Added silc_packet_stream_is_udp
[silc.git] / lib / silccore / silcpacket.c
index 70ef94e281ae463fa1cb9868d1628bdce2dc8cee..bf23cfe6b4906fe188b9393896985d5b5cb03e11 100644 (file)
@@ -33,10 +33,11 @@ struct SilcPacketEngineStruct {
   SilcList streams;                     /* All streams in engine */
   SilcList packet_pool;                 /* Free list for received packets */
   SilcMutex lock;                       /* Engine lock */
+  SilcHashTable udp_remote;             /* UDP remote streams, or NULL */
   SilcBool local_is_router;
 };
 
-/* Packet procesor context */
+/* Packet processor context */
 typedef struct SilcPacketProcessStruct {
   SilcInt32 priority;                   /* Priority */
   SilcPacketType *types;                /* Packets to process */
@@ -44,32 +45,41 @@ typedef struct SilcPacketProcessStruct {
   void *callback_context;
 } *SilcPacketProcess;
 
+/* UDP remote stream tuple */
+typedef struct {
+  char *remote_ip;                      /* Remote IP address */
+  SilcUInt16 remote_port;               /* Remote port */
+} *SilcPacketRemoteUDP;
+
 /* Packet stream */
 struct SilcPacketStreamStruct {
   struct SilcPacketStreamStruct *next;
   SilcPacketEngine engine;              /* Packet engine */
   SilcStream stream;                    /* Underlaying stream */
   SilcMutex lock;                       /* Stream lock */
-  SilcDList process;                    /* Packet processors, it set */
+  SilcDList process;                    /* Packet processors, or NULL */
+  SilcPacketRemoteUDP remote_udp;       /* UDP remote stream tuple, or NULL */
   void *stream_context;                         /* Stream context */
   SilcBufferStruct inbuf;               /* In buffer */
   SilcBufferStruct outbuf;              /* Out buffer */
-  SilcUInt32 send_psn;                  /* Sending sequence */
-  SilcCipher send_key;                  /* Sending key */
-  SilcHmac send_hmac;                   /* Sending HMAC */
-  SilcUInt32 receive_psn;               /* Receiving sequence */
-  SilcCipher receive_key;               /* Receiving key */
-  SilcHmac receive_hmac;                /* Receiving HMAC */
+  SilcCipher send_key[2];               /* Sending key */
+  SilcHmac send_hmac[2];                /* Sending HMAC */
+  SilcCipher receive_key[2];            /* Receiving key */
+  SilcHmac receive_hmac[2];             /* Receiving HMAC */
   unsigned char *src_id;                /* Source ID */
   unsigned char *dst_id;                /* Destination ID */
+  SilcUInt32 send_psn;                  /* Sending sequence */
+  SilcUInt32 receive_psn;               /* Receiving sequence */
+  SilcAtomic8 refcnt;                   /* Reference counter */
+  SilcUInt8 sid;                        /* Security ID, set if IV included */
   unsigned int src_id_len  : 6;
   unsigned int src_id_type : 2;
   unsigned int dst_id_len  : 6;
   unsigned int dst_id_type : 2;
-  SilcUInt8 refcnt;                     /* Reference counter */
   unsigned int is_router   : 1;                 /* Set if router stream */
   unsigned int destroyed   : 1;                 /* Set if destroyed */
   unsigned int iv_included : 1;          /* Set if IV included */
+  unsigned int udp         : 1;          /* UDP remote stream */
 };
 
 /* Initial size of stream buffers */
@@ -80,7 +90,7 @@ struct SilcPacketStreamStruct {
 
 /* Minimum length of SILC Packet Header. */
 #define SILC_PACKET_MIN_HEADER_LEN 16
-#define SILC_PACKET_MIN_HEADER_LEN_IV 32
+#define SILC_PACKET_MIN_HEADER_LEN_IV 32 + 1
 
 /* Maximum padding length */
 #define SILC_PACKET_MAX_PADLEN 128
@@ -141,114 +151,280 @@ do {                                                                    \
                                (s)->stream_context);                   \
 } while(0)
 
+static void silc_packet_dispatch(SilcPacket packet);
+static void silc_packet_read_process(SilcPacketStream stream);
 
 /************************ Static utility functions **************************/
 
-static void silc_packet_read_process(SilcPacketStream stream);
+/* Injects packet to new stream created with silc_packet_stream_add_remote. */
 
-/* Our stream IO notifier callback. */
+SILC_TASK_CALLBACK(silc_packet_stream_inject_packet)
+{
+  SilcPacket packet = context;
+  SilcPacketStream stream = packet->stream;
 
-static void silc_packet_stream_io(SilcStream stream, SilcStreamStatus status,
-                                 void *context)
+  SILC_LOG_DEBUG(("Injecting packet %p to stream %p", packet, packet->stream));
+
+  silc_mutex_lock(stream->lock);
+  silc_packet_dispatch(packet);
+  silc_mutex_unlock(stream->lock);
+}
+
+/* Write data to the stream.  Must be called with ps->lock locked.  Unlocks
+   the lock inside this function. */
+
+static inline SilcBool silc_packet_stream_write(SilcPacketStream ps)
 {
-  SilcPacketStream ps = context;
-  int ret;
+  SilcStream stream;
+  SilcBool connected;
+  int i;
 
-  silc_mutex_lock(ps->lock);
+  if (ps->udp)
+    stream = ((SilcPacketStream)ps->stream)->stream;
+  else
+    stream = ps->stream;
+
+  if (ps->udp && silc_socket_stream_is_udp(stream, &connected)) {
+    if (!connected) {
+      /* Connectionless UDP stream */
+      while (silc_buffer_len(&ps->outbuf) > 0) {
+       i = silc_net_udp_send(stream, ps->remote_udp->remote_ip,
+                             ps->remote_udp->remote_port,
+                             ps->outbuf.data, silc_buffer_len(&ps->outbuf));
+       if (i == -2) {
+         /* Error */
+         silc_buffer_reset(&ps->outbuf);
+         silc_mutex_unlock(ps->lock);
+         SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_WRITE);
+         return FALSE;
+       }
 
-  if (ps->destroyed) {
-    silc_mutex_unlock(ps->lock);
-    return;
+       if (i == -1) {
+         /* Cannot write now, write later. */
+         silc_mutex_unlock(ps->lock);
+         return TRUE;
+       }
+
+       /* Wrote data */
+       silc_buffer_pull(&ps->outbuf, i);
+      }
+
+      silc_buffer_reset(&ps->outbuf);
+      silc_mutex_unlock(ps->lock);
+
+      return TRUE;
+    }
   }
 
-  switch (status) {
+  /* Write the data to the stream */
+  while (silc_buffer_len(&ps->outbuf) > 0) {
+    i = silc_stream_write(stream, ps->outbuf.data,
+                         silc_buffer_len(&ps->outbuf));
+    if (i == 0) {
+      /* EOS */
+      silc_buffer_reset(&ps->outbuf);
+      silc_mutex_unlock(ps->lock);
+      SILC_PACKET_CALLBACK_EOS(ps);
+      return FALSE;
+    }
 
-  case SILC_STREAM_CAN_WRITE:
-    if (!silc_buffer_headlen(&ps->outbuf)) {
+    if (i == -2) {
+      /* Error */
+      silc_buffer_reset(&ps->outbuf);
       silc_mutex_unlock(ps->lock);
-      return;
+      SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_WRITE);
+      return FALSE;
     }
 
-    SILC_LOG_DEBUG(("Writing pending data to stream"));
+    if (i == -1) {
+      /* Cannot write now, write later. */
+      silc_mutex_unlock(ps->lock);
+      return TRUE;
+    }
 
-    /* Write pending data to stream */
-    while (silc_buffer_len(&ps->outbuf) > 0) {
-      ret = silc_stream_write(ps->stream, ps->outbuf.data,
-                             silc_buffer_len(&ps->outbuf));
-      if (ret == 0) {
-       /* EOS */
-       silc_buffer_reset(&ps->outbuf);
-       silc_mutex_unlock(ps->lock);
-       SILC_PACKET_CALLBACK_EOS(ps);
-       return;
-      }
+    /* Wrote data */
+    silc_buffer_pull(&ps->outbuf, i);
+  }
+
+  silc_buffer_reset(&ps->outbuf);
+  silc_mutex_unlock(ps->lock);
+
+  return TRUE;
+}
+
+/* Reads data from stream.  Must be called with the ps->lock locked.  If this
+   returns FALSE the lock has been unlocked.  If this returns packet stream
+   to `ret_ps' its lock has been acquired and `ps' lock has been unlocked.
+   It is returned if the stream is UDP and remote UDP stream exists for
+   the sender of the packet. */
+
+static inline SilcBool silc_packet_stream_read(SilcPacketStream ps,
+                                              SilcPacketStream *ret_ps)
+{
+  SilcStream stream;
+  SilcBool connected;
+  int ret;
+
+  stream = ps->stream;
+
+  /* Make sure we have fair amount of free space in inbuf */
+  if (silc_buffer_taillen(&ps->inbuf) < SILC_PACKET_DEFAULT_SIZE)
+    if (!silc_buffer_realloc(&ps->inbuf, silc_buffer_truelen(&ps->inbuf) +
+                            SILC_PACKET_DEFAULT_SIZE * 2)) {
+      silc_mutex_unlock(ps->lock);
+      SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_NO_MEMORY);
+      return FALSE;
+    }
 
+  if (silc_socket_stream_is_udp(stream, &connected)) {
+    if (!connected) {
+      /* Connectionless UDP stream, read one UDP packet */
+      char remote_ip[64], tuple[64];
+      int remote_port;
+      SilcPacketStream remote;
+
+      ret = silc_net_udp_receive(stream, remote_ip, sizeof(remote_ip),
+                                &remote_port, ps->inbuf.tail,
+                                silc_buffer_taillen(&ps->inbuf));
       if (ret == -2) {
        /* Error */
-       silc_buffer_reset(&ps->outbuf);
+       silc_buffer_reset(&ps->inbuf);
        silc_mutex_unlock(ps->lock);
-       SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_WRITE);
-       return;
+       SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_READ);
+       return FALSE;
       }
 
       if (ret == -1) {
-       /* Cannot write now, write later. */
+       /* Cannot read now, do it later. */
+       silc_buffer_pull(&ps->inbuf, silc_buffer_len(&ps->inbuf));
        silc_mutex_unlock(ps->lock);
-       return;
+       return FALSE;
+      }
+
+      /* See if remote packet stream exist for this sender */
+      snprintf(tuple, sizeof(tuple), "%d%s", remote_port, remote_ip);
+      silc_mutex_lock(ps->engine->lock);
+      if (silc_hash_table_find(ps->engine->udp_remote, tuple, NULL,
+                              (void *)&remote)) {
+       /* Found packet stream for this sender, copy the packet */
+       silc_mutex_unlock(ps->engine->lock);
+
+       SILC_LOG_DEBUG(("UDP packet from %s:%d for stream %p",
+                       remote_ip, remote_port, remote));
+
+       silc_mutex_lock(remote->lock);
+       if (ret > silc_buffer_taillen(&remote->inbuf))
+         if (!silc_buffer_realloc(&remote->inbuf, ret)) {
+           silc_mutex_unlock(remote->lock);
+           silc_mutex_unlock(ps->lock);
+           SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_NO_MEMORY);
+           return FALSE;
+         }
+
+       silc_buffer_put_tail(&remote->inbuf, ps->inbuf.tail, ret);
+       silc_buffer_pull_tail(&remote->inbuf, ret);
+       *ret_ps = remote;
+
+       silc_buffer_reset(&ps->inbuf);
+       silc_mutex_unlock(ps->lock);
+       return TRUE;
+      }
+      silc_mutex_unlock(ps->engine->lock);
+
+      /* Unknown sender */
+      if (!ps->remote_udp) {
+       ps->remote_udp = silc_calloc(1, sizeof(*ps->remote_udp));
+       if (!ps->remote_udp) {
+         silc_mutex_unlock(ps->lock);
+         SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_NO_MEMORY);
+         return FALSE;
+       }
       }
 
-      /* Wrote data */
-      silc_buffer_pull(&ps->outbuf, ret);
+      /* Save sender IP and port */
+      silc_free(ps->remote_udp->remote_ip);
+      ps->remote_udp->remote_ip = strdup(remote_ip);
+      ps->remote_udp->remote_port = remote_port;
+
+      silc_buffer_pull_tail(&ps->inbuf, ret);
+      return TRUE;
     }
+  }
 
-    silc_buffer_reset(&ps->outbuf);
+  /* Read data from the stream */
+  ret = silc_stream_read(ps->stream, ps->inbuf.tail,
+                        silc_buffer_taillen(&ps->inbuf));
 
+  if (ret == 0) {
+    /* EOS */
+    silc_buffer_reset(&ps->inbuf);
     silc_mutex_unlock(ps->lock);
-    break;
+    SILC_PACKET_CALLBACK_EOS(ps);
+    return FALSE;
+  }
 
-  case SILC_STREAM_CAN_READ:
-    SILC_LOG_DEBUG(("Reading data from stream"));
+  if (ret == -2) {
+    /* Error */
+    silc_buffer_reset(&ps->inbuf);
+    silc_mutex_unlock(ps->lock);
+    SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_READ);
+    return FALSE;
+  }
 
-    /* Make sure we have fair amount of free space in inbuf */
-    if (silc_buffer_taillen(&ps->inbuf) < SILC_PACKET_DEFAULT_SIZE)
-      if (!silc_buffer_realloc(&ps->inbuf, silc_buffer_truelen(&ps->inbuf) +
-                              SILC_PACKET_DEFAULT_SIZE * 2)) {
-       silc_mutex_unlock(ps->lock);
-       return;
-      }
+  if (ret == -1) {
+    /* Cannot read now, do it later. */
+    silc_buffer_pull(&ps->inbuf, silc_buffer_len(&ps->inbuf));
+    silc_mutex_unlock(ps->lock);
+    return FALSE;
+  }
 
-    /* Read data from stream */
-    ret = silc_stream_read(ps->stream, ps->inbuf.tail,
-                          silc_buffer_taillen(&ps->inbuf));
+  silc_buffer_pull_tail(&ps->inbuf, ret);
+  return TRUE;
+}
 
-    if (ret == 0) {
-      /* EOS */
-      silc_buffer_reset(&ps->inbuf);
-      silc_mutex_unlock(ps->lock);
-      SILC_PACKET_CALLBACK_EOS(ps);
-      return;
-    }
+/* Our stream IO notifier callback. */
 
-    if (ret == -2) {
-      /* Error */
-      silc_buffer_reset(&ps->inbuf);
+static void silc_packet_stream_io(SilcStream stream, SilcStreamStatus status,
+                                 void *context)
+{
+  SilcPacketStream remote = NULL, ps = context;
+
+  silc_mutex_lock(ps->lock);
+
+  if (ps->destroyed) {
+    silc_mutex_unlock(ps->lock);
+    return;
+  }
+
+  switch (status) {
+
+  case SILC_STREAM_CAN_WRITE:
+    SILC_LOG_DEBUG(("Writing pending data to stream"));
+
+    if (!silc_buffer_headlen(&ps->outbuf)) {
       silc_mutex_unlock(ps->lock);
-      SILC_PACKET_CALLBACK_ERROR(ps, SILC_PACKET_ERR_READ);
       return;
     }
 
-    if (ret == -1) {
-      /* Cannot read now, do it later. */
-      silc_buffer_pull(&ps->inbuf, silc_buffer_len(&ps->inbuf));
-      silc_mutex_unlock(ps->lock);
+    /* Write pending data to stream */
+    silc_packet_stream_write(ps);
+    break;
+
+  case SILC_STREAM_CAN_READ:
+    SILC_LOG_DEBUG(("Reading data from stream"));
+
+    /* Read data from stream */
+    if (!silc_packet_stream_read(ps, &remote))
       return;
-    }
 
     /* Now process the data */
-    silc_buffer_pull_tail(&ps->inbuf, ret);
-    silc_packet_read_process(ps);
-
-    silc_mutex_unlock(ps->lock);
+    if (!remote) {
+      silc_packet_read_process(ps);
+      silc_mutex_unlock(ps->lock);
+    } else {
+      silc_packet_read_process(remote);
+      silc_mutex_unlock(remote->lock);
+    }
     break;
 
   default:
@@ -302,6 +478,14 @@ static SilcPacket silc_packet_alloc(SilcPacketEngine engine)
   return packet;
 }
 
+/* UDP remote stream hash table destructor */
+
+static void silc_packet_engine_hash_destr(void *key, void *context,
+                                         void *user_context)
+{
+  silc_free(key);
+}
+
 
 /******************************** Packet API ********************************/
 
@@ -339,12 +523,16 @@ silc_packet_engine_start(SilcRng rng, SilcBool router,
   silc_list_init(engine->packet_pool, struct SilcPacketStruct, next);
   for (i = 0; i < 5; i++) {
     packet = silc_calloc(1, sizeof(*packet));
-    if (!packet)
+    if (!packet) {
+      silc_packet_engine_stop(engine);
       return NULL;
+    }
 
     tmp = silc_malloc(SILC_PACKET_DEFAULT_SIZE);
-    if (!tmp)
+    if (!tmp) {
+      silc_packet_engine_stop(engine);
       return NULL;
+    }
     silc_buffer_set(&packet->buffer, tmp, SILC_PACKET_DEFAULT_SIZE);
     silc_buffer_reset(&packet->buffer);
 
@@ -390,33 +578,140 @@ SilcPacketStream silc_packet_stream_create(SilcPacketEngine engine,
 
   ps->engine = engine;
   ps->stream = stream;
-  ps->refcnt++;
+  silc_atomic_init8(&ps->refcnt, 1);
+  silc_mutex_alloc(&ps->lock);
 
   /* Allocate buffers */
   tmp = silc_malloc(SILC_PACKET_DEFAULT_SIZE);
-  if (!tmp)
+  if (!tmp) {
+    silc_packet_stream_destroy(ps);
     return NULL;
+  }
   silc_buffer_set(&ps->inbuf, tmp, SILC_PACKET_DEFAULT_SIZE);
   silc_buffer_reset(&ps->inbuf);
   tmp = silc_malloc(SILC_PACKET_DEFAULT_SIZE);
-  if (!tmp)
+  if (!tmp) {
+    silc_packet_stream_destroy(ps);
     return NULL;
+  }
   silc_buffer_set(&ps->outbuf, tmp, SILC_PACKET_DEFAULT_SIZE);
   silc_buffer_reset(&ps->outbuf);
 
   /* Initialize packet procesors list */
   ps->process = silc_dlist_init();
+  if (!ps->process) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
 
   /* Set IO notifier callback */
   silc_stream_set_notifier(ps->stream, schedule, silc_packet_stream_io, ps);
 
-  silc_mutex_alloc(&ps->lock);
-
   /* Add to engine */
   silc_mutex_lock(engine->lock);
   silc_list_add(engine->streams, ps);
   silc_mutex_unlock(engine->lock);
 
+  /* If this is UDP stream, allocate UDP remote stream hash table */
+  if (!engine->udp_remote && silc_socket_stream_is_udp(stream, NULL))
+    engine->udp_remote = silc_hash_table_alloc(0, silc_hash_string, NULL,
+                                              silc_hash_string_compare, NULL,
+                                              silc_packet_engine_hash_destr,
+                                              NULL, TRUE);
+
+  return ps;
+}
+
+/* Add new remote packet stream for UDP packet streams */
+
+SilcPacketStream silc_packet_stream_add_remote(SilcPacketStream stream,
+                                              const char *remote_ip,
+                                              SilcUInt16 remote_port,
+                                              SilcPacket packet)
+{
+  SilcPacketEngine engine = stream->engine;
+  SilcPacketStream ps;
+  char *tuple;
+  void *tmp;
+
+  SILC_LOG_DEBUG(("Adding UDP remote %s:%d to packet stream %p",
+                 remote_ip, remote_port, stream));
+
+  if (!stream || !remote_ip || !remote_port)
+    return NULL;
+
+  if (!silc_socket_stream_is_udp(stream->stream, NULL)) {
+    SILC_LOG_ERROR(("Stream is not UDP stream, cannot add remote IP"));
+    return NULL;
+  }
+
+  ps = silc_calloc(1, sizeof(*ps));
+  if (!ps)
+    return NULL;
+
+  ps->engine = engine;
+  silc_atomic_init8(&ps->refcnt, 1);
+  silc_mutex_alloc(&ps->lock);
+
+  /* Set the UDP packet stream as underlaying stream */
+  silc_packet_stream_ref(stream);
+  ps->stream = (SilcStream)stream;
+  ps->udp = TRUE;
+
+  /* Allocate buffers */
+  tmp = silc_malloc(SILC_PACKET_DEFAULT_SIZE);
+  if (!tmp) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+  silc_buffer_set(&ps->inbuf, tmp, SILC_PACKET_DEFAULT_SIZE);
+  silc_buffer_reset(&ps->inbuf);
+  tmp = silc_malloc(SILC_PACKET_DEFAULT_SIZE);
+  if (!tmp) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+  silc_buffer_set(&ps->outbuf, tmp, SILC_PACKET_DEFAULT_SIZE);
+  silc_buffer_reset(&ps->outbuf);
+
+  /* Initialize packet procesors list */
+  ps->process = silc_dlist_init();
+  if (!ps->process) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+
+  /* Add to engine with this IP and port pair */
+  tuple = silc_format("%d%s", remote_port, remote_ip);
+  silc_mutex_lock(engine->lock);
+  if (!tuple || !silc_hash_table_add(engine->udp_remote, tuple, ps)) {
+    silc_mutex_unlock(engine->lock);
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+  silc_mutex_unlock(engine->lock);
+
+  /* Save remote IP and port pair */
+  ps->remote_udp = silc_calloc(1, sizeof(*ps->remote_udp));
+  if (!ps->remote_udp) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+  ps->remote_udp->remote_port = remote_port;
+  ps->remote_udp->remote_ip = strdup(remote_ip);
+  if (!ps->remote_udp->remote_ip) {
+    silc_packet_stream_destroy(ps);
+    return NULL;
+  }
+
+  if (packet) {
+    /* Inject packet to the new stream */
+    packet->stream = ps;
+    silc_schedule_task_add_timeout(silc_stream_get_schedule(stream->stream),
+                                  silc_packet_stream_inject_packet, packet,
+                                  0, 0);
+  }
+
   return ps;
 }
 
@@ -427,17 +722,37 @@ void silc_packet_stream_destroy(SilcPacketStream stream)
   if (!stream)
     return;
 
-  if (stream->refcnt > 1) {
+  if (silc_atomic_get_int8(&stream->refcnt) > 1) {
     stream->destroyed = TRUE;
     return;
   }
 
   SILC_LOG_DEBUG(("Destroying packet stream %p", stream));
 
-  /* Delete from engine */
-  silc_mutex_lock(stream->engine->lock);
-  silc_list_del(stream->engine->streams, stream);
-  silc_mutex_unlock(stream->engine->lock);
+  if (!stream->udp) {
+    /* Delete from engine */
+    silc_mutex_lock(stream->engine->lock);
+    silc_list_del(stream->engine->streams, stream);
+    silc_mutex_unlock(stream->engine->lock);
+
+    /* Destroy the underlaying stream */
+    if (stream->stream)
+      silc_stream_destroy(stream->stream);
+  } else {
+    /* Delete from UDP remote hash table */
+    char tuple[64];
+    snprintf(tuple, sizeof(tuple), "%d%s", stream->remote_udp->remote_port,
+            stream->remote_udp->remote_ip);
+    silc_mutex_lock(stream->engine->lock);
+    silc_hash_table_del(stream->engine->udp_remote, tuple);
+    silc_mutex_unlock(stream->engine->lock);
+
+    silc_free(stream->remote_udp->remote_ip);
+    silc_free(stream->remote_udp);
+
+    /* Unreference the underlaying packet stream */
+    silc_packet_stream_unref((SilcPacketStream)stream->stream);
+  }
 
   /* Clear and free buffers */
   silc_buffer_clear(&stream->inbuf);
@@ -445,12 +760,20 @@ void silc_packet_stream_destroy(SilcPacketStream stream)
   silc_buffer_purge(&stream->inbuf);
   silc_buffer_purge(&stream->outbuf);
 
-  /* XXX */
+  if (stream->process) {
+    SilcPacketProcess p;
+    silc_dlist_start(stream->process);
+    while ((p = silc_dlist_get(stream->process))) {
+      silc_free(p->types);
+      silc_free(p);
+      silc_dlist_del(stream->process, p);
+    }
+    silc_dlist_uninit(stream->process);
+  }
 
-  /* Destroy the underlaying stream */
-  silc_stream_destroy(stream->stream);
+  /* XXX */
 
-  silc_dlist_uninit(stream->process);
+  silc_atomic_uninit8(&stream->refcnt);
   silc_mutex_free(stream->lock);
   silc_free(stream);
 }
@@ -583,6 +906,7 @@ void silc_packet_stream_unlink(SilcPacketStream stream,
     if (p->callbacks == callbacks &&
        p->callback_context == callback_context) {
       silc_dlist_del(stream->process, p);
+      silc_free(p->types);
       silc_free(p);
       break;
     }
@@ -597,23 +921,40 @@ void silc_packet_stream_unlink(SilcPacketStream stream,
   silc_packet_stream_unref(stream);
 }
 
+/* Returns TRUE if stream is UDP stream */
+
+SilcBool silc_packet_stream_is_udp(SilcPacketStream stream)
+{
+  return stream->udp || silc_socket_stream_is_udp(stream->stream, NULL);
+}
+
+/* Return packet sender IP and port for UDP packet stream */
+
+SilcBool silc_packet_get_sender(SilcPacket packet,
+                               const char **sender_ip,
+                               SilcUInt16 *sender_port)
+{
+  if (!packet->stream->remote_udp)
+    return FALSE;
+
+  *sender_ip = packet->stream->remote_udp->remote_ip;
+  *sender_port = packet->stream->remote_udp->remote_port;
+
+  return TRUE;
+}
+
 /* Reference packet stream */
 
 void silc_packet_stream_ref(SilcPacketStream stream)
 {
-  silc_mutex_lock(stream->lock);
-  stream->refcnt++;
-  silc_mutex_unlock(stream->lock);
+  silc_atomic_add_int8(&stream->refcnt, 1);
 }
 
 /* Unreference packet stream */
 
 void silc_packet_stream_unref(SilcPacketStream stream)
 {
-  silc_mutex_lock(stream->lock);
-  stream->refcnt--;
-  silc_mutex_unlock(stream->lock);
-  if (stream->refcnt == 0)
+  if (silc_atomic_sub_int8(&stream->refcnt, 1) == 0)
     silc_packet_stream_destroy(stream);
 }
 
@@ -644,6 +985,18 @@ void *silc_packet_get_context(SilcPacketStream stream)
   return context;
 }
 
+/* Change underlaying stream */
+
+void silc_packet_stream_set_stream(SilcPacketStream ps,
+                                  SilcStream stream,
+                                  SilcSchedule schedule)
+{
+  if (ps->stream)
+    silc_stream_set_notifier(ps->stream, schedule, NULL, NULL);
+  ps->stream = stream;
+  silc_stream_set_notifier(ps->stream, schedule, silc_packet_stream_io, ps);
+}
+
 /* Return underlaying stream */
 
 SilcStream silc_packet_stream_get_stream(SilcPacketStream stream)
@@ -657,9 +1010,29 @@ void silc_packet_set_ciphers(SilcPacketStream stream, SilcCipher send,
                             SilcCipher receive)
 {
   SILC_LOG_DEBUG(("Setting new ciphers to packet stream"));
+
   silc_mutex_lock(stream->lock);
-  stream->send_key = send;
-  stream->receive_key = receive;
+
+  /* In case IV Included is set, save the old key */
+  if (stream->iv_included) {
+    if (stream->send_key[1]) {
+      silc_cipher_free(stream->send_key[1]);
+      stream->send_key[1] = stream->send_key[0];
+    }
+    if (stream->receive_key[1]) {
+      silc_cipher_free(stream->receive_key[1]);
+      stream->receive_key[1] = stream->receive_key[0];
+    }
+  } else {
+    if (stream->send_key[0])
+      silc_cipher_free(stream->send_key[0]);
+    if (stream->send_key[1])
+      silc_cipher_free(stream->receive_key[0]);
+  }
+
+  stream->send_key[0] = send;
+  stream->receive_key[0] = receive;
+
   silc_mutex_unlock(stream->lock);
 }
 
@@ -668,15 +1041,15 @@ void silc_packet_set_ciphers(SilcPacketStream stream, SilcCipher send,
 SilcBool silc_packet_get_ciphers(SilcPacketStream stream, SilcCipher *send,
                                 SilcCipher *receive)
 {
-  if (!stream->send_key && !stream->receive_key)
+  if (!stream->send_key[0] && !stream->receive_key[0])
     return FALSE;
 
   silc_mutex_lock(stream->lock);
 
   if (send)
-    *send = stream->send_key;
+    *send = stream->send_key[0];
   if (receive)
-    *receive = stream->receive_key;
+    *receive = stream->receive_key[0];
 
   silc_mutex_unlock(stream->lock);
 
@@ -689,9 +1062,29 @@ void silc_packet_set_hmacs(SilcPacketStream stream, SilcHmac send,
                           SilcHmac receive)
 {
   SILC_LOG_DEBUG(("Setting new HMACs to packet stream"));
+
   silc_mutex_lock(stream->lock);
-  stream->send_hmac = send;
-  stream->receive_hmac = receive;
+
+  /* In case IV Included is set, save the old HMAC */
+  if (stream->iv_included) {
+    if (stream->send_hmac[1]) {
+      silc_hmac_free(stream->send_hmac[1]);
+      stream->send_hmac[1] = stream->send_hmac[0];
+    }
+    if (stream->receive_hmac[1]) {
+      silc_hmac_free(stream->receive_hmac[1]);
+      stream->receive_hmac[1] = stream->receive_hmac[0];
+    }
+  } else {
+    if (stream->send_hmac[0])
+      silc_hmac_free(stream->send_hmac[0]);
+    if (stream->receive_hmac[0])
+      silc_hmac_free(stream->receive_hmac[0]);
+  }
+
+  stream->send_hmac[0] = send;
+  stream->receive_hmac[0] = receive;
+
   silc_mutex_unlock(stream->lock);
 }
 
@@ -700,15 +1093,15 @@ void silc_packet_set_hmacs(SilcPacketStream stream, SilcHmac send,
 SilcBool silc_packet_get_hmacs(SilcPacketStream stream, SilcHmac *send,
                               SilcHmac *receive)
 {
-  if (!stream->send_hmac && !stream->receive_hmac)
+  if (!stream->send_hmac[0] && !stream->receive_hmac[0])
     return FALSE;
 
   silc_mutex_lock(stream->lock);
 
   if (send)
-    *send = stream->send_hmac;
+    *send = stream->send_hmac[0];
   if (receive)
-    *receive = stream->receive_hmac;
+    *receive = stream->receive_hmac[0];
 
   silc_mutex_unlock(stream->lock);
 
@@ -766,6 +1159,19 @@ SilcBool silc_packet_set_ids(SilcPacketStream stream,
   return TRUE;
 }
 
+/* Adds Security ID (SID) */
+
+SilcBool silc_packet_set_sid(SilcPacketStream stream, SilcUInt8 sid)
+{
+  if (!stream->iv_included)
+    return FALSE;
+
+  SILC_LOG_DEBUG(("Set packet stream %p SID to %d", stream, sid));
+
+  stream->sid = sid;
+  return TRUE;
+}
+
 /* Free packet */
 
 void silc_packet_free(SilcPacket packet)
@@ -774,17 +1180,15 @@ void silc_packet_free(SilcPacket packet)
 
   SILC_LOG_DEBUG(("Freeing packet %p", packet));
 
-#if defined(SILC_DEBUG)
   /* Check for double free */
-  assert(packet->stream != NULL);
-#endif /* SILC_DEBUG */
-
-  silc_mutex_lock(stream->engine->lock);
+  SILC_ASSERT(packet->stream != NULL);
 
   packet->stream = NULL;
   packet->src_id = packet->dst_id = NULL;
   silc_buffer_reset(&packet->buffer);
 
+  silc_mutex_lock(stream->engine->lock);
+
   /* Put the packet back to freelist */
   silc_list_add(stream->engine->packet_pool, packet);
   if (silc_list_count(stream->engine->packet_pool) == 1)
@@ -841,12 +1245,12 @@ static SilcBool silc_packet_send_raw(SilcPacketStream stream,
                                     SilcCipher cipher,
                                     SilcHmac hmac)
 {
-  unsigned char tmppad[SILC_PACKET_MAX_PADLEN], iv[32], psn[4];
+  unsigned char tmppad[SILC_PACKET_MAX_PADLEN], iv[33], psn[4];
   int block_len = (cipher ? silc_cipher_get_block_len(cipher) : 0);
   int i, enclen, truelen, padlen, ivlen = 0, psnlen = 0;
   SilcBufferStruct packet;
 
-  SILC_LOG_DEBUG(("Sending packet %s (%d) flags %d, src %d dst %d,"
+  SILC_LOG_DEBUG(("Sending packet %s (%d) flags %d, src %d dst %d, "
                  "data len %d", silc_get_packet_name(type), stream->send_psn,
                  flags, src_id_type, dst_id_type, data_len));
 
@@ -858,11 +1262,12 @@ static SilcBool silc_packet_send_raw(SilcPacketStream stream,
   enclen = truelen = (data_len + SILC_PACKET_HEADER_LEN +
                      src_id_len + dst_id_len);
 
-  /* If IV is included, the IV and sequence number is added to packet */
+  /* If IV is included, the SID, IV and sequence number is added to packet */
   if (stream->iv_included && cipher) {
-    ivlen = block_len;
     psnlen = sizeof(psn);
-    memcpy(iv, silc_cipher_get_iv(cipher), block_len);
+    ivlen = block_len + 1;
+    iv[0] = stream->sid;
+    memcpy(iv + 1, silc_cipher_get_iv(cipher), block_len);
   }
 
   /* We automatically figure out the packet structure from the packet
@@ -912,8 +1317,8 @@ static SilcBool silc_packet_send_raw(SilcPacketStream stream,
   /* Create the packet.  This creates the SILC header, adds padding, and
      the actual packet data. */
   i = silc_buffer_format(&packet,
-                        SILC_STR_UI_XNSTRING(iv, ivlen),
-                        SILC_STR_UI_XNSTRING(psn, psnlen),
+                        SILC_STR_DATA(iv, ivlen),
+                        SILC_STR_DATA(psn, psnlen),
                         SILC_STR_UI_SHORT(truelen),
                         SILC_STR_UI_CHAR(flags),
                         SILC_STR_UI_CHAR(type),
@@ -922,11 +1327,11 @@ static SilcBool silc_packet_send_raw(SilcPacketStream stream,
                         SILC_STR_UI_CHAR(src_id_len),
                         SILC_STR_UI_CHAR(dst_id_len),
                         SILC_STR_UI_CHAR(src_id_type),
-                        SILC_STR_UI_XNSTRING(src_id, src_id_len),
+                        SILC_STR_DATA(src_id, src_id_len),
                         SILC_STR_UI_CHAR(dst_id_type),
-                        SILC_STR_UI_XNSTRING(dst_id, dst_id_len),
-                        SILC_STR_UI_XNSTRING(tmppad, padlen),
-                        SILC_STR_UI_XNSTRING(data, data_len),
+                        SILC_STR_DATA(dst_id, dst_id_len),
+                        SILC_STR_DATA(tmppad, padlen),
+                        SILC_STR_DATA(data, data_len),
                         SILC_STR_END);
   if (i < 0) {
     silc_mutex_unlock(stream->lock);
@@ -962,38 +1367,7 @@ static SilcBool silc_packet_send_raw(SilcPacketStream stream,
   }
 
   /* Write the packet to the stream */
-  while (silc_buffer_len(&stream->outbuf) > 0) {
-    i = silc_stream_write(stream->stream, stream->outbuf.data,
-                         silc_buffer_len(&stream->outbuf));
-    if (i == 0) {
-      /* EOS */
-      silc_buffer_reset(&stream->outbuf);
-      silc_mutex_unlock(stream->lock);
-      SILC_PACKET_CALLBACK_EOS(stream);
-      return FALSE;
-    }
-
-    if (i == -2) {
-      /* Error */
-      silc_buffer_reset(&stream->outbuf);
-      silc_mutex_unlock(stream->lock);
-      SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_WRITE);
-      return FALSE;
-    }
-
-    if (i == -1) {
-      /* Cannot write now, write later. */
-      silc_mutex_unlock(stream->lock);
-      return TRUE;
-    }
-
-    /* Wrote data */
-    silc_buffer_pull(&stream->outbuf, i);
-  }
-  silc_buffer_reset(&stream->outbuf);
-
-  silc_mutex_unlock(stream->lock);
-  return TRUE;
+  return silc_packet_stream_write(stream);
 }
 
 /* Sends a packet */
@@ -1010,8 +1384,8 @@ SilcBool silc_packet_send(SilcPacketStream stream,
                              stream->dst_id,
                              stream->dst_id_len,
                              data, data_len,
-                             stream->send_key,
-                             stream->send_hmac);
+                             stream->send_key[0],
+                             stream->send_hmac[0]);
 }
 
 /* Sends a packet, extended routine */
@@ -1043,21 +1417,76 @@ SilcBool silc_packet_send_ext(SilcPacketStream stream,
                              dst_id ? dst_id_data : stream->dst_id,
                              dst_id ? dst_id_len : stream->dst_id_len,
                              data, data_len,
-                             cipher ? cipher : stream->send_key,
-                             hmac ? hmac : stream->send_hmac);
+                             cipher ? cipher : stream->send_key[0],
+                             hmac ? hmac : stream->send_hmac[0]);
+}
+
+/* Sends packet after formatting the arguments to buffer */
+
+SilcBool silc_packet_send_va(SilcPacketStream stream,
+                            SilcPacketType type, SilcPacketFlags flags, ...)
+{
+  SilcBufferStruct buf;
+  SilcBool ret;
+  va_list va;
+
+  va_start(va, flags);
+
+  memset(&buf, 0, sizeof(buf));
+  if (silc_buffer_format_vp(&buf, va) < 0) {
+    va_end(va);
+    return FALSE;
+  }
+
+  ret = silc_packet_send(stream, type, flags, silc_buffer_data(&buf),
+                        silc_buffer_len(&buf));
+
+  silc_buffer_purge(&buf);
+  va_end(va);
+
+  return ret;
 }
 
+/* Sends packet after formatting the arguments to buffer, extended routine */
+
+SilcBool silc_packet_send_va_ext(SilcPacketStream stream,
+                                SilcPacketType type, SilcPacketFlags flags,
+                                SilcIdType src_id_type, void *src_id,
+                                SilcIdType dst_id_type, void *dst_id,
+                                SilcCipher cipher, SilcHmac hmac, ...)
+{
+  SilcBufferStruct buf;
+  SilcBool ret;
+  va_list va;
+
+  va_start(va, hmac);
+
+  memset(&buf, 0, sizeof(buf));
+  if (silc_buffer_format_vp(&buf, va) < 0) {
+    va_end(va);
+    return FALSE;
+  }
+
+  ret = silc_packet_send_ext(stream, type, flags, src_id_type, src_id,
+                            dst_id_type, dst_id, silc_buffer_data(&buf),
+                            silc_buffer_len(&buf), cipher, hmac);
+
+  silc_buffer_purge(&buf);
+  va_end(va);
+
+  return TRUE;
+}
 
 /***************************** Packet Receiving *****************************/
 
 /* Checks MAC in the packet. Returns TRUE if MAC is Ok. */
 
-static SilcBool silc_packet_check_mac(SilcHmac hmac,
-                                     const unsigned char *data,
-                                     SilcUInt32 data_len,
-                                     const unsigned char *packet_mac,
-                                     const unsigned char *packet_seq,
-                                     SilcUInt32 sequence)
+static inline SilcBool silc_packet_check_mac(SilcHmac hmac,
+                                            const unsigned char *data,
+                                            SilcUInt32 data_len,
+                                            const unsigned char *packet_mac,
+                                            const unsigned char *packet_seq,
+                                            SilcUInt32 sequence)
 {
   /* Check MAC */
   if (hmac) {
@@ -1093,9 +1522,9 @@ static SilcBool silc_packet_check_mac(SilcHmac hmac,
 /* Decrypts SILC packet.  Handles both normal and special packet decryption.
    Return 0 when packet is normal and 1 when it it special, -1 on error. */
 
-static int silc_packet_decrypt(SilcCipher cipher, SilcHmac hmac,
-                              SilcUInt32 sequence, SilcBuffer buffer,
-                              SilcBool normal)
+static inline int silc_packet_decrypt(SilcCipher cipher, SilcHmac hmac,
+                                     SilcUInt32 sequence, SilcBuffer buffer,
+                                     SilcBool normal)
 {
   if (normal == TRUE) {
     if (cipher) {
@@ -1141,52 +1570,59 @@ static int silc_packet_decrypt(SilcCipher cipher, SilcHmac hmac,
    parsed. The buffer sent must be already decrypted before calling this
    function. */
 
-static SilcBool silc_packet_parse(SilcPacket packet)
+static inline SilcBool silc_packet_parse(SilcPacket packet)
 {
   SilcBuffer buffer = &packet->buffer;
   SilcUInt8 padlen = (SilcUInt8)buffer->data[4];
   SilcUInt8 src_id_len, dst_id_len, src_id_type, dst_id_type;
-  int len, ret;
+  int ret;
 
   SILC_LOG_DEBUG(("Parsing incoming packet"));
 
   /* Parse the buffer.  This parses the SILC header of the packet. */
-  len = silc_buffer_unformat(buffer,
+  ret = silc_buffer_unformat(buffer,
+                            SILC_STR_ADVANCE,
                             SILC_STR_OFFSET(6),
                             SILC_STR_UI_CHAR(&src_id_len),
                             SILC_STR_UI_CHAR(&dst_id_len),
                             SILC_STR_UI_CHAR(&src_id_type),
                             SILC_STR_END);
-  if (len == -1) {
-    SILC_LOG_ERROR(("Malformed packet header, packet dropped"));
+  if (ret == -1) {
+    if (!packet->stream->udp &&
+       !silc_socket_stream_is_udp(packet->stream->stream, NULL))
+      SILC_LOG_ERROR(("Malformed packet header, packet dropped"));
     return FALSE;
   }
 
   if (src_id_len > SILC_PACKET_MAX_ID_LEN ||
       dst_id_len > SILC_PACKET_MAX_ID_LEN) {
-    SILC_LOG_ERROR(("Bad ID lengths in packet (%d and %d)",
-                   packet->src_id_len, packet->dst_id_len));
+    if (!packet->stream->udp &&
+       !silc_socket_stream_is_udp(packet->stream->stream, NULL))
+      SILC_LOG_ERROR(("Bad ID lengths in packet (%d and %d)",
+                     packet->src_id_len, packet->dst_id_len));
     return FALSE;
   }
 
   ret = silc_buffer_unformat(buffer,
-                            SILC_STR_OFFSET(len),
-                            SILC_STR_UI_XNSTRING(&packet->src_id,
-                                                 src_id_len),
+                            SILC_STR_ADVANCE,
+                            SILC_STR_DATA(&packet->src_id, src_id_len),
                             SILC_STR_UI_CHAR(&dst_id_type),
-                            SILC_STR_UI_XNSTRING(&packet->dst_id,
-                                                 dst_id_len),
+                            SILC_STR_DATA(&packet->dst_id, dst_id_len),
                             SILC_STR_OFFSET(padlen),
                             SILC_STR_END);
   if (ret == -1) {
-    SILC_LOG_ERROR(("Malformed packet header, packet dropped"));
+    if (!packet->stream->udp &&
+       !silc_socket_stream_is_udp(packet->stream->stream, NULL))
+      SILC_LOG_ERROR(("Malformed packet header, packet dropped"));
     return FALSE;
   }
 
   if (src_id_type > SILC_ID_CHANNEL ||
       dst_id_type > SILC_ID_CHANNEL) {
-    SILC_LOG_ERROR(("Bad ID types in packet (%d and %d)",
-                   src_id_type, dst_id_type));
+    if (!packet->stream->udp &&
+       !silc_socket_stream_is_udp(packet->stream->stream, NULL))
+      SILC_LOG_ERROR(("Bad ID types in packet (%d and %d)",
+                     src_id_type, dst_id_type));
     return FALSE;
   }
 
@@ -1195,12 +1631,9 @@ static SilcBool silc_packet_parse(SilcPacket packet)
   packet->src_id_type = src_id_type;
   packet->dst_id_type = dst_id_type;
 
-  SILC_LOG_HEXDUMP(("Parsed packet, len %d", silc_buffer_len(buffer)),
-                  buffer->data, silc_buffer_len(buffer));
-
-  /* Pull SILC header and padding from packet to get the data payload */
-  silc_buffer_pull(buffer, SILC_PACKET_HEADER_LEN +
-                  packet->src_id_len + packet->dst_id_len + padlen);
+  SILC_LOG_HEXDUMP(("Parsed packet, len %d", silc_buffer_headlen(buffer) +
+                  silc_buffer_len(buffer)), buffer->head,
+                  silc_buffer_headlen(buffer) + silc_buffer_len(buffer));
 
   SILC_LOG_DEBUG(("Incoming packet type: %d (%s)", packet->type,
                  silc_get_packet_name(packet->type)));
@@ -1217,27 +1650,18 @@ static void silc_packet_dispatch(SilcPacket packet)
   SilcBool default_sent = FALSE;
   SilcPacketType *pt;
 
-  /* Parse the packet */
-  if (!silc_packet_parse(packet)) {
-    silc_mutex_unlock(packet->stream->lock);
-    SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_MALFORMED);
-    silc_mutex_lock(packet->stream->lock);
-    silc_packet_free(packet);
-    return;
-  }
-
   /* Dispatch packet to all packet processors that want it */
 
   if (!stream->process) {
     /* Send to default processor as no others exist */
     SILC_LOG_DEBUG(("Dispatching packet to default callbacks"));
-    silc_mutex_unlock(packet->stream->lock);
+    silc_mutex_unlock(stream->lock);
     if (!stream->engine->callbacks->
        packet_receive(stream->engine, stream, packet,
                       stream->engine->callback_context,
                       stream->stream_context))
       silc_packet_free(packet);
-    silc_mutex_lock(packet->stream->lock);
+    silc_mutex_lock(stream->lock);
     return;
   }
 
@@ -1249,43 +1673,43 @@ static void silc_packet_dispatch(SilcPacket packet)
     if (!default_sent && p->priority <= 0) {
       SILC_LOG_DEBUG(("Dispatching packet to default callbacks"));
       default_sent = TRUE;
-      silc_mutex_unlock(packet->stream->lock);
+      silc_mutex_unlock(stream->lock);
       if (stream->engine->callbacks->
          packet_receive(stream->engine, stream, packet,
                         stream->engine->callback_context,
                         stream->stream_context)) {
-       silc_mutex_lock(packet->stream->lock);
+       silc_mutex_lock(stream->lock);
        return;
       }
-      silc_mutex_lock(packet->stream->lock);
+      silc_mutex_lock(stream->lock);
     }
 
     /* Send to processor */
     if (!p->types) {
       /* Send all packet types */
       SILC_LOG_DEBUG(("Dispatching packet to %p callbacks", p->callbacks));
-      silc_mutex_unlock(packet->stream->lock);
+      silc_mutex_unlock(stream->lock);
       if (p->callbacks->packet_receive(stream->engine, stream, packet,
                                       p->callback_context,
                                       stream->stream_context)) {
-       silc_mutex_lock(packet->stream->lock);
+       silc_mutex_lock(stream->lock);
        return;
       }
-      silc_mutex_lock(packet->stream->lock);
+      silc_mutex_lock(stream->lock);
     } else {
       /* Send specific types */
       for (pt = p->types; *pt; pt++) {
        if (*pt != packet->type)
          continue;
        SILC_LOG_DEBUG(("Dispatching packet to %p callbacks", p->callbacks));
-       silc_mutex_unlock(packet->stream->lock);
+       silc_mutex_unlock(stream->lock);
        if (p->callbacks->packet_receive(stream->engine, stream, packet,
                                         p->callback_context,
                                         stream->stream_context)) {
-         silc_mutex_lock(packet->stream->lock);
+         silc_mutex_lock(stream->lock);
          return;
        }
-       silc_mutex_lock(packet->stream->lock);
+       silc_mutex_lock(stream->lock);
        break;
       }
     }
@@ -1294,15 +1718,15 @@ static void silc_packet_dispatch(SilcPacket packet)
   if (!default_sent) {
     /* Send to default processor as it has not been sent yet */
     SILC_LOG_DEBUG(("Dispatching packet to default callbacks"));
-    silc_mutex_unlock(packet->stream->lock);
+    silc_mutex_unlock(stream->lock);
     if (stream->engine->callbacks->
        packet_receive(stream->engine, stream, packet,
                       stream->engine->callback_context,
                       stream->stream_context)) {
-      silc_mutex_lock(packet->stream->lock);
+      silc_mutex_lock(stream->lock);
       return;
     }
-    silc_mutex_lock(packet->stream->lock);
+    silc_mutex_lock(stream->lock);
   }
 
   /* If we got here, no one wanted the packet, so drop it */
@@ -1314,44 +1738,71 @@ static void silc_packet_dispatch(SilcPacket packet)
 
 static void silc_packet_read_process(SilcPacketStream stream)
 {
+  SilcCipher cipher;
+  SilcHmac hmac;
   SilcPacket packet;
+  SilcUInt8 sid;
   SilcUInt16 packetlen;
   SilcUInt32 paddedlen, mac_len, block_len, ivlen, psnlen;
   unsigned char tmp[SILC_PACKET_MIN_HEADER_LEN], *header;
   unsigned char iv[SILC_CIPHER_MAX_IV_SIZE], *packet_seq = NULL;
-  SilcBool normal = TRUE;
+  SilcBool normal;
   int ret;
 
   /* Parse the packets from the data */
   while (silc_buffer_len(&stream->inbuf) > 0) {
     ivlen = psnlen = 0;
+    cipher = stream->receive_key[0];
+    hmac = stream->receive_hmac[0];
+    normal = FALSE;
 
     if (silc_buffer_len(&stream->inbuf) <
-       stream->iv_included ? SILC_PACKET_MIN_HEADER_LEN_IV :
-       SILC_PACKET_MIN_HEADER_LEN) {
+       (stream->iv_included ? SILC_PACKET_MIN_HEADER_LEN_IV :
+        SILC_PACKET_MIN_HEADER_LEN)) {
       SILC_LOG_DEBUG(("Partial packet in queue, waiting for the rest"));
       return;
     }
 
-    if (stream->receive_hmac)
-      mac_len = silc_hmac_len(stream->receive_hmac);
+    if (hmac)
+      mac_len = silc_hmac_len(hmac);
     else
       mac_len = 0;
 
     /* Decrypt first block of the packet to get the length field out */
-    if (stream->receive_key) {
-      block_len = silc_cipher_get_block_len(stream->receive_key);
+    if (cipher) {
+      block_len = silc_cipher_get_block_len(cipher);
 
       if (stream->iv_included) {
-       /* IV is included in the ciphertext */
-       memcpy(iv, stream->inbuf.data, block_len);
-       ivlen = block_len;
+       /* SID, IV and sequence number is included in the ciphertext */
+       sid = (SilcUInt8)stream->inbuf.data[0];
+       memcpy(iv, stream->inbuf.data + 1, block_len);
+       ivlen = block_len + 1;
        psnlen = 4;
-      } else
-       memcpy(iv, silc_cipher_get_iv(stream->receive_key), block_len);
 
-      silc_cipher_decrypt(stream->receive_key, stream->inbuf.data + ivlen,
-                         tmp, block_len, iv);
+       /* Check SID, and get correct decryption key */
+       if (sid != stream->sid) {
+         /* If SID is recent get the previous key and use it */
+         if (sid > 0 && stream->sid > 0 && stream->sid - 1 == sid &&
+             stream->receive_key[1] && !stream->receive_hmac[1]) {
+           cipher = stream->receive_key[1];
+           hmac = stream->receive_hmac[1];
+         } else {
+           /* The SID is unknown, drop rest of the data in buffer */
+           SILC_LOG_DEBUG(("Unknown Security ID %d in packet, expected %d",
+                           sid, stream->sid));
+           silc_mutex_unlock(stream->lock);
+           SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_UNKNOWN_SID);
+           silc_mutex_lock(stream->lock);
+           silc_buffer_reset(&stream->inbuf);
+           return;
+         }
+       }
+      } else {
+       memcpy(iv, silc_cipher_get_iv(cipher), block_len);
+      }
+
+      silc_cipher_decrypt(cipher, stream->inbuf.data + ivlen, tmp,
+                         block_len, iv);
 
       header = tmp;
       if (stream->iv_included) {
@@ -1369,7 +1820,8 @@ static void silc_packet_read_process(SilcPacketStream stream)
 
     /* Sanity checks */
     if (packetlen < SILC_PACKET_MIN_LEN) {
-      SILC_LOG_ERROR(("Received too short packet"));
+      if (!stream->udp && !silc_socket_stream_is_udp(stream->stream, NULL))
+       SILC_LOG_ERROR(("Received too short packet"));
       silc_mutex_unlock(stream->lock);
       SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_MALFORMED);
       silc_mutex_lock(stream->lock);
@@ -1387,7 +1839,7 @@ static void silc_packet_read_process(SilcPacketStream stream)
     }
 
     /* Check MAC of the packet */
-    if (!silc_packet_check_mac(stream->receive_hmac, stream->inbuf.data,
+    if (!silc_packet_check_mac(hmac, stream->inbuf.data,
                               paddedlen + ivlen,
                               stream->inbuf.data + ivlen + paddedlen,
                               packet_seq, stream->receive_psn)) {
@@ -1409,6 +1861,7 @@ static void silc_packet_read_process(SilcPacketStream stream)
       silc_buffer_reset(&stream->inbuf);
       return;
     }
+    packet->stream = stream;
 
     /* Allocate more space to packet buffer, if needed */
     if (silc_buffer_truelen(&packet->buffer) < paddedlen) {
@@ -1457,10 +1910,10 @@ static void silc_packet_read_process(SilcPacketStream stream)
     silc_buffer_put(&packet->buffer, (stream->inbuf.data + ivlen +
                                      psnlen + (block_len - psnlen)),
                    paddedlen - ivlen - psnlen - (block_len - psnlen));
-    if (stream->receive_key) {
-      silc_cipher_set_iv(stream->receive_key, iv);
-      ret = silc_packet_decrypt(stream->receive_key, stream->receive_hmac,
-                               stream->receive_psn, &packet->buffer, normal);
+    if (cipher) {
+      silc_cipher_set_iv(cipher, iv);
+      ret = silc_packet_decrypt(cipher, hmac, stream->receive_psn,
+                               &packet->buffer, normal);
       if (ret < 0) {
        silc_mutex_unlock(stream->lock);
        SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_DECRYPTION_FAILED);
@@ -1477,8 +1930,17 @@ static void silc_packet_read_process(SilcPacketStream stream)
     /* Pull the packet from inbuf thus we'll get the next one in the inbuf. */
     silc_buffer_pull(&stream->inbuf, paddedlen + mac_len);
 
+    /* Parse the packet */
+    if (!silc_packet_parse(packet)) {
+      silc_mutex_unlock(stream->lock);
+      SILC_PACKET_CALLBACK_ERROR(stream, SILC_PACKET_ERR_MALFORMED);
+      silc_mutex_lock(stream->lock);
+      silc_packet_free(packet);
+      memset(tmp, 0, sizeof(tmp));
+      return;
+    }
+
     /* Dispatch the packet to application */
-    packet->stream = stream;
     silc_packet_dispatch(packet);
   }