017 orignal <i2porignal@yandex.ru> - 2.17.0
-- Added reseed through HTTP and SOCKS proxy
-- Added show status of client services through web console
-- Added change log level through web connsole
-- Added transient keys for tunnels
-- Added i2p.streaming.initialAckDelay parameter
-- Added CRYPTO_TYPE for SAM destination
-- Added signature and crypto type for newkeys BOB command
-- Changed - correct publication of ECIES destinations
-- Changed - disable RSA signatures completely
-- Fixed CVE-2017-17066
-- Fixed possible buffer overflow for RSA-4096
-- Fixed shutdown from web console for Windows
-- Fixed web console page layout
+- update to 2.17.0
 
 * Mon Nov 13 2017 orignal <i2porignal@yandex.ru> - 2.16.0
-- Added https and "Connect" method for HTTP proxy
-- Added outproxy for HTTP proxy
-- Added initial support of ECIES crypto
-- Added NTCP soft and hard descriptors limits
-- Added support full timestamps in logs
-- Changed faster implmentation of GOST R 34.11 hash
-- Changed reject routers with RSA signtures
-- Changed reload config and shudown from Windows GUI
-- Changed update tunnels address(destination) without restart
-- Fixed BOB crashes if destination is not set
-- Fixed correct SAM tunnel name
-- Fixed QT GUI issues
+- update to 2.16.0
 
 * Thu Aug 17 2017 orignal <i2porignal@yandex.ru> - 2.15.0
-- Added QT GUI
-- Added ability add and remove I2P tunnels without restart
-- Added ability to disable SOCKS outproxy option
-- Changed strip-out Accept-* hedaers in HTTP proxy
-- Changed peer test if nat=false
-- Changed separate output of NTCP and SSU sessions in Transports tab
-- Fixed handle lines with comments in hosts.txt file for address book
-- Fixed run router with empty netdb for testnet
-- Fixed skip expired introducers by iexp
+- update to 2.15.0
 
 * Thu Jun 01 2017 orignal <i2porignal@yandex.ru> - 2.14.0
-- Added transit traffic bandwidth limitation
-- Added NTCP connections through HTTP and SOCKS proxies
-- Added ability to disable address helper for HTTP proxy
-- Changed reseed servers list
+- update to 2.14.0
 
 * Thu Apr 06 2017 orignal <i2porignal@yandex.ru> - 2.13.0
-- Added persist local destination's tags
-- Added GOST signature types 9 and 10
-- Added exploratory tunnels configuration
-- Changed reseed servers list
-- Changed inactive NTCP sockets get closed faster
-- Changed some EdDSA speed up
-- Fixed multiple acceptors for SAM
-- Fixed follow on data after STREAM CREATE for SAM
-- Fixed memory leaks
+- update to 2.13.0
 
 * Tue Feb 14 2017 orignal <i2porignal@yandex.ru> - 2.12.0
-- Additional HTTP and SOCKS proxy tunnels
-- Reseed from ZIP archive
-- 'X' bandwidth code
-- Reduced memory and file descriptors usage
+- update to 2.12.0
 
 * Mon Dec 19 2016 orignal <i2porignal@yandex.ru> - 2.11.0
-- Full support of zero-hops tunnels
-- Tunnel configuration for HTTP and SOCKS proxy
-- Websockets support
-- Multiple acceptors for SAM destination
-- Routing path for UDP tunnels
-- Reseed through a floodfill
-- Use AVX instructions for DHT and HMAC if applicable
-- Fixed UPnP discovery bug, producing excessive CPU usage
-- Handle multiple lookups of the same LeaseSet correctly
+- update to 2.11.0
 
 * Thu Oct 20 2016 Anatolii Vorona <vorona.tolik@gmail.com> - 2.10.0-3
 - add support C7
diff --git a/daemon/Daemon.cpp b/daemon/Daemon.cpp
index 54146d5d..d077644d 100644
--- a/daemon/Daemon.cpp
+++ b/daemon/Daemon.cpp
@@ -119,12 +119,6 @@ namespace i2p
 			}
 
 			LogPrint(eLogInfo,	"i2pd v", VERSION, " starting");
-#ifdef AESNI
-			LogPrint(eLogInfo,	"AESNI enabled");
-#endif
-#if defined(__AVX__)
-			LogPrint(eLogInfo,	"AVX enabled");
-#endif
 			LogPrint(eLogDebug, "FS: main config file: ", config);
 			LogPrint(eLogDebug, "FS: data directory: ", datadir);
 
diff --git a/daemon/HTTPServer.cpp b/daemon/HTTPServer.cpp
index 017bc8a4..6f884a9b 100644
--- a/daemon/HTTPServer.cpp
+++ b/daemon/HTTPServer.cpp
@@ -733,8 +733,9 @@ namespace http {
 		}
 	}
 
-	HTTPConnection::HTTPConnection (std::shared_ptr<boost::asio::ip::tcp::socket> socket):
-		m_Socket (socket), m_Timer (socket->get_io_service ()), m_BufferLen (0)
+	HTTPConnection::HTTPConnection (std::string hostname, std::shared_ptr<boost::asio::ip::tcp::socket> socket):
+		m_Socket (socket), m_Timer (socket->get_io_service ()), m_BufferLen (0),
+		expected_host(hostname)
 	{
 		/* cache options */
 		i2p::config::GetOption("http.auth", needAuth);
@@ -833,7 +834,28 @@ namespace http {
 			SendReply(res, content);
 			return;
 		}
-
+		bool strictheaders;
+		i2p::config::GetOption("http.strictheaders", strictheaders);
+		if (strictheaders)
+		{
+			std::string http_hostname;
+			i2p::config::GetOption("http.hostname", http_hostname);
+			std::string host = req.GetHeader("Host");
+			auto idx = host.find(':');
+			/* strip out port so it's just host */
+			if (idx != std::string::npos && idx > 0)
+			{
+				host = host.substr(0, idx);
+			}
+			if (!(host == expected_host || host == http_hostname))
+			{
+				/* deny request as it's from a non whitelisted hostname */
+				res.code = 403;
+				content = "host missmatch";
+				SendReply(res, content);
+				return;
+			}
+		}
 		// Html5 head start
 		ShowPageHead (s);
 		if (req.uri.find("page=") != std::string::npos) {
@@ -976,7 +998,8 @@ namespace http {
 
 	HTTPServer::HTTPServer (const std::string& address, int port):
 		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service),
-		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::address::from_string(address), port))
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::address::from_string(address), port)),
+		m_Hostname(address)
 	{
 	}
 
@@ -1061,7 +1084,7 @@ namespace http {
 
 	void HTTPServer::CreateConnection(std::shared_ptr<boost::asio::ip::tcp::socket> newSocket)
 	{
-		auto conn = std::make_shared<HTTPConnection> (newSocket);
+		auto conn = std::make_shared<HTTPConnection> (m_Hostname, newSocket);
 		conn->Receive ();
 	}
 } // http
diff --git a/daemon/HTTPServer.h b/daemon/HTTPServer.h
index f1ca10fc..46477dae 100644
--- a/daemon/HTTPServer.h
+++ b/daemon/HTTPServer.h
@@ -21,7 +21,7 @@ namespace http
 	{
 		public:
 
-			HTTPConnection (std::shared_ptr<boost::asio::ip::tcp::socket> socket);
+			HTTPConnection (std::string serverhost, std::shared_ptr<boost::asio::ip::tcp::socket> socket);
 			void Receive ();
 
 		private:
@@ -46,6 +46,7 @@ namespace http
 			bool needAuth;
 			std::string user;
 			std::string pass;
+			std::string expected_host;
 
 			static std::map<uint32_t, uint32_t> m_Tokens; // token->timestamp in seconds
 	};
@@ -75,6 +76,7 @@ namespace http
 			boost::asio::io_service m_Service;
 			boost::asio::io_service::work m_Work;
 			boost::asio::ip::tcp::acceptor m_Acceptor;
+			std::string m_Hostname;
 	};
 
     //all the below functions are also used by Qt GUI, see mainwindow.cpp -> getStatusPageHtml
diff --git a/daemon/I2PControl.cpp b/daemon/I2PControl.cpp
index 494ea026..fcff78cd 100644
--- a/daemon/I2PControl.cpp
+++ b/daemon/I2PControl.cpp
@@ -65,6 +65,7 @@ namespace client
 		m_MethodHandlers["RouterInfo"]     = &I2PControlService::RouterInfoHandler;
 		m_MethodHandlers["RouterManager"]  = &I2PControlService::RouterManagerHandler;
 		m_MethodHandlers["NetworkSetting"] = &I2PControlService::NetworkSettingHandler;
+		m_MethodHandlers["ClientServicesInfo"]     = &I2PControlService::ClientServicesInfoHandler;
 
 		// I2PControl
 		m_I2PControlHandlers["i2pcontrol.password"] = &I2PControlService::PasswordHandler;
@@ -92,6 +93,14 @@ namespace client
 		// NetworkSetting
 		m_NetworkSettingHandlers["i2p.router.net.bw.in"]  = &I2PControlService::InboundBandwidthLimit;
 		m_NetworkSettingHandlers["i2p.router.net.bw.out"] = &I2PControlService::OutboundBandwidthLimit;
+
+		// ClientServicesInfo
+		m_ClientServicesInfoHandlers["I2PTunnel"] = &I2PControlService::I2PTunnelInfoHandler;
+		m_ClientServicesInfoHandlers["HTTPProxy"] = &I2PControlService::HTTPProxyInfoHandler;
+		m_ClientServicesInfoHandlers["SOCKS"] = &I2PControlService::SOCKSInfoHandler;
+		m_ClientServicesInfoHandlers["SAM"] = &I2PControlService::SAMInfoHandler;
+		m_ClientServicesInfoHandlers["BOB"] = &I2PControlService::BOBInfoHandler;
+		m_ClientServicesInfoHandlers["I2CP"] = &I2PControlService::I2CPInfoHandler;
 	}
 
 	I2PControlService::~I2PControlService ()
@@ -289,6 +298,13 @@ namespace client
 		ss << "\"" << name << "\":" << std::fixed << std::setprecision(2) << value;
 	}
 
+	void I2PControlService::InsertParam (std::ostringstream& ss, const std::string& name, const boost::property_tree::ptree& value) const
+	{
+		std::ostringstream buf;
+		boost::property_tree::write_json (buf, value, false);
+		ss << "\"" << name << "\":" << buf.str();
+	}
+
 	void I2PControlService::SendResponse (std::shared_ptr<ssl_socket> socket,
 		std::shared_ptr<I2PControlBuffer> buf, std::ostringstream& response, bool isHtml)
 	{
@@ -457,6 +473,7 @@ namespace client
 		InsertParam (results, "i2p.router.net.total.sent.bytes",     (double)i2p::transport::transports.GetTotalSentBytes ());
 	}
 
+
 // RouterManager
 
 	void I2PControlService::RouterManagerHandler (const boost::property_tree::ptree& params, std::ostringstream& results)
@@ -586,5 +603,178 @@ namespace client
 		}
 		EVP_PKEY_free (pkey);
 	}
+
+// ClientServicesInfo
+
+	void I2PControlService::ClientServicesInfoHandler (const boost::property_tree::ptree& params, std::ostringstream& results)
+	{
+		for (auto it = params.begin (); it != params.end (); it++)
+		{
+			LogPrint (eLogDebug, "I2PControl: ClientServicesInfo request: ", it->first);
+			auto it1 = m_ClientServicesInfoHandlers.find (it->first);
+			if (it1 != m_ClientServicesInfoHandlers.end ())
+			{
+				if (it != params.begin ()) results << ",";
+				(this->*(it1->second))(results);
+			}
+			else
+				LogPrint (eLogError, "I2PControl: ClientServicesInfo unknown request ", it->first);
+		}
+	}
+
+	void I2PControlService::I2PTunnelInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+		boost::property_tree::ptree client_tunnels, server_tunnels;
+
+		for (auto& it: i2p::client::context.GetClientTunnels ())
+		{
+			auto& ident = it.second->GetLocalDestination ()->GetIdentHash();
+			boost::property_tree::ptree ct;
+			ct.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+			client_tunnels.add_child(it.second->GetName (), ct);
+		}
+
+		auto& serverTunnels = i2p::client::context.GetServerTunnels ();
+		if (!serverTunnels.empty ()) {
+			for (auto& it: serverTunnels)
+			{
+				auto& ident = it.second->GetLocalDestination ()->GetIdentHash();
+				boost::property_tree::ptree st;
+				st.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+				st.put("port", it.second->GetLocalPort ());
+				server_tunnels.add_child(it.second->GetName (), st);
+			}
+		}
+
+		auto& clientForwards = i2p::client::context.GetClientForwards ();
+		if (!clientForwards.empty ())
+		{
+			for (auto& it: clientForwards)
+			{
+				auto& ident = it.second->GetLocalDestination ()->GetIdentHash();
+				boost::property_tree::ptree ct;
+				ct.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+				client_tunnels.add_child(it.second->GetName (), ct);
+			}
+		}
+
+		auto& serverForwards = i2p::client::context.GetServerForwards ();
+		if (!serverForwards.empty ())
+		{
+			for (auto& it: serverForwards)
+			{
+				auto& ident = it.second->GetLocalDestination ()->GetIdentHash();
+				boost::property_tree::ptree st;
+				st.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+				server_tunnels.add_child(it.second->GetName (), st);
+			}
+		}
+
+		pt.add_child("client", client_tunnels);
+		pt.add_child("server", server_tunnels);
+
+		InsertParam (results, "I2PTunnel", pt);
+	}
+
+	void I2PControlService::HTTPProxyInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+
+		auto httpProxy = i2p::client::context.GetHttpProxy ();
+		if (httpProxy)
+		{
+			auto& ident = httpProxy->GetLocalDestination ()->GetIdentHash();
+			pt.put("enabled", true);
+			pt.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+		}
+		else
+			pt.put("enabled", false);
+
+		InsertParam (results, "HTTPProxy", pt);
+	}
+
+	void I2PControlService::SOCKSInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+
+		auto socksProxy = i2p::client::context.GetSocksProxy ();
+		if (socksProxy)
+		{
+			auto& ident = socksProxy->GetLocalDestination ()->GetIdentHash();
+			pt.put("enabled", true);
+			pt.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+		}
+		else
+			pt.put("enabled", false);
+
+		InsertParam (results, "SOCKS", pt);
+	}
+
+	void I2PControlService::SAMInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+		auto sam = i2p::client::context.GetSAMBridge ();
+		if (sam)
+		{
+			pt.put("enabled", true);
+			boost::property_tree::ptree sam_sessions;
+			for (auto& it: sam->GetSessions ())
+			{
+				boost::property_tree::ptree sam_session, sam_session_sockets;
+				auto& name = it.second->localDestination->GetNickname ();
+				auto& ident = it.second->localDestination->GetIdentHash();
+				sam_session.put("name", name);
+				sam_session.put("address", i2p::client::context.GetAddressBook ().ToAddress(ident));
+
+				for (const auto& socket: it.second->ListSockets())
+				{
+					boost::property_tree::ptree stream;
+					stream.put("type", socket->GetSocketType ());
+					stream.put("peer", socket->GetSocket ().remote_endpoint());
+
+					sam_session_sockets.push_back(std::make_pair("", stream));
+				}
+				sam_session.add_child("sockets", sam_session_sockets);
+				sam_sessions.add_child(it.first, sam_session);
+			}
+
+			pt.add_child("sessions", sam_sessions);
+		}
+		else
+			pt.put("enabled", false);
+
+		InsertParam (results, "SAM", pt);
+	}
+
+	void I2PControlService::BOBInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+		auto bob = i2p::client::context.GetBOBCommandChannel ();
+		if (bob)
+		{
+			/* TODO more info */
+			pt.put("enabled", true);
+		}
+		else
+			pt.put("enabled", false);
+
+		InsertParam (results, "BOB", pt);
+	}
+
+	void I2PControlService::I2CPInfoHandler (std::ostringstream& results)
+	{
+		boost::property_tree::ptree pt;
+		auto i2cp = i2p::client::context.GetI2CPServer ();
+		if (i2cp)
+		{
+			/* TODO more info */
+			pt.put("enabled", true);
+		}
+		else
+			pt.put("enabled", false);
+
+		InsertParam (results, "I2CP", pt);
+	}
 }
 }
diff --git a/daemon/I2PControl.h b/daemon/I2PControl.h
index a7ed1eab..3233ad12 100644
--- a/daemon/I2PControl.h
+++ b/daemon/I2PControl.h
@@ -57,6 +57,7 @@ namespace client
 			void InsertParam (std::ostringstream& ss, const std::string& name, int value) const;
 			void InsertParam (std::ostringstream& ss, const std::string& name, double value) const;
 			void InsertParam (std::ostringstream& ss, const std::string& name, const std::string& value) const;
+			void InsertParam (std::ostringstream& ss, const std::string& name, const boost::property_tree::ptree& value) const;
 
 			// methods
 			typedef void (I2PControlService::*MethodHandler)(const boost::property_tree::ptree& params, std::ostringstream& results);
@@ -67,6 +68,7 @@ namespace client
 			void RouterInfoHandler (const boost::property_tree::ptree& params, std::ostringstream& results);
 			void RouterManagerHandler (const boost::property_tree::ptree& params, std::ostringstream& results);
 			void NetworkSettingHandler (const boost::property_tree::ptree& params, std::ostringstream& results);
+			void ClientServicesInfoHandler (const boost::property_tree::ptree& params, std::ostringstream& results);
 
 			// I2PControl
 			typedef void (I2PControlService::*I2PControlRequestHandler)(const std::string& value);
@@ -98,6 +100,15 @@ namespace client
 			void InboundBandwidthLimit  (const std::string& value, std::ostringstream& results);
 			void OutboundBandwidthLimit (const std::string& value, std::ostringstream& results);
 
+			// ClientServicesInfo
+			typedef void (I2PControlService::*ClientServicesInfoRequestHandler)(std::ostringstream& results);
+			void I2PTunnelInfoHandler (std::ostringstream& results);
+			void HTTPProxyInfoHandler (std::ostringstream& results);
+			void SOCKSInfoHandler (std::ostringstream& results);
+			void SAMInfoHandler (std::ostringstream& results);
+			void BOBInfoHandler (std::ostringstream& results);
+			void I2CPInfoHandler (std::ostringstream& results);
+
 		private:
 
 			std::string m_Password;
@@ -115,6 +126,7 @@ namespace client
 			std::map<std::string, RouterInfoRequestHandler> m_RouterInfoHandlers;
 			std::map<std::string, RouterManagerRequestHandler> m_RouterManagerHandlers;
 			std::map<std::string, NetworkSettingRequestHandler> m_NetworkSettingHandlers;
+			std::map<std::string, ClientServicesInfoRequestHandler> m_ClientServicesInfoHandlers;
 	};
 }
 }
diff --git a/daemon/UnixDaemon.cpp b/daemon/UnixDaemon.cpp
index 075aa7d8..a9c48fee 100644
--- a/daemon/UnixDaemon.cpp
+++ b/daemon/UnixDaemon.cpp
@@ -13,6 +13,7 @@
 #include "Config.h"
 #include "FS.h"
 #include "Log.h"
+#include "Tunnel.h"
 #include "RouterContext.h"
 #include "ClientContext.h"
 
@@ -163,7 +164,7 @@ namespace i2p
 			sigaction(SIGABRT, &sa, 0);
 			sigaction(SIGTERM, &sa, 0);
 			sigaction(SIGINT, &sa, 0);
-			sigaction(SIGPIPE, &sa, 0);
+			sigaction(SIGPIPE, &sa, 0);			
 
 			return Daemon_Singleton::start();
 		}
@@ -183,7 +184,7 @@ namespace i2p
 				if (gracefulShutdownInterval)
 				{
 					gracefulShutdownInterval--; // - 1 second
-					if (gracefulShutdownInterval <= 0)
+					if (gracefulShutdownInterval <= 0 || i2p::tunnel::tunnels.CountTransitTunnels() <= 0)
 					{
 						LogPrint(eLogInfo, "Graceful shutdown");
 						return;
diff --git a/daemon/i2pd.cpp b/daemon/i2pd.cpp
index 589274f5..8718ad0c 100644
--- a/daemon/i2pd.cpp
+++ b/daemon/i2pd.cpp
@@ -22,6 +22,8 @@ int main( int argc, char* argv[] )
 	{
 		if (Daemon.start())
 			Daemon.run ();
+		else
+			return EXIT_FAILURE;
 		Daemon.stop();
 	}
 	return EXIT_SUCCESS;
diff --git a/debian/changelog b/debian/changelog
index 94105535..afddc797 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+i2pd (2.18.0-1) unstable; urgency=low
+
+  * updated to version 2.18.0/0.9.33
+
+ -- orignal <orignal@i2pmail.org>  Tue, 30 Jan 2018 16:00:00 +0000
+
 i2pd (2.17.0-1) unstable; urgency=low
 
   * updated to version 2.17.0/0.9.32
diff --git a/debian/compat b/debian/compat
index ec635144..f11c82a4 100644
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-9
+9
\ No newline at end of file
diff --git a/debian/control b/debian/control
index 808cdda9..7bd18ebb 100644
--- a/debian/control
+++ b/debian/control
@@ -2,11 +2,11 @@ Source: i2pd
 Section: net
 Priority: optional
 Maintainer: R4SAS <r4sas@i2pmail.org>
-Build-Depends: debhelper (>= 9), dpkg-dev (>= 1.16.1~), gcc (>= 4.7) | clang (>= 3.3), libboost-system-dev (>= 1.46), libboost-date-time-dev, libboost-filesystem-dev, libboost-program-options-dev, libminiupnpc-dev, libssl-dev, zlib1g-dev, dh-apparmor
+Build-Depends: debhelper (>= 9), dpkg-dev (>= 1.16.1~), gcc (>= 4.7) | clang (>= 3.3), libboost-system-dev (>= 1.46), libboost-date-time-dev (>= 1.46), libboost-filesystem-dev (>= 1.46), libboost-program-options-dev (>= 1.46), libminiupnpc-dev, libssl-dev, zlib1g-dev, dh-apparmor
 Standards-Version: 3.9.6
 Homepage: http://i2pd.website/
 Vcs-Git: git://github.com/PurpleI2P/i2pd.git
-Vcs-Browser: https://github.com/PurpleI2P/i2pd.git
+Vcs-Browser: https://github.com/PurpleI2P/i2pd
 
 Package: i2pd
 Architecture: any
diff --git a/debian/copyright b/debian/copyright
index 6aeefebf..3c513020 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -4,6 +4,22 @@ Source: https://github.com/PurpleI2P
 
 Files: *
 Copyright: 2013-2017 PurpleI2P
+License: BSD-3-clause
+
+Files: qt/i2pd_qt/android/src/org/kde/necessitas/ministro/IMinistro.aidl
+       qt/i2pd_qt/android/src/org/kde/necessitas/ministro/IMinistroCallback.aidl
+       qt/i2pd_qt/android/src/org/qtproject/qt5/android/bindings/QtActivity.java
+       qt/i2pd_qt/android/src/org/qtproject/qt5/android/bindings/QtApplication.java
+Copyright: 2011-2013 BogDan Vatra <bogdan@kde.org>
+License: BSD-2-Clause
+
+Files: debian/*
+Copyright: 2013-2015 Kill Your TV <killyourtv@i2pmail.org>
+           2014-2016 hagen <hagen@i2pmail.org>
+           2016-2017 R4SAS <r4sas@i2pmail.org>
+           2017-2018 Yangfl <mmyangfl@gmail.com>
+License: GPL-2+
+
 License: BSD-3-clause
  Copyright (c) 2013-2017, The PurpleI2P Project
  .
@@ -33,11 +49,29 @@ License: BSD-3-clause
  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-Files: debian/*
-Copyright: 2016-2017 R4SAS <r4sas@i2pmail.org>
-           2014-2016 hagen <hagen@i2pmail.org>
-           2013-2015 Kill Your TV <killyourtv@i2pmail.org>
-License: GPL-2.0+
+License: BSD-2-Clause
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE HOLDERS OR
+ CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+License: GPL-2+
  This package is free software; you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation; either version 2 of the License, or
diff --git a/debian/lintian-overrides b/debian/lintian-overrides
new file mode 100644
index 00000000..af3d61c6
--- /dev/null
+++ b/debian/lintian-overrides
@@ -0,0 +1,2 @@
+# GPL come from debian/
+i2pd: possible-gpl-code-linked-with-openssl
\ No newline at end of file
diff --git a/entrypoint.sh b/entrypoint.sh
deleted file mode 100644
index 24a415aa..00000000
--- a/entrypoint.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-
-ARGS=""
-if [ "${ENABLE_IPV6}" != "" ]; then
-  ARGS="${ARGS} –ipv6"
-fi
-
-if [ "${LOGLEVEL}" != "" ]; then
-  ARGS="${ARGS} –loglevel=${LOGLEVEL}"
-fi
-
-if [ "${ENABLE_AUTH}" != "" ]; then
-  ARGS="${ARGS} –http.auth"
-fi
-
-
-# To make ports exposeable
-DEFAULT_ARGS=" –http.address=0.0.0.0 –httpproxy.address=0.0.0.0 -socksproxy.address=0.0.0.0 –sam.address=0.0.0.0 –bob.address=0.0.0.0 –i2cp.address=0.0.0.0 –i2pcontrol.port=0.0.0.0 –upnp.enabled=false -service "
-
-mkdir -p /var/lib/i2pd && chown -R i2pd:nobody /var/lib/i2pd && chmod u+rw /var/lib/i2pd
-
-gosu i2pd i2pd $DEFAULT_ARGS $ARGS
-
-
diff --git a/libi2pd/CPU.cpp b/libi2pd/CPU.cpp
new file mode 100644
index 00000000..d2868a20
--- /dev/null
+++ b/libi2pd/CPU.cpp
@@ -0,0 +1,43 @@
+#include "CPU.h"
+#if defined(__x86_64__) || defined(__i386__)
+#include <cpuid.h>
+#endif
+#include "Log.h"
+
+#ifndef bit_AES
+#define bit_AES (1 << 25)
+#endif
+#ifndef bit_AVX
+#define bit_AVX (1 << 28)
+#endif
+
+
+namespace i2p
+{
+namespace cpu
+{
+	bool aesni = false;
+	bool avx = false;
+
+	void Detect()
+	{
+#if defined(__x86_64__) || defined(__i386__)
+		int info[4];
+		__cpuid(0, info[0], info[1], info[2], info[3]);
+		if (info[0] >= 0x00000001) {
+			__cpuid(0x00000001, info[0], info[1], info[2], info[3]);
+			aesni = info[2] & bit_AES;  // AESNI
+			avx = info[2] & bit_AVX;  // AVX
+		}
+#endif
+		if(aesni)
+		{
+			LogPrint(eLogInfo, "AESNI enabled");
+		}
+		if(avx)
+		{
+			LogPrint(eLogInfo, "AVX enabled");
+		}
+	}
+}
+}
diff --git a/libi2pd/CPU.h b/libi2pd/CPU.h
new file mode 100644
index 00000000..b4c19607
--- /dev/null
+++ b/libi2pd/CPU.h
@@ -0,0 +1,15 @@
+#ifndef LIBI2PD_CPU_H
+#define LIBI2PD_CPU_H
+
+namespace i2p
+{
+namespace cpu
+{
+  extern bool aesni;
+  extern bool avx;
+
+  void Detect();
+}
+}
+
+#endif
diff --git a/libi2pd/Config.cpp b/libi2pd/Config.cpp
index 636e4986..d9cc6dec 100644
--- a/libi2pd/Config.cpp
+++ b/libi2pd/Config.cpp
@@ -73,6 +73,7 @@ namespace config {
 			("limits.transittunnels", value<uint16_t>()->default_value(2500), "Maximum active transit sessions (default:2500)")
 			("limits.ntcpsoft", value<uint16_t>()->default_value(0),          "Threshold to start probabalistic backoff with ntcp sessions (default: use system limit)")
 			("limits.ntcphard", value<uint16_t>()->default_value(0),          "Maximum number of ntcp sessions (default: use system limit)")
+			("limits.ntcpthreads", value<uint16_t>()->default_value(1),       "Maximum number of threads used by NTCP DH worker (default: 1)")
 		;
 
 		options_description httpserver("HTTP Server options");
@@ -83,6 +84,8 @@ namespace config {
 			("http.auth", value<bool>()->default_value(false),                 "Enable Basic HTTP auth for webconsole")
 			("http.user", value<std::string>()->default_value("i2pd"),         "Username for basic auth")
 			("http.pass", value<std::string>()->default_value(""),             "Password for basic auth (default: random, see logs)")
+			("http.strictheaders", value<bool>()->default_value(true),         "Enable strict host checking on WebUI")
+			("http.hostname", value<std::string>()->default_value("localhost"),"Expected hostname for WebUI")
 		;
 
 		options_description httpproxy("HTTP Proxy options");
diff --git a/libi2pd/Crypto.cpp b/libi2pd/Crypto.cpp
index 6109529d..5ba3334d 100644
--- a/libi2pd/Crypto.cpp
+++ b/libi2pd/Crypto.cpp
@@ -373,7 +373,7 @@ namespace crypto
 	}
 
 // ECIES
-	void ECIESEncrypt (const EC_GROUP * curve, const EC_POINT * key, const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
+	void ECIESEncrypt (const EC_GROUP * curve, const EC_POINT * key, const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding)
 	{
 		BN_CTX_start (ctx);
 		BIGNUM * q = BN_CTX_get (ctx);
@@ -386,10 +386,19 @@ namespace crypto
 		EC_POINT_mul (curve, p, k, nullptr, nullptr, ctx);
 		BIGNUM * x = BN_CTX_get (ctx), * y = BN_CTX_get (ctx);
 		EC_POINT_get_affine_coordinates_GFp (curve, p, x, y, nullptr);
-		encrypted[0] = 0;
-		bn2buf (x, encrypted + 1, len);
-		bn2buf (y, encrypted + 1 + len, len);
-		RAND_bytes (encrypted + 1 + 2*len, 256 - 2*len);
+		if (zeroPadding)
+		{
+			encrypted[0] = 0;
+			bn2buf (x, encrypted + 1, len);
+			bn2buf (y, encrypted + 1 + len, len);
+			RAND_bytes (encrypted + 1 + 2*len, 256 - 2*len);
+		}	
+		else
+		{
+			bn2buf (x, encrypted, len);
+			bn2buf (y, encrypted + len, len);
+			RAND_bytes (encrypted + 2*len, 256 - 2*len);
+		}
 		// ecryption key and iv
 		EC_POINT_mul (curve, p, nullptr, key, k, ctx);
 		EC_POINT_get_affine_coordinates_GFp (curve, p, x, y, nullptr);
@@ -403,16 +412,21 @@ namespace crypto
 		memcpy (m+33, data, 222);
 		SHA256 (m+33, 222, m+1);
 		// encrypt
-		encrypted[257] = 0;
 		CBCEncryption encryption;
 		encryption.SetKey (shared);
 		encryption.SetIV (iv);
-		encryption.Encrypt (m, 256, encrypted + 258);
+		if (zeroPadding)
+		{
+			encrypted[257] = 0;
+			encryption.Encrypt (m, 256, encrypted + 258);
+		}
+		else
+			encryption.Encrypt (m, 256, encrypted + 256);
 		EC_POINT_free (p);
 		BN_CTX_end (ctx);
 	}
 
-	bool ECIESDecrypt (const EC_GROUP * curve, const BIGNUM * key, const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
+	bool ECIESDecrypt (const EC_GROUP * curve, const BIGNUM * key, const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding)
 	{
 		bool ret = true;
 		BN_CTX_start (ctx);
@@ -421,8 +435,16 @@ namespace crypto
 		int len = BN_num_bytes (q);
 		// point for shared secret
 		BIGNUM * x = BN_CTX_get (ctx), * y = BN_CTX_get (ctx);
-		BN_bin2bn (encrypted + 1, len, x);
-		BN_bin2bn (encrypted + 1 + len, len, y);
+		if (zeroPadding)
+		{
+			BN_bin2bn (encrypted + 1, len, x);
+			BN_bin2bn (encrypted + 1 + len, len, y);
+		}
+		else
+		{
+			BN_bin2bn (encrypted, len, x);
+			BN_bin2bn (encrypted + len, len, y);
+		}
 		auto p = EC_POINT_new (curve);
 		if (EC_POINT_set_affine_coordinates_GFp (curve, p, x, y, nullptr))
 		{
@@ -439,7 +461,10 @@ namespace crypto
 			CBCDecryption decryption;
 			decryption.SetKey (shared);
 			decryption.SetIV (iv);
-			decryption.Decrypt (encrypted + 258, 256, m);
+			if (zeroPadding)	
+				decryption.Decrypt (encrypted + 258, 256, m);
+			else
+				decryption.Decrypt (encrypted + 256, 256, m);	
 			// verify and copy
 			uint8_t hash[32];
 			SHA256 (m + 33, 222, hash);
@@ -479,10 +504,9 @@ namespace crypto
 	const uint64_t IPAD = 0x3636363636363636;
 	const uint64_t OPAD = 0x5C5C5C5C5C5C5C5C;
 
-#if defined(__AVX__)
+
 	static const uint64_t ipads[] = { IPAD, IPAD, IPAD, IPAD };
 	static const uint64_t opads[] = { OPAD, OPAD, OPAD, OPAD };
-#endif
 
 	void HMACMD5Digest (uint8_t * msg, size_t len, const MACKey& key, uint8_t * digest)
 	// key is 32 bytes
@@ -491,47 +515,73 @@ namespace crypto
 	{
 		uint64_t buf[256];
 		uint64_t hash[12]; // 96 bytes
-#if defined(__AVX__) // for AVX
-		__asm__
-		(
-			"vmovups %[key], %%ymm0 \n"
-			"vmovups %[ipad], %%ymm1 \n"
-			"vmovups %%ymm1, 32(%[buf]) \n"
-			"vxorps %%ymm0, %%ymm1, %%ymm1 \n"
-			"vmovups %%ymm1, (%[buf]) \n"
-			"vmovups %[opad], %%ymm1 \n"
-			"vmovups %%ymm1, 32(%[hash]) \n"
-			"vxorps %%ymm0, %%ymm1, %%ymm1 \n"
-			"vmovups %%ymm1, (%[hash]) \n"
-			"vzeroall \n" // end of AVX
-			"movups %%xmm0, 80(%[hash]) \n" // zero last 16 bytes
-			:
-			: [key]"m"(*(const uint8_t *)key), [ipad]"m"(*ipads), [opad]"m"(*opads),
-				[buf]"r"(buf), [hash]"r"(hash)
-			: "memory", "%xmm0"	// TODO: change to %ymm0 later
-		);
+		if(i2p::cpu::avx)
+		{
+#ifdef AVX
+			__asm__
+				(
+					"vmovups %[key], %%ymm0 \n"
+					"vmovups %[ipad], %%ymm1 \n"
+					"vmovups %%ymm1, 32(%[buf]) \n"
+					"vxorps %%ymm0, %%ymm1, %%ymm1 \n"
+					"vmovups %%ymm1, (%[buf]) \n"
+					"vmovups %[opad], %%ymm1 \n"
+					"vmovups %%ymm1, 32(%[hash]) \n"
+					"vxorps %%ymm0, %%ymm1, %%ymm1 \n"
+					"vmovups %%ymm1, (%[hash]) \n"
+					"vzeroall \n" // end of AVX
+					"movups %%xmm0, 80(%[hash]) \n" // zero last 16 bytes
+					:
+					: [key]"m"(*(const uint8_t *)key), [ipad]"m"(*ipads), [opad]"m"(*opads),
+						[buf]"r"(buf), [hash]"r"(hash)
+					: "memory", "%xmm0"	// TODO: change to %ymm0 later
+					);
 #else
-		// ikeypad
-		buf[0] = key.GetLL ()[0] ^ IPAD;
-		buf[1] = key.GetLL ()[1] ^ IPAD;
-		buf[2] = key.GetLL ()[2] ^ IPAD;
-		buf[3] = key.GetLL ()[3] ^ IPAD;
-		buf[4] = IPAD;
-		buf[5] = IPAD;
-		buf[6] = IPAD;
-		buf[7] = IPAD;
-		// okeypad
-		hash[0] = key.GetLL ()[0] ^ OPAD;
-		hash[1] = key.GetLL ()[1] ^ OPAD;
-		hash[2] = key.GetLL ()[2] ^ OPAD;
-		hash[3] = key.GetLL ()[3] ^ OPAD;
-		hash[4] = OPAD;
-		hash[5] = OPAD;
-		hash[6] = OPAD;
-		hash[7] = OPAD;
-		// fill last 16 bytes with zeros (first hash size assumed 32 bytes in I2P)
-		memset (hash + 10, 0, 16);
+			// ikeypad
+			buf[0] = key.GetLL ()[0] ^ IPAD;
+			buf[1] = key.GetLL ()[1] ^ IPAD;
+			buf[2] = key.GetLL ()[2] ^ IPAD;
+			buf[3] = key.GetLL ()[3] ^ IPAD;
+			buf[4] = IPAD;
+			buf[5] = IPAD;
+			buf[6] = IPAD;
+			buf[7] = IPAD;
+			// okeypad
+			hash[0] = key.GetLL ()[0] ^ OPAD;
+			hash[1] = key.GetLL ()[1] ^ OPAD;
+			hash[2] = key.GetLL ()[2] ^ OPAD;
+			hash[3] = key.GetLL ()[3] ^ OPAD;
+			hash[4] = OPAD;
+			hash[5] = OPAD;
+			hash[6] = OPAD;
+			hash[7] = OPAD;
+			// fill last 16 bytes with zeros (first hash size assumed 32 bytes in I2P)
+			memset (hash + 10, 0, 16);
 #endif
+		}
+		else
+		{
+			// ikeypad
+			buf[0] = key.GetLL ()[0] ^ IPAD;
+			buf[1] = key.GetLL ()[1] ^ IPAD;
+			buf[2] = key.GetLL ()[2] ^ IPAD;
+			buf[3] = key.GetLL ()[3] ^ IPAD;
+			buf[4] = IPAD;
+			buf[5] = IPAD;
+			buf[6] = IPAD;
+			buf[7] = IPAD;
+			// okeypad
+			hash[0] = key.GetLL ()[0] ^ OPAD;
+			hash[1] = key.GetLL ()[1] ^ OPAD;
+			hash[2] = key.GetLL ()[2] ^ OPAD;
+			hash[3] = key.GetLL ()[3] ^ OPAD;
+			hash[4] = OPAD;
+			hash[5] = OPAD;
+			hash[6] = OPAD;
+			hash[7] = OPAD;
+			// fill last 16 bytes with zeros (first hash size assumed 32 bytes in I2P)
+			memset (hash + 10, 0, 16);
+		}
 
 		// concatenate with msg
 		memcpy (buf + 8, msg, len);
@@ -543,8 +593,7 @@ namespace crypto
 	}
 
 // AES
-	#ifdef AESNI
-
+#ifdef AESNI
 	#define KeyExpansion256(round0,round1) \
 		"pshufd	$0xff, %%xmm2, %%xmm2 \n" \
 		"movaps	%%xmm1, %%xmm4 \n" \
@@ -567,7 +616,9 @@ namespace crypto
 		"pxor %%xmm4, %%xmm3 \n" \
 		"pxor %%xmm2, %%xmm3 \n" \
 		"movaps	%%xmm3, "#round1"(%[sched]) \n"
+#endif
 
+#ifdef AESNI
 	void ECBCryptoAESNI::ExpandKey (const AESKey& key)
 	{
 		__asm__
@@ -604,8 +655,11 @@ namespace crypto
 			: [key]"r"((const uint8_t *)key), [sched]"r"(GetKeySchedule ()) // input
 			: "%xmm1", "%xmm2", "%xmm3", "%xmm4", "memory" // clogged
 		);
-	}
+	}	
+#endif
 
+
+#if AESNI
 	#define EncryptAES256(sched) \
 		"pxor (%["#sched"]), %%xmm0 \n" \
 		"aesenc	16(%["#sched"]), %%xmm0 \n" \
@@ -622,18 +676,31 @@ namespace crypto
 		"aesenc	192(%["#sched"]), %%xmm0 \n" \
 		"aesenc	208(%["#sched"]), %%xmm0 \n" \
 		"aesenclast	224(%["#sched"]), %%xmm0 \n"
-
-	void ECBEncryptionAESNI::Encrypt (const ChipherBlock * in, ChipherBlock * out)
+#endif
+	
+	void ECBEncryption::Encrypt (const ChipherBlock * in, ChipherBlock * out)
 	{
-		__asm__
-		(
-			"movups	(%[in]), %%xmm0 \n"
-			EncryptAES256(sched)
-			"movups	%%xmm0, (%[out]) \n"
-			: : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
-		);
+		if(i2p::cpu::aesni)
+		{
+#ifdef AESNI
+			__asm__
+				(
+					"movups	(%[in]), %%xmm0 \n"
+					EncryptAES256(sched)
+					"movups	%%xmm0, (%[out]) \n"
+					: : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
+					);
+#else
+			AES_encrypt (in->buf, out->buf, &m_Key);
+#endif
+		}
+		else
+		{
+			AES_encrypt (in->buf, out->buf, &m_Key);
+		}	
 	}
 
+#ifdef AESNI
 	#define DecryptAES256(sched) \
 		"pxor 224(%["#sched"]), %%xmm0 \n" \
 		"aesdec	208(%["#sched"]), %%xmm0 \n" \
@@ -650,79 +717,130 @@ namespace crypto
 		"aesdec	32(%["#sched"]), %%xmm0 \n" \
 		"aesdec	16(%["#sched"]), %%xmm0 \n" \
 		"aesdeclast (%["#sched"]), %%xmm0 \n"
-
-	void ECBDecryptionAESNI::Decrypt (const ChipherBlock * in, ChipherBlock * out)
+#endif
+	
+	void ECBDecryption::Decrypt (const ChipherBlock * in, ChipherBlock * out)
 	{
-		__asm__
-		(
-			"movups	(%[in]), %%xmm0 \n"
-			DecryptAES256(sched)
-			"movups	%%xmm0, (%[out]) \n"
-			: : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
-		);
+		if(i2p::cpu::aesni)
+		{
+#ifdef AESNI
+			__asm__
+				(
+					"movups	(%[in]), %%xmm0 \n"
+					DecryptAES256(sched)
+					"movups	%%xmm0, (%[out]) \n"
+					: : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
+					);
+#else
+			AES_decrypt (in->buf, out->buf, &m_Key);
+#endif
+		}
+		else
+		{
+			AES_decrypt (in->buf, out->buf, &m_Key);
+		}
 	}
 
+#ifdef AESNI
 	#define CallAESIMC(offset) \
 		"movaps "#offset"(%[shed]), %%xmm0 \n"	\
 		"aesimc %%xmm0, %%xmm0 \n" \
 		"movaps %%xmm0, "#offset"(%[shed]) \n"
+#endif
 
-	void ECBDecryptionAESNI::SetKey (const AESKey& key)
+	void ECBEncryption::SetKey (const AESKey& key)
 	{
-		ExpandKey (key); // expand encryption key first
-		// then  invert it using aesimc
-		__asm__
-		(
-			CallAESIMC(16)
-			CallAESIMC(32)
-			CallAESIMC(48)
-			CallAESIMC(64)
-			CallAESIMC(80)
-			CallAESIMC(96)
-			CallAESIMC(112)
-			CallAESIMC(128)
-			CallAESIMC(144)
-			CallAESIMC(160)
-			CallAESIMC(176)
-			CallAESIMC(192)
-			CallAESIMC(208)
-			: : [shed]"r"(GetKeySchedule ()) : "%xmm0", "memory"
-		);
+		if(i2p::cpu::aesni)
+		{
+#ifdef AESNI
+			ExpandKey (key); 
+#else
+			AES_set_encrypt_key (key, 256, &m_Key);
+#endif
+		}
+		else
+		{
+			AES_set_encrypt_key (key, 256, &m_Key);
+		}
 	}
-
+	
+	void ECBDecryption::SetKey (const AESKey& key)
+	{
+		if(i2p::cpu::aesni)
+		{
+#ifdef AESNI
+			ExpandKey (key); // expand encryption key first
+			// then  invert it using aesimc
+			__asm__
+				(
+					CallAESIMC(16)
+					CallAESIMC(32)
+					CallAESIMC(48)
+					CallAESIMC(64)
+					CallAESIMC(80)
+					CallAESIMC(96)
+					CallAESIMC(112)
+					CallAESIMC(128)
+					CallAESIMC(144)
+					CallAESIMC(160)
+					CallAESIMC(176)
+					CallAESIMC(192)
+					CallAESIMC(208)
+					: : [shed]"r"(GetKeySchedule ()) : "%xmm0", "memory"
+					);
+#else
+			AES_set_decrypt_key (key, 256, &m_Key);
 #endif
+		}
+		else
+		{
+			AES_set_decrypt_key (key, 256, &m_Key);
+		}
+	}
 
 
 	void CBCEncryption::Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			"movups	(%[iv]), %%xmm1 \n"
-			"1: \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"pxor %%xmm1, %%xmm0 \n"
-			EncryptAES256(sched)
-			"movaps	%%xmm0, %%xmm1 \n"
-			"movups	%%xmm0, (%[out]) \n"
-			"add $16, %[in] \n"
-			"add $16, %[out] \n"
-			"dec %[num] \n"
-			"jnz 1b \n"
-			"movups	%%xmm1, (%[iv]) \n"
-			:
-			: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
-			  [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
-			: "%xmm0", "%xmm1", "cc", "memory"
-		);
+			__asm__
+				(
+					"movups	(%[iv]), %%xmm1 \n"
+					"1: \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"pxor %%xmm1, %%xmm0 \n"
+					EncryptAES256(sched)
+					"movaps	%%xmm0, %%xmm1 \n"
+					"movups	%%xmm0, (%[out]) \n"
+					"add $16, %[in] \n"
+					"add $16, %[out] \n"
+					"dec %[num] \n"
+					"jnz 1b \n"
+					"movups	%%xmm1, (%[iv]) \n"
+					:
+					: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+					: "%xmm0", "%xmm1", "cc", "memory"
+					);
 #else
-		for (int i = 0; i < numBlocks; i++)
+			for (int i = 0; i < numBlocks; i++)
+			{
+				*m_LastBlock.GetChipherBlock () ^= in[i];
+				m_ECBEncryption.Encrypt (m_LastBlock.GetChipherBlock (), m_LastBlock.GetChipherBlock ());
+				out[i] = *m_LastBlock.GetChipherBlock ();
+			}
+#endif
+		}
+		else
 		{
-			*m_LastBlock.GetChipherBlock () ^= in[i];
-			m_ECBEncryption.Encrypt (m_LastBlock.GetChipherBlock (), m_LastBlock.GetChipherBlock ());
-			out[i] = *m_LastBlock.GetChipherBlock ();
+			for (int i = 0; i < numBlocks; i++)
+			{
+				*m_LastBlock.GetChipherBlock () ^= in[i];
+				m_ECBEncryption.Encrypt (m_LastBlock.GetChipherBlock (), m_LastBlock.GetChipherBlock ());
+				out[i] = *m_LastBlock.GetChipherBlock ();
+			}
 		}
-#endif
 	}
 
 	void CBCEncryption::Encrypt (const uint8_t * in, std::size_t len, uint8_t * out)
@@ -735,57 +853,75 @@ namespace crypto
 
 	void CBCEncryption::Encrypt (const uint8_t * in, uint8_t * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			"movups	(%[iv]), %%xmm1 \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"pxor %%xmm1, %%xmm0 \n"
-			EncryptAES256(sched)
-			"movups	%%xmm0, (%[out]) \n"
-			"movups	%%xmm0, (%[iv]) \n"
-			:
-			: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
-			  [in]"r"(in), [out]"r"(out)
-			: "%xmm0", "%xmm1", "memory"
-		);
+			__asm__
+				(
+					"movups	(%[iv]), %%xmm1 \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"pxor %%xmm1, %%xmm0 \n"
+					EncryptAES256(sched)
+					"movups	%%xmm0, (%[out]) \n"
+					"movups	%%xmm0, (%[iv]) \n"
+					:
+					: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out)
+					: "%xmm0", "%xmm1", "memory"
+					);
 #else
-		Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
+			Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 #endif
+		}
+		else
+			Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 	}
 
 	void CBCDecryption::Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			"movups	(%[iv]), %%xmm1 \n"
-			"1: \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"movaps %%xmm0, %%xmm2 \n"
-			DecryptAES256(sched)
-			"pxor %%xmm1, %%xmm0 \n"
-			"movups	%%xmm0, (%[out]) \n"
-			"movaps %%xmm2, %%xmm1 \n"
-			"add $16, %[in] \n"
-			"add $16, %[out] \n"
-			"dec %[num] \n"
-			"jnz 1b \n"
-			"movups	%%xmm1, (%[iv]) \n"
-			:
-			: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
-			  [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
-			: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
-		);
+			__asm__
+				(
+					"movups	(%[iv]), %%xmm1 \n"
+					"1: \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"movaps %%xmm0, %%xmm2 \n"
+					DecryptAES256(sched)
+					"pxor %%xmm1, %%xmm0 \n"
+					"movups	%%xmm0, (%[out]) \n"
+					"movaps %%xmm2, %%xmm1 \n"
+					"add $16, %[in] \n"
+					"add $16, %[out] \n"
+					"dec %[num] \n"
+					"jnz 1b \n"
+					"movups	%%xmm1, (%[iv]) \n"
+					:
+					: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+					: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+					);
 #else
-		for (int i = 0; i < numBlocks; i++)
+			for (int i = 0; i < numBlocks; i++)
+			{
+				ChipherBlock tmp = in[i];
+				m_ECBDecryption.Decrypt (in + i, out + i);
+				out[i] ^= *m_IV.GetChipherBlock ();
+				*m_IV.GetChipherBlock () = tmp;
+			}
+#endif
+		}
+		else
 		{
-			ChipherBlock tmp = in[i];
-			m_ECBDecryption.Decrypt (in + i, out + i);
-			out[i] ^= *m_IV.GetChipherBlock ();
-			*m_IV.GetChipherBlock () = tmp;
+			for (int i = 0; i < numBlocks; i++)
+			{
+				ChipherBlock tmp = in[i];
+				m_ECBDecryption.Decrypt (in + i, out + i);
+				out[i] ^= *m_IV.GetChipherBlock ();
+				*m_IV.GetChipherBlock () = tmp;
+			}
 		}
-#endif
 	}
 
 	void CBCDecryption::Decrypt (const uint8_t * in, std::size_t len, uint8_t * out)
@@ -797,96 +933,121 @@ namespace crypto
 
 	void CBCDecryption::Decrypt (const uint8_t * in, uint8_t * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			"movups	(%[iv]), %%xmm1 \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"movups	%%xmm0, (%[iv]) \n"
-			DecryptAES256(sched)
-			"pxor %%xmm1, %%xmm0 \n"
-			"movups	%%xmm0, (%[out]) \n"
-			:
-			: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
-			  [in]"r"(in), [out]"r"(out)
-			: "%xmm0", "%xmm1", "memory"
-		);
+			__asm__
+				(
+					"movups	(%[iv]), %%xmm1 \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"movups	%%xmm0, (%[iv]) \n"
+					DecryptAES256(sched)
+					"pxor %%xmm1, %%xmm0 \n"
+					"movups	%%xmm0, (%[out]) \n"
+					:
+					: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out)
+					: "%xmm0", "%xmm1", "memory"
+					);
 #else
-		Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
+			Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 #endif
+		}
+		else
+			Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 	}
 
 	void TunnelEncryption::Encrypt (const uint8_t * in, uint8_t * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			// encrypt IV
-			"movups	(%[in]), %%xmm0 \n"
-			EncryptAES256(sched_iv)
-			"movaps %%xmm0, %%xmm1 \n"
-			// double IV encryption
-			EncryptAES256(sched_iv)
-			"movups %%xmm0, (%[out]) \n"
-			// encrypt data, IV is xmm1
-			"1: \n"
-			"add $16, %[in] \n"
-			"add $16, %[out] \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"pxor %%xmm1, %%xmm0 \n"
-			EncryptAES256(sched_l)
-			"movaps	%%xmm0, %%xmm1 \n"
-			"movups	%%xmm0, (%[out]) \n"
-			"dec %[num] \n"
-			"jnz 1b \n"
-			:
-			: [sched_iv]"r"(m_IVEncryption.GetKeySchedule ()), [sched_l]"r"(m_LayerEncryption.GetKeySchedule ()),
-			  [in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
-			: "%xmm0", "%xmm1", "cc", "memory"
-		);
+			__asm__
+				(
+					// encrypt IV
+					"movups	(%[in]), %%xmm0 \n"
+					EncryptAES256(sched_iv)
+					"movaps %%xmm0, %%xmm1 \n"
+					// double IV encryption
+					EncryptAES256(sched_iv)
+					"movups %%xmm0, (%[out]) \n"
+					// encrypt data, IV is xmm1
+					"1: \n"
+					"add $16, %[in] \n"
+					"add $16, %[out] \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"pxor %%xmm1, %%xmm0 \n"
+					EncryptAES256(sched_l)
+					"movaps	%%xmm0, %%xmm1 \n"
+					"movups	%%xmm0, (%[out]) \n"
+					"dec %[num] \n"
+					"jnz 1b \n"
+					:
+					: [sched_iv]"r"(m_IVEncryption.GetKeySchedule ()), [sched_l]"r"(m_LayerEncryption.ECB().GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+					: "%xmm0", "%xmm1", "cc", "memory"
+					);
 #else
-		m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
-		m_LayerEncryption.SetIV (out);
-		m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
-		m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+			m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerEncryption.SetIV (out);
+			m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
 #endif
+		}
+		else
+		{
+			m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerEncryption.SetIV (out);
+			m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+		}
 	}
 
 	void TunnelDecryption::Decrypt (const uint8_t * in, uint8_t * out)
 	{
+		if(i2p::cpu::aesni)
+		{
 #ifdef AESNI
-		__asm__
-		(
-			// decrypt IV
-			"movups	(%[in]), %%xmm0 \n"
-			DecryptAES256(sched_iv)
-			"movaps %%xmm0, %%xmm1 \n"
-			// double IV encryption
-			DecryptAES256(sched_iv)
-			"movups %%xmm0, (%[out]) \n"
-			// decrypt data, IV is xmm1
-			"1: \n"
-			"add $16, %[in] \n"
-			"add $16, %[out] \n"
-			"movups	(%[in]), %%xmm0 \n"
-			"movaps %%xmm0, %%xmm2 \n"
-			DecryptAES256(sched_l)
-			"pxor %%xmm1, %%xmm0 \n"
-			"movups	%%xmm0, (%[out]) \n"
-			"movaps %%xmm2, %%xmm1 \n"
-			"dec %[num] \n"
-			"jnz 1b \n"
-			:
-			: [sched_iv]"r"(m_IVDecryption.GetKeySchedule ()), [sched_l]"r"(m_LayerDecryption.GetKeySchedule ()),
-				[in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
-			: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
-		);
+			__asm__
+				(
+					// decrypt IV
+					"movups	(%[in]), %%xmm0 \n"
+					DecryptAES256(sched_iv)
+					"movaps %%xmm0, %%xmm1 \n"
+					// double IV encryption
+					DecryptAES256(sched_iv)
+					"movups %%xmm0, (%[out]) \n"
+					// decrypt data, IV is xmm1
+					"1: \n"
+					"add $16, %[in] \n"
+					"add $16, %[out] \n"
+					"movups	(%[in]), %%xmm0 \n"
+					"movaps %%xmm0, %%xmm2 \n"
+					DecryptAES256(sched_l)
+					"pxor %%xmm1, %%xmm0 \n"
+					"movups	%%xmm0, (%[out]) \n"
+					"movaps %%xmm2, %%xmm1 \n"
+					"dec %[num] \n"
+					"jnz 1b \n"
+					:
+					: [sched_iv]"r"(m_IVDecryption.GetKeySchedule ()), [sched_l]"r"(m_LayerDecryption.ECB().GetKeySchedule ()),
+						[in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+					: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+					);
 #else
-		m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
-		m_LayerDecryption.SetIV (out);
-		m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
-		m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+			m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerDecryption.SetIV (out);
+			m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
 #endif
+		}
+		else
+		{
+			m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerDecryption.SetIV (out);
+			m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+		}
 	}
 
 /*	std::vector <std::unique_ptr<std::mutex> >  m_OpenSSLMutexes;
@@ -904,6 +1065,7 @@ namespace crypto
 
 	void InitCrypto (bool precomputation)
 	{
+		i2p::cpu::Detect ();
 		SSL_library_init ();
 /*		auto numLocks = CRYPTO_num_locks();
 		for (int i = 0; i < numLocks; i++)
diff --git a/libi2pd/Crypto.h b/libi2pd/Crypto.h
index e495d2e6..6e4ddb3d 100644
--- a/libi2pd/Crypto.h
+++ b/libi2pd/Crypto.h
@@ -16,6 +16,7 @@
 
 #include "Base.h"
 #include "Tag.h"
+#include "CPU.h"
 
 namespace i2p
 {
@@ -53,8 +54,8 @@ namespace crypto
 	void GenerateElGamalKeyPair (uint8_t * priv, uint8_t * pub);
 
 	// ECIES
-	void ECIESEncrypt (const EC_GROUP * curve, const EC_POINT * key, const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx); // 222 bytes data, 514 bytes encrypted
-	bool ECIESDecrypt (const EC_GROUP * curve, const BIGNUM * key, const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx);
+	void ECIESEncrypt (const EC_GROUP * curve, const EC_POINT * key, const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding = false); // 222 bytes data, 514 bytes encrypted with zeropadding, 512 without
+	bool ECIESDecrypt (const EC_GROUP * curve, const BIGNUM * key, const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding = false);
 	void GenerateECIESKeyPair (const EC_GROUP * curve, BIGNUM *& priv, EC_POINT *& pub);
 
 	// HMAC
@@ -68,33 +69,30 @@ namespace crypto
 
 		void operator^=(const ChipherBlock& other) // XOR
 		{
-#if defined(__AVX__) // AVX
-			__asm__
-			(
-				"vmovups (%[buf]), %%xmm0 \n"
-				"vmovups (%[other]), %%xmm1 \n"
-				"vxorps %%xmm0, %%xmm1, %%xmm0 \n"
-				"vmovups %%xmm0, (%[buf]) \n"
-				:
-				: [buf]"r"(buf), [other]"r"(other.buf)
-				: "%xmm0", "%xmm1", "memory"
-			);
-#elif defined(__SSE__) // SSE
-			__asm__
-			(
-				"movups	(%[buf]), %%xmm0 \n"
-				"movups	(%[other]), %%xmm1 \n"
-				"pxor %%xmm1, %%xmm0 \n"
-				"movups	%%xmm0, (%[buf]) \n"
-				:
-				: [buf]"r"(buf), [other]"r"(other.buf)
-				: "%xmm0", "%xmm1", "memory"
-			);
+			if (i2p::cpu::avx)
+			{
+#ifdef AVX
+				__asm__
+					(
+						"vmovups (%[buf]), %%xmm0 \n"
+						"vmovups (%[other]), %%xmm1 \n"
+						"vxorps %%xmm0, %%xmm1, %%xmm0 \n"
+						"vmovups %%xmm0, (%[buf]) \n"
+						:
+						: [buf]"r"(buf), [other]"r"(other.buf)
+						: "%xmm0", "%xmm1", "memory"
+						);
 #else
-			// TODO: implement it better
-			for (int i = 0; i < 16; i++)
-				buf[i] ^= other.buf[i];
+				for (int i = 0; i < 16; i++)
+					buf[i] ^= other.buf[i];
 #endif
+			}
+			else
+			{
+				// TODO: implement it better
+				for (int i = 0; i < 16; i++)
+					buf[i] ^= other.buf[i];
+			}
 		}
 	};
 
@@ -138,69 +136,40 @@ namespace crypto
 
 		private:
 
-			AESAlignedBuffer<240> m_KeySchedule;  // 14 rounds for AES-256, 240 bytes
+			AESAlignedBuffer<240> m_KeySchedule;	// 14 rounds for AES-256, 240 bytes
 	};
+#endif
 
-	class ECBEncryptionAESNI: public ECBCryptoAESNI
-	{
-		public:
-
-			void SetKey (const AESKey& key) { ExpandKey (key); };
-			void Encrypt (const ChipherBlock * in, ChipherBlock * out);
-	};
-
-	class ECBDecryptionAESNI: public ECBCryptoAESNI
-	{
-		public:
-
-			void SetKey (const AESKey& key);
-			void Decrypt (const ChipherBlock * in, ChipherBlock * out);
-	};
-
-	typedef ECBEncryptionAESNI ECBEncryption;
-	typedef ECBDecryptionAESNI ECBDecryption;
-
-#else // use openssl
-
+#ifdef AESNI
+	class ECBEncryption: public ECBCryptoAESNI
+#else
 	class ECBEncryption
+#endif
 	{
 		public:
 
-			void SetKey (const AESKey& key)
-			{
-				AES_set_encrypt_key (key, 256, &m_Key);
-			}
-			void Encrypt (const ChipherBlock * in, ChipherBlock * out)
-			{
-				AES_encrypt (in->buf, out->buf, &m_Key);
-			}
-
-		private:
+		void SetKey (const AESKey& key);
+		
+		void Encrypt(const ChipherBlock * in, ChipherBlock * out);
 
-			AES_KEY m_Key;
+	private:
+		AES_KEY m_Key;
 	};
 
+#ifdef AESNI
+	class ECBDecryption: public ECBCryptoAESNI
+#else
 	class ECBDecryption
+#endif
 	{
 		public:
 
-			void SetKey (const AESKey& key)
-			{
-				AES_set_decrypt_key (key, 256, &m_Key);
-			}
-			void Decrypt (const ChipherBlock * in, ChipherBlock * out)
-			{
-				AES_decrypt (in->buf, out->buf, &m_Key);
-			}
-
+			void SetKey (const AESKey& key);
+			void Decrypt (const ChipherBlock * in, ChipherBlock * out);
 		private:
-
 			AES_KEY m_Key;
 	};
 
-
-#endif
-
 	class CBCEncryption
 	{
 		public:
@@ -214,6 +183,8 @@ namespace crypto
 			void Encrypt (const uint8_t * in, std::size_t len, uint8_t * out);
 			void Encrypt (const uint8_t * in, uint8_t * out); // one block
 
+			ECBEncryption & ECB() { return m_ECBEncryption; }
+		
 		private:
 
 			AESAlignedBuffer<16> m_LastBlock;
@@ -234,6 +205,8 @@ namespace crypto
 			void Decrypt (const uint8_t * in, std::size_t len, uint8_t * out);
 			void Decrypt (const uint8_t * in, uint8_t * out); // one block
 
+			ECBDecryption & ECB() { return m_ECBDecryption; }
+		
 		private:
 
 			AESAlignedBuffer<16> m_IV;
@@ -255,11 +228,7 @@ namespace crypto
 		private:
 
 			ECBEncryption m_IVEncryption;
-#ifdef AESNI
-			ECBEncryption m_LayerEncryption;
-#else
 			CBCEncryption m_LayerEncryption;
-#endif
 	};
 
 	class TunnelDecryption // with double IV encryption
@@ -277,11 +246,7 @@ namespace crypto
 		private:
 
 			ECBDecryption m_IVDecryption;
-#ifdef AESNI
-			ECBDecryption m_LayerDecryption;
-#else
 			CBCDecryption m_LayerDecryption;
-#endif
 	};
 
 	void InitCrypto (bool precomputation);
diff --git a/libi2pd/CryptoKey.cpp b/libi2pd/CryptoKey.cpp
index 4be230f7..cd6952a0 100644
--- a/libi2pd/CryptoKey.cpp
+++ b/libi2pd/CryptoKey.cpp
@@ -47,7 +47,7 @@ namespace crypto
 	void ECIESP256Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
 	{
 		if (m_Curve && m_PublicKey)
-			ECIESEncrypt (m_Curve, m_PublicKey, data, encrypted, ctx);
+			ECIESEncrypt (m_Curve, m_PublicKey, data, encrypted, ctx, true);
 	}
 
 	ECIESP256Decryptor::ECIESP256Decryptor (const uint8_t * priv)
@@ -65,7 +65,7 @@ namespace crypto
 	bool ECIESP256Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
 	{
 		if (m_Curve && m_PrivateKey)
-			return ECIESDecrypt (m_Curve, m_PrivateKey, encrypted, data, ctx);
+			return ECIESDecrypt (m_Curve, m_PrivateKey, encrypted, data, ctx, true);
 		return false;
 	}
 
@@ -107,7 +107,7 @@ namespace crypto
 	void ECIESGOSTR3410Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
 	{
 		if (m_PublicKey)
-			ECIESEncrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PublicKey, data, encrypted, ctx);
+			ECIESEncrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PublicKey, data, encrypted, ctx, true);
 	}
 
 	ECIESGOSTR3410Decryptor::ECIESGOSTR3410Decryptor (const uint8_t * priv)
@@ -123,7 +123,7 @@ namespace crypto
 	bool ECIESGOSTR3410Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
 	{
 		if (m_PrivateKey)
-			return ECIESDecrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PrivateKey, encrypted, data, ctx);
+			return ECIESDecrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PrivateKey, encrypted, data, ctx, true);
 		return false;
 	}
 
diff --git a/libi2pd/CryptoWorker.h b/libi2pd/CryptoWorker.h
new file mode 100644
index 00000000..d43e356c
--- /dev/null
+++ b/libi2pd/CryptoWorker.h
@@ -0,0 +1,81 @@
+#ifndef CRYPTO_WORKER_H_
+#define CRYPTO_WORKER_H_
+
+#include <condition_variable>
+#include <mutex>
+#include <deque>
+#include <thread>
+#include <vector>
+#include <memory>
+
+namespace i2p
+{
+namespace worker
+{
+	template<typename Caller>
+	struct ThreadPool
+	{
+		typedef std::function<void(void)> ResultFunc;
+		typedef std::function<ResultFunc(void)> WorkFunc;
+		typedef std::pair<std::shared_ptr<Caller>, WorkFunc> Job;
+		typedef std::mutex mtx_t;
+		typedef std::unique_lock<mtx_t> lock_t;
+		typedef std::condition_variable cond_t;
+		ThreadPool(int workers)
+		{
+			stop = false;
+			if(workers > 0)
+			{
+				while(workers--)
+				{
+					threads.emplace_back([this] {
+							for (;;)
+							{
+								Job job;
+								{
+									lock_t lock(this->queue_mutex);
+									this->condition.wait(
+										lock, [this] { return this->stop || !this->jobs.empty(); });
+									if (this->stop && this->jobs.empty()) return;
+									job = std::move(this->jobs.front());
+									this->jobs.pop_front();
+								}
+								ResultFunc result = job.second();
+								job.first->GetService().post(result);
+							}
+					});
+				}
+			}
+		};
+
+		void Offer(const Job & job)
+		{
+			{
+				lock_t lock(queue_mutex);
+				if (stop) return;
+				jobs.emplace_back(job);
+			}
+			condition.notify_one();
+		}
+
+		~ThreadPool()
+		{
+			{
+				lock_t lock(queue_mutex);
+				stop = true;
+			}
+			condition.notify_all();
+			for(auto &t: threads) t.join();
+		}
+
+		std::vector<std::thread> threads;
+		std::deque<Job> jobs;
+		mtx_t queue_mutex;
+		cond_t condition;
+		bool stop;
+	};
+}
+}
+
+
+#endif
diff --git a/libi2pd/Destination.cpp b/libi2pd/Destination.cpp
index 33eff029..b191cbf1 100644
--- a/libi2pd/Destination.cpp
+++ b/libi2pd/Destination.cpp
@@ -169,6 +169,46 @@ namespace client
 			return false;
 	}
 
+	bool LeaseSetDestination::Reconfigure(std::map<std::string, std::string> params)
+	{
+		
+		auto itr = params.find("i2cp.dontPublishLeaseSet");
+		if (itr != params.end())
+		{
+			m_IsPublic = itr->second != "true";
+		}
+		
+		int inLen, outLen, inQuant, outQuant, numTags, minLatency, maxLatency;
+		std::map<std::string, int&> intOpts = {
+			{I2CP_PARAM_INBOUND_TUNNEL_LENGTH, inLen},
+			{I2CP_PARAM_OUTBOUND_TUNNEL_LENGTH, outLen},
+			{I2CP_PARAM_INBOUND_TUNNELS_QUANTITY, inQuant},
+			{I2CP_PARAM_OUTBOUND_TUNNELS_QUANTITY, outQuant},
+			{I2CP_PARAM_TAGS_TO_SEND, numTags},
+			{I2CP_PARAM_MIN_TUNNEL_LATENCY, minLatency},
+			{I2CP_PARAM_MAX_TUNNEL_LATENCY, maxLatency}
+		};
+
+		auto pool = GetTunnelPool();
+		inLen = pool->GetNumInboundHops();
+		outLen = pool->GetNumOutboundHops();
+		inQuant = pool->GetNumInboundTunnels();
+		outQuant = pool->GetNumOutboundTunnels();
+		minLatency = 0;
+		maxLatency = 0;
+		
+		for (auto & opt : intOpts)
+		{
+			itr = params.find(opt.first);
+			if(itr != params.end())
+			{
+				opt.second = std::stoi(itr->second);
+			}
+		}
+		pool->RequireLatency(minLatency, maxLatency);
+		return pool->Reconfigure(inLen, outLen, inQuant, outQuant);
+	}
+	
 	std::shared_ptr<const i2p::data::LeaseSet> LeaseSetDestination::FindLeaseSet (const i2p::data::IdentHash& ident)
 	{
 		std::shared_ptr<i2p::data::LeaseSet> remoteLS;
diff --git a/libi2pd/Destination.h b/libi2pd/Destination.h
index 6f37e768..3f261bc9 100644
--- a/libi2pd/Destination.h
+++ b/libi2pd/Destination.h
@@ -96,6 +96,10 @@ namespace client
 
 			virtual bool Start ();
 			virtual bool Stop ();
+
+			/** i2cp reconfigure */
+			virtual bool Reconfigure(std::map<std::string, std::string> i2cpOpts);
+		
 			bool IsRunning () const { return m_IsRunning; };
 			boost::asio::io_service& GetService () { return m_Service; };
 			std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () { return m_Pool; };
diff --git a/libi2pd/HTTP.cpp b/libi2pd/HTTP.cpp
index 24e55457..41d7903b 100644
--- a/libi2pd/HTTP.cpp
+++ b/libi2pd/HTTP.cpp
@@ -8,6 +8,7 @@
 
 #include <algorithm>
 #include <utility>
+#include <stdio.h>
 #include "util.h"
 #include "HTTP.h"
 #include <ctime>
@@ -21,6 +22,13 @@ namespace http {
   const std::vector<std::string> HTTP_VERSIONS = {
     "HTTP/1.0", "HTTP/1.1"
   };
+  const std::vector<const char *> weekdays = {
+    "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
+  };
+  const std::vector<const char *> months = {
+    "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+    "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+  };
 
   inline bool is_http_version(const std::string & str) {
     return std::find(HTTP_VERSIONS.begin(), HTTP_VERSIONS.end(), str) != std::end(HTTP_VERSIONS);
@@ -56,10 +64,14 @@ namespace http {
     return std::make_pair(line.substr(0, pos), line.substr(pos + len));
   }
 
-  void gen_rfc1123_date(std::string & out) {
+  void gen_rfc7231_date(std::string & out) {
     std::time_t now = std::time(nullptr);
     char buf[128];
-    std::strftime(buf, sizeof(buf), "%a, %d %b %Y %H:%M:%S GMT", std::gmtime(&now));
+    std::tm *tm = std::gmtime(&now);
+    snprintf(buf, sizeof(buf), "%s, %02d %s %d %02d:%02d:%02d GMT",
+      weekdays[tm->tm_wday], tm->tm_mday, months[tm->tm_mon],
+      tm->tm_year + 1900, tm->tm_hour, tm->tm_min, tm->tm_sec
+    );
     out = buf;
   }
 
@@ -88,7 +100,7 @@ namespace http {
           user = url.substr(pos_p, delim - pos_p);
           delim += 1;
           pass = url.substr(delim, pos_c - delim);
-        } else {
+        } else if(delim) {
           user = url.substr(pos_p, pos_c - pos_p);
         }
         pos_p = pos_c + 1;
@@ -400,7 +412,7 @@ namespace http {
   std::string HTTPRes::to_string() {
     if (version == "HTTP/1.1" && headers.count("Date") == 0) {
       std::string date;
-      gen_rfc1123_date(date);
+      gen_rfc7231_date(date);
       add_header("Date", date.c_str());
     }
     if (status == "OK" && code != 200)
diff --git a/libi2pd/I2PEndian.h b/libi2pd/I2PEndian.h
index e5271233..d2250768 100644
--- a/libi2pd/I2PEndian.h
+++ b/libi2pd/I2PEndian.h
@@ -3,9 +3,9 @@
 #include <inttypes.h>
 #include <string.h>
 
-#if defined(__FreeBSD__)
+#if defined(__FreeBSD__) || defined(__NetBSD__)
 #include <sys/endian.h>
-#elif defined(__linux__) || defined(__FreeBSD_kernel__) || defined(__OpenBSD__)
+#elif defined(__linux__) || defined(__FreeBSD_kernel__) || defined(__OpenBSD__) || defined(__GLIBC__)
 #include <endian.h>
 #elif defined(__APPLE__) && defined(__MACH__)
 
diff --git a/libi2pd/LeaseSet.cpp b/libi2pd/LeaseSet.cpp
index d1a70ba5..f2355930 100644
--- a/libi2pd/LeaseSet.cpp
+++ b/libi2pd/LeaseSet.cpp
@@ -21,7 +21,7 @@ namespace data
 		ReadFromBuffer ();
 	}
 
-	void LeaseSet::Update (const uint8_t * buf, size_t len)
+	void LeaseSet::Update (const uint8_t * buf, size_t len, bool verifySignature)
 	{
 		if (len > m_BufferLen)
 		{
@@ -31,7 +31,7 @@ namespace data
 		}
 		memcpy (m_Buffer, buf, len);
 		m_BufferLen = len;
-		ReadFromBuffer (false);
+		ReadFromBuffer (false, verifySignature);
 	}
 
 	void LeaseSet::PopulateLeases ()
@@ -40,7 +40,7 @@ namespace data
 		ReadFromBuffer (false);
 	}
 
-	void LeaseSet::ReadFromBuffer (bool readIdentity)
+	void LeaseSet::ReadFromBuffer (bool readIdentity, bool verifySignature)
 	{
 		if (readIdentity || !m_Identity)
 			m_Identity = std::make_shared<IdentityEx>(m_Buffer, m_BufferLen);
@@ -128,7 +128,7 @@ namespace data
 		}
 
 		// verify
-		if (!m_Identity->Verify (m_Buffer, leases - m_Buffer, leases))
+		if (verifySignature && !m_Identity->Verify (m_Buffer, leases - m_Buffer, leases))
 		{
 			LogPrint (eLogWarning, "LeaseSet: verification failed");
 			m_IsValid = false;
@@ -265,5 +265,39 @@ namespace data
 		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
 		return ts > m_ExpirationTime;
 	}
+
+	bool LeaseSetBufferValidate(const uint8_t * ptr, size_t sz, uint64_t & expires)
+	{
+		IdentityEx ident(ptr, sz);
+		size_t size = ident.GetFullLen ();
+		if (size > sz)
+		{
+			LogPrint (eLogError, "LeaseSet: identity length ", size, " exceeds buffer size ", sz);
+			return false;
+		}
+		// encryption key
+		size += 256;
+		// signing key (unused)
+		size += ident.GetSigningPublicKeyLen ();
+		uint8_t numLeases = ptr[size];
+		++size;
+		if (!numLeases || numLeases > MAX_NUM_LEASES)
+		{
+			LogPrint (eLogError, "LeaseSet: incorrect number of leases", (int)numLeases);
+			return false;
+		}
+		const uint8_t * leases = ptr + size;
+		expires = 0;
+		/** find lease with the max expiration timestamp */
+		for (int i = 0; i < numLeases; i++)
+		{
+			leases += 36; // gateway + tunnel ID
+			uint64_t endDate = bufbe64toh (leases);
+			leases += 8; // end date
+			if(endDate > expires)
+				expires = endDate;
+		}
+		return ident.Verify(ptr, leases - ptr, leases);
+	}
 }
 }
diff --git a/libi2pd/LeaseSet.h b/libi2pd/LeaseSet.h
index c7d2066e..fa24df2f 100644
--- a/libi2pd/LeaseSet.h
+++ b/libi2pd/LeaseSet.h
@@ -57,7 +57,7 @@ namespace data
 
 			LeaseSet (const uint8_t * buf, size_t len, bool storeLeases = true);
 			~LeaseSet () { delete[] m_Buffer; };
-			void Update (const uint8_t * buf, size_t len);
+			void Update (const uint8_t * buf, size_t len, bool verifySignature = true);
 			bool IsNewer (const uint8_t * buf, size_t len) const;
 			void PopulateLeases (); // from buffer
 
@@ -81,8 +81,8 @@ namespace data
 
 		private:
 
-			void ReadFromBuffer (bool readIdentity = true);
-			uint64_t ExtractTimestamp (const uint8_t * buf, size_t len) const; // min expiration time
+			void ReadFromBuffer (bool readIdentity = true, bool verifySignature = true);
+			uint64_t ExtractTimestamp (const uint8_t * buf, size_t len) const; // returns max expiration time
 
 		private:
 
@@ -95,6 +95,12 @@ namespace data
 			size_t m_BufferLen;
 	};
 
+	/**
+			validate lease set buffer signature and extract expiration timestamp
+			@returns true if the leaseset is well formed and signature is valid
+	 */
+	bool LeaseSetBufferValidate(const uint8_t * ptr, size_t sz, uint64_t & expires);
+
 	class LocalLeaseSet
 	{
 		public:
diff --git a/libi2pd/NTCPSession.cpp b/libi2pd/NTCPSession.cpp
index a340089c..e3d6c004 100644
--- a/libi2pd/NTCPSession.cpp
+++ b/libi2pd/NTCPSession.cpp
@@ -105,6 +105,11 @@ namespace transport
 		transports.PeerConnected (shared_from_this ());
 	}
 
+	boost::asio::io_service & NTCPSession::GetService()
+	{
+		return m_Server.GetService();
+	}
+
 	void NTCPSession::ClientLogin ()
 	{
 		if (!m_DHKeysPair)
@@ -171,27 +176,14 @@ namespace transport
 					return;
 				}
 			}
-#if (__GNUC__ == 4) && (__GNUC_MINOR__ <= 7)
-// due the bug in gcc 4.7. std::shared_future.get() is not const
-			if (!m_DHKeysPair)
-				m_DHKeysPair = transports.GetNextDHKeysPair ();
-			CreateAESKey (m_Establisher->phase1.pubKey);
-			SendPhase2 ();
-#else
 			// TODO: check for number of pending keys
 			auto s = shared_from_this ();
-			auto keyCreated = std::async (std::launch::async, [s] ()
-				{
+			m_Server.Work(s, [s]() -> std::function<void(void)> {
 					if (!s->m_DHKeysPair)
 						s->m_DHKeysPair = transports.GetNextDHKeysPair ();
 					s->CreateAESKey (s->m_Establisher->phase1.pubKey);
-				}).share ();
-			m_Server.GetService ().post ([s, keyCreated]()
-			{
-				keyCreated.get ();
-				s->SendPhase2 ();
+					return std::bind(&NTCPSession::SendPhase2, s);
 			});
-#endif
 		}
 	}
 
@@ -211,9 +203,8 @@ namespace transport
 		m_Decryption.SetIV (m_Establisher->phase1.HXxorHI + 16);
 
 		m_Encryption.Encrypt ((uint8_t *)&m_Establisher->phase2.encrypted, sizeof(m_Establisher->phase2.encrypted), (uint8_t *)&m_Establisher->phase2.encrypted);
-		boost::asio::async_write (m_Socket, boost::asio::buffer (&m_Establisher->phase2, sizeof (NTCPPhase2)), boost::asio::transfer_all (),
-					std::bind(&NTCPSession::HandlePhase2Sent, shared_from_this (), std::placeholders::_1, std::placeholders::_2, tsB));
-
+		boost::asio::async_write(m_Socket, boost::asio::buffer (&m_Establisher->phase2, sizeof (NTCPPhase2)), boost::asio::transfer_all(),
+			std::bind(&NTCPSession::HandlePhase2Sent, shared_from_this(), std::placeholders::_1, std::placeholders::_2, tsB));
 	}
 
 	void NTCPSession::HandlePhase2Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB)
@@ -250,24 +241,11 @@ namespace transport
 		}
 		else
 		{
-#if (__GNUC__ == 4) && (__GNUC_MINOR__ <= 7)
-// due the bug in gcc 4.7. std::shared_future.get() is not const
-			CreateAESKey (m_Establisher->phase2.pubKey);
-			HandlePhase2 ();
-#else
 			auto s = shared_from_this ();
-			// create AES key in separate thread
-			auto keyCreated = std::async (std::launch::async, [s] ()
-				{
-					s->CreateAESKey (s->m_Establisher->phase2.pubKey);
-				}).share (); // TODO: use move capture in C++ 14 instead shared_future
-			// let other operations execute while a key gets created
-			m_Server.GetService ().post ([s, keyCreated]()
-				{
-					keyCreated.get (); // we might wait if no more pending operations
-					s->HandlePhase2 ();
-				});
-#endif
+			m_Server.Work(s, [s]() -> std::function<void(void)> {
+				s->CreateAESKey (s->m_Establisher->phase2.pubKey);
+				return std::bind(&NTCPSession::HandlePhase2, s);
+			});
 		}
 	}
 
@@ -788,12 +766,14 @@ namespace transport
 	}
 
 //-----------------------------------------
-	NTCPServer::NTCPServer ():
+	NTCPServer::NTCPServer (int workers):
 		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service),
 		m_TerminationTimer (m_Service), m_NTCPAcceptor (nullptr), m_NTCPV6Acceptor (nullptr),
 		m_ProxyType(eNoProxy), m_Resolver(m_Service), m_ProxyEndpoint(nullptr),
 		m_SoftLimit(0), m_HardLimit(0)
 	{
+		if(workers <= 0) workers = 1;
+		m_CryptoPool = std::make_shared<Pool>(workers);
 	}
 
 	NTCPServer::~NTCPServer ()
diff --git a/libi2pd/NTCPSession.h b/libi2pd/NTCPSession.h
index b64f63aa..5335fbdd 100644
--- a/libi2pd/NTCPSession.h
+++ b/libi2pd/NTCPSession.h
@@ -12,6 +12,7 @@
 #include "RouterInfo.h"
 #include "I2NPProtocol.h"
 #include "TransportSession.h"
+#include "CryptoWorker.h"
 
 namespace i2p
 {
@@ -55,6 +56,7 @@ namespace transport
 			void Done ();
 
 			boost::asio::ip::tcp::socket& GetSocket () { return m_Socket; };
+			boost::asio::io_service & GetService();
 			bool IsEstablished () const { return m_IsEstablished; };
 			bool IsTerminated () const { return m_IsTerminated; };
 
@@ -131,6 +133,8 @@ namespace transport
 	{
 		public:
 
+			typedef i2p::worker::ThreadPool<NTCPSession> Pool;
+
 			enum RemoteAddressType
 			{
 				eIP4Address,
@@ -146,7 +150,7 @@ namespace transport
 			};
 
 
-			NTCPServer ();
+			NTCPServer (int workers=4);
 			~NTCPServer ();
 
 			void Start ();
@@ -169,6 +173,10 @@ namespace transport
 
 			void SetSessionLimits(uint16_t softLimit, uint16_t hardLimit) { m_SoftLimit = softLimit; m_HardLimit = hardLimit; }
 			bool ShouldLimit() const { return ShouldHardLimit() || ShouldSoftLimit(); }
+			void Work(std::shared_ptr<NTCPSession> conn, Pool::WorkFunc work)
+			{
+				m_CryptoPool->Offer({conn, work});
+			}
 		private:
 
 			/** @brief return true for hard limit */
@@ -210,6 +218,8 @@ namespace transport
 			boost::asio::ip::tcp::resolver m_Resolver;
 			boost::asio::ip::tcp::endpoint * m_ProxyEndpoint;
 
+			std::shared_ptr<Pool> m_CryptoPool;
+
 			uint16_t m_SoftLimit, m_HardLimit;
 		public:
 
diff --git a/libi2pd/NetDb.cpp b/libi2pd/NetDb.cpp
index 0215c570..b136dfd5 100644
--- a/libi2pd/NetDb.cpp
+++ b/libi2pd/NetDb.cpp
@@ -237,22 +237,20 @@ namespace data
 			auto it = m_LeaseSets.find(ident);
 			if (it != m_LeaseSets.end ())
 			{
-				if (it->second->IsNewer (buf, len))
+				uint64_t expires;
+				if(LeaseSetBufferValidate(buf, len, expires))
 				{
-					it->second->Update (buf, len);
-					if (it->second->IsValid ())
+					if(it->second->GetExpirationTime() < expires)
 					{
+						it->second->Update (buf, len, false); // signature is verified already
 						LogPrint (eLogInfo, "NetDb: LeaseSet updated: ", ident.ToBase32());
 						updated = true;
 					}
 					else
-					{
-						LogPrint (eLogWarning, "NetDb: LeaseSet update failed: ", ident.ToBase32());
-						m_LeaseSets.erase (it);
-					}
+						LogPrint(eLogDebug, "NetDb: LeaseSet is older: ", ident.ToBase32());
 				}
 				else
-					LogPrint (eLogDebug, "NetDb: LeaseSet is older: ", ident.ToBase32());
+					LogPrint(eLogError, "NetDb: LeaseSet is invalid: ", ident.ToBase32());
 			}
 			else
 			{
diff --git a/libi2pd/Queue.h b/libi2pd/Queue.h
index d701e4b8..0438cc37 100644
--- a/libi2pd/Queue.h
+++ b/libi2pd/Queue.h
@@ -32,7 +32,7 @@ namespace util
 				{
 					std::unique_lock<std::mutex>  l(m_QueueMutex);
 					for (const auto& it: vec)
-						m_Queue.push (it);
+						m_Queue.push (std::move(it));
 					m_NonEmpty.notify_one ();
 				}
 			}
diff --git a/libi2pd/Streaming.cpp b/libi2pd/Streaming.cpp
index 37d9d2c4..91acc9d0 100644
--- a/libi2pd/Streaming.cpp
+++ b/libi2pd/Streaming.cpp
@@ -378,9 +378,15 @@ namespace stream
 
 	size_t Stream::Send (const uint8_t * buf, size_t len)
 	{
-		// TODO: check max buffer size
+		size_t sent = len;
+		while(len > MAX_PACKET_SIZE)
+		{
+			AsyncSend (buf, MAX_PACKET_SIZE, nullptr);
+			buf += MAX_PACKET_SIZE;
+			len -= MAX_PACKET_SIZE;
+		}
 		AsyncSend (buf, len, nullptr);
-		return len;
+		return sent;
 	}
 
 	void Stream::AsyncSend (const uint8_t * buf, size_t len, SendHandler handler)
@@ -572,7 +578,9 @@ namespace stream
 				if (m_SentPackets.empty () && m_SendBuffer.IsEmpty ()) // nothing to send
 				{
 					m_Status = eStreamStatusClosed;
-					SendClose ();
+					// close could be called from another thread so do SendClose from the destination thread
+					// this is so m_LocalDestination.NewPacket () does not trigger a race condition
+					m_Service.post(std::bind(&Stream::SendClose, shared_from_this()));
 				}
 			break;
 			case eStreamStatusClosed:
diff --git a/libi2pd/Streaming.h b/libi2pd/Streaming.h
index 202ff73f..a114844d 100644
--- a/libi2pd/Streaming.h
+++ b/libi2pd/Streaming.h
@@ -276,10 +276,9 @@ namespace stream
 			/** set max connections per minute per destination */
 			void SetMaxConnsPerMinute(const uint32_t conns);
 
-			Packet * NewPacket () { return m_PacketsPool.Acquire (); }
-			void DeletePacket (Packet * p) { m_PacketsPool.Release (p); }
+			Packet * NewPacket () { return m_PacketsPool.Acquire(); }
+			void DeletePacket (Packet * p) { return m_PacketsPool.Release(p); }
 
-		private:
 
 			void AcceptOnceAcceptor (std::shared_ptr<Stream> stream, Acceptor acceptor, Acceptor prev);
 
@@ -334,16 +333,21 @@ namespace stream
 	void Stream::AsyncReceive (const Buffer& buffer, ReceiveHandler handler, int timeout)
 	{
 		auto s = shared_from_this();
-		m_Service.post ([=](void)
+		m_Service.post ([s, buffer, handler, timeout](void)
 		{
 			if (!s->m_ReceiveQueue.empty () || s->m_Status == eStreamStatusReset)
 				s->HandleReceiveTimer (boost::asio::error::make_error_code (boost::asio::error::operation_aborted), buffer, handler, 0);
 			else
 			{
-				int t = (timeout > MAX_RECEIVE_TIMEOUT) ?  MAX_RECEIVE_TIMEOUT : timeout;
+				int t = (timeout > MAX_RECEIVE_TIMEOUT) ? MAX_RECEIVE_TIMEOUT : timeout;
 				s->m_ReceiveTimer.expires_from_now (boost::posix_time::seconds(t));
-				s->m_ReceiveTimer.async_wait ([=](const boost::system::error_code& ecode)
-					{ s->HandleReceiveTimer (ecode, buffer, handler, timeout - t); });
+				int left = timeout - t;
+				auto self = s->shared_from_this();
+				self->m_ReceiveTimer.async_wait (
+					[self, buffer, handler, left](const boost::system::error_code & ec)
+					{
+						self->HandleReceiveTimer(ec, buffer, handler, left);
+					});
 			}
 		});
 	}
diff --git a/libi2pd/Transports.cpp b/libi2pd/Transports.cpp
index 6dcbe56d..9914c75e 100644
--- a/libi2pd/Transports.cpp
+++ b/libi2pd/Transports.cpp
@@ -153,9 +153,10 @@ namespace transport
 		m_Thread = new std::thread (std::bind (&Transports::Run, this));
 		std::string ntcpproxy; i2p::config::GetOption("ntcpproxy", ntcpproxy);
 		i2p::http::URL proxyurl;
-		uint16_t softLimit, hardLimit;
+		uint16_t softLimit, hardLimit, threads;
 		i2p::config::GetOption("limits.ntcpsoft", softLimit);
 		i2p::config::GetOption("limits.ntcphard", hardLimit);
+		i2p::config::GetOption("limits.ntcpthreads", threads);
 		if(softLimit > 0 && hardLimit > 0 && softLimit >= hardLimit)
 		{
 			LogPrint(eLogError, "ntcp soft limit must be less than ntcp hard limit");
@@ -167,7 +168,7 @@ namespace transport
 			{
 				if(proxyurl.schema == "socks" || proxyurl.schema == "http")
 				{
-					m_NTCPServer = new NTCPServer();
+					m_NTCPServer = new NTCPServer(threads);
 					m_NTCPServer->SetSessionLimits(softLimit, hardLimit);
 					NTCPServer::ProxyType proxytype = NTCPServer::eSocksProxy;
 
@@ -198,7 +199,7 @@ namespace transport
 			if (!address) continue;
 			if (m_NTCPServer == nullptr && enableNTCP)
 			{
-				m_NTCPServer = new NTCPServer ();
+				m_NTCPServer = new NTCPServer (threads);
 				m_NTCPServer->SetSessionLimits(softLimit, hardLimit);
 				m_NTCPServer->Start ();
 				if (!(m_NTCPServer->IsBoundV6() || m_NTCPServer->IsBoundV4())) {
diff --git a/libi2pd/Tunnel.cpp b/libi2pd/Tunnel.cpp
index e2c12b83..c7e1b1b4 100644
--- a/libi2pd/Tunnel.cpp
+++ b/libi2pd/Tunnel.cpp
@@ -670,10 +670,13 @@ namespace tunnel
 					{
 						if (!tunnel->IsRecreated () && ts + TUNNEL_RECREATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
 						{
-							tunnel->SetIsRecreated ();
 							auto pool = tunnel->GetTunnelPool ();
-							if (pool)
+							// let it die if the tunnel pool has been reconfigured and this is old
+							if (pool && tunnel->GetNumHops() == pool->GetNumOutboundHops())
+							{
+								tunnel->SetIsRecreated ();
 								pool->RecreateOutboundTunnel (tunnel);
+							}
 						}
 						if (ts + TUNNEL_EXPIRATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
 							tunnel->SetState (eTunnelStateExpiring);
@@ -721,10 +724,13 @@ namespace tunnel
 					{
 						if (!tunnel->IsRecreated () && ts + TUNNEL_RECREATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
 						{
-							tunnel->SetIsRecreated ();
 							auto pool = tunnel->GetTunnelPool ();
-							if (pool)
+							// let it die if the tunnel pool was reconfigured and has different number of hops
+							if (pool && tunnel->GetNumHops() == pool->GetNumInboundHops())
+							{
+								tunnel->SetIsRecreated ();
 								pool->RecreateInboundTunnel (tunnel);
+							}
 						}
 
 						if (ts + TUNNEL_EXPIRATION_THRESHOLD > tunnel->GetCreationTime () + TUNNEL_EXPIRATION_TIMEOUT)
diff --git a/libi2pd/Tunnel.h b/libi2pd/Tunnel.h
index 38beccaa..3244faad 100644
--- a/libi2pd/Tunnel.h
+++ b/libi2pd/Tunnel.h
@@ -105,6 +105,7 @@ namespace tunnel
 			bool IsFailed () const { return m_State == eTunnelStateFailed; };
 			bool IsRecreated () const { return m_IsRecreated; };
 			void SetIsRecreated () { m_IsRecreated = true; };
+			int GetNumHops () const { return m_Hops.size (); };
 			virtual bool IsInbound() const = 0;
 
 			std::shared_ptr<TunnelPool> GetTunnelPool () const { return m_Pool; };
diff --git a/libi2pd/TunnelBase.h b/libi2pd/TunnelBase.h
index 8b7fb408..53782ae3 100644
--- a/libi2pd/TunnelBase.h
+++ b/libi2pd/TunnelBase.h
@@ -59,13 +59,14 @@ namespace tunnel
 
 	struct TunnelCreationTimeCmp
 	{
-		bool operator() (std::shared_ptr<const TunnelBase> t1, std::shared_ptr<const TunnelBase> t2) const
+		template<typename T>
+		bool operator() (const std::shared_ptr<T> & t1, const std::shared_ptr<T> & t2) const
 		{
 			if (t1->GetCreationTime () != t2->GetCreationTime ())
 				return t1->GetCreationTime () > t2->GetCreationTime ();
 			else
 				return t1 < t2;
-		};
+		}
 	};
 }
 }
diff --git a/libi2pd/TunnelConfig.h b/libi2pd/TunnelConfig.h
index 7267fc30..9707fa17 100644
--- a/libi2pd/TunnelConfig.h
+++ b/libi2pd/TunnelConfig.h
@@ -35,6 +35,7 @@ namespace tunnel
 			RAND_bytes (replyKey, 32);
 			RAND_bytes (replyIV, 16);
 			RAND_bytes ((uint8_t *)&tunnelID, 4);
+			if (!tunnelID) tunnelID = 1; // tunnelID can't be zero
 			isGateway = true;
 			isEndpoint = true;
 			ident = r;
@@ -50,6 +51,7 @@ namespace tunnel
 			nextIdent = ident;
 			isEndpoint = false;
 			RAND_bytes ((uint8_t *)&nextTunnelID, 4);
+			if (!nextTunnelID) nextTunnelID = 1; // tunnelID can't be zero
 		}
 
 		void SetReplyHop (uint32_t replyTunnelID, const i2p::data::IdentHash& replyIdent)
diff --git a/libi2pd/TunnelPool.cpp b/libi2pd/TunnelPool.cpp
index 52736fa0..4f740a09 100644
--- a/libi2pd/TunnelPool.cpp
+++ b/libi2pd/TunnelPool.cpp
@@ -69,6 +69,18 @@ namespace tunnel
 		m_Tests.clear ();
 	}
 
+	bool TunnelPool::Reconfigure(int inHops, int outHops, int inQuant, int outQuant)	{
+		if( inHops >= 0 && outHops >= 0 && inQuant > 0 && outQuant > 0)
+		{
+			m_NumInboundHops = inHops;
+			m_NumOutboundHops = outHops;
+			m_NumInboundTunnels = inQuant;
+			m_NumOutboundTunnels = outQuant;
+			return true;
+		}
+		return false;
+	}
+	
 	void TunnelPool::TunnelCreated (std::shared_ptr<InboundTunnel> createdTunnel)
 	{
 		if (!m_IsActive) return;
@@ -479,11 +491,17 @@ namespace tunnel
 			outboundTunnel = tunnels.GetNextOutboundTunnel ();
 		LogPrint (eLogDebug, "Tunnels: Re-creating destination inbound tunnel...");
 		std::shared_ptr<TunnelConfig> config;
-		if (m_NumInboundHops > 0) config = std::make_shared<TunnelConfig>(tunnel->GetPeers ());
-		auto newTunnel = tunnels.CreateInboundTunnel (config, outboundTunnel);
-		newTunnel->SetTunnelPool (shared_from_this());
-		if (newTunnel->IsEstablished ()) // zero hops
-			TunnelCreated (newTunnel);
+		if (m_NumInboundHops > 0 && tunnel->GetPeers().size())
+		{
+			config = std::make_shared<TunnelConfig>(tunnel->GetPeers ());
+		}
+		if (m_NumInboundHops == 0 || config)
+		{
+			auto newTunnel = tunnels.CreateInboundTunnel (config, outboundTunnel);
+			newTunnel->SetTunnelPool (shared_from_this());
+			if (newTunnel->IsEstablished ()) // zero hops
+				TunnelCreated (newTunnel);
+		}
 	}
 
 	void TunnelPool::CreateOutboundTunnel ()
@@ -521,12 +539,17 @@ namespace tunnel
 		{
 			LogPrint (eLogDebug, "Tunnels: Re-creating destination outbound tunnel...");
 			std::shared_ptr<TunnelConfig> config;
-			if (m_NumOutboundHops > 0)
+			if (m_NumOutboundHops > 0 && tunnel->GetPeers().size())
+			{
 				config = std::make_shared<TunnelConfig>(tunnel->GetPeers (), inboundTunnel->GetNextTunnelID (), inboundTunnel->GetNextIdentHash ());
-			auto newTunnel = tunnels.CreateOutboundTunnel (config);
-			newTunnel->SetTunnelPool (shared_from_this ());
-			if (newTunnel->IsEstablished ()) // zero hops
-				TunnelCreated (newTunnel);
+			}
+			if(m_NumOutboundHops == 0 || config)
+			{
+				auto newTunnel = tunnels.CreateOutboundTunnel (config);
+				newTunnel->SetTunnelPool (shared_from_this ());
+				if (newTunnel->IsEstablished ()) // zero hops
+					TunnelCreated (newTunnel);
+			}
 		}
 		else
 			LogPrint (eLogDebug, "Tunnels: Can't re-create outbound tunnel, no inbound tunnels found");
diff --git a/libi2pd/TunnelPool.h b/libi2pd/TunnelPool.h
index 07c3024e..fc46930c 100644
--- a/libi2pd/TunnelPool.h
+++ b/libi2pd/TunnelPool.h
@@ -78,7 +78,12 @@ namespace tunnel
 
 			int GetNumInboundTunnels () const { return m_NumInboundTunnels; };
 			int GetNumOutboundTunnels () const { return m_NumOutboundTunnels; };
+			int GetNumInboundHops() const { return m_NumInboundHops; };
+			int GetNumOutboundHops() const { return m_NumOutboundHops; };
 
+			/** i2cp reconfigure */
+			bool Reconfigure(int inboundHops, int outboundHops, int inboundQuant, int outboundQuant);
+    
 			void SetCustomPeerSelector(ITunnelPeerSelector * selector);
 			void UnsetCustomPeerSelector();
 			bool HasCustomPeerSelector();
diff --git a/libi2pd/version.h b/libi2pd/version.h
index b443ea6f..36e7eb6e 100644
--- a/libi2pd/version.h
+++ b/libi2pd/version.h
@@ -7,7 +7,7 @@
 #define MAKE_VERSION(a,b,c) STRINGIZE(a) "." STRINGIZE(b) "." STRINGIZE(c)
 
 #define I2PD_VERSION_MAJOR 2
-#define I2PD_VERSION_MINOR 17
+#define I2PD_VERSION_MINOR 18
 #define I2PD_VERSION_MICRO 0
 #define I2PD_VERSION_PATCH 0
 #define I2PD_VERSION MAKE_VERSION(I2PD_VERSION_MAJOR, I2PD_VERSION_MINOR, I2PD_VERSION_MICRO)
@@ -21,7 +21,7 @@
 
 #define I2P_VERSION_MAJOR 0
 #define I2P_VERSION_MINOR 9
-#define I2P_VERSION_MICRO 32
+#define I2P_VERSION_MICRO 33
 #define I2P_VERSION_PATCH 0
 #define I2P_VERSION MAKE_VERSION(I2P_VERSION_MAJOR, I2P_VERSION_MINOR, I2P_VERSION_MICRO)
 
diff --git a/libi2pd_client/AddressBook.cpp b/libi2pd_client/AddressBook.cpp
index 4dfeeb53..f29ecee3 100644
--- a/libi2pd_client/AddressBook.cpp
+++ b/libi2pd_client/AddressBook.cpp
@@ -207,7 +207,7 @@ namespace client
 
 //---------------------------------------------------------------------
 	AddressBook::AddressBook (): m_Storage(nullptr), m_IsLoaded (false), m_IsDownloading (false),
-		m_DefaultSubscription (nullptr), m_SubscriptionsUpdateTimer (nullptr)
+		m_NumRetries (0), m_DefaultSubscription (nullptr), m_SubscriptionsUpdateTimer (nullptr)
 	{
 	}
 
@@ -486,9 +486,13 @@ namespace client
 	void AddressBook::DownloadComplete (bool success, const i2p::data::IdentHash& subscription, const std::string& etag, const std::string& lastModified)
 	{
 		m_IsDownloading = false;
-		int nextUpdateTimeout = CONTINIOUS_SUBSCRIPTION_RETRY_TIMEOUT;
+		m_NumRetries++;
+		int nextUpdateTimeout = m_NumRetries*CONTINIOUS_SUBSCRIPTION_RETRY_TIMEOUT;
+		if (m_NumRetries > CONTINIOUS_SUBSCRIPTION_MAX_NUM_RETRIES || nextUpdateTimeout > CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT)
+			nextUpdateTimeout = CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT;
 		if (success)
 		{
+			m_NumRetries = 0;
 			if (m_DefaultSubscription) m_DefaultSubscription = nullptr;
 			if (m_IsLoaded)
 				nextUpdateTimeout = CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT;
@@ -692,7 +696,7 @@ namespace client
 			std::unique_lock<std::mutex> l(newDataReceivedMutex);
 			i2p::client::context.GetSharedLocalDestination ()->RequestDestination (m_Ident,
 				[&newDataReceived, &leaseSet, &newDataReceivedMutex](std::shared_ptr<i2p::data::LeaseSet> ls)
-			    {
+				{
 					leaseSet = ls;
 					std::unique_lock<std::mutex> l1(newDataReceivedMutex);
 					newDataReceived.notify_all ();
@@ -749,7 +753,7 @@ namespace client
 						end = true;
 					newDataReceived.notify_all ();
 				},
-				30); // wait for 30 seconds
+				SUBSCRIPTION_REQUEST_TIMEOUT);
 			std::unique_lock<std::mutex> l(newDataReceivedMutex);
 			if (newDataReceived.wait_for (l, std::chrono::seconds (SUBSCRIPTION_REQUEST_TIMEOUT)) == std::cv_status::timeout)
 			{
diff --git a/libi2pd_client/AddressBook.h b/libi2pd_client/AddressBook.h
index 3feb2ece..19257eca 100644
--- a/libi2pd_client/AddressBook.h
+++ b/libi2pd_client/AddressBook.h
@@ -22,7 +22,8 @@ namespace client
 	const int INITIAL_SUBSCRIPTION_RETRY_TIMEOUT = 1; // in minutes
 	const int CONTINIOUS_SUBSCRIPTION_UPDATE_TIMEOUT = 720; // in minutes (12 hours)
 	const int CONTINIOUS_SUBSCRIPTION_RETRY_TIMEOUT = 5; // in minutes
-	const int SUBSCRIPTION_REQUEST_TIMEOUT = 60; //in second
+	const int CONTINIOUS_SUBSCRIPTION_MAX_NUM_RETRIES = 10; // then update timeout
+	const int SUBSCRIPTION_REQUEST_TIMEOUT = 120; //in second
 
 	const uint16_t ADDRESS_RESOLVER_DATAGRAM_PORT = 53;
 	const uint16_t ADDRESS_RESPONSE_DATAGRAM_PORT = 54;
@@ -97,6 +98,7 @@ namespace client
 			std::map<uint32_t, std::string> m_Lookups; // nonce -> address
 			AddressBookStorage * m_Storage;
 			volatile bool m_IsLoaded, m_IsDownloading;
+			int m_NumRetries;
 			std::vector<std::shared_ptr<AddressBookSubscription> > m_Subscriptions;
 			std::shared_ptr<AddressBookSubscription> m_DefaultSubscription; // in case if we don't know any addresses yet
 			boost::asio::deadline_timer * m_SubscriptionsUpdateTimer;
diff --git a/libi2pd_client/ClientContext.cpp b/libi2pd_client/ClientContext.cpp
index 41b8615a..fb8fff97 100644
--- a/libi2pd_client/ClientContext.cpp
+++ b/libi2pd_client/ClientContext.cpp
@@ -35,87 +35,18 @@ namespace client
 
 	void ClientContext::Start ()
 	{
+		// shared local destination
 		if (!m_SharedLocalDestination)
-		{
-			m_SharedLocalDestination = CreateNewLocalDestination (); // non-public, DSA
-			m_SharedLocalDestination->Acquire ();
-			m_Destinations[m_SharedLocalDestination->GetIdentity ()->GetIdentHash ()] = m_SharedLocalDestination;
-			m_SharedLocalDestination->Start ();
-		}
-
+			CreateNewSharedLocalDestination ();
 
+		// addressbook	
 		m_AddressBook.Start ();
 
-		std::shared_ptr<ClientDestination> localDestination;
-		bool httproxy; i2p::config::GetOption("httpproxy.enabled", httproxy);
-		if (httproxy)
-		{
-			std::string httpProxyKeys; i2p::config::GetOption("httpproxy.keys",    httpProxyKeys);
-			std::string httpProxyAddr; i2p::config::GetOption("httpproxy.address", httpProxyAddr);
-			uint16_t    httpProxyPort; i2p::config::GetOption("httpproxy.port",    httpProxyPort);
-			i2p::data::SigningKeyType sigType; i2p::config::GetOption("httpproxy.signaturetype",  sigType);
-			std::string httpOutProxyURL; i2p::config::GetOption("httpproxy.outproxy",     httpOutProxyURL);
-			LogPrint(eLogInfo, "Clients: starting HTTP Proxy at ", httpProxyAddr, ":", httpProxyPort);
-			if (httpProxyKeys.length () > 0)
-			{
-				i2p::data::PrivateKeys keys;
-				if(LoadPrivateKeys (keys, httpProxyKeys, sigType))
-				{
-					std::map<std::string, std::string> params;
-					ReadI2CPOptionsFromConfig ("httpproxy.", params);
-					localDestination = CreateNewLocalDestination (keys, false, &params);
-					localDestination->Acquire ();
-				}
-				else
-					LogPrint(eLogError, "Clients: failed to load HTTP Proxy key");
-			}
-			try
-			{
-				m_HttpProxy = new i2p::proxy::HTTPProxy("HTTP Proxy", httpProxyAddr, httpProxyPort, httpOutProxyURL, localDestination);
-				m_HttpProxy->Start();
-			}
-			catch (std::exception& e)
-			{
-				LogPrint(eLogError, "Clients: Exception in HTTP Proxy: ", e.what());
-			}
-		}
+		// HTTP proxy
+		ReadHttpProxy ();
 
-		localDestination = nullptr;
-		bool socksproxy; i2p::config::GetOption("socksproxy.enabled", socksproxy);
-		if (socksproxy)
-		{
-			std::string socksProxyKeys; i2p::config::GetOption("socksproxy.keys",     socksProxyKeys);
-			std::string socksProxyAddr; i2p::config::GetOption("socksproxy.address",  socksProxyAddr);
-			uint16_t    socksProxyPort; i2p::config::GetOption("socksproxy.port",     socksProxyPort);
-			bool socksOutProxy; i2p::config::GetOption("socksproxy.outproxy.enabled", socksOutProxy);
-			std::string socksOutProxyAddr; i2p::config::GetOption("socksproxy.outproxy",     socksOutProxyAddr);
-			uint16_t    socksOutProxyPort; i2p::config::GetOption("socksproxy.outproxyport", socksOutProxyPort);
-			i2p::data::SigningKeyType sigType; i2p::config::GetOption("socksproxy.signaturetype",  sigType);
-			LogPrint(eLogInfo, "Clients: starting SOCKS Proxy at ", socksProxyAddr, ":", socksProxyPort);
-			if (socksProxyKeys.length () > 0)
-			{
-				i2p::data::PrivateKeys keys;
-				if (LoadPrivateKeys (keys, socksProxyKeys, sigType))
-				{
-					std::map<std::string, std::string> params;
-					ReadI2CPOptionsFromConfig ("socksproxy.", params);
-					localDestination = CreateNewLocalDestination (keys, false, &params);
-					localDestination->Acquire ();
-				}
-				else
-					LogPrint(eLogError, "Clients: failed to load SOCKS Proxy key");
-			}
-			try
-			{
-				m_SocksProxy = new i2p::proxy::SOCKSProxy("SOCKS", socksProxyAddr, socksProxyPort,
-					socksOutProxy, socksOutProxyAddr, socksOutProxyPort, localDestination);
-				m_SocksProxy->Start();
-			}
-			catch (std::exception& e)
-			{
-				LogPrint(eLogError, "Clients: Exception in SOCKS Proxy: ", e.what());
-			}
-		}
+		// SOCKS proxy
+		ReadSocksProxy ();
 
 		// I2P tunnels
 		ReadTunnels ();
@@ -267,6 +198,26 @@ namespace client
 		// delete not updated tunnels (not in config anymore)
 		VisitTunnels ([](I2PService * s)->bool { return s->isUpdated; });
 
+		// change shared local destination
+		m_SharedLocalDestination->Release ();
+		CreateNewSharedLocalDestination ();
+
+		// recreate HTTP proxy
+		if (m_HttpProxy)
+		{
+			m_HttpProxy->Stop ();
+			m_HttpProxy = nullptr;
+		}		
+		ReadHttpProxy ();
+	
+		// recreate SOCKS proxy
+		if (m_SocksProxy)
+		{
+			m_SocksProxy->Stop ();
+			m_SocksProxy = nullptr;
+		}		
+		ReadSocksProxy ();	
+
 		// delete unused destinations
 		std::unique_lock<std::mutex> l(m_DestinationsMutex);
 		for (auto it = m_Destinations.begin (); it != m_Destinations.end ();)
@@ -407,6 +358,14 @@ namespace client
 		return localDestination;
 	}
 
+	void ClientContext::CreateNewSharedLocalDestination ()
+	{
+		m_SharedLocalDestination = CreateNewLocalDestination (); // non-public, DSA
+		m_SharedLocalDestination->Acquire ();
+		m_Destinations[m_SharedLocalDestination->GetIdentity ()->GetIdentHash ()] = m_SharedLocalDestination;
+		m_SharedLocalDestination->Start ();
+	}
+
 	std::shared_ptr<ClientDestination> ClientContext::FindLocalDestination (const i2p::data::IdentHash& destination) const
 	{
 		auto it = m_Destinations.find (destination);
@@ -716,6 +675,83 @@ namespace client
 		LogPrint (eLogInfo, "Clients: ", numServerTunnels, " I2P server tunnels created");
 	}
 
+	void ClientContext::ReadHttpProxy ()
+	{
+		std::shared_ptr<ClientDestination> localDestination;
+		bool httproxy; i2p::config::GetOption("httpproxy.enabled", httproxy);
+		if (httproxy)
+		{
+			std::string httpProxyKeys; i2p::config::GetOption("httpproxy.keys",    httpProxyKeys);
+			std::string httpProxyAddr; i2p::config::GetOption("httpproxy.address", httpProxyAddr);
+			uint16_t    httpProxyPort; i2p::config::GetOption("httpproxy.port",    httpProxyPort);
+			i2p::data::SigningKeyType sigType; i2p::config::GetOption("httpproxy.signaturetype",  sigType);
+			std::string httpOutProxyURL; i2p::config::GetOption("httpproxy.outproxy",     httpOutProxyURL);
+			LogPrint(eLogInfo, "Clients: starting HTTP Proxy at ", httpProxyAddr, ":", httpProxyPort);
+			if (httpProxyKeys.length () > 0)
+			{
+				i2p::data::PrivateKeys keys;
+				if(LoadPrivateKeys (keys, httpProxyKeys, sigType))
+				{
+					std::map<std::string, std::string> params;
+					ReadI2CPOptionsFromConfig ("httpproxy.", params);
+					localDestination = CreateNewLocalDestination (keys, false, &params);
+					localDestination->Acquire ();
+				}
+				else
+					LogPrint(eLogError, "Clients: failed to load HTTP Proxy key");
+			}
+			try
+			{
+				m_HttpProxy = new i2p::proxy::HTTPProxy("HTTP Proxy", httpProxyAddr, httpProxyPort, httpOutProxyURL, localDestination);
+				m_HttpProxy->Start();
+			}
+			catch (std::exception& e)
+			{
+				LogPrint(eLogError, "Clients: Exception in HTTP Proxy: ", e.what());
+			}
+		}
+	}
+	
+	void ClientContext::ReadSocksProxy ()
+	{
+		std::shared_ptr<ClientDestination> localDestination;
+		bool socksproxy; i2p::config::GetOption("socksproxy.enabled", socksproxy);
+		if (socksproxy)
+		{
+			std::string socksProxyKeys; i2p::config::GetOption("socksproxy.keys",     socksProxyKeys);
+			std::string socksProxyAddr; i2p::config::GetOption("socksproxy.address",  socksProxyAddr);
+			uint16_t    socksProxyPort; i2p::config::GetOption("socksproxy.port",     socksProxyPort);
+			bool socksOutProxy; i2p::config::GetOption("socksproxy.outproxy.enabled", socksOutProxy);
+			std::string socksOutProxyAddr; i2p::config::GetOption("socksproxy.outproxy",     socksOutProxyAddr);
+			uint16_t    socksOutProxyPort; i2p::config::GetOption("socksproxy.outproxyport", socksOutProxyPort);
+			i2p::data::SigningKeyType sigType; i2p::config::GetOption("socksproxy.signaturetype",  sigType);
+			LogPrint(eLogInfo, "Clients: starting SOCKS Proxy at ", socksProxyAddr, ":", socksProxyPort);
+			if (socksProxyKeys.length () > 0)
+			{
+				i2p::data::PrivateKeys keys;
+				if (LoadPrivateKeys (keys, socksProxyKeys, sigType))
+				{
+					std::map<std::string, std::string> params;
+					ReadI2CPOptionsFromConfig ("socksproxy.", params);
+					localDestination = CreateNewLocalDestination (keys, false, &params);
+					localDestination->Acquire ();
+				}
+				else
+					LogPrint(eLogError, "Clients: failed to load SOCKS Proxy key");
+			}
+			try
+			{
+				m_SocksProxy = new i2p::proxy::SOCKSProxy("SOCKS", socksProxyAddr, socksProxyPort,
+					socksOutProxy, socksOutProxyAddr, socksOutProxyPort, localDestination);
+				m_SocksProxy->Start();
+			}
+			catch (std::exception& e)
+			{
+				LogPrint(eLogError, "Clients: Exception in SOCKS Proxy: ", e.what());
+			}
+		}
+	}
+
 	void ClientContext::ScheduleCleanupUDP()
 	{
 		if (m_CleanupUDPTimer)
diff --git a/libi2pd_client/ClientContext.h b/libi2pd_client/ClientContext.h
index 8f7143bb..922d7acc 100644
--- a/libi2pd_client/ClientContext.h
+++ b/libi2pd_client/ClientContext.h
@@ -87,6 +87,8 @@ namespace client
 		private:
 
 			void ReadTunnels ();
+			void ReadHttpProxy ();
+			void ReadSocksProxy ();
 			template<typename Section, typename Type>
 			std::string GetI2CPOption (const Section& section, const std::string& name, const Type& value) const;
 			template<typename Section>
@@ -99,6 +101,8 @@ namespace client
 			template<typename Visitor>
 			void VisitTunnels (Visitor v); // Visitor: (I2PService *) -> bool, true means retain
 
+			void CreateNewSharedLocalDestination (); 
+
 		private:
 
 			std::mutex m_DestinationsMutex;
diff --git a/libi2pd_client/I2CP.cpp b/libi2pd_client/I2CP.cpp
index 371456ee..361d9f94 100644
--- a/libi2pd_client/I2CP.cpp
+++ b/libi2pd_client/I2CP.cpp
@@ -416,9 +416,60 @@ namespace client
 
 	void I2CPSession::ReconfigureSessionMessageHandler (const uint8_t * buf, size_t len)
 	{
-		// TODO: implement actual reconfiguration
-		SendSessionStatusMessage (2); // updated
-	}
+		uint8_t status = 3; // rejected
+		if(len > sizeof(uint16_t))
+		{
+			uint16_t sessionID = bufbe16toh(buf);
+			if(sessionID == m_SessionID)
+			{
+				buf += sizeof(uint16_t);
+				const uint8_t * body = buf;
+				i2p::data::IdentityEx ident;
+				if(ident.FromBuffer(buf, len - sizeof(uint16_t)))
+				{
+					if (ident == *m_Destination->GetIdentity())
+					{
+						size_t identsz = ident.GetFullLen();
+						buf += identsz;
+						uint16_t optssize = bufbe16toh(buf);
+						if (optssize <= len - sizeof(uint16_t) - sizeof(uint64_t) - identsz - ident.GetSignatureLen() - sizeof(uint16_t))
+						{
+							buf += sizeof(uint16_t);
+							std::map<std::string, std::string> opts;
+							ExtractMapping(buf, optssize, opts);
+							buf += optssize;
+							//uint64_t date = bufbe64toh(buf);
+							buf += sizeof(uint64_t);
+							const uint8_t * sig = buf;
+							if(ident.Verify(body, len - sizeof(uint16_t) - ident.GetSignatureLen(), sig))
+							{
+								if(m_Destination->Reconfigure(opts))
+								{
+									LogPrint(eLogInfo, "I2CP: reconfigured destination");
+									status = 2; // updated
+								}
+								else
+									LogPrint(eLogWarning, "I2CP: failed to reconfigure destination");
+							}
+							else
+								LogPrint(eLogError, "I2CP: invalid reconfigure message signature");
+						}
+						else
+							LogPrint(eLogError, "I2CP: mapping size missmatch");
+					}
+					else
+						LogPrint(eLogError, "I2CP: destination missmatch");
+				}
+				else
+					LogPrint(eLogError, "I2CP: malfromed destination");
+			}
+			else
+				LogPrint(eLogError, "I2CP: session missmatch");
+		}
+		else
+			LogPrint(eLogError, "I2CP: short message");
+		SendSessionStatusMessage (status); 
+	}	
 
 	void I2CPSession::SendSessionStatusMessage (uint8_t status)
 	{
diff --git a/libi2pd_client/I2PService.cpp b/libi2pd_client/I2PService.cpp
index 6fd5d763..21e1fdfa 100644
--- a/libi2pd_client/I2PService.cpp
+++ b/libi2pd_client/I2PService.cpp
@@ -280,6 +280,8 @@ namespace client
 	void TCPIPAcceptor::Start ()
 	{
 		m_Acceptor.reset (new boost::asio::ip::tcp::acceptor (GetService (), m_LocalEndpoint));
+		//update the local end point in case port has been set zero and got updated now
+		m_LocalEndpoint = m_Acceptor->local_endpoint();
 		m_Acceptor->listen ();
 		Accept ();
 	}
diff --git a/libi2pd_client/SAM.cpp b/libi2pd_client/SAM.cpp
index 57767e77..05943981 100644
--- a/libi2pd_client/SAM.cpp
+++ b/libi2pd_client/SAM.cpp
@@ -15,32 +15,61 @@ namespace i2p
 {
 namespace client
 {
-	SAMSocket::SAMSocket (SAMBridge& owner):
-		m_Owner (owner), m_Socket (m_Owner.GetService ()), m_Timer (m_Owner.GetService ()),
-		m_BufferOffset (0), m_SocketType (eSAMSocketTypeUnknown), m_IsSilent (false),
-		m_IsAccepting (false), m_Stream (nullptr), m_Session (nullptr)
+	SAMSocket::SAMSocket (SAMBridge& owner, std::shared_ptr<Socket_t> socket):
+		m_Owner (owner), m_Socket(socket), m_Timer (m_Owner.GetService ()),
+		m_BufferOffset (0), 
+		m_SocketType (eSAMSocketTypeUnknown), m_IsSilent (false),
+		m_IsAccepting (false), m_Stream (nullptr)
 	{
 	}
 
 	SAMSocket::~SAMSocket ()
 	{
-		Terminate ("~SAMSocket()");
-	}
-
-	void SAMSocket::CloseStream (const char* reason)
-	{
-		LogPrint (eLogDebug, "SAMSocket::CloseStream, reason: ", reason);
-		if (m_Stream)
+		if(m_Stream)
 		{
 			m_Stream->Close ();
 			m_Stream.reset ();
 		}
-	}
+		auto Session = m_Owner.FindSession(m_ID);
+		
+		switch (m_SocketType)
+		{
+			case eSAMSocketTypeSession:
+				m_Owner.CloseSession (m_ID);
+			break;
+			case eSAMSocketTypeStream:
+			{
+				if (Session)
+					Session->DelSocket (this);
+				break;
+			}
+			case eSAMSocketTypeAcceptor:
+			{
+				if (Session)
+				{
+					Session->DelSocket (this);
+					if (m_IsAccepting && Session->localDestination)
+						Session->localDestination->StopAcceptingStreams ();
+				}
+				break;
+			}
+			default:
+				;
+		}
+		m_SocketType = eSAMSocketTypeTerminated;
+		if (m_Socket && m_Socket->is_open()) m_Socket->close ();
+		m_Socket.reset ();
+	}	
 
 	void SAMSocket::Terminate (const char* reason)
 	{
-		CloseStream (reason);
-
+		if(m_Stream)
+		{
+			m_Stream->Close ();
+			m_Stream.reset ();
+		}
+		auto Session = m_Owner.FindSession(m_ID);
+		
 		switch (m_SocketType)
 		{
 			case eSAMSocketTypeSession:
@@ -48,17 +77,17 @@ namespace client
 			break;
 			case eSAMSocketTypeStream:
 			{
-				if (m_Session)
-					m_Session->DelSocket (shared_from_this ());
+				if (Session)
+					Session->DelSocket (this);
 				break;
 			}
 			case eSAMSocketTypeAcceptor:
 			{
-				if (m_Session)
+				if (Session)
 				{
-					m_Session->DelSocket (shared_from_this ());
-					if (m_IsAccepting && m_Session->localDestination)
-						m_Session->localDestination->StopAcceptingStreams ();
+					Session->DelSocket (this);
+					if (m_IsAccepting && Session->localDestination)
+						Session->localDestination->StopAcceptingStreams ();
 				}
 				break;
 			}
@@ -66,15 +95,31 @@ namespace client
 				;
 		}
 		m_SocketType = eSAMSocketTypeTerminated;
-		if (m_Socket.is_open()) m_Socket.close ();
-		m_Session = nullptr;
+		if (m_Socket && m_Socket->is_open()) m_Socket->close ();
+		m_Socket.reset ();
 	}
 
 	void SAMSocket::ReceiveHandshake ()
 	{
-		m_Socket.async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),
-			std::bind(&SAMSocket::HandleHandshakeReceived, shared_from_this (),
-			std::placeholders::_1, std::placeholders::_2));
+		if(m_Socket)
+			m_Socket->async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),
+				std::bind(&SAMSocket::HandleHandshakeReceived, shared_from_this (),
+				std::placeholders::_1, std::placeholders::_2));
+	}
+
+	static bool SAMVersionAcceptable(const std::string & ver)
+	{
+		return ver == "3.0" || ver == "3.1";
+	}
+
+	static bool SAMVersionTooLow(const std::string & ver)
+	{
+		return ver.size() && ver[0] < '3';
+	}
+
+	static bool SAMVersionTooHigh(const std::string & ver)
+	{
+		return ver.size() && ver > "3.1";
 	}
 
 	void SAMSocket::HandleHandshakeReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
@@ -102,31 +147,49 @@ namespace client
 
 			if (!strcmp (m_Buffer, SAM_HANDSHAKE))
 			{
-				std::string version("3.0");
+				std::string maxver("3.1");
+				std::string minver("3.0");
 				// try to find MIN and MAX, 3.0 if not found
 				if (separator)
 				{
 					separator++;
 					std::map<std::string, std::string> params;
 					ExtractParams (separator, params);
-					//auto it = params.find (SAM_PARAM_MAX);
-					// TODO: check MIN as well
-					//if (it != params.end ())
-					//	version = it->second;
+					auto it = params.find (SAM_PARAM_MAX);
+					if (it != params.end ())
+						maxver = it->second;
+					it = params.find(SAM_PARAM_MIN);
+					if (it != params.end ())
+						minver = it->second;
 				}
-				if (version[0] == '3') // we support v3 (3.0 and 3.1) only
+				// version negotiation
+				std::string version;
+				if (SAMVersionAcceptable(maxver))
+				{
+					version = maxver;
+				}
+				else if (SAMVersionAcceptable(minver))
+				{
+					version = minver;
+				}
+				else if (SAMVersionTooLow(minver) && SAMVersionTooHigh(maxver))
+				{
+					version = "3.0";
+				}
+
+				if (SAMVersionAcceptable(version))
 				{
 #ifdef _MSC_VER
 					size_t l = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_HANDSHAKE_REPLY, version.c_str ());
 #else
 					size_t l = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_HANDSHAKE_REPLY, version.c_str ());
 #endif
-					boost::asio::async_write (m_Socket, boost::asio::buffer (m_Buffer, l), boost::asio::transfer_all (),
+					boost::asio::async_write (*m_Socket, boost::asio::buffer (m_Buffer, l), boost::asio::transfer_all (),
 								std::bind(&SAMSocket::HandleHandshakeReplySent, shared_from_this (),
 						std::placeholders::_1, std::placeholders::_2));
 				}
 				else
-					SendMessageReply (SAM_HANDSHAKE_I2P_ERROR, strlen (SAM_HANDSHAKE_I2P_ERROR), true);
+					SendMessageReply (SAM_HANDSHAKE_NOVERSION, strlen (SAM_HANDSHAKE_NOVERSION), true);
 			}
 			else
 			{
@@ -144,9 +207,9 @@ namespace client
 			if (ecode != boost::asio::error::operation_aborted)
 				Terminate ("SAM: handshake reply send error");
 		}
-		else
+		else if(m_Socket)
 		{
-			m_Socket.async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),
+			m_Socket->async_read_some (boost::asio::buffer(m_Buffer, SAM_SOCKET_BUFFER_SIZE),
 				std::bind(&SAMSocket::HandleMessage, shared_from_this (),
 				std::placeholders::_1, std::placeholders::_2));
 		}
@@ -157,7 +220,7 @@ namespace client
 		LogPrint (eLogDebug, "SAMSocket::SendMessageReply, close=",close?"true":"false", " reason: ", msg);
 
 		if (!m_IsSilent)
-			boost::asio::async_write (m_Socket, boost::asio::buffer (msg, len), boost::asio::transfer_all (),
+			boost::asio::async_write (*m_Socket, boost::asio::buffer (msg, len), boost::asio::transfer_all (),
 				std::bind(&SAMSocket::HandleMessageReplySent, shared_from_this (),
 				std::placeholders::_1, std::placeholders::_2, close));
 		else
@@ -266,6 +329,19 @@ namespace client
 		}
 	}
 
+	static bool IsAcceptableSessionName(const std::string & str)
+	{
+		auto itr = str.begin();
+		while(itr != str.end())
+		{
+			char ch = *itr;
+			++itr;
+			if (ch == '<' || ch == '>' || ch == '"' || ch == '\'' || ch == '/')
+				return false;
+		}
+		return true;
+	}
+
 	void SAMSocket::ProcessSessionCreate (char * buf, size_t len)
 	{
 		LogPrint (eLogDebug, "SAM: session create: ", buf);
@@ -274,6 +350,13 @@ namespace client
 		std::string& style = params[SAM_PARAM_STYLE];
 		std::string& id = params[SAM_PARAM_ID];
 		std::string& destination = params[SAM_PARAM_DESTINATION];
+
+		if(!IsAcceptableSessionName(id))
+		{
+			// invalid session id
+			SendMessageReply (SAM_SESSION_CREATE_INVALID_ID, strlen(SAM_SESSION_CREATE_INVALID_ID), true);
+			return;
+		}
 		m_ID = id;
 		if (m_Owner.FindSession (id))
 		{
@@ -306,19 +389,19 @@ namespace client
 		}
 
 		// create destination
-		m_Session = m_Owner.CreateSession (id, destination == SAM_VALUE_TRANSIENT ? "" : destination, &params);
-		if (m_Session)
+		auto session = m_Owner.CreateSession (id, destination == SAM_VALUE_TRANSIENT ? "" : destination, &params);
+		if (session)
 		{
 			m_SocketType = eSAMSocketTypeSession;
 			if (style == SAM_VALUE_DATAGRAM)
 			{
-				m_Session->UDPEndpoint = forward;
-				auto dest = m_Session->localDestination->CreateDatagramDestination ();
+				session->UDPEndpoint = forward;
+				auto dest = session->localDestination->CreateDatagramDestination ();
 				dest->SetReceiver (std::bind (&SAMSocket::HandleI2PDatagramReceive, shared_from_this (),
 					std::placeholders::_1, std::placeholders::_2, std::placeholders::_3, std::placeholders::_4, std::placeholders::_5));
 			}
 
-			if (m_Session->localDestination->IsReady ())
+			if (session->localDestination->IsReady ())
 				SendSessionCreateReplyOk ();
 			else
 			{
@@ -335,30 +418,38 @@ namespace client
 	{
 		if (ecode != boost::asio::error::operation_aborted)
 		{
-			if (m_Session->localDestination->IsReady ())
-				SendSessionCreateReplyOk ();
-			else
+			auto session = m_Owner.FindSession(m_ID);
+			if(session)
 			{
-				m_Timer.expires_from_now (boost::posix_time::seconds(SAM_SESSION_READINESS_CHECK_INTERVAL));
-				m_Timer.async_wait (std::bind (&SAMSocket::HandleSessionReadinessCheckTimer,
-					shared_from_this (), std::placeholders::_1));
+				if (session->localDestination->IsReady ())
+					SendSessionCreateReplyOk ();
+				else
+				{
+					m_Timer.expires_from_now (boost::posix_time::seconds(SAM_SESSION_READINESS_CHECK_INTERVAL));
+					m_Timer.async_wait (std::bind (&SAMSocket::HandleSessionReadinessCheckTimer,
+						shared_from_this (), std::placeholders::_1));
+				}
 			}
 		}
 	}
 
 	void SAMSocket::SendSessionCreateReplyOk ()
 	{
-		uint8_t buf[1024];
-		char priv[1024];
-		size_t l = m_Session->localDestination->GetPrivateKeys ().ToBuffer (buf, 1024);
-		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, priv, 1024);
-		priv[l1] = 0;
+		auto session = m_Owner.FindSession(m_ID);
+		if (session)
+		{
+			uint8_t buf[1024];
+			char priv[1024];
+			size_t l = session->localDestination->GetPrivateKeys ().ToBuffer (buf, 1024);
+			size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, priv, 1024);
+			priv[l1] = 0;
 #ifdef _MSC_VER
-		size_t l2 = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
+			size_t l2 = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
 #else
-		size_t l2 = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
+			size_t l2 = snprintf (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
 #endif
-		SendMessageReply (m_Buffer, l2, false);
+			SendMessageReply (m_Buffer, l2, false);
+		}
 	}
 
 	void SAMSocket::ProcessStreamConnect (char * buf, size_t len, size_t rem)
@@ -371,8 +462,8 @@ namespace client
 		std::string& silent = params[SAM_PARAM_SILENT];
 		if (silent == SAM_VALUE_TRUE) m_IsSilent = true;
 		m_ID = id;
-		m_Session = m_Owner.FindSession (id);
-		if (m_Session)
+		auto session = m_Owner.FindSession (id);
+		if (session)
 		{
 			if (rem > 0) // handle follow on data
 			{
@@ -387,12 +478,12 @@ namespace client
 			if (l > 0)
 			{
 				context.GetAddressBook().InsertAddress(dest);
-				auto leaseSet = m_Session->localDestination->FindLeaseSet(dest->GetIdentHash());
+				auto leaseSet = session->localDestination->FindLeaseSet(dest->GetIdentHash());
 				if (leaseSet)
 					Connect(leaseSet);
 				else
 				{
-					m_Session->localDestination->RequestDestination(dest->GetIdentHash(),
+					session->localDestination->RequestDestination(dest->GetIdentHash(),
 						std::bind(&SAMSocket::HandleConnectLeaseSetRequestComplete,
 						shared_from_this(), std::placeholders::_1));
 				}
@@ -406,13 +497,17 @@ namespace client
 
 	void SAMSocket::Connect (std::shared_ptr<const i2p::data::LeaseSet> remote)
 	{
-		m_SocketType = eSAMSocketTypeStream;
-		m_Session->AddSocket (shared_from_this ());
-		m_Stream = m_Session->localDestination->CreateStream (remote);
-		m_Stream->Send ((uint8_t *)m_Buffer, m_BufferOffset); // connect and send
-		m_BufferOffset = 0;
-		I2PReceive ();
-		SendMessageReply (SAM_STREAM_STATUS_OK, strlen(SAM_STREAM_STATUS_OK), false);
+		auto session = m_Owner.FindSession(m_ID);
+		if(session)
+		{
+			m_SocketType = eSAMSocketTypeStream;
+			session->AddSocket (shared_from_this ());
+			m_Stream = session->localDestination->CreateStream (remote);
+			m_Stream->Send ((uint8_t *)m_Buffer, m_BufferOffset); // connect and send
+			m_BufferOffset = 0;
+			I2PReceive ();
+			SendMessageReply (SAM_STREAM_STATUS_OK, strlen(SAM_STREAM_STATUS_OK), false);
+		}
 	}
 
 	void SAMSocket::HandleConnectLeaseSetRequestComplete (std::shared_ptr<i2p::data::LeaseSet> leaseSet)
@@ -435,15 +530,15 @@ namespace client
 		std::string& silent = params[SAM_PARAM_SILENT];
 		if (silent == SAM_VALUE_TRUE) m_IsSilent = true;
 		m_ID = id;
-		m_Session = m_Owner.FindSession (id);
-		if (m_Session)
+		auto session = m_Owner.FindSession (id);
+		if (session)
 		{
 			m_SocketType = eSAMSocketTypeAcceptor;
-			m_Session->AddSocket (shared_from_this ());
-			if (!m_Session->localDestination->IsAcceptingStreams ())
+			session->AddSocket (shared_from_this ());
+			if (!session->localDestination->IsAcceptingStreams ())
 			{
-				m_IsAccepting = true;
-				m_Session->localDestination->AcceptOnce (std::bind (&SAMSocket::HandleI2PAccept, shared_from_this (), std::placeholders::_1));
+				m_IsAccepting = true;	
+				session->localDestination->AcceptOnce (std::bind (&SAMSocket::HandleI2PAccept, shared_from_this (), std::placeholders::_1));
 			}
 			SendMessageReply (SAM_STREAM_STATUS_OK, strlen(SAM_STREAM_STATUS_OK), false);
 		}
@@ -459,9 +554,10 @@ namespace client
 		size_t size = std::stoi(params[SAM_PARAM_SIZE]), offset = data - buf;
 		if (offset + size <= len)
 		{
-			if (m_Session)
+			auto session = m_Owner.FindSession(m_ID);
+			if (session)
 			{
-				auto d = m_Session->localDestination->GetDatagramDestination ();
+				auto d = session->localDestination->GetDatagramDestination ();
 				if (d)
 				{
 					i2p::data::IdentityEx dest;
@@ -516,7 +612,8 @@ namespace client
 		std::string& name = params[SAM_PARAM_NAME];
 		std::shared_ptr<const i2p::data::IdentityEx> identity;
 		i2p::data::IdentHash ident;
-		auto dest = m_Session == nullptr ? context.GetSharedLocalDestination() : m_Session->localDestination;
+		auto session = m_Owner.FindSession(m_ID);
+		auto dest = session == nullptr ? context.GetSharedLocalDestination() : session->localDestination;
 		if (name == "ME")
 			SendNamingLookupReply (dest->GetIdentity ());
 		else if ((identity = context.GetAddressBook ().GetAddress (name)) != nullptr)
@@ -612,16 +709,18 @@ namespace client
 			LogPrint (eLogError, "SAM: Buffer is full, terminate");
 			Terminate ("Buffer is full");
 			return;
-		}
-		m_Socket.async_read_some (boost::asio::buffer(m_Buffer + m_BufferOffset, SAM_SOCKET_BUFFER_SIZE - m_BufferOffset),
-			std::bind((m_SocketType == eSAMSocketTypeStream) ? &SAMSocket::HandleReceived : &SAMSocket::HandleMessage,
-			shared_from_this (), std::placeholders::_1, std::placeholders::_2));
+		} else if (m_Socket)
+			m_Socket->async_read_some (boost::asio::buffer(m_Buffer + m_BufferOffset, SAM_SOCKET_BUFFER_SIZE - m_BufferOffset),
+				std::bind((m_SocketType == eSAMSocketTypeStream) ? &SAMSocket::HandleReceived : &SAMSocket::HandleMessage,
+				shared_from_this (), std::placeholders::_1, std::placeholders::_2));
+		else
+			LogPrint(eLogError, "SAM: receive with no native socket");
 	}
 
 	void SAMSocket::HandleReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
 	{
 		if (ecode)
-        {
+		{
 			LogPrint (eLogError, "SAM: read error: ", ecode.message ());
 			if (ecode != boost::asio::error::operation_aborted)
 				Terminate ("read error");
@@ -637,8 +736,8 @@ namespace client
 					[s](const boost::system::error_code& ecode)
 				    {
 						if (!ecode)
-							s->Receive ();
-						else
+							s->m_Owner.GetService ().post ([s] { s->Receive (); });
+						else	
 							s->m_Owner.GetService ().post ([s] { s->Terminate ("AsyncSend failed"); });
 					});
 			}
@@ -650,21 +749,21 @@ namespace client
 		if (m_Stream)
 		{
 			if (m_Stream->GetStatus () == i2p::stream::eStreamStatusNew ||
-			    m_Stream->GetStatus () == i2p::stream::eStreamStatusOpen) // regular
+					 m_Stream->GetStatus () == i2p::stream::eStreamStatusOpen) // regular
 			{
 				m_Stream->AsyncReceive (boost::asio::buffer (m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE),
-					std::bind (&SAMSocket::HandleI2PReceive, shared_from_this (),
+						std::bind (&SAMSocket::HandleI2PReceive, shared_from_this(),
 						std::placeholders::_1, std::placeholders::_2),
-					SAM_SOCKET_CONNECTION_MAX_IDLE);
+							SAM_SOCKET_CONNECTION_MAX_IDLE);
 			}
 			else // closed by peer
 			{
+				uint8_t * buff = new uint8_t[SAM_SOCKET_BUFFER_SIZE];
 				// get remaning data
-				auto len = m_Stream->ReadSome (m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE);
+				auto len = m_Stream->ReadSome (buff, SAM_SOCKET_BUFFER_SIZE);
 				if (len > 0) // still some data
 				{
-					boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, len),
-						std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1));
+					WriteI2PDataImmediate(buff, len);
 				}
 				else // no more data
 					Terminate ("no more data");
@@ -672,6 +771,30 @@ namespace client
 		}
 	}
 
+	void SAMSocket::WriteI2PDataImmediate(uint8_t * buff, size_t sz)
+	{
+		if(m_Socket)
+			boost::asio::async_write (
+				*m_Socket,
+				boost::asio::buffer (buff, sz),
+				boost::asio::transfer_all(),
+				std::bind (&SAMSocket::HandleWriteI2PDataImmediate, shared_from_this (), std::placeholders::_1, buff)); // postpone termination
+		else
+			LogPrint(eLogError, "SAM: no native socket");
+	}
+
+	void SAMSocket::HandleWriteI2PDataImmediate(const boost::system::error_code & ec, uint8_t * buff)
+	{
+		delete [] buff;
+	}
+	
+	void SAMSocket::WriteI2PData(size_t sz)
+	{
+		uint8_t * sendbuff = new uint8_t[sz];
+		memcpy(sendbuff, m_StreamBuffer, sz);
+		WriteI2PDataImmediate(sendbuff, sz);
+	}
+	
 	void SAMSocket::HandleI2PReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred)
 	{
 		if (ecode)
@@ -680,8 +803,9 @@ namespace client
 			if (ecode != boost::asio::error::operation_aborted)
 			{
 				if (bytes_transferred > 0)
-					boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, bytes_transferred),
-						std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1)); // postpone termination
+				{
+					WriteI2PData(bytes_transferred);
+				}
 				else
 				{
 					auto s = shared_from_this ();
@@ -696,13 +820,18 @@ namespace client
 		}
 		else
 		{
-			if (m_SocketType != eSAMSocketTypeTerminated) // check for possible race condition with Terminate()
-				boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, bytes_transferred),
-					std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1));
+			if (m_SocketType != eSAMSocketTypeTerminated)
+			{
+				if (bytes_transferred > 0)
+				{
+					WriteI2PData(bytes_transferred);
+				}
+				I2PReceive();
+			}
 		}
 	}
 
-	void SAMSocket::HandleWriteI2PData (const boost::system::error_code& ecode)
+	void SAMSocket::HandleWriteI2PData (const boost::system::error_code& ecode, size_t bytes_transferred)
 	{
 		if (ecode)
 		{
@@ -711,7 +840,9 @@ namespace client
 				Terminate ("socket write error at HandleWriteI2PData");
 		}
 		else
+		{
 			I2PReceive ();
+		}
 	}
 
 	void SAMSocket::HandleI2PAccept (std::shared_ptr<i2p::stream::Stream> stream)
@@ -760,39 +891,42 @@ namespace client
 	{
 		LogPrint (eLogDebug, "SAM: datagram received ", len);
 		auto base64 = from.ToBase64 ();
-		auto ep = m_Session->UDPEndpoint;
-		if (ep)
-		{
-			// udp forward enabled
-			size_t bsz = base64.size();
-			size_t sz = bsz + 1 + len;
-			// build datagram body
-			uint8_t * data = new uint8_t[sz];
-			// Destination
-			memcpy(data, base64.c_str(), bsz);
-			// linefeed
-			data[bsz] = '\n';
-			// Payload
-			memcpy(data+bsz+1, buf, len);
-			// send to remote endpoint
-			m_Owner.SendTo(data, sz, ep);
-			delete [] data;
-		}
-		else
+		auto session = m_Owner.FindSession(m_ID);
+		if(session)
 		{
+			auto ep = session->UDPEndpoint;
+			if (ep)
+			{
+				// udp forward enabled
+				size_t bsz = base64.size();
+				size_t sz = bsz + 1 + len;
+				// build datagram body
+				uint8_t * data = new uint8_t[sz];
+				// Destination
+				memcpy(data, base64.c_str(), bsz);
+				// linefeed
+				data[bsz] = '\n';
+				// Payload
+				memcpy(data+bsz+1, buf, len);
+				// send to remote endpoint
+				m_Owner.SendTo(data, sz, ep);
+				delete [] data;
+			}
+			else
+			{
 #ifdef _MSC_VER
-			size_t l = sprintf_s ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), (long unsigned int)len);
+				size_t l = sprintf_s ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), (long unsigned int)len);
 #else
-			size_t l = snprintf ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), (long unsigned int)len);
+				size_t l = snprintf ((char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE, SAM_DATAGRAM_RECEIVED, base64.c_str (), (long unsigned int)len);
 #endif
-			if (len < SAM_SOCKET_BUFFER_SIZE - l)
-			{
-				memcpy (m_StreamBuffer + l, buf, len);
-				boost::asio::async_write (m_Socket, boost::asio::buffer (m_StreamBuffer, len + l),
-																	std::bind (&SAMSocket::HandleWriteI2PData, shared_from_this (), std::placeholders::_1));
+				if (len < SAM_SOCKET_BUFFER_SIZE - l)
+				{
+					memcpy (m_StreamBuffer + l, buf, len);
+					WriteI2PData(len + l);
+				}
+				else
+					LogPrint (eLogWarning, "SAM: received datagram size ", len," exceeds buffer");
 			}
-			else
-				LogPrint (eLogWarning, "SAM: received datagram size ", len," exceeds buffer");
 		}
 	}
 
@@ -875,8 +1009,9 @@ namespace client
 
 	void SAMBridge::Accept ()
 	{
-		auto newSocket = std::make_shared<SAMSocket> (*this);
-		m_Acceptor.async_accept (newSocket->GetSocket (), std::bind (&SAMBridge::HandleAccept, this,
+		auto native = std::make_shared<boost::asio::ip::tcp::socket>(m_Service);
+		auto newSocket = std::make_shared<SAMSocket> (*this, native);
+		m_Acceptor.async_accept (*native, std::bind (&SAMBridge::HandleAccept, this,
 			std::placeholders::_1, newSocket));
 	}
 
diff --git a/libi2pd_client/SAM.h b/libi2pd_client/SAM.h
index 3cbe0447..6ecd14a4 100644
--- a/libi2pd_client/SAM.h
+++ b/libi2pd_client/SAM.h
@@ -23,11 +23,13 @@ namespace client
 	const int SAM_SESSION_READINESS_CHECK_INTERVAL = 20; // in seconds
 	const char SAM_HANDSHAKE[] = "HELLO VERSION";
 	const char SAM_HANDSHAKE_REPLY[] = "HELLO REPLY RESULT=OK VERSION=%s\n";
+	const char SAM_HANDSHAKE_NOVERSION[] = "HELLO REPLY RESULT=NOVERSION\n";
 	const char SAM_HANDSHAKE_I2P_ERROR[] = "HELLO REPLY RESULT=I2P_ERROR\n";
 	const char SAM_SESSION_CREATE[] = "SESSION CREATE";
 	const char SAM_SESSION_CREATE_REPLY_OK[] = "SESSION STATUS RESULT=OK DESTINATION=%s\n";
 	const char SAM_SESSION_CREATE_DUPLICATED_ID[] = "SESSION STATUS RESULT=DUPLICATED_ID\n";
 	const char SAM_SESSION_CREATE_DUPLICATED_DEST[] = "SESSION STATUS RESULT=DUPLICATED_DEST\n";
+	const char SAM_SESSION_CREATE_INVALID_ID[] = "SESSION STATUS RESULT=INVALID_ID\n";
 	const char SAM_SESSION_STATUS_INVALID_KEY[] = "SESSION STATUS RESULT=INVALID_KEY\n";
 	const char SAM_SESSION_STATUS_I2P_ERROR[] = "SESSION STATUS RESULT=I2P_ERROR MESSAGE=%s\n";
 	const char SAM_STREAM_CONNECT[] = "STREAM CONNECT";
@@ -79,18 +81,18 @@ namespace client
 	{
 		public:
 
-			SAMSocket (SAMBridge& owner);
-			~SAMSocket ();
-			void CloseStream (const char* reason); // TODO: implement it better
+			typedef boost::asio::ip::tcp::socket Socket_t;
+			SAMSocket (SAMBridge& owner, std::shared_ptr<Socket_t> socket);
+			~SAMSocket ();			
 
-			boost::asio::ip::tcp::socket& GetSocket () { return m_Socket; };
+			boost::asio::ip::tcp::socket& GetSocket () { return *m_Socket; };
 			void ReceiveHandshake ();
 			void SetSocketType (SAMSocketType socketType) { m_SocketType = socketType; };
 			SAMSocketType GetSocketType () const { return m_SocketType; };
 
-                        void Terminate (const char* reason);
+			void Terminate (const char* reason);
 
-                private:
+		 private:
 
 			void HandleHandshakeReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleHandshakeReplySent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
@@ -103,7 +105,7 @@ namespace client
 			void I2PReceive ();
 			void HandleI2PReceive (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleI2PAccept (std::shared_ptr<i2p::stream::Stream> stream);
-			void HandleWriteI2PData (const boost::system::error_code& ecode);
+			void HandleWriteI2PData (const boost::system::error_code& ecode, size_t sz);
 			void HandleI2PDatagramReceive (const i2p::data::IdentityEx& from, uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len);
 
 			void ProcessSessionCreate (char * buf, size_t len);
@@ -122,10 +124,14 @@ namespace client
 			void HandleSessionReadinessCheckTimer (const boost::system::error_code& ecode);
 			void SendSessionCreateReplyOk ();
 
+			void WriteI2PData(size_t sz);
+			void WriteI2PDataImmediate(uint8_t * ptr, size_t sz);
+
+			void HandleWriteI2PDataImmediate(const boost::system::error_code & ec, uint8_t * buff);
 		private:
 
 			SAMBridge& m_Owner;
-			boost::asio::ip::tcp::socket m_Socket;
+			std::shared_ptr<Socket_t> m_Socket;
 			boost::asio::deadline_timer m_Timer;
 			char m_Buffer[SAM_SOCKET_BUFFER_SIZE + 1];
 			size_t m_BufferOffset;
@@ -135,7 +141,6 @@ namespace client
 			bool m_IsSilent;
 			bool m_IsAccepting; // for eSAMSocketTypeAcceptor only
 			std::shared_ptr<i2p::stream::Stream> m_Stream;
-			std::shared_ptr<SAMSession> m_Session;
 	};
 
 	struct SAMSession
@@ -146,15 +151,15 @@ namespace client
 		std::mutex m_SocketsMutex;
 
 		/** safely add a socket to this session */
-		void AddSocket(const std::shared_ptr<SAMSocket> & sock) {
+		void AddSocket(std::shared_ptr<SAMSocket> sock) {
 			std::lock_guard<std::mutex> lock(m_SocketsMutex);
 			m_Sockets.push_back(sock);
 		}
 
 		/** safely remove a socket from this session */
-		void DelSocket(const std::shared_ptr<SAMSocket> & sock) {
+		void DelSocket(SAMSocket * sock) {
 			std::lock_guard<std::mutex> lock(m_SocketsMutex);
-			m_Sockets.remove(sock);
+			m_Sockets.remove_if([sock](const std::shared_ptr<SAMSocket> s) -> bool { return s.get() == sock; });
 		}
 
 		/** get a list holding a copy of all sam sockets from this session */
diff --git a/libi2pd_client/WebSocks.cpp b/libi2pd_client/WebSocks.cpp
index 0b8062d3..ee64001d 100644
--- a/libi2pd_client/WebSocks.cpp
+++ b/libi2pd_client/WebSocks.cpp
@@ -136,6 +136,13 @@ namespace client
 			return boost::asio::ip::tcp::endpoint(boost::asio::ip::address::from_string(m_Addr), m_Port);
 		}
 
+		i2p::datagram::DatagramDestination * GetDatagramDest() const
+		{
+			auto dgram = m_Dest->GetDatagramDestination();
+			if(!dgram) dgram = m_Dest->CreateDatagramDestination();
+			return dgram;
+		}
+		
 		WebSocks * Parent;
 
 	private:
@@ -156,6 +163,7 @@ namespace client
 			eWSCTryConnect,
 			eWSCFailConnect,
 			eWSCOkayConnect,
+			eWSCDatagram,
 			eWSCClose,
 			eWSCEnd
 		};
@@ -174,13 +182,17 @@ namespace client
 		std::string m_RemoteAddr;
 		int m_RemotePort;
 		uint8_t m_RecvBuf[2048];
+		bool m_IsDatagram;
+		i2p::datagram::DatagramDestination * m_Datagram;
 
 		WebSocksConn(const ServerConn & conn, WebSocksImpl * parent) :
 			IWebSocksConn(parent->Parent),
 			m_Conn(conn),
 			m_Stream(nullptr),
 			m_State(eWSCInitial),
-			m_Parent(parent)
+			m_Parent(parent),
+			m_IsDatagram(false),
+			m_Datagram(nullptr)
 		{
 
 		}
@@ -190,6 +202,35 @@ namespace client
 			Close();
 		}
 
+		void HandleDatagram(const i2p::data::IdentityEx& from, uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len)
+		{
+			auto conn = m_Parent->GetConn(m_Conn);
+			if(conn)
+			{
+				std::stringstream ss;
+				ss << from.GetIdentHash().ToBase32();
+				ss << ".b32.i2p:";
+				ss << std::to_string(fromPort);
+				ss << "\n";
+				ss.write((char *)buf, len);
+				conn->send(ss.str());
+			}
+		}
+		
+		void BeginDatagram()
+		{
+			m_Datagram = m_Parent->GetDatagramDest();
+			m_Datagram->SetReceiver(
+				std::bind(
+					&WebSocksConn::HandleDatagram,
+					this,
+					std::placeholders::_1,
+					std::placeholders::_2,
+					std::placeholders::_3,
+					std::placeholders::_4,
+					std::placeholders::_5), m_RemotePort);
+		}
+
 		void EnterState(ConnState state)
 		{
 			LogPrint(eLogDebug, "websocks: state ", m_State, " -> ", state);
@@ -206,6 +247,16 @@ namespace client
 					// we will try to connect
 					m_State = eWSCTryConnect;
 					m_Parent->CreateStreamTo(m_RemoteAddr, m_RemotePort, std::bind(&WebSocksConn::ConnectResult, this, std::placeholders::_1));
+				} else if (state == eWSCDatagram) {
+					if (m_RemotePort >= 0 && m_RemotePort <= 65535)
+					{
+						LogPrint(eLogDebug, "websocks: datagram mode initiated");
+						m_State = eWSCDatagram;
+						BeginDatagram();
+						SendResponse("");
+					}
+					else
+						SendResponse("invalid port");
 				} else {
 					LogPrint(eLogWarning, "websocks: invalid state change ", m_State, " -> ", state);
 				}
@@ -245,6 +296,13 @@ namespace client
 					LogPrint(eLogWarning, "websocks: invalid state change ", m_State, " -> ", state);
 				}
 				return;
+			case eWSCDatagram:
+				if(state != eWSCClose) {
+					LogPrint(eLogWarning, "websocks: invalid state change ", m_State, " -> ", state);
+				}
+				m_State = eWSCClose;
+				Close();
+				return;
 			case eWSCOkayConnect:
 				if(state == eWSCClose) {
 					// graceful close
@@ -253,6 +311,7 @@ namespace client
 				} else {
 					LogPrint(eLogWarning, "websocks: invalid state change ", m_State, " -> ", state);
 				}
+				return;
 			case eWSCClose:
 				if(state == eWSCEnd) {
 					LogPrint(eLogDebug, "websocks: socket ended");
@@ -361,7 +420,36 @@ namespace client
 					m_RemotePort = std::stoi(payload.substr(itr+1));
 					m_RemoteAddr = payload.substr(0, itr);
 				}
-				EnterState(eWSCTryConnect);
+				m_IsDatagram = m_RemoteAddr == "DATAGRAM";
+				if(m_IsDatagram)
+					EnterState(eWSCDatagram);
+				else
+					EnterState(eWSCTryConnect);
+			} else if (m_State == eWSCDatagram) {
+				// send datagram
+				// format is "host:port\npayload"
+				auto idx = payload.find("\n");
+				std::string line = payload.substr(0, idx);
+				auto itr = line.find(":");
+				auto & addressbook = i2p::client::context.GetAddressBook();
+				std::string addr;
+				int port = 0;
+				if (itr == std::string::npos)
+				{
+					addr = line;
+				}
+				else
+				{
+					addr = line.substr(0, itr);
+					port = std::atoi(line.substr(itr+1).c_str());
+				}
+				i2p::data::IdentHash ident;
+				if(addressbook.GetIdentHash(addr, ident))
+				{
+					const char * data = payload.c_str() + idx + 1;
+					size_t len = payload.size() - (1 + line.size());
+					m_Datagram->SendDatagramTo((const uint8_t*)data, len, ident, m_RemotePort, port);
+				}
 			} else {
 				// wtf?
 				LogPrint(eLogWarning, "websocks: got message in invalid state ", m_State);
@@ -373,6 +461,7 @@ namespace client
 			if(m_State == eWSCClose) {
 				LogPrint(eLogDebug, "websocks: closing connection");
 				if(m_Stream) m_Stream->Close();
+				if(m_Datagram) m_Datagram->ResetReceiver(m_RemotePort);
 				m_Parent->CloseConn(m_Conn);
 				EnterState(eWSCEnd);
 			} else {
diff --git a/qt/i2pd_qt/android/AndroidManifest.xml b/qt/i2pd_qt/android/AndroidManifest.xml
index 20061963..56b37e6a 100644
--- a/qt/i2pd_qt/android/AndroidManifest.xml
+++ b/qt/i2pd_qt/android/AndroidManifest.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<manifest package="org.purplei2p.i2pd" xmlns:android="http://schemas.android.com/apk/res/android" android:versionName="2.17.0" android:versionCode="2" android:installLocation="auto">
+<manifest package="org.purplei2p.i2pd" xmlns:android="http://schemas.android.com/apk/res/android" android:versionName="2.18.0" android:versionCode="2" android:installLocation="auto">
     <uses-sdk android:minSdkVersion="11" android:targetSdkVersion="23"/>
         <supports-screens android:largeScreens="true" android:normalScreens="true" android:anyDensity="true" android:smallScreens="true"/>
     <!-- <application android:hardwareAccelerated="true" -->
diff --git a/qt/i2pd_qt/i2pd_qt.pro b/qt/i2pd_qt/i2pd_qt.pro
index f575438c..a2ba4261 100644
--- a/qt/i2pd_qt/i2pd_qt.pro
+++ b/qt/i2pd_qt/i2pd_qt.pro
@@ -29,6 +29,7 @@ SOURCES += DaemonQT.cpp mainwindow.cpp \
     ../../libi2pd/Base.cpp \
     ../../libi2pd/BloomFilter.cpp \
     ../../libi2pd/Config.cpp \
+    ../../libi2pd/CPU.cpp \
     ../../libi2pd/Crypto.cpp \
 	../../libi2pd/CryptoKey.cpp \
     ../../libi2pd/Datagram.cpp \