diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..aa9fc78
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+# Docker build context is the repository root (bench/Dockerfile): send only what it uses.
+*
+!bench/
+!server/
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..c530d09
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,253 @@
+#
+# build.yml — VTesse CI: tests, static musl builds for camera/router targets,
+# the Docker test bench, releases.
+#
+# The VTun server (vtund) is built with our patches (server/build-vtund.sh,
+# server/patches) for PCs/servers only, in the x86_64 job, and released as
+# vtund-<vtun version>-x86_64. Cameras and routers build it in the OpenIPC
+# environment when needed.
+#
+# Static musl binaries (a static glibc binary cannot resolve host names without
+# the NSS libraries of the same glibc on the device). 32-bit ARM uses the OpenIPC
+# firmware toolchain, MIPS (both byte orders) the OpenWrt toolchains (musl,
+# soft-float: no FPU needed on routers), the rest Bootlin musl toolchains
+# (ci/build-musl.sh).
+#
+# Release: one release only, "latest", replaced by every push to main. Its title
+# carries the version from include/vtesse/version.h (VTESSE_VERSION "MAJOR.MM")
+# and its notes are one short line; the change history lives in CHANGELOG.md.
+# No versioned releases are kept.
+#
+
+name: VTesse CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# One run per branch and event: a newer push cancels the older run, so
+# "latest" always carries the build of the newest commit.
+concurrency:
+  group: build-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ------------------------------------------------------------------ tests
+  tests:
+    name: Unit tests (native, sanitizers)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Build and test
+        run: |
+          make -j"$(nproc)"
+          make test
+
+      - name: Test under ASan/UBSan
+        run: |
+          make -j"$(nproc)" BUILD=build-asan \
+            CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer" \
+            LDFLAGS="-fsanitize=address,undefined" test
+
+      - name: TAP-only build (LWIP=0)
+        run: make -j"$(nproc)" BUILD=build-tap LWIP=0 all
+
+      - name: Minimal lwIP build (SOCKS=0 UDP_RELAY=0 TAP=0) and its tests
+        run: make -j"$(nproc)" BUILD=build-min SOCKS=0 UDP_RELAY=0 TAP=0 test
+
+  # ------------------------------------------------------------------ cross
+  build:
+    name: Build ${{ matrix.target }} (musl static)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [arm32, mipsel, arm64, mips, x86_64]
+    env:
+      TOOLCHAIN_CACHE: ${{ github.workspace }}/.toolchains
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install qemu-user and the vtund build tools
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq qemu-user
+          # vtund (x86_64 job only)
+          if [ "${{ matrix.target }}" = x86_64 ]; then sudo apt-get install -y -qq bison flex autotools-dev; fi
+
+      - name: Cache toolchain
+        uses: actions/cache@v6
+        with:
+          path: .toolchains
+          key: toolchain-${{ matrix.target }}-${{ hashFiles('ci/build-musl.sh') }}
+
+      - name: Cache vtun sources
+        if: matrix.target == 'x86_64'
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/vtesse-vtun
+          key: vtun-${{ hashFiles('server/build-vtund.sh') }}
+
+      - name: Build and run the unit tests under qemu
+        run: QEMU=1 ci/build-musl.sh ${{ matrix.target }} dist
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v7
+        with:
+          name: vtesse-${{ matrix.target }}
+          path: dist/*
+          if-no-files-found: error
+
+  # ------------------------------------------------------------------ bench
+  bench:
+    name: Test bench (VTun 3.0.2 + our patches, in Docker)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Build
+        run: make -j"$(nproc)"
+
+      - name: Start the bench
+        run: |
+          bench/bench.sh build
+          bench/bench.sh up
+          sleep 5
+
+      - name: Server self-test
+        run: bench/bench.sh selftest
+
+      - name: Stage 1 acceptance (lwIP, DHCP)
+        run: bench/bench.sh cli-test
+
+      - name: Stage 2 acceptance (SOCKS5, port forwards)
+        run: bench/bench.sh proxy-test
+
+      - name: TAP backend acceptance
+        run: bench/bench.sh tap-test
+
+      - name: type tun acceptance (manual IPv4, lwIP and TAP)
+        run: bench/bench.sh tun-test
+
+      - name: UDP relay acceptance (RTP from cameras)
+        run: bench/bench.sh udp-test
+
+      - name: Failure scenarios (link loss, server restart, no option 121, lease renewal)
+        run: bench/bench.sh fault-test
+
+      - name: Server log
+        if: always()
+        run: docker logs vtesse-bench-server 2>&1 | tail -100 || true
+
+  # ---------------------------------------------------------------- android
+  android:
+    name: Android APK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Cache Gradle
+        uses: actions/cache@v6
+        with:
+          path: android/.gradle-cache
+          key: gradle-${{ hashFiles('android/**/*.kts', 'android/gradle.properties') }}
+
+      - name: Build APKs (Docker, ci/Dockerfile.android)
+        env:
+          KEYSTORE_BASE64: ${{ secrets.VTESSE_KEYSTORE_BASE64 }}
+          VTESSE_KEYSTORE_PASSWORD: ${{ secrets.VTESSE_KEYSTORE_PASSWORD }}
+          VTESSE_KEY_ALIAS: ${{ secrets.VTESSE_KEY_ALIAS }}
+          VTESSE_KEY_PASSWORD: ${{ secrets.VTESSE_KEY_PASSWORD }}
+        run: |
+          # release signing key from the repository secrets (absent in forks: unsigned)
+          if [ -n "$KEYSTORE_BASE64" ]; then
+            mkdir -p "$RUNNER_TEMP/keys"
+            echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/keys/vtesse-release.jks"
+            export VTESSE_KEYSTORE="$RUNNER_TEMP/keys/vtesse-release.jks"
+          fi
+          android/build.sh assembleDebug assembleRelease
+          rm -rf "$RUNNER_TEMP/keys"
+
+      - name: Upload APKs
+        uses: actions/upload-artifact@v7
+        with:
+          name: vtesse-android
+          path: android/app/build/outputs/apk/*/*.apk
+          if-no-files-found: error
+
+  # ---------------------------------------------------------------- release
+  release:
+    name: Release
+    needs: [tests, build, bench, android]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/download-artifact@v8
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Collect assets
+        id: vars
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VER=$(sed -n 's/^#define VTESSE_VERSION "\(.*\)"/\1/p' include/vtesse/version.h)
+          if [ -z "$VER" ]; then echo "::error::no VTESSE_VERSION found"; exit 1; fi
+          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          # the APK goes to Telegram only when the version changes (#33)
+          PREV=$(gh release view latest --json name -q .name 2>/dev/null || true)
+          echo "Previous release: ${PREV:-none}"
+          [ "$PREV" = "VTesse $VER" ] || echo "new=true" >> "$GITHUB_OUTPUT"
+          echo "vtun=$(server/build-vtund.sh --version)" >> "$GITHUB_OUTPUT"
+          mkdir release
+          # artifacts keep their directory layout (dist/...)
+          find artifacts -type f \( -name 'vtesse-*' -o -name 'vtund-*' \) -exec cp {} release/ \;
+          [ -f "release/vtund-$(server/build-vtund.sh --version)-x86_64" ] || { echo "::error::no vtund x86_64 binary"; exit 1; }
+          # Android: the signed release APK only (an unsigned one is app-release-unsigned.apk)
+          apk=$(find artifacts -type f -name app-release.apk | head -1)
+          [ -n "$apk" ] || { echo "::error::no signed release APK"; exit 1; }
+          cp "$apk" release/vtesse-android.apk
+          cp scripts/vtesse-hook.sh scripts/vtesse-udhcpc.script scripts/S99vtesse scripts/vtesse.init release/
+          (cd release && sha256sum * > SHA256SUMS)
+          ls -l release
+
+      - name: Publish "latest"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VER: ${{ steps.vars.outputs.ver }}
+          VTUN: ${{ steps.vars.outputs.vtun }}
+        run: |
+          gh release delete latest --cleanup-tag --yes 2>/dev/null || true
+          gh release create latest release/* \
+            --latest \
+            --title "VTesse ${VER}" \
+            --target "${GITHUB_SHA}" \
+            --notes "VTesse ${VER} (${GITHUB_SHA::7}): static musl builds of vtesse-cli for arm32, mipsel, mips, arm64 and x86_64, the Android app (vtesse-android.apk, Android 5.0+) and the VTun ${VTUN} server with our patches for PCs (vtund-${VTUN}-x86_64). Changes: CHANGELOG.md; installation: README.md."
+
+      # The Telegram channel gets the APK of every new version, as in OpenIPC/decoder (#33).
+      # Organization secrets; a failed upload is reported but does not fail the release.
+      - name: Telegram
+        if: steps.vars.outputs.new == 'true'
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_TOKEN_BOT_OPENIPC }}
+          TG_CHANNEL: ${{ secrets.TELEGRAM_CHANNEL_OPENIPC_DEV }}
+          VER: ${{ steps.vars.outputs.ver }}
+        run: |
+          if [ -z "$TG_TOKEN" ] || [ -z "$TG_CHANNEL" ]; then
+            echo "::warning::Telegram secrets are not available, APK not posted"; exit 0
+          fi
+          CAPTION=$(printf 'VTesse %s for Android\nCommit: %s\nTime: %s\n\n%s' "$VER" "${GITHUB_SHA::7}" \
+            "$(date -u '+%Y-%m-%d %H:%M:%S UTC')" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/latest")
+          HTTP=$(curl -sS -o tg.json -w '%{http_code}' "https://api.telegram.org/bot${TG_TOKEN}/sendDocument" \
+            -F chat_id="$TG_CHANNEL" -F caption="$CAPTION" -F document=@release/vtesse-android.apk) || HTTP=000
+          echo "Telegram response: $HTTP"
+          [ "$HTTP" = 200 ] || { echo "::warning::Telegram upload failed (HTTP $HTTP): $(cat tg.json 2>/dev/null)"; }
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..70fb162
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,109 @@
+# VTesse build.
+#   make CROSS_COMPILE=mipsel-linux-musl- STATIC=1   cross compile, static binary
+#   make LWIP=0                                       TAP backend only (no stack, no proxy)
+#   make LWIP_PROFILE=medium                          lwIP memory profile: large (default),
+#                                                     medium (cameras, routers), small
+#   make SOCKS=0 UDP_RELAY=0 TAP=0                   leave out optional modules (default 1)
+#   (use a separate BUILD=... directory per variant: objects are not rebuilt on a change)
+CROSS_COMPILE ?=
+ifneq ($(CROSS_COMPILE),)
+CC      := $(CROSS_COMPILE)gcc
+AR      := $(CROSS_COMPILE)ar
+endif
+CC      ?= cc
+AR      ?= ar
+CFLAGS  ?= -Os -g
+STATIC  ?= 0
+# Required flags stay separate so that CFLAGS can be overridden on the command line.
+LWIP_DIR    := third_party/lwip
+INCLUDES    := -Iinclude -Iport/lwip -I$(LWIP_DIR)/src/include
+BASE_CFLAGS := -std=c99 -Wall -Wextra -Wpedantic -Wshadow -D_POSIX_C_SOURCE=200809L \
+               -ffunction-sections -fdata-sections $(INCLUDES)
+BASE_LDFLAGS := -Wl,--gc-sections
+ifeq ($(STATIC),1)
+BASE_LDFLAGS += -static
+endif
+# vendored lwIP: unmodified upstream code, built with relaxed warnings
+LWIP_CFLAGS := -std=gnu99 -Wall -Wno-unused-parameter -Wno-address \
+               -ffunction-sections -fdata-sections $(INCLUDES)
+LDFLAGS ?=
+BUILD   ?= build
+LWIP    ?= 1
+# lwIP memory profile (port/lwip/lwipopts.h): large (PCs, Android), medium (cameras,
+# routers), small
+LWIP_PROFILE ?= large
+# optional modules of the lwIP build (1 = in, 0 = out): SOCKS5 server, UDP relay,
+# TAP/TUN backend (kernel interface; Linux only)
+SOCKS     ?= 1
+UDP_RELAY ?= 1
+TAP       ?= 1
+
+NETCORE_SRC := netcore/tunnel.c netcore/loop.c netcore/route.c
+ifeq ($(TAP),1)
+NETCORE_SRC += netcore/tapdev.c
+else
+BASE_CFLAGS += -DVTESSE_WITH_TAP=0
+endif
+VTUN_SRC    := vtun/vtun_proto.c vtun/vtun_client.c
+LWIP_SRC    := $(addprefix $(LWIP_DIR)/src/core/, def.c inet_chksum.c init.c ip.c mem.c \
+                 memp.c netif.c pbuf.c stats.c sys.c tcp.c tcp_in.c tcp_out.c timeouts.c udp.c) \
+               $(addprefix $(LWIP_DIR)/src/core/ipv4/, dhcp.c etharp.c icmp.c ip4.c ip4_addr.c ip4_frag.c) \
+               $(LWIP_DIR)/src/netif/ethernet.c
+
+LWIP_PROFILE_NUM := $(if $(filter small,$(LWIP_PROFILE)),0,$(if $(filter medium,$(LWIP_PROFILE)),1,2))
+BASE_CFLAGS += -DVTESSE_LWIP_PROFILE=$(LWIP_PROFILE_NUM)
+LWIP_CFLAGS += -DVTESSE_LWIP_PROFILE=$(LWIP_PROFILE_NUM)
+
+ifeq ($(LWIP),1)
+NETCORE_SRC += netcore/stack.c netcore/proxy.c
+BASE_CFLAGS += -DNC_WITH_SOCKS=$(SOCKS)
+ifeq ($(UDP_RELAY),1)
+NETCORE_SRC += netcore/udprelay.c
+else
+BASE_CFLAGS += -DVTESSE_WITH_UDP_RELAY=0
+endif
+NETCORE_OBJ := $(NETCORE_SRC:%.c=$(BUILD)/%.o) $(LWIP_SRC:%.c=$(BUILD)/%.o)
+else
+BASE_CFLAGS += -DVTESSE_WITH_LWIP=0
+NETCORE_OBJ := $(NETCORE_SRC:%.c=$(BUILD)/%.o)
+endif
+VTUN_OBJ    := $(VTUN_SRC:%.c=$(BUILD)/%.o)
+
+LIBNETCORE := $(BUILD)/libnetcore.a
+LIBVTESSE  := $(BUILD)/libvtesse.a
+CLI        := $(BUILD)/vtesse-cli
+TESTS      := $(BUILD)/test_proto $(BUILD)/test_client $(BUILD)/test_route
+
+.PHONY: all test tests clean
+
+all: $(LIBNETCORE) $(LIBVTESSE) $(CLI)
+
+$(BUILD)/$(LWIP_DIR)/%.o: $(LWIP_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CC) $(LWIP_CFLAGS) $(CFLAGS) -MMD -MP -c $< -o $@
+
+$(BUILD)/%.o: %.c
+	@mkdir -p $(dir $@)
+	$(CC) $(BASE_CFLAGS) $(CFLAGS) -MMD -MP -c $< -o $@
+
+$(LIBNETCORE): $(NETCORE_OBJ)
+	$(AR) rcs $@ $^
+
+$(LIBVTESSE): $(VTUN_OBJ)
+	$(AR) rcs $@ $^
+
+$(CLI): $(BUILD)/cli/vtesse_cli.o $(LIBVTESSE) $(LIBNETCORE)
+	$(CC) $(BASE_LDFLAGS) $(LDFLAGS) -o $@ $^
+
+$(BUILD)/test_%: $(BUILD)/tests/test_%.o $(LIBVTESSE) $(LIBNETCORE)
+	$(CC) $(BASE_LDFLAGS) $(LDFLAGS) -o $@ $^
+
+tests: $(TESTS)
+
+test: $(TESTS)
+	@for t in $(TESTS); do echo "== $$t"; $$t || exit 1; done
+
+clean:
+	rm -rf $(BUILD)
+
+-include $(shell find $(BUILD) -name '*.d' 2>/dev/null)
diff --git a/android/.gitignore b/android/.gitignore
new file mode 100644
index 0000000..7e3d718
--- /dev/null
+++ b/android/.gitignore
@@ -0,0 +1,9 @@
+.gradle/
+.gradle-cache/
+build/
+app/build/
+app/.cxx/
+local.properties
+keystore.properties
+*.jks
+*.keystore
diff --git a/android/.kotlin/errors/errors-1792001346003.log b/android/.kotlin/errors/errors-1792001346003.log
new file mode 100644
index 0000000..1219b50
--- /dev/null
+++ b/android/.kotlin/errors/errors-1792001346003.log
@@ -0,0 +1,4 @@
+kotlin version: 2.0.21
+error message: The daemon has terminated unexpectedly on startup attempt #1 with error code: 0. The daemon process output:
+    1. Kotlin compile daemon is ready
+
diff --git a/android/.kotlin/errors/errors-1792001436810.log b/android/.kotlin/errors/errors-1792001436810.log
new file mode 100644
index 0000000..1219b50
--- /dev/null
+++ b/android/.kotlin/errors/errors-1792001436810.log
@@ -0,0 +1,4 @@
+kotlin version: 2.0.21
+error message: The daemon has terminated unexpectedly on startup attempt #1 with error code: 0. The daemon process output:
+    1. Kotlin compile daemon is ready
+
diff --git a/android/.kotlin/errors/errors-1792001732067.log b/android/.kotlin/errors/errors-1792001732067.log
new file mode 100644
index 0000000..1219b50
--- /dev/null
+++ b/android/.kotlin/errors/errors-1792001732067.log
@@ -0,0 +1,4 @@
+kotlin version: 2.0.21
+error message: The daemon has terminated unexpectedly on startup attempt #1 with error code: 0. The daemon process output:
+    1. Kotlin compile daemon is ready
+
diff --git a/android/README.md b/android/README.md
new file mode 100644
index 0000000..2288196
--- /dev/null
+++ b/android/README.md
@@ -0,0 +1,81 @@
+# VTesse for Android
+
+VTun client for Android **without `VpnService`** (#13): a foreground service with a
+regular notification runs the tunnel and the lwIP stack and offers a local SOCKS5
+proxy and TCP port forwards on `127.0.0.1`. Other apps use them directly, e.g. VLC
+with `rtsp://127.0.0.1:8554/...` for a forward `8554:CAMERA_IP:554`. No VPN icon, no
+VPN permission; Android 5.0 (API 21) and later, phones and Android TV boxes (TV
+launcher banner, no touchscreen required).
+
+- Servers: up to three (name, VTun server, port, device ID, password), selected with
+  the buttons at the top. Selecting another server while connected disconnects and
+  connects with it; the notification shows `VTesse · Server N · name`.
+- Cameras: up to 8 per server (name, IP). For every camera the checked services
+  are forwarded on fixed local ports, **local port = server·1000 + service·10 +
+  camera** (#27):
+
+  | Service | Camera port | Server 1 | Server 2 | Server 3 |
+  |---|---|---|---|---|
+  | RTSP (55) | 554 | 1551–1558 | 2551–2558 | 3551–3558 |
+  | HTTP (80) | 80 | 1801–1808 | 2801–2808 | 3801–3808 |
+  | SSH (22), off by default | 22 | 1221–1228 | 2221–2228 | 3221–3228 |
+  | SOCKS5 | — | 1080 | 2080 | 3080 |
+
+  Camera 3 of server 1 in a player: `rtsp://user:pass@127.0.0.1:1553/stream=0`; its
+  web UI: `http://127.0.0.1:1803/`. Anything else goes into *Other forwards*
+  (`LPORT:IP:RPORT`).
+- RTP/UDP from cameras (#28): with *Receive RTP/UDP* checked, datagrams sent to the
+  device's tunnel address on port **S559** (1559, 2559, 3559 — "camera 9" of the RTSP
+  block) are relayed to `127.0.0.1:S559`. The status shows what to configure: on the
+  camera `outgoing` → `udp://<tunnel address>:1559` (majestic.yaml: `server:` or
+  `servers:` depending on the Majestic version, see
+  [usage](../docs/usage.md#udp-relay-rtp-from-cameras)), in the player `udp://@:1559`
+  (OpenIPC Decoder: a `udp://` slot, shown as `UDP push`). The tunnel address stays
+  the same across reconnects. Verified on the Android TV box: a camera pushing H.264
+  1080p, Decoder playing it at full rate through the relay.
+- Device ID: generated once (random locally administered unicast MAC, second
+  character `2`, `6`, `A` or `E`) and kept; it can be replaced by hand. Add it as a
+  session on the VTun server (long press copies it).
+- The tunnel runs in its own process (`:tunnel`): the native stack can be started
+  once per process, so *Disconnect* ends that process.
+- Network changes (Wi-Fi ↔ mobile) reconnect at once (`vt_network_changed()`);
+  a partial wake lock keeps keepalives going with the screen off.
+- Native code: the repository's C sources built by CMake
+  ([`app/src/main/cpp`](app/src/main/cpp)); JNI bridge `vtesse_jni.c`.
+
+## Players
+
+Recommended: [OpenIPC Decoder](https://github.com/OpenIPC/decoder) with the slot's
+transport set to **TCP** — RTP over UDP cannot pass a TCP port forward (Auto falls
+back to TCP after 3 s). A camera can be opened from the shell:
+
+```sh
+adb shell am start -a android.intent.action.SEND -t text/plain \
+  --es android.intent.extra.TEXT 'rtsp://user:pass@127.0.0.1:1551/stream=0' \
+  --es transport tcp -n com.openipc.decoder/.Decoder
+```
+
+Keep Decoder's **S** mode (key frames only) off for full-rate video. VLC works too
+(`rtsp://127.0.0.1:1551/...`). Smooth 1080p through the tunnel was confirmed on an
+Android TV box (#25); if a stream shows far fewer frames than the camera is set to,
+check the camera's own uplink first (transmit drops in its `/metrics`): the tunnel
+carries several Mbit/s per connection (#24).
+
+## Build
+
+```sh
+android/build.sh                    # debug + release APK in Docker (ci/Dockerfile.android)
+adb install -r android/app/build/outputs/apk/debug/app-debug.apk
+```
+
+Release signing: `VTESSE_KEYSTORE` (path) with `VTESSE_KEYSTORE_PASSWORD`,
+`VTESSE_KEY_ALIAS`, `VTESSE_KEY_PASSWORD` in the environment, or
+`android/keystore.properties` (`storeFile`, `storePassword`, `keyAlias`,
+`keyPassword`); `android/build.sh` also picks up a key kept outside the repository in
+`~/.config/vtesse/`. CI signs with the repository secrets `VTESSE_KEYSTORE_BASE64`,
+`VTESSE_KEYSTORE_PASSWORD`, `VTESSE_KEY_ALIAS`, `VTESSE_KEY_PASSWORD`; without a key
+the release APK is unsigned and the release job refuses it. Keep a backup of the
+key: updates must be signed with the same key.
+
+Release certificate (SHA-256):
+`5B:EF:22:D7:BB:4F:1B:CB:DA:0F:4E:DE:AD:2B:6D:D7:18:C1:48:AA:F4:48:17:BB:69:2A:15:72:A8:FB:0D:E2`
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
new file mode 100644
index 0000000..8d226f1
--- /dev/null
+++ b/android/app/build.gradle.kts
@@ -0,0 +1,72 @@
+// VTesse for Android: VTun client with a local proxy, no VpnService (#13).
+import java.util.Properties
+
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+// Version from include/vtesse/version.h ("MAJOR.MM" -> versionCode MAJOR*100+MM).
+val vtesseVersion: String = Regex("#define VTESSE_VERSION \"([0-9.]+)\"")
+    .find(rootProject.file("../include/vtesse/version.h").readText())!!.groupValues[1]
+
+// Release signing from android/keystore.properties (not in the repository) or env.
+val keystoreProps = Properties().apply {
+    val f = rootProject.file("keystore.properties")
+    if (f.exists()) f.inputStream().use { load(it) }
+}
+fun signingValue(key: String, env: String): String? = keystoreProps.getProperty(key) ?: System.getenv(env)
+
+android {
+    namespace = "org.openipc.vtesse"
+    compileSdk = 35
+    ndkVersion = "27.2.12479018"
+    buildToolsVersion = "35.0.0"
+
+    defaultConfig {
+        applicationId = "org.openipc.vtesse"
+        minSdk = 21
+        targetSdk = 35
+        versionName = vtesseVersion
+        versionCode = vtesseVersion.split(".").let { it[0].toInt() * 100 + it[1].toInt() }
+        ndk {
+            abiFilters += listOf("armeabi-v7a", "arm64-v8a", "x86", "x86_64")
+        }
+    }
+
+    signingConfigs {
+        create("release") {
+            val store = signingValue("storeFile", "VTESSE_KEYSTORE")
+            if (store != null) {
+                storeFile = file(store)
+                storePassword = signingValue("storePassword", "VTESSE_KEYSTORE_PASSWORD")
+                keyAlias = signingValue("keyAlias", "VTESSE_KEY_ALIAS")
+                keyPassword = signingValue("keyPassword", "VTESSE_KEY_PASSWORD")
+            }
+        }
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = true
+            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            if (signingValue("storeFile", "VTESSE_KEYSTORE") != null)
+                signingConfig = signingConfigs.getByName("release")
+        }
+    }
+
+    externalNativeBuild {
+        cmake {
+            path = file("src/main/cpp/CMakeLists.txt")
+            version = "3.22.1"
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+}
diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro
new file mode 100644
index 0000000..2883359
--- /dev/null
+++ b/android/app/proguard-rules.pro
@@ -0,0 +1,2 @@
+# JNI entry points are looked up by name.
+-keep class org.openipc.vtesse.Native { *; }
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
new file mode 100644
index 0000000..03d2741
--- /dev/null
+++ b/android/app/src/main/AndroidManifest.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
+    <!-- also for Android TV boxes (no touchscreen) -->
+    <uses-feature android:name="android.hardware.touchscreen" android:required="false" />
+    <uses-feature android:name="android.software.leanback" android:required="false" />
+
+    <application
+        android:allowBackup="false"
+        android:banner="@drawable/banner"
+        android:icon="@drawable/ic_launcher"
+        android:label="@string/app_name"
+        android:theme="@android:style/Theme.Material.Light.DarkActionBar">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:windowSoftInputMode="adjustResize|stateHidden">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <!-- Not a VPN: a regular foreground service with a local proxy on 127.0.0.1.
+             Own process: the native stack is initialised once per process. -->
+        <service
+            android:name=".TunnelService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:process=":tunnel">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="VTun tunnel to remote IP cameras with a local SOCKS5 proxy and port forwards" />
+        </service>
+    </application>
+</manifest>
diff --git a/android/app/src/main/cpp/CMakeLists.txt b/android/app/src/main/cpp/CMakeLists.txt
new file mode 100644
index 0000000..b1d17ab
--- /dev/null
+++ b/android/app/src/main/cpp/CMakeLists.txt
@@ -0,0 +1,28 @@
+# libvtesse.so for the Android app: the VTun client, libnetcore (lwIP stack,
+# local proxy) and the JNI bridge, built from the repository sources.
+cmake_minimum_required(VERSION 3.22.1)
+project(vtesse C)
+
+set(ROOT ${CMAKE_CURRENT_SOURCE_DIR}/../../../../..)
+set(LWIP ${ROOT}/third_party/lwip/src)
+
+set(LWIP_SRC
+    ${LWIP}/core/def.c ${LWIP}/core/inet_chksum.c ${LWIP}/core/init.c ${LWIP}/core/ip.c
+    ${LWIP}/core/mem.c ${LWIP}/core/memp.c ${LWIP}/core/netif.c ${LWIP}/core/pbuf.c
+    ${LWIP}/core/stats.c ${LWIP}/core/sys.c ${LWIP}/core/tcp.c ${LWIP}/core/tcp_in.c
+    ${LWIP}/core/tcp_out.c ${LWIP}/core/timeouts.c ${LWIP}/core/udp.c
+    ${LWIP}/core/ipv4/dhcp.c ${LWIP}/core/ipv4/etharp.c ${LWIP}/core/ipv4/icmp.c
+    ${LWIP}/core/ipv4/ip4.c ${LWIP}/core/ipv4/ip4_addr.c ${LWIP}/core/ipv4/ip4_frag.c
+    ${LWIP}/netif/ethernet.c)
+
+set(CORE_SRC
+    ${ROOT}/netcore/tunnel.c ${ROOT}/netcore/loop.c ${ROOT}/netcore/route.c
+    ${ROOT}/netcore/stack.c ${ROOT}/netcore/proxy.c ${ROOT}/netcore/udprelay.c
+    ${ROOT}/vtun/vtun_proto.c ${ROOT}/vtun/vtun_client.c)
+
+add_library(vtesse SHARED vtesse_jni.c ${CORE_SRC} ${LWIP_SRC})
+target_include_directories(vtesse PRIVATE ${ROOT}/include ${ROOT}/port/lwip ${LWIP}/include)
+target_compile_options(vtesse PRIVATE -std=gnu99 -Os -Wall -Wno-unused-parameter -Wno-address
+                       -ffunction-sections -fdata-sections)
+target_link_options(vtesse PRIVATE -Wl,--gc-sections)
+target_link_libraries(vtesse PRIVATE log)
diff --git a/android/app/src/main/cpp/vtesse_jni.c b/android/app/src/main/cpp/vtesse_jni.c
new file mode 100644
index 0000000..868fdaa
--- /dev/null
+++ b/android/app/src/main/cpp/vtesse_jni.c
@@ -0,0 +1,579 @@
+/*
+ * JNI bridge of the Android app.
+ *
+ * Runs the VTun client, the lwIP stack and the local proxy (SOCKS5, port
+ * forwards on 127.0.0.1) in one native thread: the libraries are
+ * single-threaded. Java talks to that thread through a pipe (stop, network
+ * changed) and reads a status snapshot kept under a mutex.
+ *
+ * One session per process: lwIP keeps global state and is initialised once, so
+ * the app runs the tunnel service in its own process and ends that process on
+ * stop.
+ *
+ * Configuration: the key=value lines of the vtesse-cli config file (host, port,
+ * session, password, ip, gw, route, udp_relay) plus socks_port,
+ * forward=LPORT:IP:RPORT (repeatable) and listen.
+ */
+#include <jni.h>
+
+#include <android/log.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "netcore/loop.h"
+#include "netcore/proxy.h"
+#include "netcore/route.h"
+#include "netcore/stack.h"
+#include "netcore/udprelay.h"
+#include "vtesse/version.h"
+#include "vtesse/vtun_client.h"
+
+#define TAG          "vtesse"
+#define LOG_LINES    40
+#define LOG_LINE_MAX 160
+
+enum { ST_IDLE, ST_CONNECTING, ST_UP, ST_DOWN, ST_FAILED, ST_STOPPED };
+static const char *const state_names[] = { "idle", "connecting", "up", "down", "failed", "stopped" };
+
+/* Shared with the Java threads; everything below the mutex. */
+static struct {
+    pthread_mutex_t mu;
+    int state;
+    int bound;
+    char addr[16], mask[16], gw[16];
+    char routes[NC_ROUTES_MAX][48];
+    int route_count;
+    char flags[32];
+    char error[128];
+    nc_proxy_stats_t ps;
+    nc_udp_relay_stats_t us[NC_UDP_RELAY_MAX];
+    char log[LOG_LINES][LOG_LINE_MAX];
+    int log_next, log_count;
+} S = { .mu = PTHREAD_MUTEX_INITIALIZER };
+
+/* Owned by the loop thread once it runs. */
+static pthread_t loop_thread;
+static int started;
+static int cmd_pipe[2] = { -1, -1 };
+static nc_loop_t loop;
+static vt_t *vt;
+static nc_proxy_t *px;
+static nc_udp_relay_t *relay[NC_UDP_RELAY_MAX];
+static uint64_t t_start, next_stats;
+
+static void logf_(int prio, const char *fmt, ...)
+{
+    char msg[LOG_LINE_MAX - 12];
+    va_list ap;
+
+    va_start(ap, fmt);
+    vsnprintf(msg, sizeof(msg), fmt, ap);
+    va_end(ap);
+    __android_log_print(prio, TAG, "%s", msg);
+    pthread_mutex_lock(&S.mu);
+    snprintf(S.log[S.log_next], LOG_LINE_MAX, "[%7.1f] %s",
+             t_start ? (double)(nc_now_ms() - t_start) / 1000.0 : 0.0, msg);
+    S.log_next = (S.log_next + 1) % LOG_LINES;
+    if (S.log_count < LOG_LINES)
+        S.log_count++;
+    pthread_mutex_unlock(&S.mu);
+}
+
+static void set_state(int state, int err)
+{
+    pthread_mutex_lock(&S.mu);
+    S.state = state;
+    if (err)
+        snprintf(S.error, sizeof(S.error), "%s", tunnel_strerror(err));
+    else if (state == ST_UP)
+        S.error[0] = '\0';
+    pthread_mutex_unlock(&S.mu);
+}
+
+/* ---- events (loop thread) ---- */
+
+static void on_bound(void)
+{
+    nc_stack_info_t in;
+    int i;
+
+    nc_stack_get_info(&in);
+    pthread_mutex_lock(&S.mu);
+    S.bound = 1;
+    nc_ip4_format(in.addr, S.addr, sizeof(S.addr));
+    nc_ip4_format(in.mask, S.mask, sizeof(S.mask));
+    nc_ip4_format(in.gw, S.gw, sizeof(S.gw));
+    S.route_count = in.routes.count;
+    for (i = 0; i < in.routes.count; i++)
+        nc_route_format(&in.routes.r[i], S.routes[i], sizeof(S.routes[i]));
+    pthread_mutex_unlock(&S.mu);
+    logf_(ANDROID_LOG_INFO, "address %s mask %s%s", S.addr, S.mask,
+          in.default_route ? " (default route)" : "");
+    for (i = 0; i < in.routes.count; i++)
+        logf_(ANDROID_LOG_INFO, "  route %s", S.routes[i]);
+}
+
+static void on_stack_event(void *user, int ev, int tev, int err)
+{
+    (void)user;
+    if (ev == NC_STACK_EV_ADDR_BOUND) {
+        on_bound();
+    } else if (ev == NC_STACK_EV_ADDR_LOST) {
+        pthread_mutex_lock(&S.mu);
+        S.bound = 0;
+        pthread_mutex_unlock(&S.mu);
+        logf_(ANDROID_LOG_INFO, "address lost");
+    } else if (ev == NC_STACK_EV_TUNNEL) {
+        switch (tev) {
+        case TUNNEL_EV_CONNECTING:
+            set_state(ST_CONNECTING, 0);
+            logf_(ANDROID_LOG_INFO, "connecting");
+            break;
+        case TUNNEL_EV_UP: {
+            char flags[32];
+
+            vt_flags_format(vt_session_flags(vt), flags, sizeof(flags));
+            pthread_mutex_lock(&S.mu);
+            snprintf(S.flags, sizeof(S.flags), "%s", flags);
+            pthread_mutex_unlock(&S.mu);
+            set_state(ST_UP, 0);
+            logf_(ANDROID_LOG_INFO, "up: %s, flags %s", vt_greeting(vt), flags);
+            break;
+        }
+        case TUNNEL_EV_DOWN:
+            set_state(ST_DOWN, err);
+            logf_(ANDROID_LOG_WARN, "down: %s", tunnel_strerror(err));
+            break;
+        case TUNNEL_EV_FAILED:
+            set_state(ST_FAILED, err);
+            logf_(ANDROID_LOG_ERROR, "failed: %s", tunnel_strerror(err));
+            break;
+        }
+    }
+}
+
+static void on_proxy_log(void *user, const char *msg)
+{
+    (void)user;
+    logf_(ANDROID_LOG_INFO, "proxy: %s", msg);
+}
+
+/* ---- command pipe and stats timer (loop sources) ---- */
+
+static int cmd_get_fd(void *ctx)
+{
+    (void)ctx;
+    return cmd_pipe[0];
+}
+
+static void cmd_on_readable(void *ctx)
+{
+    char buf[16];
+    ssize_t n, i;
+
+    (void)ctx;
+    while ((n = read(cmd_pipe[0], buf, sizeof(buf))) > 0)
+        for (i = 0; i < n; i++) {
+            if (buf[i] == 'q')
+                loop.stop = 1;
+            else if (buf[i] == 'n') {
+                logf_(ANDROID_LOG_INFO, "network changed");
+                vt_network_changed(vt);
+            }
+        }
+}
+
+static int stats_next(void *ctx)
+{
+    uint64_t now = nc_now_ms();
+
+    (void)ctx;
+    return now >= next_stats ? 0 : (int)(next_stats - now);
+}
+
+static void stats_on_timer(void *ctx)
+{
+    (void)ctx;
+    next_stats = nc_now_ms() + 1000;
+    pthread_mutex_lock(&S.mu);
+    if (px)
+        nc_proxy_get_stats(px, &S.ps);
+    for (int i = 0; i < NC_UDP_RELAY_MAX; i++)
+        if (relay[i])
+            nc_udp_relay_get_stats(relay[i], &S.us[i]);
+    pthread_mutex_unlock(&S.mu);
+}
+
+static void *loop_main(void *arg)
+{
+    tunnel_t t = vt_tunnel(vt);
+
+    (void)arg;
+    vt_start(vt);
+    nc_loop_run(&loop, 0);
+
+    t.ops->close(t.ctx);            /* CONN_CLOSE to the server */
+    if (px)
+        nc_proxy_destroy(px);
+    px = NULL;
+    for (int i = 0; i < NC_UDP_RELAY_MAX; i++) {
+        nc_udp_relay_destroy(relay[i]);
+        relay[i] = NULL;
+    }
+    vt_destroy(vt);
+    vt = NULL;
+    set_state(ST_STOPPED, 0);
+    logf_(ANDROID_LOG_INFO, "stopped");
+    return NULL;
+}
+
+/* ---- configuration ---- */
+
+static int parse_ip4(const char *s, uint32_t *out)
+{
+    unsigned a, b, c, d;
+    char tail;
+
+    if (sscanf(s, "%u.%u.%u.%u%c", &a, &b, &c, &d, &tail) != 4 || a > 255 || b > 255 || c > 255 || d > 255)
+        return -1;
+    *out = a << 24 | b << 16 | c << 8 | d;
+    return 0;
+}
+
+static int parse_prefix(const char *s, uint32_t *addr, int *prefix)
+{
+    char buf[32];
+    const char *slash = strchr(s, '/');
+
+    if (!slash || (size_t)(slash - s) >= sizeof(buf))
+        return -1;
+    memcpy(buf, s, (size_t)(slash - s));
+    buf[slash - s] = '\0';
+    *prefix = atoi(slash + 1);
+    return *prefix < 0 || *prefix > 32 || parse_ip4(buf, addr) < 0 ? -1 : 0;
+}
+
+static int parse_forward(const char *s, nc_forward_t *f)
+{
+    unsigned lp, rp;
+    char ip[32];
+
+    if (sscanf(s, "%u:%31[0-9.]:%u", &lp, ip, &rp) != 3 || !lp || lp > 65535 || !rp || rp > 65535)
+        return -1;
+    f->local_port = (uint16_t)lp;
+    f->port = (uint16_t)rp;
+    return parse_ip4(ip, &f->ip);
+}
+
+static char *trim(char *s)
+{
+    char *e;
+
+    while (*s == ' ' || *s == '\t')
+        s++;
+    e = s + strlen(s);
+    while (e > s && (e[-1] == ' ' || e[-1] == '\t' || e[-1] == '\r' || e[-1] == '\n'))
+        *--e = '\0';
+    return s;
+}
+
+typedef struct app_cfg {
+    char host[256], session[64], password[128], listen[64];
+    int port, socks_port;
+    uint16_t relay_port[NC_UDP_RELAY_MAX], relay_local[NC_UDP_RELAY_MAX];
+    int nrelays;
+    vt_cfg_t vc;
+    nc_stack_cfg_t sc;
+    nc_proxy_cfg_t pc;
+} app_cfg_t;
+
+static app_cfg_t cfg;   /* strings referenced by vt (copied) and the proxy (kept) */
+
+/* Fills cfg from key=value text. NULL on success, else a message. */
+static const char *parse_config(char *text)
+{
+    static char msg[128];
+    char *line, *save = NULL;
+
+    memset(&cfg, 0, sizeof(cfg));
+    for (line = strtok_r(text, "\n", &save); line; line = strtok_r(NULL, "\n", &save)) {
+        char *k = trim(line), *v = strchr(k, '=');
+
+        if (*k == '#' || !v)
+            continue;
+        *v++ = '\0';
+        k = trim(k);
+        v = trim(v);
+        if (!strcmp(k, "host"))
+            snprintf(cfg.host, sizeof(cfg.host), "%s", v);
+        else if (!strcmp(k, "port"))
+            cfg.port = atoi(v);
+        else if (!strcmp(k, "session"))
+            snprintf(cfg.session, sizeof(cfg.session), "%s", v);
+        else if (!strcmp(k, "password"))
+            snprintf(cfg.password, sizeof(cfg.password), "%s", v);
+        else if (!strcmp(k, "listen"))
+            snprintf(cfg.listen, sizeof(cfg.listen), "%s", v);
+        else if (!strcmp(k, "socks_port"))
+            cfg.socks_port = atoi(v);
+        else if (!strcmp(k, "forward")) {
+            if (cfg.pc.forward_count >= NC_PROXY_MAX_FORWARDS ||
+                parse_forward(v, &cfg.pc.forwards[cfg.pc.forward_count]) < 0) {
+                snprintf(msg, sizeof(msg), "bad forward '%s' (LPORT:A.B.C.D:RPORT, max %d)", v,
+                         NC_PROXY_MAX_FORWARDS);
+                return msg;
+            }
+            cfg.pc.forward_count++;
+        } else if (!strcmp(k, "udp_relay")) {
+            if (cfg.nrelays >= NC_UDP_RELAY_MAX ||
+                nc_udp_relay_parse(v, &cfg.relay_port[cfg.nrelays], &cfg.relay_local[cfg.nrelays]) < 0) {
+                snprintf(msg, sizeof(msg), "bad udp_relay '%s' (PORT[:LOCAL_PORT], max %d)", v, NC_UDP_RELAY_MAX);
+                return msg;
+            }
+            cfg.nrelays++;
+        } else if (!strcmp(k, "ip")) {
+            int p;
+
+            if (parse_prefix(v, &cfg.sc.addr, &p) < 0)
+                return "bad ip (A.B.C.D/P)";
+            cfg.sc.mask = p ? 0xffffffffu << (32 - p) : 0;
+            cfg.sc.static_ip = 1;
+        } else if (!strcmp(k, "gw")) {
+            if (parse_ip4(v, &cfg.sc.gw) < 0)
+                return "bad gw (A.B.C.D)";
+        } else if (!strcmp(k, "route")) {
+            uint32_t net;
+            int p;
+
+            if (parse_prefix(v, &net, &p) < 0 || nc_routes_add(&cfg.sc.routes, net, (uint8_t)p, 0) < 0)
+                return "bad route (NET/P)";
+        }
+    }
+    if (!cfg.host[0] || cfg.port <= 0 || cfg.port > 65535)
+        return "server and port are required";
+    if (nc_devid_to_mac(cfg.session, cfg.sc.mac) < 0)
+        return "device ID: 12 characters 0-9A-F, unicast";
+    if (!cfg.password[0])
+        return "password is required";
+    if (cfg.socks_port < 0 || cfg.socks_port > 65535)
+        return "bad SOCKS5 port";
+    if (!cfg.socks_port && !cfg.pc.forward_count && !cfg.nrelays)
+        return "nothing to do: no SOCKS5, port forward or UDP relay";
+    /* routes added before gw= is known: set their gateway now */
+    {
+        int i;
+
+        for (i = 0; i < cfg.sc.routes.count; i++)
+            cfg.sc.routes.r[i].gw = cfg.sc.gw;
+    }
+    return NULL;
+}
+
+/* ---- JNI ---- */
+
+static jstring jerr(JNIEnv *env, const char *msg)
+{
+    return (*env)->NewStringUTF(env, msg);
+}
+
+JNIEXPORT jstring JNICALL
+Java_org_openipc_vtesse_Native_start(JNIEnv *env, jclass cls, jstring jconfig)
+{
+    const char *utf;
+    char *text;
+    const char *msg;
+    nc_source_t src;
+    tunnel_t t;
+    int err;
+
+    (void)cls;
+    if (started)
+        return jerr(env, "already started in this process");
+    utf = (*env)->GetStringUTFChars(env, jconfig, NULL);
+    text = utf ? strdup(utf) : NULL;
+    if (utf)
+        (*env)->ReleaseStringUTFChars(env, jconfig, utf);
+    if (!text)
+        return jerr(env, "out of memory");
+    t_start = nc_now_ms();
+    msg = parse_config(text);
+    memset(text, 0, strlen(text));      /* password */
+    free(text);
+    if (msg)
+        return jerr(env, msg);
+
+    cfg.vc.host = cfg.host;
+    cfg.vc.port = (uint16_t)cfg.port;
+    cfg.vc.session = cfg.session;
+    cfg.vc.password = cfg.password;
+    cfg.vc.auth = VT_AUTH_XOR;
+    vt = vt_create(&cfg.vc, &err);
+    memset(cfg.password, 0, sizeof(cfg.password));
+    if (!vt)
+        return jerr(env, tunnel_strerror(err));
+    t = vt_tunnel(vt);
+
+    nc_loop_init(&loop);
+    src = nc_source_from_tunnel(&t);
+    nc_loop_add(&loop, &src);
+    if (nc_stack_init(&t, &cfg.sc, on_stack_event, NULL) < 0) {
+        vt_destroy(vt);
+        return jerr(env, "stack initialisation failed");
+    }
+    src = nc_stack_timer_source();
+    nc_loop_add(&loop, &src);
+
+    {
+        int i;
+        char rmsg[128];
+
+        for (i = 0; i < cfg.nrelays; i++) {
+            relay[i] = nc_udp_relay_create(cfg.relay_port[i], NULL, cfg.relay_local[i], rmsg, sizeof(rmsg));
+            if (!relay[i]) {
+                vt_destroy(vt);
+                return jerr(env, rmsg);
+            }
+            logf_(ANDROID_LOG_INFO, "udp relay :%u -> 127.0.0.1:%u", (unsigned)cfg.relay_port[i],
+                  (unsigned)cfg.relay_local[i]);
+        }
+    }
+
+    cfg.pc.listen_addr = cfg.listen[0] ? cfg.listen : "127.0.0.1";
+    cfg.pc.socks_port = (uint16_t)cfg.socks_port;
+    if (cfg.socks_port || cfg.pc.forward_count) {
+        px = nc_proxy_create(&cfg.pc, on_proxy_log, NULL);
+        if (!px) {
+            vt_destroy(vt);
+            return jerr(env, "cannot open the local ports (in use?)");
+        }
+        src = nc_proxy_source(px);
+        nc_loop_add(&loop, &src);
+    }
+
+    if (pipe(cmd_pipe) < 0) {
+        nc_proxy_destroy(px);
+        vt_destroy(vt);
+        return jerr(env, strerror(errno));
+    }
+    fcntl(cmd_pipe[0], F_SETFL, fcntl(cmd_pipe[0], F_GETFL) | O_NONBLOCK);
+    memset(&src, 0, sizeof(src));
+    src.get_fd = cmd_get_fd;
+    src.on_readable = cmd_on_readable;
+    nc_loop_add(&loop, &src);
+    memset(&src, 0, sizeof(src));
+    src.next_timeout_ms = stats_next;
+    src.on_timer = stats_on_timer;
+    nc_loop_add(&loop, &src);
+
+    if (cfg.socks_port)
+        logf_(ANDROID_LOG_INFO, "socks5 on %s:%d", cfg.pc.listen_addr, cfg.socks_port);
+    {
+        int i;
+
+        for (i = 0; i < cfg.pc.forward_count; i++) {
+            char ip[16];
+
+            nc_ip4_format(cfg.pc.forwards[i].ip, ip, sizeof(ip));
+            logf_(ANDROID_LOG_INFO, "forward %s:%u -> %s:%u", cfg.pc.listen_addr,
+                  (unsigned)cfg.pc.forwards[i].local_port, ip, (unsigned)cfg.pc.forwards[i].port);
+        }
+    }
+    set_state(ST_CONNECTING, 0);
+    if (pthread_create(&loop_thread, NULL, loop_main, NULL) != 0) {
+        nc_proxy_destroy(px);
+        vt_destroy(vt);
+        return jerr(env, "cannot start the network thread");
+    }
+    started = 1;
+    return NULL;
+}
+
+static void send_cmd(char c)
+{
+    if (started && cmd_pipe[1] >= 0)
+        (void)!write(cmd_pipe[1], &c, 1);
+}
+
+JNIEXPORT void JNICALL
+Java_org_openipc_vtesse_Native_stop(JNIEnv *env, jclass cls)
+{
+    (void)env;
+    (void)cls;
+    if (!started)
+        return;
+    send_cmd('q');
+    pthread_join(loop_thread, NULL);
+    started = 0;
+}
+
+JNIEXPORT void JNICALL
+Java_org_openipc_vtesse_Native_networkChanged(JNIEnv *env, jclass cls)
+{
+    (void)env;
+    (void)cls;
+    send_cmd('n');
+}
+
+/* key=value lines; "route" and "log" repeat. */
+JNIEXPORT jstring JNICALL
+Java_org_openipc_vtesse_Native_status(JNIEnv *env, jclass cls)
+{
+    static char buf[16384];
+    size_t n = 0;
+    int i;
+
+    (void)cls;
+#define PUT(...) do { if (n < sizeof(buf)) n += (size_t)snprintf(buf + n, sizeof(buf) - n, __VA_ARGS__); } while (0)
+    pthread_mutex_lock(&S.mu);
+    PUT("state=%s\n", state_names[S.state]);
+    PUT("bound=%d\n", S.bound);
+    if (S.bound) {
+        PUT("addr=%s\nmask=%s\ngw=%s\n", S.addr, S.mask, S.gw);
+        for (i = 0; i < S.route_count; i++)
+            PUT("route=%s\n", S.routes[i]);
+    }
+    if (S.flags[0])
+        PUT("flags=%s\n", S.flags);
+    if (S.error[0])
+        PUT("error=%s\n", S.error);
+    PUT("accepted=%lu\nactive=%lu\nfailed=%lu\nrejected=%lu\nup=%llu\ndown=%llu\n",
+        S.ps.accepted, S.ps.active, S.ps.failed, S.ps.rejected, S.ps.bytes_up, S.ps.bytes_down);
+    /* udp=PORT,LOCAL_PORT,datagrams,bytes,dropped */
+    for (i = 0; i < cfg.nrelays && i < NC_UDP_RELAY_MAX; i++)
+        PUT("udp=%u,%u,%lu,%llu,%lu\n", (unsigned)cfg.relay_port[i], (unsigned)cfg.relay_local[i],
+            S.us[i].datagrams, S.us[i].bytes, S.us[i].dropped);
+    for (i = 0; i < S.log_count; i++)
+        PUT("log=%s\n", S.log[(S.log_next - S.log_count + i + LOG_LINES) % LOG_LINES]);
+    pthread_mutex_unlock(&S.mu);
+#undef PUT
+    if (n >= sizeof(buf))
+        buf[sizeof(buf) - 1] = '\0';
+    return (*env)->NewStringUTF(env, buf);
+}
+
+JNIEXPORT jstring JNICALL
+Java_org_openipc_vtesse_Native_version(JNIEnv *env, jclass cls)
+{
+    (void)cls;
+    return (*env)->NewStringUTF(env, VTESSE_VERSION);
+}
+
+/* Device ID check for the settings screen: NULL if valid, else a message. */
+JNIEXPORT jstring JNICALL
+Java_org_openipc_vtesse_Native_checkDeviceId(JNIEnv *env, jclass cls, jstring jid)
+{
+    const char *id = (*env)->GetStringUTFChars(env, jid, NULL);
+    uint8_t mac[6];
+    int ok = id && nc_devid_to_mac(id, mac) == 0;
+
+    (void)cls;
+    if (id)
+        (*env)->ReleaseStringUTFChars(env, jid, id);
+    return ok ? NULL : jerr(env, "12 characters 0-9A-F, first byte unicast");
+}
diff --git a/android/app/src/main/java/org/openipc/vtesse/MainActivity.kt b/android/app/src/main/java/org/openipc/vtesse/MainActivity.kt
new file mode 100644
index 0000000..fde744d
--- /dev/null
+++ b/android/app/src/main/java/org/openipc/vtesse/MainActivity.kt
@@ -0,0 +1,349 @@
+package org.openipc.vtesse
+
+import android.Manifest
+import android.app.Activity
+import android.app.ActivityManager
+import android.content.BroadcastReceiver
+import android.content.ClipData
+import android.content.ClipboardManager
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.content.pm.PackageManager
+import android.graphics.Typeface
+import android.os.Build
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.text.Editable
+import android.text.InputType
+import android.text.TextWatcher
+import android.util.TypedValue
+import android.view.Gravity
+import android.view.View
+import android.widget.Button
+import android.widget.CheckBox
+import android.widget.EditText
+import android.widget.LinearLayout
+import android.widget.TextView
+import android.widget.Toast
+
+/**
+ * Servers (up to 3) with their cameras (up to 8 each), settings and status
+ * (#26, #27). The tunnel itself runs in [TunnelService] (":tunnel" process).
+ */
+class MainActivity : Activity() {
+    private class CameraRow(val name: EditText, val ip: EditText, val ports: TextView)
+
+    private lateinit var serverButtons: List<Button>
+    private lateinit var serverName: EditText
+    private lateinit var host: EditText
+    private lateinit var port: EditText
+    private lateinit var deviceId: EditText
+    private lateinit var password: EditText
+    private lateinit var svcRtsp: CheckBox
+    private lateinit var svcHttp: CheckBox
+    private lateinit var svcSsh: CheckBox
+    private lateinit var svcSocks: CheckBox
+    private lateinit var svcUdp: CheckBox
+    private lateinit var cameraRows: List<CameraRow>
+    private lateinit var forwards: EditText
+    private lateinit var toggle: Button
+    private lateinit var state: TextView
+    private lateinit var details: TextView
+
+    private val handler = Handler(Looper.getMainLooper())
+    private var server = 1              // shown in the form
+    private var pendingSwitch = 0       // server to connect once the tunnel has stopped
+    private var running = false
+    private var lastStatusAt = 0L
+
+    private val receiver = object : BroadcastReceiver() {
+        override fun onReceive(context: Context, intent: Intent) {
+            intent.getStringExtra(TunnelService.EXTRA_STATUS)?.let { show(Status.parse(it)) }
+        }
+    }
+
+    /** No status for a while: the service is not running. */
+    private val staleCheck = object : Runnable {
+        override fun run() {
+            if (running && System.currentTimeMillis() - lastStatusAt > 3000) show(Status.parse("state=stopped\n"))
+            handler.postDelayed(this, 1000)
+        }
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContentView(R.layout.activity_main)
+        serverButtons = listOf(R.id.profile_1, R.id.profile_2, R.id.profile_3).map { findViewById(it) }
+        serverName = findViewById(R.id.profile_name)
+        host = findViewById(R.id.host)
+        port = findViewById(R.id.port)
+        deviceId = findViewById(R.id.device_id)
+        password = findViewById(R.id.password)
+        svcRtsp = findViewById(R.id.svc_rtsp)
+        svcHttp = findViewById(R.id.svc_http)
+        svcSsh = findViewById(R.id.svc_ssh)
+        svcSocks = findViewById(R.id.svc_socks)
+        svcUdp = findViewById(R.id.svc_udp)
+        forwards = findViewById(R.id.forwards)
+        toggle = findViewById(R.id.toggle)
+        state = findViewById(R.id.state)
+        details = findViewById(R.id.details)
+        cameraRows = buildCameraRows(findViewById(R.id.cameras))
+        title = "${getString(R.string.app_name)} ${Native.version()}"
+
+        server = Settings.active(this)
+        loadForm(server)
+        serverButtons.forEachIndexed { i, b -> b.setOnClickListener { selectServer(i + 1) } }
+        listOf(svcRtsp, svcHttp, svcSsh, svcSocks).forEach { it.setOnCheckedChangeListener { _, _ -> refreshPorts() } }
+        // the server button shows the name (or host) as it is typed
+        val relabel = object : TextWatcher {
+            override fun beforeTextChanged(s: CharSequence?, a: Int, b: Int, c: Int) {}
+            override fun onTextChanged(s: CharSequence?, a: Int, b: Int, c: Int) {}
+            override fun afterTextChanged(s: Editable?) { refreshServerButtons() }
+        }
+        serverName.addTextChangedListener(relabel)
+        host.addTextChangedListener(relabel)
+
+        findViewById<Button>(R.id.generate).setOnClickListener {
+            deviceId.setText(Settings.generateDeviceId())
+            Toast.makeText(this, R.string.id_generated, Toast.LENGTH_LONG).show()
+        }
+        deviceId.setOnLongClickListener {
+            (getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager)
+                .setPrimaryClip(ClipData.newPlainText("device ID", deviceId.text))
+            Toast.makeText(this, R.string.id_copied, Toast.LENGTH_SHORT).show()
+            true
+        }
+        toggle.setOnClickListener { if (running) TunnelService.stop(this) else connect() }
+        show(Status.parse("state=stopped\n"))
+
+        if (Build.VERSION.SDK_INT >= 33 &&
+            checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED
+        ) requestPermissions(arrayOf(Manifest.permission.POST_NOTIFICATIONS), 1)
+    }
+
+    override fun onStart() {
+        super.onStart()
+        val filter = IntentFilter(TunnelService.ACTION_STATUS)
+        if (Build.VERSION.SDK_INT >= 33) registerReceiver(receiver, filter, Context.RECEIVER_NOT_EXPORTED)
+        else registerReceiver(receiver, filter)
+        handler.post(staleCheck)
+    }
+
+    override fun onStop() {
+        unregisterReceiver(receiver)
+        handler.removeCallbacks(staleCheck)
+        super.onStop()
+    }
+
+    override fun onPause() {
+        if (!running) formSettings().save(this, server)     // keep edits of the shown server
+        super.onPause()
+    }
+
+    // ---- form ----
+
+    private fun dp(v: Int) = TypedValue.applyDimension(TypedValue.COMPLEX_UNIT_DIP, v.toFloat(), resources.displayMetrics).toInt()
+
+    /** Camera rows: number, name, IP, local ports. */
+    private fun buildCameraRows(parent: LinearLayout): List<CameraRow> = (1..Settings.CAMERAS).map { n ->
+        val row = LinearLayout(this).apply {
+            orientation = LinearLayout.HORIZONTAL
+            gravity = Gravity.CENTER_VERTICAL
+        }
+        val num = TextView(this).apply {
+            text = "$n"
+            setTypeface(null, Typeface.BOLD)
+            width = dp(28)
+        }
+        val name = EditText(this).apply {
+            hint = getString(R.string.camera_name_hint, n)
+            contentDescription = getString(R.string.camera_name_desc, n)
+            inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_FLAG_CAP_SENTENCES
+            setSingleLine()
+        }
+        val ip = EditText(this).apply {
+            hint = getString(R.string.camera_ip_hint)
+            contentDescription = getString(R.string.camera_ip_desc, n)
+            inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_FLAG_NO_SUGGESTIONS
+            typeface = Typeface.MONOSPACE
+            setSingleLine()
+            setOnFocusChangeListener { _, _ -> refreshPorts() }
+        }
+        val ports = TextView(this).apply {
+            typeface = Typeface.MONOSPACE
+            setTextSize(TypedValue.COMPLEX_UNIT_SP, 12f)
+            setPadding(dp(8), 0, 0, 0)
+        }
+        row.addView(num)
+        row.addView(name, LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 2f))
+        row.addView(ip, LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 2f))
+        row.addView(ports, LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 3f))
+        parent.addView(row)
+        CameraRow(name, ip, ports)
+    }
+
+    private fun loadForm(n: Int) {
+        val s = Settings.load(this, n)
+        serverName.setText(s.name)
+        host.setText(s.host)
+        port.setText(s.port.toString())
+        deviceId.setText(s.deviceId)
+        password.setText(s.password)
+        svcRtsp.isChecked = s.rtsp
+        svcHttp.isChecked = s.http
+        svcSsh.isChecked = s.ssh
+        svcSocks.isChecked = s.socks
+        svcUdp.isChecked = s.udp
+        s.cameras.forEachIndexed { i, c ->
+            cameraRows[i].name.setText(c.name)
+            cameraRows[i].ip.setText(c.ip)
+        }
+        forwards.setText(s.extraForwards.joinToString("\n"))
+        refreshServerButtons()
+        refreshPorts()
+    }
+
+    /** Service labels and the local ports of every camera for the shown server. */
+    private fun refreshPorts() {
+        svcRtsp.text = "RTSP ${server}55N"
+        svcHttp.text = "HTTP ${server}80N"
+        svcSsh.text = "SSH ${server}22N"
+        svcSocks.text = getString(R.string.svc_socks, Settings.socksPort(server))
+        svcUdp.text = getString(R.string.svc_udp, Settings.udpPort(server))
+        cameraRows.forEachIndexed { i, r ->
+            val n = i + 1
+            val list = buildList {
+                if (svcRtsp.isChecked) add("rtsp ${Settings.port(server, Settings.RTSP, n)}")
+                if (svcHttp.isChecked) add("http ${Settings.port(server, Settings.HTTP, n)}")
+                if (svcSsh.isChecked) add("ssh ${Settings.port(server, Settings.SSH, n)}")
+            }
+            r.ports.text = list.joinToString(" · ")
+            r.ports.alpha = if (r.ip.text.isBlank()) 0.35f else 1f
+        }
+    }
+
+    private fun refreshServerButtons() {
+        serverButtons.forEachIndexed { i, b ->
+            val n = i + 1
+            b.text = if (n == server) formSettings().label(this, n) else Settings.load(this, n).label(this, n)
+            b.setTypeface(null, if (n == server) Typeface.BOLD else Typeface.NORMAL)
+            b.alpha = if (n == server) 1f else 0.6f
+        }
+    }
+
+    /** Switch the form to server [n]; while connected, reconnect with it. */
+    private fun selectServer(n: Int) {
+        if (n == server && pendingSwitch == 0) return
+        if (running) {
+            pendingSwitch = n
+            state.text = getString(R.string.switching, n.toString())
+            TunnelService.stop(this)
+            return
+        }
+        formSettings().save(this, server)
+        server = n
+        Settings.setActive(this, n)
+        loadForm(n)
+    }
+
+    /** The form as settings, lenient (drafts are saved as typed). */
+    private fun formSettings(): Settings = Settings(
+        name = serverName.text.toString().trim(),
+        host = host.text.toString().trim(),
+        port = port.text.toString().toIntOrNull() ?: 5000,
+        deviceId = deviceId.text.toString().trim().uppercase(),
+        password = password.text.toString(),
+        cameras = cameraRows.map { Camera(it.name.text.toString().trim(), it.ip.text.toString().trim()) },
+        rtsp = svcRtsp.isChecked,
+        http = svcHttp.isChecked,
+        ssh = svcSsh.isChecked,
+        socks = svcSocks.isChecked,
+        udp = svcUdp.isChecked,
+        extraForwards = forwards.text.toString().lines().map { it.trim() }.filter { it.isNotEmpty() },
+    )
+
+    // ---- connect ----
+
+    private fun connect() {
+        val id = deviceId.text.toString().trim().uppercase()
+        Native.checkDeviceId(id)?.let { deviceId.error = it; return }
+        val p = port.text.toString().toIntOrNull()
+        if (p == null || p !in 1..65535) { port.error = getString(R.string.bad_port); return }
+        cameraRows.forEach { r ->
+            val ip = r.ip.text.toString().trim()
+            if (ip.isNotEmpty() && !Settings.isIpv4(ip)) { r.ip.error = getString(R.string.bad_ip); r.ip.requestFocus(); return }
+        }
+        val s = formSettings().copy(deviceId = id, port = p)
+        s.save(this, server)
+        Settings.setActive(this, server)
+        refreshServerButtons()
+        show(Status.parse("state=connecting\n"))
+        val n = server
+        // the previous tunnel process must be gone: lwIP starts once per process
+        whenTunnelProcessGone { TunnelService.start(this, s.toConfig(n), s.label(this, n)) }
+    }
+
+    /** Runs [action] once the previous tunnel process has ended (up to 30 s). */
+    private fun whenTunnelProcessGone(action: () -> Unit) {
+        val am = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
+        val name = TunnelService.processName(this)
+        val deadline = System.currentTimeMillis() + 30000
+        val check = object : Runnable {
+            override fun run() {
+                val alive = am.runningAppProcesses?.any { it.processName == name } == true
+                when {
+                    !alive -> action()
+                    System.currentTimeMillis() < deadline -> {
+                        state.text = getString(R.string.waiting_previous)
+                        lastStatusAt = System.currentTimeMillis()   // not stale while waiting
+                        handler.postDelayed(this, 200)
+                    }
+                    else -> show(Status.parse("state=failed\nerror=${getString(R.string.err_previous_closing)}\n"))
+                }
+            }
+        }
+        check.run()
+    }
+
+    // ---- status ----
+
+    private fun show(st: Status) {
+        lastStatusAt = System.currentTimeMillis()
+        running = st.running
+        if (!running && pendingSwitch != 0) {
+            val n = pendingSwitch
+            pendingSwitch = 0
+            server = n
+            Settings.setActive(this, n)
+            loadForm(n)
+            if (host.text.isNotBlank()) {       // an empty server: just disconnect
+                connect()
+                return
+            }
+        }
+        state.text = if (pendingSwitch != 0) getString(R.string.switching, pendingSwitch.toString()) else st.summary(this)
+        toggle.setText(if (running) R.string.stop else R.string.start)
+        val editable = listOf<View>(serverName, host, port, deviceId, password, svcRtsp, svcHttp, svcSsh, svcSocks, svcUdp, forwards) +
+            cameraRows.flatMap { listOf(it.name, it.ip) }
+        editable.forEach { it.isEnabled = !running }
+        details.text = buildString {
+            if (st.bound) {
+                append("address ").append(st.addr).append(" / ").append(st.mask).append('\n')
+                st.routes.forEach { append("route ").append(it).append('\n') }
+            }
+            st.flags?.let { append("flags ").append(it).append('\n') }
+            st.udp.forEach {
+                append(getString(R.string.udp_hint, st.addr ?: "?", it.port, it.local, it.datagrams, it.dropped)).append('\n')
+            }
+            if (running) append("connections ").append(st.active)
+                .append(", up ").append(st.bytesUp).append(" B, down ").append(st.bytesDown).append(" B\n")
+            if (st.log.isNotEmpty()) {
+                append('\n')
+                st.log.forEach { append(it).append('\n') }
+            }
+        }
+    }
+}
diff --git a/android/app/src/main/java/org/openipc/vtesse/Native.kt b/android/app/src/main/java/org/openipc/vtesse/Native.kt
new file mode 100644
index 0000000..3220854
--- /dev/null
+++ b/android/app/src/main/java/org/openipc/vtesse/Native.kt
@@ -0,0 +1,25 @@
+package org.openipc.vtesse
+
+/** JNI bridge (src/main/cpp/vtesse_jni.c). One tunnel per process. */
+object Native {
+    init {
+        System.loadLibrary("vtesse")
+    }
+
+    /** Starts the tunnel from key=value lines; null on success, else an error message. */
+    @JvmStatic external fun start(config: String): String?
+
+    /** Stops the tunnel (sends CONN_CLOSE) and waits for the network thread. */
+    @JvmStatic external fun stop()
+
+    /** The device's network changed: reconnect at once. */
+    @JvmStatic external fun networkChanged()
+
+    /** Status snapshot: key=value lines, "route" and "log" repeat. */
+    @JvmStatic external fun status(): String
+
+    @JvmStatic external fun version(): String
+
+    /** null if [id] is a valid device ID, else a message. */
+    @JvmStatic external fun checkDeviceId(id: String): String?
+}
diff --git a/android/app/src/main/java/org/openipc/vtesse/Settings.kt b/android/app/src/main/java/org/openipc/vtesse/Settings.kt
new file mode 100644
index 0000000..bd751cd
--- /dev/null
+++ b/android/app/src/main/java/org/openipc/vtesse/Settings.kt
@@ -0,0 +1,178 @@
+package org.openipc.vtesse
+
+import android.content.Context
+import java.security.SecureRandom
+
+/** A camera behind a server (#27). */
+data class Camera(val name: String, val ip: String)
+
+/**
+ * One VTun server (#26, #27) with up to [CAMERAS] cameras behind it, kept in the
+ * main process (SharedPreferences, keys prefixed "p<S>_"). Local ports follow a
+ * fixed scheme, see [port].
+ */
+data class Settings(
+    val name: String,
+    val host: String,
+    val port: Int,
+    val deviceId: String,
+    val password: String,
+    val cameras: List<Camera>,          // always CAMERAS entries; ip "" = unused
+    val rtsp: Boolean,
+    val http: Boolean,
+    val ssh: Boolean,
+    val socks: Boolean,
+    val udp: Boolean,                   // RTP/UDP relay on port S559 (#28)
+    val extraForwards: List<String>,    // free-form LPORT:IP:RPORT
+) {
+    /** key=value text for [Native.start] (same keys as the vtesse-cli config). */
+    fun toConfig(server: Int): String = buildString {
+        append("host=").append(host).append('\n')
+        append("port=").append(port).append('\n')
+        append("session=").append(deviceId).append('\n')
+        append("password=").append(password).append('\n')
+        append("socks_port=").append(if (socks) socksPort(server) else 0).append('\n')
+        cameras.forEachIndexed { i, c ->
+            if (c.ip.isBlank()) return@forEachIndexed
+            val n = i + 1
+            if (rtsp) append("forward=${port(server, RTSP, n)}:${c.ip}:554\n")
+            if (http) append("forward=${port(server, HTTP, n)}:${c.ip}:80\n")
+            if (ssh) append("forward=${port(server, SSH, n)}:${c.ip}:22\n")
+        }
+        extraForwards.forEach { append("forward=").append(it).append('\n') }
+        if (udp) append("udp_relay=${udpPort(server)}\n")
+    }
+
+    /** "Server 2 · Office" (or the host) for buttons and the notification. */
+    fun label(ctx: Context, server: Int): String {
+        val what = name.ifBlank { host }
+        val s = ctx.getString(R.string.server_n, server)
+        return if (what.isBlank()) s else "$s · $what"
+    }
+
+    fun save(ctx: Context, server: Int) {
+        val p = "p${server}_"
+        val e = prefs(ctx).edit()
+            .putString(p + K_NAME, name)
+            .putString(p + K_HOST, host)
+            .putInt(p + K_PORT, port)
+            .putString(p + K_ID, deviceId)
+            .putString(p + K_PASSWORD, password)
+            .putBoolean(p + K_RTSP, rtsp)
+            .putBoolean(p + K_HTTP, http)
+            .putBoolean(p + K_SSH, ssh)
+            .putBoolean(p + K_SOCKS_ON, socks)
+            .putBoolean(p + K_UDP, udp)
+            .putString(p + K_FORWARDS, extraForwards.joinToString("\n"))
+        cameras.forEachIndexed { i, c ->
+            e.putString("${p}cam${i + 1}_name", c.name).putString("${p}cam${i + 1}_ip", c.ip)
+        }
+        e.apply()
+    }
+
+    companion object {
+        const val SERVERS = 3
+        const val CAMERAS = 8
+
+        /** Service codes of the port scheme. */
+        const val SSH = 22
+        const val RTSP = 55
+        const val HTTP = 80
+
+        /**
+         * Local port of camera [camera] (1-8) of server [server] (1-3) for a service
+         * code: server*1000 + code*10 + camera, e.g. RTSP of camera 3 on server 1 =
+         * 1553, HTTP = 1803, SSH = 1223. 9 as the camera number is reserved (RTP/UDP, #28).
+         */
+        fun port(server: Int, code: Int, camera: Int) = server * 1000 + code * 10 + camera
+
+        /** SOCKS5 port of a server: 1080, 2080, 3080. */
+        fun socksPort(server: Int) = server * 1000 + 80
+
+        /** RTP/UDP relay port ("camera 9" of the RTSP block): 1559, 2559, 3559 (#28).
+         *  The same number on the tunnel address and on 127.0.0.1. */
+        fun udpPort(server: Int) = port(server, RTSP, 9)
+
+        private const val K_NAME = "name"
+        private const val K_HOST = "host"
+        private const val K_PORT = "port"
+        private const val K_ID = "device_id"
+        private const val K_PASSWORD = "password"
+        private const val K_SOCKS = "socks_port"        // 1.05: a port number
+        private const val K_SOCKS_ON = "socks"
+        private const val K_RTSP = "rtsp"
+        private const val K_HTTP = "http"
+        private const val K_SSH = "ssh"
+        private const val K_UDP = "udp"
+        private const val K_FORWARDS = "forwards"       // 1.05 forwards become extra forwards
+        private const val K_ACTIVE = "active_profile"
+
+        private fun prefs(ctx: Context) = ctx.getSharedPreferences("vtesse", Context.MODE_PRIVATE)
+
+        /** The selected server, 1..[SERVERS]. */
+        fun active(ctx: Context): Int = prefs(ctx).getInt(K_ACTIVE, 1).coerceIn(1, SERVERS)
+
+        fun setActive(ctx: Context, server: Int) {
+            prefs(ctx).edit().putInt(K_ACTIVE, server.coerceIn(1, SERVERS)).apply()
+        }
+
+        fun load(ctx: Context, server: Int): Settings {
+            val sp = prefs(ctx)
+            migrate(ctx)
+            val p = "p${server}_"
+            var id = sp.getString(p + K_ID, null)
+            if (id.isNullOrEmpty()) {
+                // the same device on every server: start from server 1's ID
+                id = if (server == 1) generateDeviceId() else load(ctx, 1).deviceId
+                sp.edit().putString(p + K_ID, id).apply()
+            }
+            return Settings(
+                name = sp.getString(p + K_NAME, "") ?: "",
+                host = sp.getString(p + K_HOST, "") ?: "",
+                port = sp.getInt(p + K_PORT, 5000),
+                deviceId = id,
+                password = sp.getString(p + K_PASSWORD, "") ?: "",
+                cameras = (1..CAMERAS).map {
+                    Camera(sp.getString("${p}cam${it}_name", "") ?: "", sp.getString("${p}cam${it}_ip", "") ?: "")
+                },
+                rtsp = sp.getBoolean(p + K_RTSP, true),
+                http = sp.getBoolean(p + K_HTTP, true),
+                ssh = sp.getBoolean(p + K_SSH, false),
+                socks = if (sp.contains(p + K_SOCKS_ON)) sp.getBoolean(p + K_SOCKS_ON, true)
+                        else sp.getInt(p + K_SOCKS, 1080) != 0,
+                udp = sp.getBoolean(p + K_UDP, false),
+                extraForwards = (sp.getString(p + K_FORWARDS, "") ?: "").lines().map { it.trim() }.filter { it.isNotEmpty() },
+            )
+        }
+
+        /** Single-server settings of 1.03 and earlier become server 1. */
+        private fun migrate(ctx: Context) {
+            val sp = prefs(ctx)
+            if (!sp.contains(K_HOST) && !sp.contains(K_ID)) return
+            val e = sp.edit()
+            if (!sp.contains("p1_$K_ID")) {
+                sp.getString(K_HOST, null)?.let { e.putString("p1_$K_HOST", it) }
+                if (sp.contains(K_PORT)) e.putInt("p1_$K_PORT", sp.getInt(K_PORT, 5000))
+                sp.getString(K_ID, null)?.let { e.putString("p1_$K_ID", it) }
+                sp.getString(K_PASSWORD, null)?.let { e.putString("p1_$K_PASSWORD", it) }
+                if (sp.contains(K_SOCKS)) e.putInt("p1_$K_SOCKS", sp.getInt(K_SOCKS, 1080))
+                sp.getString(K_FORWARDS, null)?.let { e.putString("p1_$K_FORWARDS", it) }
+            }
+            e.remove(K_HOST).remove(K_PORT).remove(K_ID).remove(K_PASSWORD).remove(K_SOCKS).remove(K_FORWARDS)
+            e.commit()
+        }
+
+        private val IPV4 = Regex("^((25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(25[0-5]|2[0-4]\\d|1?\\d?\\d)$")
+        fun isIpv4(s: String) = IPV4.matches(s)
+
+        /**
+         * Random locally administered unicast MAC as a device ID: bit 1 of the
+         * first byte set, bit 0 clear, so the second character is 2, 6, A or E.
+         */
+        fun generateDeviceId(): String {
+            val b = ByteArray(6).also { SecureRandom().nextBytes(it) }
+            b[0] = ((b[0].toInt() and 0xFC) or 0x02).toByte()
+            return b.joinToString("") { "%02X".format(it.toInt() and 0xFF) }
+        }
+    }
+}
diff --git a/android/app/src/main/java/org/openipc/vtesse/Status.kt b/android/app/src/main/java/org/openipc/vtesse/Status.kt
new file mode 100644
index 0000000..95f1058
--- /dev/null
+++ b/android/app/src/main/java/org/openipc/vtesse/Status.kt
@@ -0,0 +1,70 @@
+package org.openipc.vtesse
+
+import android.content.Context
+
+/** One UDP relay of the status (#28). */
+class UdpRelay(val port: Int, val local: Int, val datagrams: Long, val bytes: Long, val dropped: Long)
+
+/** Parsed [Native.status] snapshot. */
+class Status(
+    val state: String,
+    val bound: Boolean,
+    val addr: String?,
+    val mask: String?,
+    val routes: List<String>,
+    val flags: String?,
+    val error: String?,
+    val active: Long,
+    val bytesUp: Long,
+    val bytesDown: Long,
+    val log: List<String>,
+    val udp: List<UdpRelay>,
+) {
+    val running get() = state != "stopped" && state != "failed" && state != "idle"
+
+    /** One line for the notification and the status header. */
+    fun summary(ctx: Context): String = when {
+        state == "up" && bound -> ctx.getString(R.string.state_up_addr, addr)
+        state == "up" -> ctx.getString(R.string.state_up_dhcp)
+        state == "connecting" -> ctx.getString(R.string.state_connecting)
+        state == "down" -> ctx.getString(R.string.state_down, error ?: "")
+        state == "failed" -> ctx.getString(R.string.state_failed, error ?: "")
+        else -> ctx.getString(R.string.state_stopped)
+    }
+
+    companion object {
+        fun parse(text: String): Status {
+            val single = HashMap<String, String>()
+            val routes = ArrayList<String>()
+            val log = ArrayList<String>()
+            val udp = ArrayList<UdpRelay>()
+            text.lineSequence().forEach { line ->
+                val eq = line.indexOf('=')
+                if (eq <= 0) return@forEach
+                val k = line.substring(0, eq)
+                val v = line.substring(eq + 1)
+                when (k) {
+                    "route" -> routes += v
+                    "log" -> log += v
+                    "udp" -> v.split(',').mapNotNull { it.toLongOrNull() }.takeIf { it.size == 5 }
+                        ?.let { udp += UdpRelay(it[0].toInt(), it[1].toInt(), it[2], it[3], it[4]) }
+                    else -> single[k] = v
+                }
+            }
+            return Status(
+                state = single["state"] ?: "idle",
+                bound = single["bound"] == "1",
+                addr = single["addr"],
+                mask = single["mask"],
+                routes = routes,
+                flags = single["flags"],
+                error = single["error"],
+                active = single["active"]?.toLongOrNull() ?: 0,
+                bytesUp = single["up"]?.toLongOrNull() ?: 0,
+                bytesDown = single["down"]?.toLongOrNull() ?: 0,
+                log = log,
+                udp = udp,
+            )
+        }
+    }
+}
diff --git a/android/app/src/main/java/org/openipc/vtesse/TunnelService.kt b/android/app/src/main/java/org/openipc/vtesse/TunnelService.kt
new file mode 100644
index 0000000..4c1ca2b
--- /dev/null
+++ b/android/app/src/main/java/org/openipc/vtesse/TunnelService.kt
@@ -0,0 +1,218 @@
+package org.openipc.vtesse
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.ServiceInfo
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import android.os.Build
+import android.os.Handler
+import android.os.IBinder
+import android.os.Looper
+import android.os.PowerManager
+import android.os.Process
+
+/**
+ * Foreground service that runs the tunnel (no VpnService). It lives in its own
+ * process (":tunnel", see the manifest): the native stack can be started once
+ * per process, so stopping ends the process. Status goes to the UI as a
+ * package-local broadcast once a second.
+ */
+class TunnelService : Service() {
+    private val handler = Handler(Looper.getMainLooper())
+    private var running = false
+    private var wakeLock: PowerManager.WakeLock? = null
+    private var netCallback: ConnectivityManager.NetworkCallback? = null
+    private var label = ""      // active profile, for the notification title
+
+    private val tick = object : Runnable {
+        override fun run() {
+            if (!running) return
+            publish(Native.status())
+            handler.postDelayed(this, 1000)
+        }
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        when (intent?.action) {
+            ACTION_STOP -> shutdown()
+            ACTION_START -> if (!running) {
+                if (sessionUsed) {
+                    // this process is about to end (lwIP starts once per process)
+                    publish("state=failed\nerror=${getString(R.string.err_previous_closing)}\n")
+                } else {
+                    label = intent.getStringExtra(EXTRA_LABEL) ?: ""
+                    start(intent.getStringExtra(EXTRA_CONFIG) ?: "")
+                }
+            }
+        }
+        return START_REDELIVER_INTENT
+    }
+
+    private fun start(config: String) {
+        startInForeground(getString(R.string.notify_connecting))
+        sessionUsed = true
+        val err = Native.start(config)
+        if (err != null) {
+            publish("state=failed\nerror=$err\n")
+            shutdown()
+            return
+        }
+        running = true
+        wakeLock = (getSystemService(Context.POWER_SERVICE) as PowerManager)
+            .newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "vtesse:tunnel").apply { acquire() }
+        watchNetwork()
+        handler.post(tick)
+    }
+
+    private fun shutdown() {
+        handler.removeCallbacks(tick)
+        if (running) {
+            running = false
+            stopNative()
+        }
+        netCallback?.let {
+            runCatching { connectivity().unregisterNetworkCallback(it) }
+            netCallback = null
+        }
+        wakeLock?.let { if (it.isHeld) it.release() }
+        wakeLock = null
+        publish("state=stopped\n")
+        stopForegroundCompat()
+        stopSelf()
+        // lwIP can be initialised once per process: start the next session fresh
+        handler.postDelayed({ Process.killProcess(Process.myPid()) }, 300)
+    }
+
+    override fun onDestroy() {
+        if (running) {
+            running = false
+            stopNative()
+        }
+        super.onDestroy()
+    }
+
+    /** Native.stop() waits for the network thread; never block the main thread long
+     *  for it: the process ends right after anyway. */
+    private fun stopNative() {
+        val t = Thread { Native.stop() }
+        t.start()
+        t.join(2000)
+    }
+
+    private fun publish(status: String) {
+        sendBroadcast(Intent(ACTION_STATUS).setPackage(packageName).putExtra(EXTRA_STATUS, status))
+        if (running) {
+            val s = Status.parse(status)
+            getSystemService(NotificationManager::class.java)
+                ?.notify(NOTIFY_ID, notification(s.summary(this)))
+        }
+    }
+
+    // ---- network changes: reconnect at once instead of waiting for keepalive ----
+
+    private fun connectivity() = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+
+    private fun watchNetwork() {
+        val cb = object : ConnectivityManager.NetworkCallback() {
+            private var last: Network? = null
+            private var lost = false
+
+            override fun onAvailable(network: Network) {
+                handler.post {
+                    if (running && last != null && (network != last || lost)) Native.networkChanged()
+                    last = network
+                    lost = false
+                }
+            }
+
+            override fun onLost(network: Network) {
+                handler.post { if (network == last) lost = true }
+            }
+        }
+        if (Build.VERSION.SDK_INT >= 24) {
+            connectivity().registerDefaultNetworkCallback(cb)
+        } else {
+            val req = NetworkRequest.Builder().addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET).build()
+            connectivity().registerNetworkCallback(req, cb)
+        }
+        netCallback = cb
+    }
+
+    // ---- notification ----
+
+    private fun startInForeground(text: String) {
+        val n = notification(text)
+        if (Build.VERSION.SDK_INT >= 34)
+            startForeground(NOTIFY_ID, n, ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
+        else
+            startForeground(NOTIFY_ID, n)
+    }
+
+    @Suppress("DEPRECATION")
+    private fun stopForegroundCompat() {
+        if (Build.VERSION.SDK_INT >= 24) stopForeground(STOP_FOREGROUND_REMOVE) else stopForeground(true)
+    }
+
+    @Suppress("DEPRECATION")
+    private fun notification(text: String): Notification {
+        val piFlags = if (Build.VERSION.SDK_INT >= 23) PendingIntent.FLAG_IMMUTABLE else 0
+        val open = PendingIntent.getActivity(this, 0, Intent(this, MainActivity::class.java), piFlags)
+        val stop = PendingIntent.getService(
+            this, 1, Intent(this, TunnelService::class.java).setAction(ACTION_STOP), piFlags
+        )
+        val b = if (Build.VERSION.SDK_INT >= 26) {
+            val nm = getSystemService(NotificationManager::class.java)
+            if (nm.getNotificationChannel(CHANNEL) == null)
+                nm.createNotificationChannel(
+                    NotificationChannel(CHANNEL, getString(R.string.channel_name), NotificationManager.IMPORTANCE_LOW)
+                )
+            Notification.Builder(this, CHANNEL)
+        } else {
+            Notification.Builder(this).setPriority(Notification.PRIORITY_LOW)
+        }
+        return b.setSmallIcon(R.drawable.ic_notify)
+            .setContentTitle(if (label.isEmpty()) getString(R.string.app_name) else "${getString(R.string.app_name)} · $label")
+            .setContentText(text)
+            .setOngoing(true)
+            .setContentIntent(open)
+            .addAction(Notification.Action.Builder(0, getString(R.string.stop), stop).build())
+            .build()
+    }
+
+    companion object {
+        const val ACTION_START = "org.openipc.vtesse.START"
+        const val ACTION_STOP = "org.openipc.vtesse.STOP"
+        const val ACTION_STATUS = "org.openipc.vtesse.STATUS"
+        const val EXTRA_CONFIG = "config"
+        const val EXTRA_LABEL = "label"
+        const val EXTRA_STATUS = "status"
+        private const val CHANNEL = "tunnel"
+        private const val NOTIFY_ID = 1
+
+        /** A session ran in this process: it cannot start another one. */
+        @Volatile private var sessionUsed = false
+
+        /** Name of the process the tunnel runs in (manifest: android:process=":tunnel"). */
+        fun processName(ctx: Context) = ctx.packageName + ":tunnel"
+
+        fun start(ctx: Context, config: String, label: String) {
+            val i = Intent(ctx, TunnelService::class.java).setAction(ACTION_START)
+                .putExtra(EXTRA_CONFIG, config).putExtra(EXTRA_LABEL, label)
+            if (Build.VERSION.SDK_INT >= 26) ctx.startForegroundService(i) else ctx.startService(i)
+        }
+
+        fun stop(ctx: Context) {
+            ctx.startService(Intent(ctx, TunnelService::class.java).setAction(ACTION_STOP))
+        }
+    }
+}
diff --git a/android/app/src/main/res/drawable/banner.xml b/android/app/src/main/res/drawable/banner.xml
new file mode 100644
index 0000000..9d2b7ba
--- /dev/null
+++ b/android/app/src/main/res/drawable/banner.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Android TV launcher banner (320x180). -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="320dp" android:height="180dp"
+    android:viewportWidth="320" android:viewportHeight="180">
+    <path android:fillColor="#FF1E5AA8" android:pathData="M0,0h320v180h-320z"/>
+    <path android:fillColor="#FFFFFFFF"
+        android:pathData="M110,70a20,20 0,1 1,0 40a20,20 0,1 1,0 -40zM210,70a20,20 0,1 1,0 40a20,20 0,1 1,0 -40zM126,85h68v10h-68z"/>
+</vector>
diff --git a/android/app/src/main/res/drawable/ic_launcher.xml b/android/app/src/main/res/drawable/ic_launcher.xml
new file mode 100644
index 0000000..db0cddf
--- /dev/null
+++ b/android/app/src/main/res/drawable/ic_launcher.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="48dp" android:height="48dp"
+    android:viewportWidth="48" android:viewportHeight="48">
+    <path android:fillColor="#FF1E5AA8" android:pathData="M24,2a22,22 0,1 1,0 44a22,22 0,1 1,0 -44z"/>
+    <path android:fillColor="#FFFFFFFF"
+        android:pathData="M13,18a6,6 0,1 1,0 12a6,6 0,1 1,0 -12zM35,18a6,6 0,1 1,0 12a6,6 0,1 1,0 -12zM18,22.5h12v3h-12z"/>
+</vector>
diff --git a/android/app/src/main/res/drawable/ic_notify.xml b/android/app/src/main/res/drawable/ic_notify.xml
new file mode 100644
index 0000000..9943988
--- /dev/null
+++ b/android/app/src/main/res/drawable/ic_notify.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Tunnel: two endpoints joined by a link. -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp" android:height="24dp"
+    android:viewportWidth="24" android:viewportHeight="24">
+    <path android:fillColor="#FFFFFFFF"
+        android:pathData="M5,8a4,4 0,1 1,0 8a4,4 0,1 1,0 -8zM19,8a4,4 0,1 1,0 8a4,4 0,1 1,0 -8zM8,11h8v2h-8z"/>
+</vector>
diff --git a/android/app/src/main/res/layout/activity_main.xml b/android/app/src/main/res/layout/activity_main.xml
new file mode 100644
index 0000000..eaf3441
--- /dev/null
+++ b/android/app/src/main/res/layout/activity_main.xml
@@ -0,0 +1,172 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:fitsSystemWindows="true">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="vertical"
+        android:padding="16dp">
+
+        <!-- servers (#26, #27) -->
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="horizontal">
+            <Button
+                android:id="@+id/profile_1"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:singleLine="true" />
+            <Button
+                android:id="@+id/profile_2"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:singleLine="true" />
+            <Button
+                android:id="@+id/profile_3"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:singleLine="true" />
+        </LinearLayout>
+
+        <TextView
+            android:id="@+id/state"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:textSize="18sp"
+            android:textStyle="bold"
+            android:paddingTop="4dp"
+            android:paddingBottom="8dp" />
+
+        <Button
+            android:id="@+id/toggle"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/start" />
+
+        <!-- server -->
+        <TextView style="@style/Section" android:text="@string/section_server" />
+
+        <TextView style="@style/Label" android:text="@string/server_name" />
+        <EditText
+            android:id="@+id/profile_name"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:inputType="textCapSentences"
+            android:hint="@string/server_name_hint" />
+
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="horizontal">
+            <LinearLayout
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="3"
+                android:orientation="vertical">
+                <TextView style="@style/Label" android:text="@string/server" />
+                <EditText
+                    android:id="@+id/host"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:inputType="textUri"
+                    android:hint="vtun.example.org" />
+            </LinearLayout>
+            <LinearLayout
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:orientation="vertical">
+                <TextView style="@style/Label" android:text="@string/port" />
+                <EditText
+                    android:id="@+id/port"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:inputType="number" />
+            </LinearLayout>
+        </LinearLayout>
+
+        <TextView style="@style/Label" android:text="@string/device_id" />
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="horizontal">
+            <EditText
+                android:id="@+id/device_id"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:fontFamily="monospace"
+                android:inputType="textCapCharacters|textNoSuggestions"
+                android:maxLength="12" />
+            <Button
+                android:id="@+id/generate"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:text="@string/generate" />
+        </LinearLayout>
+
+        <TextView style="@style/Label" android:text="@string/password" />
+        <EditText
+            android:id="@+id/password"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:inputType="textPassword" />
+
+        <!-- cameras (#27) -->
+        <TextView style="@style/Section" android:text="@string/section_cameras" />
+        <TextView style="@style/Label" android:text="@string/services" />
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="horizontal">
+            <CheckBox android:id="@+id/svc_rtsp" android:layout_width="0dp" android:layout_height="wrap_content"
+                android:layout_weight="1" android:singleLine="true" />
+            <CheckBox android:id="@+id/svc_http" android:layout_width="0dp" android:layout_height="wrap_content"
+                android:layout_weight="1" android:singleLine="true" />
+            <CheckBox android:id="@+id/svc_ssh" android:layout_width="0dp" android:layout_height="wrap_content"
+                android:layout_weight="1" android:singleLine="true" />
+            <CheckBox android:id="@+id/svc_socks" android:layout_width="0dp" android:layout_height="wrap_content"
+                android:layout_weight="1" android:singleLine="true" />
+        </LinearLayout>
+        <!-- RTP over UDP pushed by cameras (#28) -->
+        <CheckBox
+            android:id="@+id/svc_udp"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content" />
+
+        <!-- 8 rows filled by MainActivity -->
+        <LinearLayout
+            android:id="@+id/cameras"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="vertical" />
+
+        <TextView style="@style/Section" android:text="@string/section_extra" />
+        <TextView style="@style/Label" android:text="@string/forwards" />
+        <EditText
+            android:id="@+id/forwards"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:fontFamily="monospace"
+            android:gravity="top"
+            android:hint="@string/forwards_hint"
+            android:inputType="textMultiLine|textNoSuggestions"
+            android:minLines="1" />
+
+        <TextView
+            android:id="@+id/details"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:paddingTop="12dp"
+            android:fontFamily="monospace"
+            android:textIsSelectable="true"
+            android:textSize="12sp" />
+    </LinearLayout>
+</ScrollView>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
new file mode 100644
index 0000000..e05623e
--- /dev/null
+++ b/android/app/src/main/res/values/strings.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">VTesse</string>
+    <string name="channel_name">Tunnel</string>
+    <string name="server_n">Server %1$d</string>
+    <string name="section_server">Server</string>
+    <string name="section_cameras">Cameras (up to 8)</string>
+    <string name="section_extra">Other forwards</string>
+    <string name="server_name">Name</string>
+    <string name="server_name_hint">e.g. Office</string>
+    <string name="services">Forward for each camera (local port = server·1000 + service·10 + camera)</string>
+    <string name="svc_rtsp">RTSP S55N</string>
+    <string name="svc_http">HTTP S80N</string>
+    <string name="svc_ssh">SSH S22N</string>
+    <string name="svc_socks">SOCKS5 :%1$d</string>
+    <string name="svc_udp">Receive RTP/UDP from cameras on port %1$d (camera: outgoing udp://&lt;tunnel address&gt;:%1$d, player: udp://@:%1$d)</string>
+    <string name="udp_hint">RTP/UDP: camera → udp://%1$s:%2$d · player → udp://@:%3$d · %4$d datagrams, %5$d dropped</string>
+    <string name="camera_name_hint">Camera %1$d</string>
+    <string name="camera_ip_hint">IP address</string>
+    <string name="camera_name_desc">Camera %1$d name</string>
+    <string name="camera_ip_desc">Camera %1$d IP address</string>
+    <string name="bad_ip">Not an IPv4 address</string>
+    <string name="switching">Switching to server %1$s…</string>
+    <string name="waiting_previous">Waiting for the previous connection to close…</string>
+    <string name="err_previous_closing">the previous connection is still closing, try again</string>
+    <string name="server">VTun server (host)</string>
+    <string name="port">Port</string>
+    <string name="device_id">Device ID (session name)</string>
+    <string name="generate">New ID</string>
+    <string name="password">Password</string>
+    <string name="forwards">One per line: LPORT:IP:RPORT (any host behind the server)</string>
+    <string name="forwards_hint">8554:10.0.0.10:554</string>
+    <string name="start">Connect</string>
+    <string name="stop">Disconnect</string>
+    <string name="notify_connecting">Connecting…</string>
+    <string name="state_connecting">Connecting…</string>
+    <string name="state_up_addr">Connected, address %1$s</string>
+    <string name="state_up_dhcp">Connected, waiting for DHCP…</string>
+    <string name="state_down">Reconnecting: %1$s</string>
+    <string name="state_failed">Failed: %1$s</string>
+    <string name="state_stopped">Not connected</string>
+    <string name="id_generated">New device ID generated: add it as a session on the server</string>
+    <string name="id_copied">Device ID copied</string>
+    <string name="bad_port">Bad port</string>
+</resources>
diff --git a/android/app/src/main/res/values/styles.xml b/android/app/src/main/res/values/styles.xml
new file mode 100644
index 0000000..5b80070
--- /dev/null
+++ b/android/app/src/main/res/values/styles.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <style name="Section">
+        <item name="android:layout_width">match_parent</item>
+        <item name="android:layout_height">wrap_content</item>
+        <item name="android:paddingTop">16dp</item>
+        <item name="android:paddingBottom">4dp</item>
+        <item name="android:textSize">16sp</item>
+        <item name="android:textStyle">bold</item>
+        <item name="android:textColor">#FF1E5AA8</item>
+    </style>
+    <style name="Label">
+        <item name="android:layout_width">wrap_content</item>
+        <item name="android:layout_height">wrap_content</item>
+        <item name="android:textSize">12sp</item>
+    </style>
+</resources>
diff --git a/android/build.gradle.kts b/android/build.gradle.kts
new file mode 100644
index 0000000..c7ad754
--- /dev/null
+++ b/android/build.gradle.kts
@@ -0,0 +1,4 @@
+plugins {
+    id("com.android.application") version "8.7.3" apply false
+    id("org.jetbrains.kotlin.android") version "2.0.21" apply false
+}
diff --git a/android/build.sh b/android/build.sh
new file mode 100755
index 0000000..c5a14a3
--- /dev/null
+++ b/android/build.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+# Build the APKs in the Android Docker image (ci/Dockerfile.android).
+#
+#   android/build.sh [gradle tasks]     default: assembleDebug assembleRelease
+#
+# Output: android/app/build/outputs/apk/{debug,release}/. Gradle and its
+# dependency cache live in android/.gradle-cache (not in the repository).
+#
+# Release signing (optional; without it the release APK is unsigned):
+#   VTESSE_KEYSTORE=/path/to/key.jks plus VTESSE_KEYSTORE_PASSWORD, VTESSE_KEY_ALIAS,
+#   VTESSE_KEY_PASSWORD in the environment (CI: from repository secrets), or
+#   ~/.config/vtesse/vtesse-release.jks with ~/.config/vtesse/android-signing.env
+#   holding those three variables (local builds).
+set -eu
+HERE=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$HERE/.." && pwd)
+LOCAL_KEYS=$HOME/.config/vtesse
+
+if [ -z "${VTESSE_KEYSTORE:-}" ] && [ -f "$LOCAL_KEYS/vtesse-release.jks" ] && [ -f "$LOCAL_KEYS/android-signing.env" ]; then
+    VTESSE_KEYSTORE=$LOCAL_KEYS/vtesse-release.jks
+    . "$LOCAL_KEYS/android-signing.env"
+fi
+SIGN=
+if [ -n "${VTESSE_KEYSTORE:-}" ]; then
+    [ -f "$VTESSE_KEYSTORE" ] || { echo "keystore not found: $VTESSE_KEYSTORE" >&2; exit 1; }
+    KDIR=$(cd "$(dirname "$VTESSE_KEYSTORE")" && pwd)
+    SIGN="-v $KDIR:/keys:ro -e VTESSE_KEYSTORE=/keys/$(basename "$VTESSE_KEYSTORE")
+          -e VTESSE_KEYSTORE_PASSWORD -e VTESSE_KEY_ALIAS -e VTESSE_KEY_PASSWORD"
+    export VTESSE_KEYSTORE_PASSWORD VTESSE_KEY_ALIAS VTESSE_KEY_PASSWORD
+fi
+
+docker build -q -t vtesse-android -f "$ROOT/ci/Dockerfile.android" "$ROOT/ci" >/dev/null
+mkdir -p "$HERE/.gradle-cache/home"
+# shellcheck disable=SC2086  # SIGN is a list of docker options
+docker run --rm --user "$(id -u):$(id -g)" -e GRADLE_USER_HOME=/src/android/.gradle-cache \
+    -e HOME=/src/android/.gradle-cache/home $SIGN \
+    -v "$ROOT:/src" -w /src/android vtesse-android \
+    gradle --no-daemon -q ${*:-assembleDebug assembleRelease}
+ls -l "$HERE"/app/build/outputs/apk/*/*.apk
diff --git a/android/gradle.properties b/android/gradle.properties
new file mode 100644
index 0000000..1675ac4
--- /dev/null
+++ b/android/gradle.properties
@@ -0,0 +1,3 @@
+org.gradle.jvmargs=-Xmx2g -Dfile.encoding=UTF-8
+android.useAndroidX=false
+kotlin.code.style=official
diff --git a/android/settings.gradle.kts b/android/settings.gradle.kts
new file mode 100644
index 0000000..92659a4
--- /dev/null
+++ b/android/settings.gradle.kts
@@ -0,0 +1,16 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+rootProject.name = "vtesse"
+include(":app")
diff --git a/bench/Dockerfile b/bench/Dockerfile
new file mode 100644
index 0000000..bac1bed
--- /dev/null
+++ b/bench/Dockerfile
@@ -0,0 +1,32 @@
+# VTesse test bench: VTun 3.0.2 server with our patches, built like the target
+# deployment (no OpenSSL -> XOR challenge response, no LZO, no zlib), plus a bridge
+# segment with a DHCP server and a "remote device" behind a router.
+
+FROM debian:bookworm-slim AS build
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends build-essential bison flex curl ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# The one vtund build script of the repository: vtun sources plus our patches
+# (server/patches), configured like the target deployment. Build context: repo root.
+COPY server/ /src/server/
+RUN /src/server/build-vtund.sh /out/opt/sbin/vtund
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        iproute2 bridge-utils dnsmasq-base isc-dhcp-client udhcpc iputils-ping \
+        tcpdump curl python3 procps \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /out/ /
+COPY bench/vtund.conf /etc/vtund.conf
+COPY bench/entrypoint.sh /usr/local/bin/entrypoint.sh
+COPY bench/device/ /opt/device/
+COPY bench/client/ /opt/client/
+
+EXPOSE 5000/tcp
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["server"]
diff --git a/bench/README.md b/bench/README.md
new file mode 100644
index 0000000..f2053f5
--- /dev/null
+++ b/bench/README.md
@@ -0,0 +1,115 @@
+# VTesse test bench
+
+A Docker image with a **VTun 3.0.2 server built like the target deployment**
+(`--disable-ssl --disable-lzo --disable-zlib --prefix=''`, so the challenge
+response is XOR) and a bridged L2 segment that looks like the real one:
+
+```
+ client (vtesse / stock vtund / probe)
+        │ TCP
+        ▼
+ ┌──────────────────────────── bench container ────────────────────────────┐
+ │ vtund -s ── tapN ──┐                                                    │
+ │                    br-vtesse 10.77.0.1/24 ── dnsmasq (DHCP, option 121) │
+ │                    │ (routing)                                          │
+ │                    rt0 10.78.0.1/24 ── veth ── netns "device"           │
+ │                                               10.78.0.10: HTTP :80,     │
+ │                                                           RTSP :554     │
+ └─────────────────────────────────────────────────────────────────────────┘
+```
+
+All names, addresses and passwords are bench-only test values.
+
+The server is built with our patches by [`server/build-vtund.sh`](../server/README.md)
+(the same script as the release binaries): a refused login is
+logged with the session name and the reason, e.g.
+`Denied connection from 172.28.0.1:33016: session 02BE0C000001: wrong password`
+(stock 3.0.2 logs only `Denied connection from IP:PORT`).
+
+- DHCP: leases `10.77.0.100–199`, infinite; option 3 `10.77.0.1`; option 121
+  `10.78.0.0/24` and `10.79.0.0/24` (unreachable) via `10.77.0.1`. dnsmasq pings an
+  address before offering it, so the OFFER comes after ~3 s, like on the target server.
+- The RTSP "device" is a stub that answers `OPTIONS`/`DESCRIBE` (no media); the
+  device also has `/big.bin` (20 MiB) on HTTP and a TCP echo server on port 7.
+- vtund syslog output is forwarded to `docker logs`.
+
+## Sessions (`vtund.conf`)
+
+| Session | Purpose | Flags |
+|---|---|---|
+| `02BE0C000001` | main: `type ether`, bridge + DHCP, `keepalive 10:5`, `multi killold` | `<TeK>` |
+| `02BE0C000002` | second ether client | `<TeK>` |
+| `02BE0C000003` | inherits `speed 512:512` from `default` | `<TeS512K>` |
+| `02BE0C000004` | `compress zlib:9` (client must refuse) | `<TeC9K>` |
+| `02BE0C000005` | `multi no` (second login → `ERR`) | `<TeK>` |
+| `02BE0C000006` | `type tun`, manual addressing (`10.76.0.1` ↔ `10.76.0.2`) | `<TuK>` |
+| `02BE0C000007`, `02BE0C000008` | more ether clients for real devices on the LAN (`BENCH_BIND`) | `<TeK>` |
+
+Passwords are in `vtund.conf`.
+
+## Usage
+
+Requires Docker with `--privileged` (tap devices, bridge, network namespace).
+
+```sh
+bench/bench.sh build        # build the image (downloads and verifies vtun-3.0.2.tar.gz)
+bench/bench.sh up           # server on 127.0.0.1:15000 (BENCH_PORT)
+bench/bench.sh selftest     # protocol self-test (see below)
+bench/bench.sh stock-test   # reference: stock vtund client + dhclient reach the device
+bench/bench.sh probe --dhcp # tools/vtun_probe.py with the main session
+bench/bench.sh logs
+bench/bench.sh down
+```
+
+`bench.sh cli-test` (after `make`) is the stage 1 acceptance test for
+`build/vtesse-cli`: DHCP address and option 121 routes, option 3 ignored, HTTP GET to
+the device through lwIP, ping of the client from the device, reconnect after a
+`killold` take-over keeping the same address.
+
+`bench.sh proxy-test` is the stage 2 acceptance test (SOCKS5 and port forwards):
+reply codes for host names/IPv6/no route/refused, `curl --socks5`, 20 MiB download
+and 8 MiB TCP echo through forwards with integrity checks, RTSP `OPTIONS`, 8 parallel
+downloads, SOCKS5 username/password. The device also serves `/big.bin` (20 MiB,
+sha256 in `/big.sha256`) and a TCP echo on port 7.
+
+`bench.sh tap-test` is the TAP backend acceptance test (the device ID comes from the MAC
+of a dummy interface, `id_from`): it builds `vtesse-cli` with
+`LWIP=0` in a Debian bookworm container (`ci/Dockerfile.native`) and runs it with
+`--tap` in a second privileged container; addressing via `udhcpc` and
+`scripts/vtesse-udhcpc.script`; inbound ping and HTTP from the device to the client.
+
+`bench.sh tun-test` is the `type tun` acceptance test (#8): session `02BE0C000006` with
+manual IPv4 (`ip=10.76.0.2/32`, `gw=10.76.0.1`, `route=10.78.0.0/24`); lwIP: HTTP to the
+device and inbound ping; `--tap`: a TUN interface addressed by the hook, ping/HTTP to the
+device, inbound ping, no default route.
+
+`bench.sh udp-test` is the UDP relay acceptance test (#28): `vtesse-cli` with
+`udp_relay=1559`; the device sends 500 numbered datagrams and a fragmented 4000-byte
+one to the client's tunnel address; all must arrive at `127.0.0.1:1559` in order.
+
+`bench.sh fault-test` covers failures (#9): link loss (`docker pause` past the keepalive
+timeout), server restart, a DHCP server without option 121 and 2-minute leases
+(renewal); it restores dnsmasq at the end. The entrypoint is restart-safe.
+
+`selftest.py` checks: 50-byte greeting; `<TeK>`; `ECHO_REQ` as the first frame;
+DHCP OFFER through the tunnel, delayed ≥ 2 s, with option 121; `killold`
+take-over (new login OK, old connection closed); shaper/compression/tun flags;
+`ERR` for a wrong password and for an unknown session (after `OK CHAL`);
+`multi no` refusal.
+
+Reference handshake vectors from the stock client: [`vectors/`](vectors/).
+
+## Findings
+
+- **tap-up race.** The server runs the session `up` commands (`ip link set up`,
+  `brctl addif`) asynchronously and starts forwarding immediately. A data frame
+  that arrives before the tap is up makes the tap write fail with `EIO` and the
+  server drops the session. Reproduced with frames sent < 50 ms after `OK FLAGS`;
+  a client must wait (~0.5 s) before its first data frame. Keepalive frames are
+  not affected.
+- **Bridge MAC changes.** `br-vtesse` has no fixed MAC, so it takes a port's MAC and
+  changes when taps join/leave. A client that cached the gateway MAC before a
+  reconnect sends to a dead MAC until the gateway re-ARPs; VTesse flushes its ARP
+  cache on every tunnel `UP`.
+- The stock client applies option 121 and therefore ignores option 3 (RFC 3442):
+  no default route via the tunnel.
diff --git a/bench/bench.sh b/bench/bench.sh
new file mode 100755
index 0000000..4db067c
--- /dev/null
+++ b/bench/bench.sh
@@ -0,0 +1,390 @@
+#!/bin/sh
+# VTesse bench control.
+#
+#   bench.sh build           build the image
+#   bench.sh up              start the server container (published on 127.0.0.1:$BENCH_PORT)
+#   bench.sh down            stop and remove bench containers and network
+#   bench.sh logs            follow server logs
+#   bench.sh stock-test      reference check with the stock vtund client (tap + dhclient)
+#   bench.sh probe [args]    run tools/vtun_probe.py against the bench
+#   bench.sh selftest        protocol self-test against the running bench
+#   bench.sh cli-test        stage 1 acceptance: build/vtesse-cli (lwIP, DHCP) on the bench
+#   bench.sh proxy-test      stage 2 acceptance: SOCKS5 and port forwards of build/vtesse-cli
+#   bench.sh tap-test        TAP backend acceptance: vtesse-cli --tap (LWIP=0 build) in a container
+#   bench.sh tun-test        type tun session (#8): manual IPv4, lwIP and --tap (TUN interface)
+#   bench.sh udp-test        UDP relay (#28): datagrams from the device to the tunnel address -> 127.0.0.1
+#   bench.sh fault-test      failures (#9): link loss, server restart, no option 121, lease renewal (~6 min)
+set -eu
+
+IMAGE=${BENCH_IMAGE:-vtesse-bench}
+NET=${BENCH_NET:-vtesse-bench}
+SERVER=vtesse-bench-server
+CLIENT=vtesse-bench-client
+BENCH_PORT=${BENCH_PORT:-15000}
+BENCH_BIND=${BENCH_BIND:-127.0.0.1}  # e.g. a LAN address to test real devices against the bench
+HERE=$(cd "$(dirname "$0")" && pwd)
+
+# Bench-only test sessions (see vtund.conf).
+SESSION=02BE0C000001
+PASSWORD=c79e01d2e49d80eafd192c043c5142bd5a65b5a9
+TUN_SESSION=02BE0C000006            # type tun: server 10.76.0.1 <-> client 10.76.0.2
+TUN_PASSWORD=3158ed23d81fba0909c1a18d263ca8f4cef1b6a0
+
+# context: the repository root, for server/ (vtund build script and patches)
+cmd_build() { docker build -t "$IMAGE" -f "$HERE/Dockerfile" "$HERE/.."; }
+
+cmd_up() {
+    docker network inspect "$NET" >/dev/null 2>&1 || docker network create "$NET" >/dev/null
+    docker rm -f "$SERVER" >/dev/null 2>&1 || true
+    docker run -d --name "$SERVER" --hostname bench-server --privileged \
+        --network "$NET" -p "$BENCH_BIND:$BENCH_PORT:5000" "$IMAGE" server >/dev/null
+    echo "server: $SERVER, $BENCH_BIND:$BENCH_PORT"
+}
+
+cmd_down() {
+    docker rm -f "$CLIENT" "$SERVER" >/dev/null 2>&1 || true
+    docker network rm "$NET" >/dev/null 2>&1 || true
+}
+
+cmd_logs() { docker logs -f "$SERVER"; }
+
+cmd_stock_test() {
+    docker rm -f "$CLIENT" >/dev/null 2>&1 || true
+    docker run -d --name "$CLIENT" --privileged --network "$NET" "$IMAGE" \
+        client "$SESSION" "$PASSWORD" "$SERVER" >/dev/null
+    echo "waiting for DHCP on the stock client..."
+    i=0
+    until docker exec "$CLIENT" sh -c 'ip -4 addr show | grep -q "10\.77\.0\."' 2>/dev/null; do
+        i=$((i + 1))
+        if [ $i -gt 30 ]; then
+            echo "FAIL: no DHCP address"; docker logs "$CLIENT"; exit 1
+        fi
+        sleep 1
+    done
+    docker exec "$CLIENT" sh -c '
+        set -e
+        echo "--- addresses";  ip -4 -br addr show
+        echo "--- routes";     ip -4 route show
+        echo "--- ping device"; ping -c 2 -W 2 10.78.0.10
+        echo "--- http";       curl -fsS --max-time 5 http://10.78.0.10/
+        echo "--- rtsp";       printf "OPTIONS rtsp://10.78.0.10/ RTSP/1.0\r\nCSeq: 1\r\n\r\n" \
+                                 | timeout 3 python3 -c "import socket,sys;s=socket.create_connection((\"10.78.0.10\",554));s.sendall(sys.stdin.buffer.read());print(s.recv(200).decode().splitlines()[0])"
+    '
+    echo "PASS: stock client reaches the device through the tunnel"
+}
+
+cmd_probe() {
+    conf=$(mktemp)
+    printf 'host=127.0.0.1\nport=%s\nsession=%s\npassword=%s\nauth=xor\n' \
+        "$BENCH_PORT" "$SESSION" "$PASSWORD" >"$conf"
+    python3 "$HERE/../tools/vtun_probe.py" --config "$conf" "$@" || rc=$?
+    rm -f "$conf"
+    return ${rc:-0}
+}
+
+cmd_cli_test() {
+    cli="$HERE/../build/vtesse-cli"
+    [ -x "$cli" ] || { echo "build the CLI first: make"; exit 1; }
+    conf=$(mktemp) log=$(mktemp)
+    printf 'host=127.0.0.1\nport=%s\nsession=%s\npassword=%s\n' "$BENCH_PORT" "$SESSION" "$PASSWORD" >"$conf"
+    fails=0
+    check() { if eval "$2"; then echo "PASS  $1"; else echo "FAIL  $1"; fails=$((fails + 1)); fi; }
+
+    "$cli" --config "$conf" --seconds 30 --fetch http://10.78.0.10/ >"$log" 2>&1 &
+    pid=$!
+    i=0
+    until grep -q "^\[.*\] address " "$log" || [ $i -gt 15 ]; do sleep 1; i=$((i + 1)); done
+    addr=$(sed -n 's/^\[.*\] address \([0-9.]*\) .*/\1/p' "$log" | head -1)
+    check "DHCP address bound" '[ -n "$addr" ]'
+    check "option 121 routes applied" 'grep -q "route 10.78.0.0/24 via 10.77.0.1" "$log"'
+    check "option 3 ignored with classless routes" 'grep -q "ignored: classless routes present" "$log"'
+    sleep 1
+    check "HTTP GET to the device through lwIP" 'grep -q "fetch 10.78.0.10:80/: ok.*HTTP/1.0 200 OK" "$log"'
+    check "device pings the client" 'docker exec "$SERVER" ip netns exec device ping -c 2 -W 2 "$addr" >/dev/null'
+    cmd_probe --seconds 1 >/dev/null 2>&1      # take the session over (multi killold)
+    i=0
+    until [ "$(grep -c '\] up: ' "$log")" -ge 2 ] || [ $i -gt 15 ]; do sleep 1; i=$((i + 1)); done
+    check "reconnect after take-over" '[ "$(grep -c "\] up: " "$log")" -ge 2 ]'
+    sleep 2
+    check "same address after reconnect, device pings it" \
+        'docker exec "$SERVER" ip netns exec device ping -c 2 -W 2 "$addr" >/dev/null'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+    echo "--- client log"; cat "$log"
+    rm -f "$conf" "$log"
+    echo "$fails failure(s)"
+    [ "$fails" -eq 0 ]
+}
+
+cmd_tap_test() {
+    repo=$(cd "$HERE/.." && pwd)
+    tapc=vtesse-bench-tapclient
+    fails=0
+    check() { if eval "$2"; then echo "PASS  $1"; else echo "FAIL  $1"; fails=$((fails + 1)); fi; }
+    inc() { docker exec "$tapc" sh -c "$1"; }
+    dev() { docker exec "$SERVER" ip netns exec device sh -c "$1"; }
+
+    # build the TAP-only CLI for the bench image (Debian bookworm)
+    docker build -q -t vtesse-ci-native -f "$repo/ci/Dockerfile.native" "$repo/ci" >/dev/null
+    docker run --rm --user "$(id -u):$(id -g)" -v "$repo:/src" -w /src vtesse-ci-native \
+        make -s BUILD=build-bench-tap LWIP=0 all >/dev/null
+
+    docker rm -f "$tapc" >/dev/null 2>&1 || true
+    docker run -d --name "$tapc" --privileged --network "$NET" -v "$repo:/src:ro" "$IMAGE" sh -c "
+        mkdir -p /var/lib/dhcp
+        # device ID from an interface MAC (id_from, #6): a dummy NIC with the session's MAC
+        ip link add idsrc0 type dummy
+        ip link set idsrc0 address $(echo $SESSION | sed 's/../&:/g; s/:$//')
+        printf 'host=$SERVER\nport=5000\nid_from=idsrc0\npassword=$PASSWORD\n' > /tmp/vtesse.conf
+        python3 -m http.server 8080 --bind 0.0.0.0 --directory /etc >/dev/null 2>&1 &
+        exec /src/build-bench-tap/vtesse-cli --tap --ifname vtesse0 --hook /src/scripts/vtesse-hook.sh --config /tmp/vtesse.conf
+    " >/dev/null
+
+    i=0
+    until inc 'ip -4 addr show vtesse0 2>/dev/null | grep -q "inet 10\.77\.0\."' || [ $i -gt 20 ]; do sleep 1; i=$((i + 1)); done
+    addr=$(inc "ip -4 -o addr show vtesse0" 2>/dev/null | sed -n 's/.*inet \([0-9.]*\).*/\1/p')
+    check "device ID taken from the MAC of idsrc0 (id_from)" 'docker logs "$tapc" 2>&1 | grep -q "device ID $SESSION (MAC of idsrc0)"'
+    check "tap interface vtesse0 with DHCP address" '[ -n "$addr" ]'
+    check "MAC of vtesse0 is the device ID" 'inc "cat /sys/class/net/vtesse0/address" | grep -qi "^02:be:0c:00:00:01$"'
+    check "option 121 route via the tunnel, no default route through it" \
+        'inc "ip route" | grep -q "10.78.0.0/24 via 10.77.0.1 dev vtesse0" && ! inc "ip route" | grep -q "default.*vtesse0"'
+    check "ping the device from the client" 'inc "ping -c 2 -W 2 10.78.0.10" >/dev/null'
+    check "HTTP to the device from any process (kernel stack)" 'inc "curl -fsS --max-time 5 http://10.78.0.10/" | grep -q "vtesse bench device"'
+    check "inbound: the device pings the client" 'dev "ping -c 2 -W 2 $addr" >/dev/null'
+    check "inbound: the device opens TCP to the client (HTTP :8080)" 'dev "curl -fsS --max-time 5 http://$addr:8080/hostname" >/dev/null'
+    sha=$(docker exec "$SERVER" cat /opt/device/www/big.sha256)
+    check "20 MiB download through the tap, sha256 matches" \
+        '[ "$(inc "curl -fsS --max-time 60 http://10.78.0.10/big.bin | sha256sum | cut -d\" \" -f1")" = "$sha" ]'
+
+    cmd_probe --seconds 1 >/dev/null 2>&1     # take the session over (multi killold)
+    i=0
+    until [ "$(docker logs "$tapc" 2>&1 | grep -c 'carrier on')" -ge 1 ] || [ $i -gt 15 ]; do sleep 1; i=$((i + 1)); done
+    check "reconnect after take-over keeps the interface" 'docker logs "$tapc" 2>&1 | grep -q "carrier on"'
+    sleep 2
+    check "same address after reconnect" 'inc "ip -4 -o addr show vtesse0" | grep -q "inet $addr/"'
+    check "traffic works after reconnect (both directions)" \
+        'inc "ping -c 2 -W 2 10.78.0.10" >/dev/null && dev "ping -c 2 -W 2 $addr" >/dev/null'
+
+    docker stop -t 5 "$tapc" >/dev/null
+    check "clean exit on SIGTERM" 'docker logs "$tapc" 2>&1 | grep -q "frames in"'
+    echo "--- client log"; docker logs "$tapc" 2>&1 | grep -v "^\(Internet\|Listening\|Sending\|Copyright\|For info\|DHCP\|bound\)" | tail -20
+    docker rm -f "$tapc" >/dev/null 2>&1
+    echo "$fails failure(s)"
+    [ "$fails" -eq 0 ]
+}
+
+# type tun (#8): no DHCP over L3, the client address comes from ip=/gw=/route=.
+# lwIP: HTTP to the device through the tunnel and inbound ping of the client;
+# --tap (LWIP=0 build, as in tap-test): a TUN interface configured by the hook.
+cmd_tun_test() {
+    repo=$(cd "$HERE/.." && pwd)
+    cli="$repo/build/vtesse-cli"
+    tunc=vtesse-bench-tunclient
+    [ -x "$cli" ] || { echo "build the CLI first: make"; exit 1; }
+    fails=0
+    check() { if eval "$2"; then echo "PASS  $1"; else echo "FAIL  $1"; fails=$((fails + 1)); fi; }
+    srv() { docker exec "$SERVER" sh -c "$1"; }
+    dev() { docker exec "$SERVER" ip netns exec device sh -c "$1"; }
+    tunconf="ip=10.76.0.2/32\ngw=10.76.0.1\nroute=10.78.0.0/24\n"
+
+    # --- lwIP backend
+    conf=$(mktemp) log=$(mktemp)
+    printf "host=127.0.0.1\nport=%s\nsession=%s\npassword=%s\n$tunconf" \
+        "$BENCH_PORT" "$TUN_SESSION" "$TUN_PASSWORD" >"$conf"
+    "$cli" --config "$conf" --seconds 15 --fetch http://10.78.0.10/ >"$log" 2>&1 &
+    pid=$!
+    i=0
+    until grep -q "fetch 10.78.0.10" "$log" || [ $i -gt 10 ]; do sleep 1; i=$((i + 1)); done
+    check "lwIP: session flags <TuK>" 'grep -q "flags <TuK>" "$log"'
+    check "lwIP: manual address 10.76.0.2, route 10.78.0.0/24, no default route" \
+        'grep -q "address 10.76.0.2 " "$log" && grep -q "route 10.78.0.0/24" "$log" && ! grep -q "(default route)" "$log"'
+    check "lwIP: HTTP GET to the device through the tun session" 'grep -q "fetch 10.78.0.10:80/: ok.*200 OK" "$log"'
+    check "lwIP: the server pings the client (10.76.0.2)" 'srv "ping -c 2 -W 2 10.76.0.2" >/dev/null'
+    check "lwIP: the device pings the client" 'dev "ping -c 2 -W 2 10.76.0.2" >/dev/null'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+    echo "--- lwIP client log"; cat "$log"
+    rm -f "$conf" "$log"
+    sleep 1
+
+    # --- TAP backend: TUN interface, addressing by the hook
+    docker build -q -t vtesse-ci-native -f "$repo/ci/Dockerfile.native" "$repo/ci" >/dev/null
+    docker run --rm --user "$(id -u):$(id -g)" -v "$repo:/src" -w /src vtesse-ci-native \
+        make -s BUILD=build-bench-tap LWIP=0 all >/dev/null
+    docker rm -f "$tunc" >/dev/null 2>&1 || true
+    docker run -d --name "$tunc" --privileged --network "$NET" -v "$repo:/src:ro" "$IMAGE" sh -c "
+        printf 'host=$SERVER\nport=5000\nsession=$TUN_SESSION\npassword=$TUN_PASSWORD\n$tunconf' > /tmp/vtesse.conf
+        exec /src/build-bench-tap/vtesse-cli --tap --ifname vtun0 --hook /src/scripts/vtesse-hook.sh --config /tmp/vtesse.conf
+    " >/dev/null
+    inc() { docker exec "$tunc" sh -c "$1"; }
+    i=0
+    until inc 'ip -4 addr show vtun0 2>/dev/null | grep -q "inet 10\.76\.0\.2"' || [ $i -gt 15 ]; do sleep 1; i=$((i + 1)); done
+    check "tap: vtun0 is a TUN (L3) interface" 'inc "ip -d link show vtun0" | grep -q "tun type tun"'
+    check "tap: hook set 10.76.0.2 and the route to 10.78.0.0/24" \
+        'inc "ip -4 addr show vtun0" | grep -q "inet 10.76.0.2/32" && inc "ip route" | grep -q "10.78.0.0/24 dev vtun0"'
+    check "tap: no default route through the tunnel" '! inc "ip route" | grep -q "default.*vtun0"'
+    check "tap: ping the device from the client" 'inc "ping -c 2 -W 2 10.78.0.10" >/dev/null'
+    check "tap: HTTP to the device from any process" 'inc "curl -fsS --max-time 5 http://10.78.0.10/" | grep -q "vtesse bench device"'
+    check "tap: inbound: the device pings the client" 'dev "ping -c 2 -W 2 10.76.0.2" >/dev/null'
+    docker stop -t 5 "$tunc" >/dev/null
+    echo "--- tap client log"; docker logs "$tunc" 2>&1 | tail -8
+    docker rm -f "$tunc" >/dev/null 2>&1
+    echo "$fails failure(s)"
+    [ "$fails" -eq 0 ]
+}
+
+# UDP relay (#28): the "device" behind the server pushes numbered RTP-like
+# datagrams to the client's tunnel address; vtesse-cli --udp-relay relays them to
+# a listener on 127.0.0.1. Checks count, order, content and a fragmented datagram.
+cmd_udp_test() {
+    cli="$HERE/../build/vtesse-cli"
+    [ -x "$cli" ] || { echo "build the CLI first: make"; exit 1; }
+    conf=$(mktemp) log=$(mktemp) got=$(mktemp)
+    fails=0
+    check() { if eval "$2"; then echo "PASS  $1"; else echo "FAIL  $1"; fails=$((fails + 1)); fi; }
+    printf 'host=127.0.0.1\nport=%s\nsession=%s\npassword=%s\nudp_relay=1559\n' \
+        "$BENCH_PORT" "$SESSION" "$PASSWORD" >"$conf"
+
+    # receiver on the client side: 127.0.0.1:1559, stops 3 s after the last datagram
+    python3 -c '
+import socket, sys
+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+s.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4 << 20)
+s.bind(("127.0.0.1", 1559)); s.settimeout(25)
+seqs, big, bad = [], 0, 0
+try:
+    while True:
+        d, _ = s.recvfrom(65535)
+        s.settimeout(3)
+        if len(d) == 4000 and d == bytes(range(256)) * 15 + bytes(range(160)): big += 1; continue
+        n = int.from_bytes(d[:4], "big")
+        if d[4:] != bytes([n & 255]) * (len(d) - 4): bad += 1
+        seqs.append(n)
+except socket.timeout: pass
+print(len(seqs), int(seqs == sorted(seqs)), bad, big)
+' >"$got" &
+    rpid=$!
+    "$cli" --config "$conf" --seconds 40 >"$log" 2>&1 &
+    pid=$!
+    i=0
+    until grep -q "udp relay 10\.77\." "$log" || [ $i -gt 15 ]; do sleep 1; i=$((i + 1)); done
+    addr=$(sed -n 's/^\[.*\]   udp relay \([0-9.]*\):1559 .*/\1/p' "$log" | head -1)
+    check "relay listening on the tunnel address" '[ -n "$addr" ]'
+    sleep 1
+    # sender behind the server: 500 x 1200 B (~2 ms apart, ~4.8 Mbit/s) + one 4000 B datagram
+    docker exec "$SERVER" ip netns exec device python3 -c "
+import socket, time
+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+for n in range(500):
+    s.sendto(n.to_bytes(4, 'big') + bytes([n & 255]) * 1196, ('$addr', 1559)); time.sleep(0.002)
+s.sendto(bytes(range(256)) * 15 + bytes(range(160)), ('$addr', 1559))
+"
+    wait "$rpid"
+    read -r count ordered bad big <"$got"
+    check "500 datagrams relayed to 127.0.0.1:1559 (got $count)" '[ "$count" = 500 ]'
+    check "in order, content intact" '[ "$ordered" = 1 ] && [ "$bad" = 0 ]'
+    check "4000-byte datagram (IP fragments) reassembled and relayed" '[ "$big" = 1 ]'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+    check "relay statistics at exit" 'grep -q "udp relay :1559: datagrams 501" "$log"'
+    echo "--- client log"; grep -v "route " "$log"
+    rm -f "$conf" "$log" "$got"
+    echo "$fails failure(s)"
+    [ "$fails" -eq 0 ]
+}
+
+# Failure scenarios (#9) with vtesse-cli (lwIP backend) on the host:
+#   link loss      the server is frozen (docker pause) longer than the keepalive
+#                  timeout (10 s x 5): DOWN (keepalive), reconnect, same address
+#   server restart docker restart: DOWN, reconnect with back-off, same address
+#   no option 121  dnsmasq without classless routes: option 3 becomes the default
+#                  route through the tunnel, the device is reached through it
+#   lease renewal  dnsmasq with 2-minute leases (its minimum): the client renews
+#                  (DHCPREQUEST/ACK at T1) and still has the address after expiry
+# dnsmasq is restored to the bench configuration at the end.
+cmd_fault_test() {
+    cli="$HERE/../build/vtesse-cli"
+    [ -x "$cli" ] || { echo "build the CLI first: make"; exit 1; }
+    fails=0
+    check() { if eval "$2"; then echo "PASS  $1"; else echo "FAIL  $1"; fails=$((fails + 1)); fi; }
+    dev() { docker exec "$SERVER" ip netns exec device sh -c "$1"; }
+    wait_log() {    # wait_log FILE PATTERN SECONDS [COUNT]
+        _i=0
+        until [ "$(grep -c -- "$2" "$1")" -ge "${4:-1}" ] || [ $_i -ge "$3" ]; do sleep 1; _i=$((_i + 1)); done
+        [ "$(grep -c -- "$2" "$1")" -ge "${4:-1}" ]
+    }
+    dnsmasq_orig=$(docker exec "$SERVER" sh -c 'tr "\0" " " < /proc/$(pidof dnsmasq)/cmdline')
+    dnsmasq_with() {    # replace the bench dnsmasq: dnsmasq_with SED-EXPRESSION (log to /tmp/dnsmasq-fault.log)
+        args=$(echo "$dnsmasq_orig" | sed "$1; s|--log-facility=-|--log-facility=/tmp/dnsmasq-fault.log|")
+        docker exec "$SERVER" sh -c "kill \$(pidof dnsmasq); sleep 0.5; rm -f /tmp/dnsmasq-fault.log; $args"
+    }
+    conf=$(mktemp) log=$(mktemp)
+    printf 'host=127.0.0.1\nport=%s\nsession=%s\npassword=%s\n' "$BENCH_PORT" "$SESSION" "$PASSWORD" >"$conf"
+
+    # --- link loss and server restart (one client)
+    "$cli" --config "$conf" >"$log" 2>&1 &
+    pid=$!
+    wait_log "$log" "\] address " 20
+    addr=$(sed -n 's/^\[.*\] address \([0-9.]*\) .*/\1/p' "$log" | head -1)
+    check "bound $addr" '[ -n "$addr" ]'
+    docker pause "$SERVER" >/dev/null
+    check "link loss: DOWN by keepalive within 60 s" 'wait_log "$log" "down: no response from server (keepalive)" 65'
+    docker unpause "$SERVER" >/dev/null
+    check "link loss: reconnected" 'wait_log "$log" "\] up: " 40 2'
+    sleep 2
+    check "link loss: same address, the device pings it" 'dev "ping -c 2 -W 2 $addr" >/dev/null'
+
+    docker restart -t 2 "$SERVER" >/dev/null
+    check "server restart: DOWN" 'wait_log "$log" "\] down: " 30 2'
+    check "server restart: reconnected" 'wait_log "$log" "\] up: " 60 3'
+    sleep 5
+    check "server restart: same address, the device pings it" 'dev "ping -c 2 -W 3 $addr" >/dev/null'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+    echo "--- client log (link loss, restart)"; grep -v "route " "$log"
+    dnsmasq_orig=$(docker exec "$SERVER" sh -c 'tr "\0" " " < /proc/$(pidof dnsmasq)/cmdline')
+
+    # --- no option 121: option 3 is the default route
+    dnsmasq_with 's|--dhcp-option=121,[^ ]*||'
+    "$cli" --config "$conf" --seconds 25 --fetch http://10.78.0.10/ >"$log" 2>&1 &
+    pid=$!
+    wait_log "$log" "fetch 10.78.0.10" 20
+    check "no option 121: option 3 used as the default route" 'grep -q "option 3 10.77.0.1 (default route)" "$log"'
+    check "no option 121: HTTP to the device through the default route" 'grep -q "fetch 10.78.0.10:80/: ok" "$log"'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+
+    # --- lease renewal: 2-minute leases
+    dnsmasq_with 's|,infinite|,2m|'
+    "$cli" --config "$conf" --seconds 170 >"$log" 2>&1 &
+    pid=$!
+    wait_log "$log" "\] address " 20
+    addr=$(sed -n 's/^\[.*\] address \([0-9.]*\) .*/\1/p' "$log" | head -1)
+    echo "waiting 150 s for renewal and lease expiry..."
+    sleep 150
+    acks=$(docker exec "$SERVER" grep -c "DHCPACK" /tmp/dnsmasq-fault.log)
+    check "lease renewal: renewed before expiry (DHCPACK x$acks)" '[ "$acks" -ge 2 ]'
+    check "lease renewal: still bound after the first lease expired, the device pings it" \
+        '! grep -q "address lost" "$log" && dev "ping -c 2 -W 2 $addr" >/dev/null'
+    kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+
+    # the bench configuration again
+    docker exec "$SERVER" sh -c "kill \$(pidof dnsmasq); sleep 0.5; $dnsmasq_orig" >/dev/null 2>&1
+    dnsmasq_now=$(docker exec "$SERVER" sh -c 'tr "\0" " " < /proc/$(pidof dnsmasq)/cmdline')
+    check "dnsmasq restored to the bench configuration" 'echo "$dnsmasq_now" | grep -q ",infinite .*--dhcp-option=121"'
+    rm -f "$conf" "$log"
+    echo "$fails failure(s)"
+    [ "$fails" -eq 0 ]
+}
+
+case "${1:-}" in
+    build) cmd_build ;;
+    up) cmd_up ;;
+    down) cmd_down ;;
+    logs) cmd_logs ;;
+    stock-test) cmd_stock_test ;;
+    probe) shift; cmd_probe "$@" ;;
+    cli-test) cmd_cli_test ;;
+    tap-test) cmd_tap_test ;;
+    tun-test) cmd_tun_test ;;
+    udp-test) cmd_udp_test ;;
+    fault-test) cmd_fault_test ;;
+    proxy-test) python3 "$HERE/proxy_test.py" "$HERE/../build/vtesse-cli" "$BENCH_PORT" "$SERVER" ;;
+    selftest) python3 "$HERE/selftest.py" 127.0.0.1 "$BENCH_PORT" ;;
+    *) sed -n '2,16p' "$0"; exit 1 ;;
+esac
diff --git a/bench/client/up.sh b/bench/client/up.sh
new file mode 100755
index 0000000..b6c14c0
--- /dev/null
+++ b/bench/client/up.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+# `up` hook of the stock vtund client: obtain address and routes via DHCP
+# (Debian dhclient requests option 121 and applies it per RFC 3442).
+dev=$1
+dhclient -v -1 -pf "/run/dhclient-$dev.pid" -lf "/var/lib/dhcp/dhclient-$dev.leases" "$dev" \
+    >"/var/log/dhclient-$dev.log" 2>&1 &
diff --git a/bench/device/echo_server.py b/bench/device/echo_server.py
new file mode 100755
index 0000000..a6ec5a2
--- /dev/null
+++ b/bench/device/echo_server.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+"""TCP echo server for proxy tests (both directions, flow control)."""
+import socketserver
+import sys
+
+
+class Handler(socketserver.BaseRequestHandler):
+    def handle(self):
+        while True:
+            data = self.request.recv(65536)
+            if not data:
+                return
+            self.request.sendall(data)
+
+
+class Server(socketserver.ThreadingTCPServer):
+    allow_reuse_address = True
+    daemon_threads = True
+
+
+if __name__ == "__main__":
+    Server((sys.argv[1], int(sys.argv[2])), Handler).serve_forever()
diff --git a/bench/device/rtsp_stub.py b/bench/device/rtsp_stub.py
new file mode 100755
index 0000000..de5e0d0
--- /dev/null
+++ b/bench/device/rtsp_stub.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Tiny RTSP responder for connectivity tests (OPTIONS and DESCRIBE only).
+
+It does not stream media; it lets port-forward / SOCKS tests verify that an
+RTSP request reaches the device and a well-formed reply comes back.
+"""
+import socketserver
+import sys
+
+SDP = (
+    "v=0\r\n"
+    "o=- 0 0 IN IP4 0.0.0.0\r\n"
+    "s=vtesse bench\r\n"
+    "t=0 0\r\n"
+    "m=video 0 RTP/AVP 96\r\n"
+    "a=rtpmap:96 H264/90000\r\n"
+    "a=control:trackID=0\r\n"
+)
+
+
+class Handler(socketserver.StreamRequestHandler):
+    def handle(self):
+        while True:
+            lines = []
+            while True:
+                line = self.rfile.readline()
+                if not line:
+                    return
+                line = line.decode("latin1").rstrip("\r\n")
+                if not line:
+                    break
+                lines.append(line)
+            method = lines[0].split(" ", 1)[0] if lines else ""
+            cseq = next((l.split(":", 1)[1].strip() for l in lines if l.lower().startswith("cseq:")), "0")
+            if method == "OPTIONS":
+                reply = "RTSP/1.0 200 OK\r\nCSeq: %s\r\nPublic: OPTIONS, DESCRIBE\r\n\r\n" % cseq
+            elif method == "DESCRIBE":
+                reply = ("RTSP/1.0 200 OK\r\nCSeq: %s\r\nContent-Type: application/sdp\r\n"
+                         "Content-Length: %d\r\n\r\n%s" % (cseq, len(SDP), SDP))
+            else:
+                reply = "RTSP/1.0 501 Not Implemented\r\nCSeq: %s\r\n\r\n" % cseq
+            self.wfile.write(reply.encode())
+
+
+class Server(socketserver.ThreadingTCPServer):
+    allow_reuse_address = True
+    daemon_threads = True
+
+
+if __name__ == "__main__":
+    Server((sys.argv[1], int(sys.argv[2])), Handler).serve_forever()
diff --git a/bench/device/syslog_stdout.py b/bench/device/syslog_stdout.py
new file mode 100755
index 0000000..403949b
--- /dev/null
+++ b/bench/device/syslog_stdout.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+"""Minimal syslog sink: receive datagrams on /dev/log and print them to stdout."""
+import os
+import socket
+import sys
+
+PATH = "/dev/log"
+
+if os.path.exists(PATH):
+    os.unlink(PATH)
+s = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
+s.bind(PATH)
+os.chmod(PATH, 0o666)
+while True:
+    data = s.recv(4096).decode("utf-8", "replace").rstrip("\n\0")
+    # strip the "<PRI>" prefix
+    if data.startswith("<") and ">" in data[:5]:
+        data = data[data.index(">") + 1:]
+    sys.stdout.write("[syslog] %s\n" % data)
+    sys.stdout.flush()
diff --git a/bench/entrypoint.sh b/bench/entrypoint.sh
new file mode 100755
index 0000000..146c35f
--- /dev/null
+++ b/bench/entrypoint.sh
@@ -0,0 +1,106 @@
+#!/bin/sh
+# VTesse bench entrypoint.
+#
+#   server                         VTun server + bridge segment + DHCP + remote device
+#   client <session> <password> <server-host> [port]
+#                                  stock vtund client (reference), tap + dhclient
+#
+# Bench addressing (test values only):
+#   bridge segment  10.77.0.0/24  bridge/router/DHCP 10.77.0.1, leases .100-.199 (infinite)
+#   device subnet   10.78.0.0/24  router 10.78.0.1, device 10.78.0.10
+#                   (HTTP :80 with /big.bin 20 MiB, RTSP stub :554, TCP echo :7)
+#   option 121      10.78.0.0/24 and 10.79.0.0/24 (unreachable) via 10.77.0.1
+set -eu
+
+log() { echo "[bench] $*"; }
+
+ensure_tun() {
+    mkdir -p /dev/net
+    [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200
+}
+
+# vtund logs only to syslog; forward /dev/log to stdout.
+start_syslog() {
+    python3 /opt/device/syslog_stdout.py &
+    for _ in 1 2 3 4 5 6 7 8 9 10; do [ -S /dev/log ] && return 0; sleep 0.2; done
+    log "warning: /dev/log not ready"
+}
+
+setup_segment() {
+    sysctl -qw net.ipv4.ip_forward=1
+    # docker restart keeps the container's files: leftovers of the previous run
+    ip netns del device 2>/dev/null || true
+    rm -f /var/run/vtund.pid /var/lock/vtund/* 2>/dev/null || true
+
+    ip link add br-vtesse type bridge
+    ip addr add 10.77.0.1/24 dev br-vtesse
+    ip link set br-vtesse up
+
+    ip netns add device
+    ip link add rt0 type veth peer name dev0
+    ip link set dev0 netns device
+    ip addr add 10.78.0.1/24 dev rt0
+    ip link set rt0 up
+    ip -n device addr add 10.78.0.10/24 dev dev0
+    ip -n device link set lo up
+    ip -n device link set dev0 up
+    ip -n device route add default via 10.78.0.1
+
+    mkdir -p /opt/device/www
+    echo "vtesse bench device" > /opt/device/www/index.html
+    head -c 20971520 /dev/urandom > /opt/device/www/big.bin     # 20 MiB for transfer tests
+    sha256sum /opt/device/www/big.bin | cut -d" " -f1 > /opt/device/www/big.sha256
+    ip netns exec device python3 -m http.server 80 --bind 10.78.0.10 --directory /opt/device/www \
+        >/var/log/device-http.log 2>&1 &
+    ip netns exec device python3 /opt/device/rtsp_stub.py 10.78.0.10 554 \
+        >/var/log/device-rtsp.log 2>&1 &
+    ip netns exec device python3 /opt/device/echo_server.py 10.78.0.10 7 \
+        >/var/log/device-echo.log 2>&1 &
+
+    # Default dnsmasq behaviour pings an address before offering it, which
+    # delays the OFFER by ~3 s (three ARP probes), like the target server.
+    dnsmasq --port=0 --interface=br-vtesse --bind-interfaces \
+        --dhcp-range=10.77.0.100,10.77.0.199,255.255.255.0,infinite \
+        --dhcp-option=3,10.77.0.1 \
+        --dhcp-option=6,10.77.0.1 \
+        --dhcp-option=121,10.78.0.0/24,10.77.0.1,10.79.0.0/24,10.77.0.1 \
+        --dhcp-leasefile=/var/lib/misc/dnsmasq.leases \
+        --log-dhcp --log-facility=- &
+}
+
+run_server() {
+    ensure_tun
+    start_syslog
+    setup_segment
+    # The upstream build script skips `make install`; the lock directory must exist
+    # or lock_host() fails and every login gets ERR.
+    mkdir -p /var/lock/vtund /var/log/vtund
+    log "starting vtund server"
+    exec /opt/sbin/vtund -n -s -f /etc/vtund.conf
+}
+
+run_client() {
+    session=$1 password=$2 server=$3 port=${4:-5000}
+    ensure_tun
+    start_syslog
+    mkdir -p /var/lock/vtund /var/log/vtund
+    cat > /etc/vtund-client.conf <<EOF
+options { port $port; timeout 60; ip /sbin/ip; }
+$session {
+  password $password;
+  persist no;
+  up {
+    ip "link set %% up mtu 1500";
+    program "/opt/client/up.sh %%";
+  };
+}
+EOF
+    log "starting stock vtund client for $session -> $server:$port"
+    exec /opt/sbin/vtund -n -f /etc/vtund-client.conf "$session" "$server"
+}
+
+case "${1:-server}" in
+    server) run_server ;;
+    client) shift; run_client "$@" ;;
+    *) exec "$@" ;;
+esac
diff --git a/bench/proxy_test.py b/bench/proxy_test.py
new file mode 100755
index 0000000..41b6ea6
--- /dev/null
+++ b/bench/proxy_test.py
@@ -0,0 +1,242 @@
+#!/usr/bin/env python3
+"""Stage 2 acceptance: SOCKS5 and port forwarding of build/vtesse-cli on the bench.
+
+Usage: proxy_test.py <vtesse-cli> <bench-port> <server-container>
+The bench must be up (bench.sh up). Uses the main bench session.
+"""
+import hashlib
+import os
+import socket
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+
+CLI, BENCH_PORT, SERVER = sys.argv[1], int(sys.argv[2]), sys.argv[3]
+SESSION = "02BE0C000001"
+PASSWORD = "c79e01d2e49d80eafd192c043c5142bd5a65b5a9"
+DEVICE = "10.78.0.10"
+SOCKS = 11080
+FWD_HTTP, FWD_RTSP, FWD_ECHO, FWD_CLOSED = 18080, 18554, 18007, 18009
+
+failures = 0
+
+
+def check(name, cond, detail=""):
+    global failures
+    print("%s  %s%s" % ("PASS" if cond else "FAIL", name, ("  (%s)" % detail) if detail else ""), flush=True)
+    if not cond:
+        failures += 1
+
+
+class Cli:
+    def __init__(self, extra, conf_extra=""):
+        fd, self.conf = tempfile.mkstemp()
+        with os.fdopen(fd, "w") as f:
+            f.write("host=127.0.0.1\nport=%d\nsession=%s\npassword=%s\n%s"
+                    % (BENCH_PORT, SESSION, PASSWORD, conf_extra))
+        self.lines = []
+        self.p = subprocess.Popen([CLI, "--config", self.conf] + extra,
+                                  stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+        threading.Thread(target=self._read, daemon=True).start()
+
+    def _read(self):
+        for line in self.p.stdout:
+            self.lines.append(line.rstrip())
+
+    def wait_for(self, text, timeout=20):
+        end = time.time() + timeout
+        while time.time() < end:
+            if any(text in l for l in self.lines):
+                return True
+            time.sleep(0.1)
+        return False
+
+    def stop(self):
+        self.p.terminate()
+        try:
+            self.p.wait(10)
+        except subprocess.TimeoutExpired:
+            self.p.kill()
+        time.sleep(0.3)
+        os.unlink(self.conf)
+
+
+def recv_exact(s, n):
+    b = b""
+    while len(b) < n:
+        c = s.recv(n - len(b))
+        if not c:
+            raise EOFError("EOF after %d bytes" % len(b))
+        b += c
+    return b
+
+
+def socks_connect(atyp, addr, port, auth=None, timeout=20):
+    """Returns (socket or None, reply code)."""
+    s = socket.create_connection(("127.0.0.1", SOCKS), timeout=timeout)
+    s.sendall(b"\x05\x01" + (b"\x02" if auth else b"\x00"))
+    m = recv_exact(s, 2)
+    if m[1] == 0xFF:
+        s.close()
+        return None, 0xFF
+    if auth:
+        u, p = auth
+        s.sendall(b"\x01" + bytes([len(u)]) + u.encode() + bytes([len(p)]) + p.encode())
+        if recv_exact(s, 2)[1] != 0:
+            s.close()
+            return None, -1
+    if atyp == 1:
+        a = socket.inet_aton(addr)
+    elif atyp == 3:
+        a = bytes([len(addr)]) + addr.encode()
+    else:
+        a = socket.inet_pton(socket.AF_INET6, addr)
+    s.sendall(b"\x05\x01\x00" + bytes([atyp]) + a + struct.pack(">H", port))
+    r = recv_exact(s, 10)
+    if r[1] != 0:
+        s.close()
+        return None, r[1]
+    return s, 0
+
+
+def http_get(s, path):
+    s.sendall(("GET %s HTTP/1.0\r\nHost: %s\r\n\r\n" % (path, DEVICE)).encode())
+    data = b""
+    while True:
+        c = s.recv(65536)
+        if not c:
+            break
+        data += c
+    s.close()
+    head, _, body = data.partition(b"\r\n\r\n")
+    return head.split(b"\r\n")[0].decode(), body
+
+
+def big_sha():
+    return subprocess.check_output(["docker", "exec", SERVER, "cat", "/opt/device/www/big.sha256"],
+                                   text=True).strip()
+
+
+def main():
+    want_sha = big_sha()
+    cli = Cli(["--socks", str(SOCKS),
+               "--forward", "%d:%s:80" % (FWD_HTTP, DEVICE),
+               "--forward", "%d:%s:554" % (FWD_RTSP, DEVICE),
+               "--forward", "%d:%s:7" % (FWD_ECHO, DEVICE),
+               "--forward", "%d:%s:9" % (FWD_CLOSED, DEVICE)])
+    try:
+        check("tunnel up and DHCP address bound", cli.wait_for("] address "))
+
+        s, rep = socks_connect(1, DEVICE, 80)
+        status, body = http_get(s, "/") if s else ("", b"")
+        check("socks5 CONNECT (IPv4) -> HTTP 200", status.endswith("200 OK") and b"vtesse bench device" in body, status)
+
+        s, rep = socks_connect(3, DEVICE, 80)
+        check("socks5 domain field with an IPv4 literal accepted", rep == 0)
+        if s:
+            s.close()
+
+        _, rep = socks_connect(3, "device.example", 80)
+        check("socks5 host name rejected: address type not supported (8)", rep == 8, "rep=%d" % rep)
+        _, rep = socks_connect(4, "2001:db8::1", 80)
+        check("socks5 IPv6 rejected (8)", rep == 8, "rep=%d" % rep)
+        _, rep = socks_connect(1, "8.8.8.8", 80)
+        check("destination without a route: network unreachable (3)", rep == 3, "rep=%d" % rep)
+        _, rep = socks_connect(1, DEVICE, 9)
+        check("closed port behind the tunnel: connection refused (5)", rep == 5, "rep=%d" % rep)
+
+        r = subprocess.run(["curl", "-sS", "--max-time", "10", "--socks5", "127.0.0.1:%d" % SOCKS,
+                            "http://%s/" % DEVICE], capture_output=True, text=True)
+        check("curl --socks5", r.returncode == 0 and "vtesse bench device" in r.stdout, r.stderr.strip())
+
+        t0 = time.time()
+        r = subprocess.run(["curl", "-sS", "--max-time", "60", "http://127.0.0.1:%d/big.bin" % FWD_HTTP],
+                           capture_output=True)
+        dt = time.time() - t0
+        got = hashlib.sha256(r.stdout).hexdigest()
+        check("port forward: 20 MiB download, sha256 matches", got == want_sha and len(r.stdout) == 20 << 20,
+              "%.1f MiB/s" % (20 / dt) if dt else "")
+
+        s = socket.create_connection(("127.0.0.1", FWD_RTSP), timeout=10)
+        s.sendall(b"OPTIONS rtsp://%s/ RTSP/1.0\r\nCSeq: 1\r\n\r\n" % DEVICE.encode())
+        line = s.recv(200).split(b"\r\n")[0]
+        s.close()
+        check("port forward: RTSP OPTIONS", line == b"RTSP/1.0 200 OK", line.decode())
+
+        payload = os.urandom(8 << 20)
+        s = socket.create_connection(("127.0.0.1", FWD_ECHO), timeout=30)
+        echoed = []
+
+        def reader():
+            n = 0
+            while n < len(payload):
+                c = s.recv(65536)
+                if not c:
+                    break
+                echoed.append(c)
+                n += len(c)
+        th = threading.Thread(target=reader)
+        th.start()
+        t0 = time.time()
+        s.sendall(payload)
+        th.join(60)
+        dt = time.time() - t0
+        s.close()
+        check("port forward: 8 MiB TCP echo (both directions), data intact", b"".join(echoed) == payload,
+              "%.1f MiB/s each way" % (8 / dt) if dt else "")
+
+        s = socket.create_connection(("127.0.0.1", FWD_CLOSED), timeout=10)
+        try:
+            closed = s.recv(10) == b""
+        except ConnectionResetError:
+            closed = True
+        s.close()
+        check("port forward to a closed port: local connection closed", closed)
+
+        results = []
+
+        def worker():
+            try:
+                s2, rep2 = socks_connect(1, DEVICE, 80, timeout=60)
+                st, body2 = http_get(s2, "/big.bin")
+                results.append(hashlib.sha256(body2).hexdigest() == want_sha)
+            except Exception as e:  # noqa: BLE001
+                results.append(False)
+                print("   worker:", e)
+        ths = [threading.Thread(target=worker) for _ in range(8)]
+        t0 = time.time()
+        for t in ths:
+            t.start()
+        for t in ths:
+            t.join(120)
+        dt = time.time() - t0
+        check("8 parallel 20 MiB downloads via socks5, all intact", results == [True] * 8,
+              "%.1f MiB/s total" % (160 / dt) if dt else "")
+    finally:
+        cli.stop()
+    stats = [l for l in cli.lines if "proxy: accepted" in l]
+    print(stats[-1] if stats else "\n".join(cli.lines[-15:]))
+
+    # SOCKS5 username/password (RFC 1929)
+    cli = Cli(["--socks", str(SOCKS)], "socks_user=bench\nsocks_password=s3cret\n")
+    try:
+        cli.wait_for("] address ")
+        _, rep = socks_connect(1, DEVICE, 80)
+        check("socks5 auth required: no-auth client refused (0xFF)", rep == 0xFF, "rep=%d" % rep)
+        _, rep = socks_connect(1, DEVICE, 80, auth=("bench", "wrong"))
+        check("socks5 wrong password refused", rep == -1, "rep=%d" % rep)
+        s, rep = socks_connect(1, DEVICE, 80, auth=("bench", "s3cret"))
+        status = http_get(s, "/")[0] if s else ""
+        check("socks5 correct user/password -> HTTP 200", status.endswith("200 OK"), status)
+    finally:
+        cli.stop()
+
+    print("\n%d failure(s)" % failures)
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/bench/selftest.py b/bench/selftest.py
new file mode 100755
index 0000000..85a21a9
--- /dev/null
+++ b/bench/selftest.py
@@ -0,0 +1,174 @@
+#!/usr/bin/env python3
+"""Bench self-test: protocol behaviour of the VTun 3.0.2 server that VTesse relies on.
+
+Usage: selftest.py [host] [port]      (default 127.0.0.1 15000, i.e. `bench.sh up`)
+"""
+import os
+import socket
+import struct
+import sys
+import time
+
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "tools"))
+from vtun_probe import (MESG_SIZE, CONN_CLOSE, ECHO_REQ, ECHO_REP, msg, read_exact, read_mesg,  # noqa: E402
+                        cl2cs, cs2cl, xor_chal, dhcp_discover)
+
+HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
+PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 15000
+
+# Bench-only test sessions (bench/vtund.conf).
+S = {
+    "main": ("02BE0C000001", "c79e01d2e49d80eafd192c043c5142bd5a65b5a9"),
+    "shaper": ("02BE0C000003", "a61ced02fb7e8191c77e74fd3e6ac5e80efce635"),
+    "compress": ("02BE0C000004", "3adac4cea43b5e0b6402463cfb62569249d6daf3"),
+    "deny": ("02BE0C000005", "5b3b17af423b1ea1c49dd3a1bc56a9baa6d33f1d"),
+    "tun": ("02BE0C000006", "3158ed23d81fba0909c1a18d263ca8f4cef1b6a0"),
+}
+
+failures = 0
+
+
+def check(name, cond, detail=""):
+    global failures
+    print("%s  %s%s" % ("PASS" if cond else "FAIL", name, ("  (%s)" % detail) if detail else ""))
+    if not cond:
+        failures += 1
+
+
+def login(session, password, greeting=None):
+    """Returns (socket, final reply, seconds from CHAL to reply)."""
+    s = socket.create_connection((HOST, PORT), timeout=15)
+    raw = read_exact(s, MESG_SIZE)
+    if greeting is not None:
+        greeting.append(raw)
+    s.sendall(msg("HOST: %s\n" % session))
+    chal = read_mesg(s)
+    if not chal.startswith("OK CHAL"):
+        return s, chal, 0
+    t0 = time.time()
+    s.sendall(msg("CHAL: %s\n" % cl2cs(xor_chal(cs2cl(chal), password))))
+    try:
+        reply = read_mesg(s)
+    except EOFError:
+        reply = "<EOF>"
+    return s, reply, time.time() - t0
+
+
+def close(s):
+    try:
+        s.sendall(struct.pack(">H", CONN_CLOSE))
+    except OSError:
+        pass
+    s.close()
+
+
+def wait_flag(s, want, seconds):
+    """Read frames for up to `seconds`; return True when a flag frame `want` is seen
+    (or EOF when want is None)."""
+    s.settimeout(0.5)
+    end, buf = time.time() + seconds, b""
+    while time.time() < end:
+        try:
+            c = s.recv(4096)
+        except socket.timeout:
+            continue
+        if not c:
+            return want is None
+        buf += c
+        while len(buf) >= 2:
+            hdr = struct.unpack(">H", buf[:2])[0]
+            fl, ln = hdr & 0xF000, hdr & 0x0FFF
+            if fl:
+                buf = buf[2:]
+                if fl == ECHO_REQ:
+                    s.sendall(struct.pack(">H", ECHO_REP))
+                if fl == want:
+                    return True
+                continue
+            if len(buf) < 2 + ln:
+                break
+            buf = buf[2 + ln:]
+    return False
+
+
+def dhcp_offer(s, mac, seconds):
+    """Send DHCPDISCOVER, return (seconds until OFFER, raw frame) or (None, None)."""
+    t0 = time.time()
+    frame = dhcp_discover(mac)
+    s.sendall(struct.pack(">H", len(frame)) + frame)
+    s.settimeout(0.5)
+    buf, end = b"", t0 + seconds
+    while time.time() < end:
+        try:
+            c = s.recv(65536)
+        except socket.timeout:
+            continue
+        if not c:
+            return None, None
+        buf += c
+        while len(buf) >= 2:
+            hdr = struct.unpack(">H", buf[:2])[0]
+            fl, ln = hdr & 0xF000, hdr & 0x0FFF
+            if fl:
+                buf = buf[2:]
+                if fl == ECHO_REQ:
+                    s.sendall(struct.pack(">H", ECHO_REP))
+                continue
+            if len(buf) < 2 + ln:
+                break
+            fr, buf = buf[2:2 + ln], buf[2 + ln:]
+            if fr[12:14] == b"\x08\x00" and fr[23] == 17 and fr[36:38] == b"\x00\x44":
+                return time.time() - t0, fr
+    return None, None
+
+
+def main():
+    # Greeting and the main session
+    g = []
+    s, reply, _ = login(*S["main"], greeting=g)
+    check("greeting is exactly 50 bytes, NUL padded",
+          len(g[0]) == 50 and g[0].startswith(b"VTUN server ver ") and g[0].rstrip(b"\0").endswith(b"\n"))
+    check("main session flags <TeK>", reply == "OK FLAGS: <TeK>\n", repr(reply))
+    check("ECHO_REQ is the first frame after OK FLAGS", wait_flag(s, ECHO_REQ, 2))
+    time.sleep(0.5)  # the server brings the tap up asynchronously
+    dt, fr = dhcp_offer(s, bytes.fromhex(S["main"][0]), 10)
+    check("DHCP OFFER through the tunnel", fr is not None, "after %.1fs" % dt if dt else "")
+    check("DHCP OFFER delayed by the ping check (>= 2 s)", dt is not None and dt >= 2.0)
+    check("DHCP OFFER carries option 121", fr is not None and b"\x79\x10\x18\x0a\x4e\x00" in fr)
+
+    # killold: a second login takes the session over, the first one is closed
+    s2, reply2, dt2 = login(*S["main"])
+    check("killold: second login succeeds", reply2.startswith("OK FLAGS"), "%.2fs" % dt2)
+    check("killold: first connection gets CONN_CLOSE or EOF",
+          wait_flag(s, CONN_CLOSE, 6) or wait_flag(s, None, 1))
+    close(s2)
+    s.close()
+
+    # Flags of other sessions
+    for key, want in (("shaper", "<TeS512K>"), ("compress", "<TeC9K>"), ("tun", "<TuK>")):
+        s, reply, _ = login(*S[key])
+        check("%s session flags %s" % (key, want), reply == "OK FLAGS: %s\n" % want, repr(reply))
+        close(s)
+
+    # Errors
+    s, reply, _ = login(S["main"][0], "wrong-password")
+    check("wrong password -> ERR", reply == "ERR\n", repr(reply))
+    s.close()
+    s, reply, _ = login("02BE0C0000FF", "whatever")
+    check("unknown session -> OK CHAL, then ERR", reply == "ERR\n", repr(reply))
+    s.close()
+
+    # multi no: the second parallel login is refused
+    s1, r1, _ = login(*S["deny"])
+    s2, r2, _ = login(*S["deny"])
+    check("multi no: first login OK", r1.startswith("OK FLAGS"), repr(r1))
+    check("multi no: second login -> ERR", r2 == "ERR\n", repr(r2))
+    close(s1)
+    s2.close()
+
+    print("\n%d failure(s)" % failures)
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/bench/vectors/README.md b/bench/vectors/README.md
new file mode 100644
index 0000000..95d7199
--- /dev/null
+++ b/bench/vectors/README.md
@@ -0,0 +1,24 @@
+# Reference vectors
+
+Captured on the bench from the **stock VTun 3.0.2 client** (`bench.sh stock-test`),
+session `02BE0C000001`, bench password `c79e01d2e49d80eafd192c043c5142bd5a65b5a9`.
+
+- `stock-client-ether.pcap` — full TCP exchange (handshake + first frames).
+
+## Handshake (each message is exactly 50 bytes, NUL padded)
+
+| Dir | Text |
+|---|---|
+| S→C | `VTUN server ver 3.X 10/13/2026\n` |
+| C→S | `HOST: 02BE0C000001\n` |
+| S→C | `OK CHAL: <djhdglocepfoaejahdbnealodcbnjgbl>\n` |
+| C→S | `CHAL: <fkeefcihhpgpgakcbgcjhjnkakcnpdhk>\n` |
+| S→C | `OK FLAGS: <TeK>\n` |
+
+XOR check: `cl2cs(cs2cl(chal) XOR password)` must equal the client `CHAL`.
+
+## First frames after `OK FLAGS`
+
+- Both sides start with `ECHO_REQ` (`20 00`) and answer with `ECHO_REP` (`40 00`).
+- Then data frames, e.g. `00 5a` + 90-byte Ethernet frame (IPv6 MLD from the
+  client tap — VTesse drops IPv6, the stock client does not).
diff --git a/bench/vectors/stock-client-ether.pcap b/bench/vectors/stock-client-ether.pcap
new file mode 100644
index 0000000..c4d82c8
Binary files /dev/null and b/bench/vectors/stock-client-ether.pcap differ
diff --git a/bench/vtund.conf b/bench/vtund.conf
new file mode 100644
index 0000000..98d22ba
--- /dev/null
+++ b/bench/vtund.conf
@@ -0,0 +1,130 @@
+# VTesse bench server configuration.
+# Mirrors the structure of the target deployment; all names, addresses and
+# passwords here are bench-only test values.
+
+options {
+  syslog daemon;
+  timeout 60;
+  ip /sbin/ip;
+}
+
+default {
+  type tun;
+  proto tcp;
+  persist yes;
+  keepalive 10:5;
+  timeout 60;
+  compress no;
+  encrypt no;
+  stat no;
+  speed 512:512;
+  multi killold;
+}
+
+# Main scenario: type ether, bridged into the DHCP segment. Flags: <TeK>
+02BE0C000001 {
+  type ether;
+  speed 0:0;
+  password c79e01d2e49d80eafd192c043c5142bd5a65b5a9;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
+
+# Second ether client (parallel sessions, take-over tests). Flags: <TeK>
+02BE0C000002 {
+  type ether;
+  speed 0:0;
+  password 5b0c441c11d30d04ed528fb5baa65bdb2dad73dc;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
+
+# Inherits the shaper from default. Flags: <TeS512K>
+02BE0C000003 {
+  type ether;
+  password a61ced02fb7e8191c77e74fd3e6ac5e80efce635;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
+
+# Compression requested -> the client must refuse. Flags: <TeC9K>
+02BE0C000004 {
+  type ether;
+  speed 0:0;
+  compress zlib:9;
+  password 3adac4cea43b5e0b6402463cfb62569249d6daf3;
+}
+
+# Multiple connections denied: a second login gets ERR. Flags: <TeK>
+02BE0C000005 {
+  type ether;
+  speed 0:0;
+  multi no;
+  password 5b3b17af423b1ea1c49dd3a1bc56a9baa6d33f1d;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
+
+# type tun with manual addressing (server 10.76.0.1, client 10.76.0.2). Flags: <TuK>
+02BE0C000006 {
+  type tun;
+  speed 0:0;
+  password 3158ed23d81fba0909c1a18d263ca8f4cef1b6a0;
+  up {
+    ip "link set %% up mtu 1500";
+    ip "addr add 10.76.0.1 peer 10.76.0.2 dev %%";
+  };
+}
+
+# Real-device tests over the LAN (BENCH_BIND): further ether clients. Flags: <TeK>
+02BE0C000007 {
+  type ether;
+  speed 0:0;
+  password 25535a528dead865cd699edf0cc111300b3822e5;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
+
+02BE0C000008 {
+  type ether;
+  speed 0:0;
+  password 933182a3c383e8a0843bea4f408e75f1198e062e;
+  up {
+    ip "link set %% up multicast off mtu 1500";
+    program "brctl addif br-vtesse %%";
+  };
+  down {
+    program "brctl delif br-vtesse %%";
+    ip "link set %% down";
+  };
+}
diff --git a/ci/Dockerfile.android b/ci/Dockerfile.android
new file mode 100644
index 0000000..bbb34b8
--- /dev/null
+++ b/ci/Dockerfile.android
@@ -0,0 +1,39 @@
+# Android build environment for android/ (APK): JDK 17, Android SDK, NDK, CMake, Gradle.
+# Used locally (android/build.sh) and in CI.
+FROM eclipse-temurin:17-jdk-jammy
+
+ARG CMDLINE_TOOLS=11076708
+ARG GRADLE_VERSION=8.11.1
+ARG ANDROID_PLATFORM=35
+ARG BUILD_TOOLS=35.0.0
+ARG NDK_VERSION=27.2.12479018
+ARG CMAKE_VERSION=3.22.1
+
+ENV ANDROID_HOME=/opt/android-sdk \
+    GRADLE_HOME=/opt/gradle \
+    GRADLE_USER_HOME=/cache/gradle
+ENV PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$GRADLE_HOME/bin
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends unzip curl ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p $ANDROID_HOME/cmdline-tools \
+ && curl -fsSL --retry 3 -o /tmp/tools.zip \
+      https://dl.google.com/android/repository/commandlinetools-linux-${CMDLINE_TOOLS}_latest.zip \
+ && unzip -q /tmp/tools.zip -d $ANDROID_HOME/cmdline-tools \
+ && mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest \
+ && rm /tmp/tools.zip \
+ && yes | sdkmanager --licenses >/dev/null \
+ && sdkmanager --install "platform-tools" "platforms;android-${ANDROID_PLATFORM}" \
+      "build-tools;${BUILD_TOOLS}" "ndk;${NDK_VERSION}" "cmake;${CMAKE_VERSION}" >/dev/null \
+ && chmod -R a+rwX $ANDROID_HOME
+
+RUN curl -fsSL --retry 3 -o /tmp/gradle.zip \
+      https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip \
+ && unzip -q /tmp/gradle.zip -d /opt \
+ && mv /opt/gradle-${GRADLE_VERSION} $GRADLE_HOME \
+ && rm /tmp/gradle.zip \
+ && mkdir -p /cache/gradle && chmod -R a+rwX /cache
+
+WORKDIR /src
diff --git a/ci/Dockerfile.cross b/ci/Dockerfile.cross
new file mode 100644
index 0000000..3ef8378
--- /dev/null
+++ b/ci/Dockerfile.cross
@@ -0,0 +1,6 @@
+# Cross build environment for ci/build-musl.sh (Bootlin musl toolchains + qemu-user).
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends make curl ca-certificates xz-utils file qemu-user \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
diff --git a/ci/Dockerfile.mips b/ci/Dockerfile.mips
new file mode 100644
index 0000000..38d735c
--- /dev/null
+++ b/ci/Dockerfile.mips
@@ -0,0 +1,6 @@
+# Big-endian MIPS cross build + test runner (qemu-user, no binfmt needed).
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends make gcc-mips-linux-gnu libc6-dev-mips-cross qemu-user \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
diff --git a/ci/Dockerfile.native b/ci/Dockerfile.native
new file mode 100644
index 0000000..2fbd140
--- /dev/null
+++ b/ci/Dockerfile.native
@@ -0,0 +1,6 @@
+# Native (x86_64) build environment matching the bench image (Debian bookworm).
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends make gcc libc6-dev \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
diff --git a/ci/build-musl.sh b/ci/build-musl.sh
new file mode 100755
index 0000000..00e276c
--- /dev/null
+++ b/ci/build-musl.sh
@@ -0,0 +1,103 @@
+#!/bin/sh
+# Static musl build of vtesse-cli for one target (and of the patched vtund server for x86_64).
+#
+#   ci/build-musl.sh <target> [outdir]
+#
+# target: arm32   OpenIPC toolchain (hisilicon-hi3516cv100, arm musleabi) — 32-bit ARM cameras
+#         mipsel | mips   OpenWrt toolchains (ramips/mt7621, ath79/generic; musl, soft-float):
+#                 run on every MIPS32r2 core with or without an FPU — Ingenic cameras and
+#                 MediaTek/Atheros routers (MT7620/7621/7628, ath79), whose kernels often
+#                 lack FPU emulation, so hard-float code dies with SIGILL (#30)
+#         arm64 | x86_64 | armv5 | armv7   Bootlin musl toolchains
+# Produces <outdir>/vtesse-<target> (lwIP + TAP) and <outdir>/vtesse-tap-<target>
+# (TAP only, LWIP=0), stripped. For x86_64 also <outdir>/vtund-<vtun version>-x86_64:
+# the VTun server with our patches (server/build-vtund.sh), a PC/server binary only;
+# VTUND=1 builds it for another target too, VTUND=0 skips it. With QEMU=1 the unit tests are run under
+# qemu-user as well. musl is used because a static glibc binary cannot resolve
+# host names without the NSS libraries of the same glibc on the device.
+set -eu
+
+TARGET=$1
+OUT=${2:-dist}
+BOOTLIN_VERSION=${BOOTLIN_VERSION:-stable-2026.08-1}
+CACHE=${TOOLCHAIN_CACHE:-$HOME/.cache/vtesse-toolchains}
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+
+OPENIPC=https://github.com/OpenIPC/firmware/releases/download/toolchain
+BOOTLIN=https://toolchains.bootlin.com/downloads/releases/toolchains
+OPENWRT_VERSION=${OPENWRT_VERSION:-23.05.5}
+OPENWRT=https://downloads.openwrt.org/releases/$OPENWRT_VERSION/targets
+SUBDIR=     # toolchain directory inside the archive, if not its top level
+case "$TARGET" in
+    arm32)   URL=$OPENIPC/toolchain.hisilicon-hi3516cv100.tgz; DIRNAME=arm-openipc-linux-musleabi_sdk-buildroot; QEMU_BIN=qemu-arm ;;
+    mipsel|mips)
+        # OpenWrt toolchains: musl, soft-float (24kc), as on the routers themselves
+        if [ "$TARGET" = mipsel ]; then OW=ramips/mt7621; OWA=mipsel_24kc; QEMU_BIN=qemu-mipsel
+        else OW=ath79/generic; OWA=mips_24kc; QEMU_BIN=qemu-mips; fi
+        DIRNAME=openwrt-toolchain-$OPENWRT_VERSION-$(echo $OW | tr / -)_gcc-12.3.0_musl.Linux-x86_64
+        URL=$OPENWRT/$OW/$DIRNAME.tar.xz
+        SUBDIR=/toolchain-${OWA}_gcc-12.3.0_musl ;;
+    *)
+        case "$TARGET" in
+            x86_64) TC=x86-64;       QEMU_BIN=qemu-x86_64 ;;
+            armv5)  TC=armv5-eabi;   QEMU_BIN=qemu-arm ;;
+            armv7)  TC=armv7-eabihf; QEMU_BIN=qemu-arm ;;
+            arm64)  TC=aarch64;      QEMU_BIN=qemu-aarch64 ;;
+            *) echo "unknown target: $TARGET" >&2; exit 2 ;;
+        esac
+        DIRNAME=$TC--musl--$BOOTLIN_VERSION
+        URL=$BOOTLIN/$TC/tarballs/$DIRNAME.tar.xz ;;
+esac
+
+DIR=$CACHE/$DIRNAME$SUBDIR
+if [ ! -d "$DIR/bin" ]; then
+    mkdir -p "$CACHE"
+    echo "downloading $URL"
+    # download first (with retries), then extract: a truncated stream piped
+    # into tar looks like a corrupt archive
+    curl -fsSL --retry 3 -o "$CACHE/toolchain.tar" "$URL"
+    tar -xf "$CACHE/toolchain.tar" -C "$CACHE"
+    rm -f "$CACHE/toolchain.tar"
+    [ -x "$DIR/relocate-sdk.sh" ] && "$DIR/relocate-sdk.sh" >/dev/null 2>&1 || true
+fi
+GCC=$(ls "$DIR"/bin/*-linux-musl*-gcc | head -1)
+export STAGING_DIR="$DIR"     # OpenWrt's gcc wrapper warns without it
+CROSS=${GCC%gcc}
+
+# lwIP memory profile (#12): medium for cameras and routers (32-bit ARM, MIPS),
+# large for arm64 boards and PCs
+case "$TARGET" in
+    arm64|x86_64) PROFILE=${LWIP_PROFILE:-large} ;;
+    *)            PROFILE=${LWIP_PROFILE:-medium} ;;
+esac
+
+mkdir -p "$OUT"
+cd "$ROOT"
+for variant in full tap; do
+    if [ $variant = full ]; then lwip=1; bin=vtesse-$TARGET; else lwip=0; bin=vtesse-tap-$TARGET; fi
+    build=build-$TARGET-$variant
+    rm -rf "$build"     # objects of another toolchain or profile are never rebuilt by make
+    make -s BUILD="$build" CROSS_COMPILE="$CROSS" STATIC=1 LWIP=$lwip LWIP_PROFILE=$PROFILE CFLAGS=-Os all tests
+    "${CROSS}strip" --strip-unneeded -o "$OUT/$bin" "$build/vtesse-cli"
+    echo "$bin: $(wc -c < "$OUT/$bin") bytes (lwIP profile $PROFILE)"
+done
+
+# vtund: PC/server only by default; for cameras and routers it is built in the OpenIPC
+# environment when needed (server/README.md)
+[ "$TARGET" = x86_64 ] && VTUND_DEFAULT=1 || VTUND_DEFAULT=0
+VTUND_BIN=
+if [ "${VTUND:-$VTUND_DEFAULT}" = 1 ]; then
+    VTUND_BIN=vtund-$("$ROOT/server/build-vtund.sh" --version)-$TARGET
+    "$ROOT/server/build-vtund.sh" --cross "$CROSS" --static "$OUT/$VTUND_BIN"
+fi
+
+if [ "${QEMU:-0}" = 1 ]; then
+    for t in test_proto test_route test_client; do
+        echo "== $QEMU_BIN $t"
+        "$QEMU_BIN" "build-$TARGET-full/$t" | tail -1
+    done
+    "$QEMU_BIN" "$OUT/vtesse-$TARGET" --version
+    "$QEMU_BIN" "$OUT/vtesse-tap-$TARGET" --version
+    # vtund has no --version; -h prints "VTun ver ..." and the usage, exit code 1
+    [ -z "$VTUND_BIN" ] || "$QEMU_BIN" "$OUT/$VTUND_BIN" -h 2>&1 | grep "^VTun ver"
+fi
diff --git a/ci/test-mips.sh b/ci/test-mips.sh
new file mode 100755
index 0000000..0633d15
--- /dev/null
+++ b/ci/test-mips.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Build VTesse for big-endian MIPS (static) and run the test suite under qemu-mips.
+#   ci/test-mips.sh
+set -eu
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+IMAGE=vtesse-ci-mips
+docker build -q -t "$IMAGE" -f "$HERE/ci/Dockerfile.mips" "$HERE/ci" >/dev/null
+docker run --rm --user "$(id -u):$(id -g)" -v "$HERE:/src" -w /src "$IMAGE" sh -c '
+    set -e
+    make -s BUILD=build-mips CC=mips-linux-gnu-gcc AR=mips-linux-gnu-ar LDFLAGS=-static all build-mips/test_proto build-mips/test_client build-mips/test_route
+    file_info=$(od -An -tx1 -j5 -N1 build-mips/vtesse-cli | tr -d " ")
+    [ "$file_info" = "02" ] && echo "ELF data: big-endian"
+    for t in build-mips/test_proto build-mips/test_route build-mips/test_client; do
+        echo "== qemu-mips $t"; qemu-mips "$t"
+    done
+    ls -l build-mips/vtesse-cli
+'
diff --git a/cli/vtesse_cli.c b/cli/vtesse_cli.c
new file mode 100644
index 0000000..aa419ca
--- /dev/null
+++ b/cli/vtesse_cli.c
@@ -0,0 +1,900 @@
+/*
+ * vtesse-cli: Linux console client.
+ *
+ * Two backends:
+ *  - lwIP (default): userspace stack over the tunnel, address and routes via
+ *    DHCP (type ether), local proxy: --socks PORT and --forward LPORT:IP:RPORT;
+ *    --fetch performs one HTTP GET through the stack.
+ *  - TAP (--tap): kernel interface through /dev/net/tun; addressing is done by
+ *    the system (e.g. a DHCP client started from the --hook script).
+ * Build without lwIP: make LWIP=0 (TAP only).
+ *
+ * Credentials are read from a key=value file, never from the command line.
+ * The session name is the device ID and doubles as the client MAC.
+ */
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "netcore/loop.h"
+#include "netcore/route.h"
+#include "vtesse/version.h"
+#include "vtesse/vtun_client.h"
+
+#ifndef VTESSE_WITH_LWIP
+#define VTESSE_WITH_LWIP 1
+#endif
+
+#if VTESSE_WITH_LWIP
+#include "lwip/ip4_addr.h"
+#include "lwip/tcp.h"
+#include "netcore/proxy.h"
+#include "netcore/stack.h"
+#endif
+#include "netcore/udprelay.h"   /* limits only; the relay itself needs lwIP */
+
+/* optional modules (make SOCKS=0 UDP_RELAY=0 TAP=0) */
+#ifndef NC_WITH_SOCKS
+#define NC_WITH_SOCKS VTESSE_WITH_LWIP
+#endif
+#ifndef VTESSE_WITH_UDP_RELAY
+#define VTESSE_WITH_UDP_RELAY VTESSE_WITH_LWIP
+#endif
+#ifndef VTESSE_WITH_TAP
+#ifdef __linux__
+#define VTESSE_WITH_TAP 1
+#else
+#define VTESSE_WITH_TAP 0
+#endif
+#endif
+#if VTESSE_WITH_TAP
+#include "netcore/tapdev.h"
+#endif
+
+#if VTESSE_WITH_LWIP && !VTESSE_WITH_UDP_RELAY
+/* built without the UDP relay (udprelay.c not linked): the options are refused */
+int nc_udp_relay_parse(const char *s, uint16_t *port, uint16_t *local_port)
+{
+    (void)s; (void)port; (void)local_port;
+    return -1;
+}
+nc_udp_relay_t *nc_udp_relay_create(uint16_t port, const char *dst_addr, uint16_t dst_port,
+                                    char *err, size_t err_size)
+{
+    (void)port; (void)dst_addr; (void)dst_port;
+    snprintf(err, err_size, "built without the UDP relay (make UDP_RELAY=0)");
+    return NULL;
+}
+void nc_udp_relay_get_stats(const nc_udp_relay_t *r, nc_udp_relay_stats_t *st)
+{
+    (void)r;
+    memset(st, 0, sizeof(*st));
+}
+void nc_udp_relay_destroy(nc_udp_relay_t *r)
+{
+    (void)r;
+}
+#endif
+
+#define DEFAULT_CONFIG "~/.config/vtesse/probe.conf"
+
+typedef struct cfg_file {
+    char host[256];
+    char session[64];
+    char id_from[32];       /* interface whose MAC is the device ID */
+    char ip[32], gw[32];    /* manual IPv4 (type tun, or instead of DHCP) */
+    char route[16][32];     /* NET/P, repeatable */
+    char udp_relay[NC_UDP_RELAY_MAX][16];   /* PORT[:LOCAL_PORT], repeatable */
+    int udp_relay_count;
+    int route_count;
+    char password[128];
+    char auth[16];
+    char socks_user[256];
+    char socks_password[256];
+    int port;
+} cfg_file_t;
+
+static nc_loop_t loop;
+static int verbose;
+
+static void on_signal(int sig)
+{
+    (void)sig;
+    loop.stop = 1;
+}
+
+static void usage(void)
+{
+    fprintf(stderr,
+            "usage: vtesse-cli [--config FILE] [--seconds N] [-v] [--version]\n"
+#if VTESSE_WITH_LWIP
+            "  lwIP backend (default):\n"
+            "                  [--socks PORT] [--forward LPORT:IP:RPORT]... [--listen ADDR]\n"
+            "                  [--fetch http://IP[:PORT]/PATH] [--udp-relay PORT[:LOCAL_PORT]]...\n"
+            "                  [--ip A.B.C.D/P [--gw A.B.C.D]]   (manual IPv4 instead of DHCP)\n"
+#endif
+#if VTESSE_WITH_TAP
+            "  TAP backend:    --tap [--ifname NAME] [--hook SCRIPT]\n"
+#endif
+            "  --id-from IFACE  device ID (session name) = MAC of IFACE, e.g. eth0\n"
+            "  FILE: key=value lines: host, port, session, password, auth (xor),\n"
+            "        optional id_from (instead of session: MAC of that interface),\n"
+            "        ip=A.B.C.D/P, gw=A.B.C.D, route=NET/P (repeatable): manual IPv4\n"
+            "        udp_relay=PORT[:LOCAL_PORT] (repeatable): UDP to the tunnel address -> 127.0.0.1\n"
+            "        (needed for type tun; with --tap passed to the hook),\n"
+            "        socks_user, socks_password (SOCKS5 user/password auth)\n"
+            "        default " DEFAULT_CONFIG "\n");
+}
+
+static void expand_home(const char *in, char *out, size_t size)
+{
+    const char *home = getenv("HOME");
+
+    if (in[0] == '~' && in[1] == '/' && home)
+        snprintf(out, size, "%s%s", home, in + 1);
+    else
+        snprintf(out, size, "%s", in);
+}
+
+static char *trim(char *s)
+{
+    char *e;
+
+    while (*s == ' ' || *s == '\t')
+        s++;
+    e = s + strlen(s);
+    while (e > s && (e[-1] == ' ' || e[-1] == '\t' || e[-1] == '\r' || e[-1] == '\n'))
+        *--e = '\0';
+    return s;
+}
+
+static int load_config(const char *path, cfg_file_t *c)
+{
+    char full[512], line[512];
+    FILE *f;
+
+    memset(c, 0, sizeof(*c));
+    snprintf(c->auth, sizeof(c->auth), "xor");
+    expand_home(path, full, sizeof(full));
+    f = fopen(full, "r");
+    if (!f) {
+        fprintf(stderr, "cannot open %s: %s\n", full, strerror(errno));
+        return -1;
+    }
+    while (fgets(line, sizeof(line), f)) {
+        char *k = trim(line), *v = strchr(k, '=');
+
+        if (*k == '#' || !v)
+            continue;
+        *v++ = '\0';
+        k = trim(k);
+        v = trim(v);
+        if (!strcmp(k, "host"))
+            snprintf(c->host, sizeof(c->host), "%s", v);
+        else if (!strcmp(k, "port"))
+            c->port = atoi(v);
+        else if (!strcmp(k, "session"))
+            snprintf(c->session, sizeof(c->session), "%s", v);
+        else if (!strcmp(k, "ip"))
+            snprintf(c->ip, sizeof(c->ip), "%s", v);
+        else if (!strcmp(k, "gw"))
+            snprintf(c->gw, sizeof(c->gw), "%s", v);
+        else if (!strcmp(k, "udp_relay")) {
+            if (c->udp_relay_count >= NC_UDP_RELAY_MAX) {
+                fprintf(stderr, "%s: at most %d udp_relay lines\n", full, NC_UDP_RELAY_MAX);
+                fclose(f);
+                return -1;
+            }
+            snprintf(c->udp_relay[c->udp_relay_count++], sizeof(c->udp_relay[0]), "%s", v);
+        } else if (!strcmp(k, "route")) {
+            if (c->route_count >= (int)(sizeof(c->route) / sizeof(c->route[0]))) {
+                fprintf(stderr, "%s: too many route lines\n", full);
+                fclose(f);
+                return -1;
+            }
+            snprintf(c->route[c->route_count++], sizeof(c->route[0]), "%s", v);
+        } else if (!strcmp(k, "id_from"))
+            snprintf(c->id_from, sizeof(c->id_from), "%s", v);
+        else if (!strcmp(k, "password"))
+            snprintf(c->password, sizeof(c->password), "%s", v);
+        else if (!strcmp(k, "auth"))
+            snprintf(c->auth, sizeof(c->auth), "%s", v);
+        else if (!strcmp(k, "socks_user"))
+            snprintf(c->socks_user, sizeof(c->socks_user), "%s", v);
+        else if (!strcmp(k, "socks_password"))
+            snprintf(c->socks_password, sizeof(c->socks_password), "%s", v);
+    }
+    fclose(f);
+    if (!c->host[0] || c->port <= 0 || c->port > 65535 || !c->password[0]) {
+        fprintf(stderr, "%s: host, port, session (or id_from) and password are required\n", full);
+        return -1;
+    }
+    if (strcmp(c->auth, "xor") != 0) {
+        fprintf(stderr, "%s: unsupported auth '%s' (only xor)\n", full, c->auth);
+        return -1;
+    }
+    return 0;
+}
+
+static int parse_ip4(const char *s, uint32_t *out)
+{
+    unsigned a, b, c, d;
+    char tail;
+
+    if (sscanf(s, "%u.%u.%u.%u%c", &a, &b, &c, &d, &tail) != 4 || a > 255 || b > 255 || c > 255 || d > 255)
+        return -1;
+    *out = a << 24 | b << 16 | c << 8 | d;
+    return 0;
+}
+
+static int parse_prefix(const char *s, uint32_t *addr, uint32_t *mask)
+{
+    char buf[32];
+    const char *slash = strchr(s, '/');
+    int p;
+
+    if (!slash || (size_t)(slash - s) >= sizeof(buf))
+        return -1;
+    memcpy(buf, s, (size_t)(slash - s));
+    buf[slash - s] = '\0';
+    p = atoi(slash + 1);
+    if (p < 0 || p > 32 || parse_ip4(buf, addr) < 0)
+        return -1;
+    *mask = p ? 0xffffffffu << (32 - p) : 0;
+    return 0;
+}
+
+/* Device ID from the MAC of a local interface (/sys/class/net/IFACE/address). */
+static int id_from_interface(const char *ifname, char *id, size_t size)
+{
+    char path[96], line[64];
+    FILE *f;
+    int rc;
+
+    if (!ifname[0] || strchr(ifname, '/') || !strcmp(ifname, ".") || !strcmp(ifname, "..") ||
+        strlen(ifname) > 31 || size < 13) {
+        fprintf(stderr, "id_from: bad interface name '%s'\n", ifname);
+        return -1;
+    }
+    snprintf(path, sizeof(path), "/sys/class/net/%s/address", ifname);
+    f = fopen(path, "r");
+    if (!f) {
+        fprintf(stderr, "id_from: cannot read %s: %s\n", path, strerror(errno));
+        return -1;
+    }
+    rc = fgets(line, sizeof(line), f) ? nc_devid_from_mac_str(line, id) : -1;
+    fclose(f);
+    if (rc < 0)
+        fprintf(stderr, "id_from: %s has no usable unicast MAC\n", ifname);
+    return rc;
+}
+
+static double elapsed(uint64_t t0)
+{
+    return (double)(nc_now_ms() - t0) / 1000.0;
+}
+
+static uint64_t t_start;
+static vt_t *vt;
+
+static void print_tunnel_event(int tev, int err);
+
+
+#if VTESSE_WITH_LWIP
+
+/* ---- --fetch: one HTTP GET through lwIP ---- */
+
+static struct {
+    int wanted, started, done;
+    uint32_t ip;
+    uint16_t port;
+    char path[256];
+    unsigned long bytes;
+    char status[96];
+    size_t status_len;
+} fetch;
+
+static int parse_url(const char *url)
+{
+    char host[64];
+    const char *p = url, *slash, *colon;
+    size_t hl;
+
+    if (strncmp(p, "http://", 7) == 0)
+        p += 7;
+    slash = strchr(p, '/');
+    hl = slash ? (size_t)(slash - p) : strlen(p);
+    if (hl == 0 || hl >= sizeof(host))
+        return -1;
+    memcpy(host, p, hl);
+    host[hl] = '\0';
+    fetch.port = 80;
+    colon = strchr(host, ':');
+    if (colon) {
+        fetch.port = (uint16_t)atoi(colon + 1);
+        host[colon - host] = '\0';
+    }
+    snprintf(fetch.path, sizeof(fetch.path), "%s", slash ? slash : "/");
+    return parse_ip4(host, &fetch.ip);
+}
+
+static void fetch_finish(struct tcp_pcb *pcb, const char *how)
+{
+    char ip[16];
+
+    if (pcb) {
+        tcp_arg(pcb, NULL);
+        tcp_recv(pcb, NULL);
+        tcp_err(pcb, NULL);
+        if (tcp_close(pcb) != ERR_OK)
+            tcp_abort(pcb);
+    }
+    fetch.done = 1;
+    nc_ip4_format(fetch.ip, ip, sizeof(ip));
+    printf("[%8.3f] fetch %s:%u%s: %s, %lu bytes, \"%s\"\n", (double)(nc_now_ms() - t_start) / 1000.0,
+           ip, fetch.port, fetch.path, how, fetch.bytes, fetch.status);
+    fflush(stdout);
+}
+
+static err_t fetch_recv(void *arg, struct tcp_pcb *pcb, struct pbuf *p, err_t err)
+{
+    struct pbuf *q;
+
+    (void)arg;
+    (void)err;
+    if (!p) {
+        fetch_finish(pcb, "ok");
+        return ERR_OK;
+    }
+    for (q = p; q; q = q->next) {
+        size_t i;
+        for (i = 0; i < q->len && fetch.status_len < sizeof(fetch.status) - 1; i++) {
+            char c = ((char *)q->payload)[i];
+            if (c == '\r' || c == '\n') {
+                fetch.status_len = sizeof(fetch.status);    /* first line complete */
+                break;
+            }
+            fetch.status[fetch.status_len++] = c;
+        }
+    }
+    fetch.bytes += p->tot_len;
+    tcp_recved(pcb, p->tot_len);
+    pbuf_free(p);
+    return ERR_OK;
+}
+
+static void fetch_err(void *arg, err_t err)
+{
+    (void)arg;
+    fetch_finish(NULL, err == ERR_RST ? "reset" : err == ERR_ABRT ? "aborted" : "timeout/error");
+}
+
+static err_t fetch_connected(void *arg, struct tcp_pcb *pcb, err_t err)
+{
+    char req[400], ip[16];
+    int n;
+
+    (void)arg;
+    (void)err;
+    nc_ip4_format(fetch.ip, ip, sizeof(ip));
+    n = snprintf(req, sizeof(req), "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: vtesse-cli\r\n\r\n",
+                 fetch.path, ip);
+    tcp_write(pcb, req, (u16_t)n, TCP_WRITE_FLAG_COPY);
+    tcp_output(pcb);
+    return ERR_OK;
+}
+
+static void fetch_start(void)
+{
+    struct tcp_pcb *pcb;
+    ip4_addr_t a;
+
+    fetch.started = 1;
+    if (!nc_stack_route_ok(fetch.ip)) {
+        snprintf(fetch.status, sizeof(fetch.status), "no route via tunnel");
+        fetch_finish(NULL, "failed");
+        return;
+    }
+    pcb = tcp_new();
+    if (!pcb) {
+        fetch_finish(NULL, "out of memory");
+        return;
+    }
+    ip4_addr_set_u32(&a, lwip_htonl(fetch.ip));
+    tcp_arg(pcb, NULL);
+    tcp_recv(pcb, fetch_recv);
+    tcp_err(pcb, fetch_err);
+    if (tcp_connect(pcb, &a, fetch.port, fetch_connected) != ERR_OK) {
+        tcp_abort(pcb);
+        fetch_finish(NULL, "connect failed");
+    }
+}
+
+static void on_proxy_log(void *user, const char *msg)
+{
+    (void)user;
+    printf("[%8.3f] proxy: %s\n", (double)(nc_now_ms() - t_start) / 1000.0, msg);
+    fflush(stdout);
+}
+
+static int parse_forward(const char *s, nc_forward_t *f)
+{
+    char ip[32];
+    unsigned lp, rp;
+
+    if (sscanf(s, "%u:%31[0-9.]:%u", &lp, ip, &rp) != 3 || !lp || lp > 65535 || !rp || rp > 65535)
+        return -1;
+    f->local_port = (uint16_t)lp;
+    f->port = (uint16_t)rp;
+    return parse_ip4(ip, &f->ip);
+}
+
+/* ---- events ---- */
+
+static int manual_ip;   /* ip= / --ip: no DHCP */
+#if VTESSE_WITH_LWIP
+static struct {
+    uint16_t port, local;
+    nc_udp_relay_t *r;
+} relays[NC_UDP_RELAY_MAX];
+static int nrelays;
+#endif
+
+static void print_info(void)
+{
+    nc_stack_info_t in;
+    char a[16], m[16], g[16], r[48];
+    int i;
+
+    nc_stack_get_info(&in);
+    nc_ip4_format(in.addr, a, sizeof(a));
+    nc_ip4_format(in.mask, m, sizeof(m));
+    nc_ip4_format(in.gw, g, sizeof(g));
+    if (manual_ip)
+        printf("[%8.3f] address %s mask %s (manual), gw %s%s\n", elapsed(t_start), a, m, g,
+               in.default_route ? " (default route)" : "");
+    else
+        printf("[%8.3f] address %s mask %s, option 3 %s%s\n", elapsed(t_start), a, m, g,
+               in.default_route ? " (default route)" : " (ignored: classless routes present)");
+    for (i = 0; i < in.routes.count; i++) {
+        nc_route_format(&in.routes.r[i], r, sizeof(r));
+        printf("[%8.3f]   route %s\n", elapsed(t_start), r);
+    }
+    for (i = 0; i < nrelays; i++)
+        printf("[%8.3f]   udp relay %s:%u -> 127.0.0.1:%u\n", elapsed(t_start), a,
+               (unsigned)relays[i].port, (unsigned)relays[i].local);
+}
+
+static void on_stack_event(void *user, int ev, int tev, int err)
+{
+    (void)user;
+    if (ev == NC_STACK_EV_ADDR_BOUND) {
+        print_info();
+        if (fetch.wanted && !fetch.started)
+            fetch_start();
+    } else if (ev == NC_STACK_EV_ADDR_LOST) {
+        printf("[%8.3f] address lost\n", elapsed(t_start));
+    } else {
+        print_tunnel_event(tev, err);
+    }
+    fflush(stdout);
+}
+
+#endif /* VTESSE_WITH_LWIP */
+
+static void print_tunnel_event(int tev, int err)
+{
+    char flags[64];
+
+    if (tev == TUNNEL_EV_UP) {
+        vt_flags_format(vt_session_flags(vt), flags, sizeof(flags));
+        printf("[%8.3f] up: %s, flags %s\n", elapsed(t_start), vt_greeting(vt), flags);
+    } else if (err) {
+        printf("[%8.3f] %s: %s\n", elapsed(t_start), tunnel_event_name(tev), tunnel_strerror(err));
+    } else {
+        printf("[%8.3f] %s\n", elapsed(t_start), tunnel_event_name(tev));
+    }
+    if (tev == TUNNEL_EV_FAILED)
+        loop.stop = 1;
+}
+
+#if VTESSE_WITH_TAP
+/* ---- TAP backend: hook script ---- */
+
+static const char *hook;
+static const char *session_name;
+static nc_tap_t *tap;
+
+static void reap_children(void)
+{
+    while (waitpid(-1, NULL, WNOHANG) > 0)
+        ;
+}
+
+/* Runs "$hook <event>" asynchronously with VTESSE_* in the environment. */
+static void run_hook(const char *event)
+{
+    pid_t pid;
+
+    reap_children();
+    if (!hook)
+        return;
+    pid = fork();
+    if (pid == 0) {
+        setenv("VTESSE_EVENT", event, 1);
+        setenv("VTESSE_IFNAME", nc_tap_ifname(tap), 1);
+        setenv("VTESSE_LINK", nc_tap_link(tap) == TUNNEL_LINK_L3 ? "tun" : "ether", 1);
+        setenv("VTESSE_SESSION", session_name, 1);
+        execl("/bin/sh", "sh", hook, event, (char *)NULL);
+        _exit(127);
+    }
+    if (pid < 0)
+        printf("[%8.3f] hook: fork failed: %s\n", elapsed(t_start), strerror(errno));
+}
+
+static void on_tap_event(void *user, int ev, int tev, int err)
+{
+    (void)user;
+    switch (ev) {
+    case NC_TAP_EV_CREATED:
+        printf("[%8.3f] interface %s (%s) created\n", elapsed(t_start), nc_tap_ifname(tap),
+               nc_tap_link(tap) == TUNNEL_LINK_L3 ? "tun" : "tap");
+        if (!hook)
+            printf("[%8.3f] no --hook: configure the address yourself (e.g. udhcpc -i %s)\n",
+                   elapsed(t_start), nc_tap_ifname(tap));
+        run_hook("up");
+        break;
+    case NC_TAP_EV_RECONNECTED:
+        printf("[%8.3f] interface %s: carrier on\n", elapsed(t_start), nc_tap_ifname(tap));
+        run_hook("reconnect");
+        break;
+    case NC_TAP_EV_ERROR:
+        printf("[%8.3f] cannot create the interface: %s%s\n", elapsed(t_start), strerror(err),
+               err == EPERM || err == EACCES ? " (needs root or CAP_NET_ADMIN)" :
+               err == ENOENT || err == ENODEV ? " (no /dev/net/tun: load the tun module)" : "");
+        loop.stop = 1;
+        break;
+    default:
+        print_tunnel_event(tev, err);
+        if (tev == TUNNEL_EV_DOWN && nc_tap_link(tap) != TUNNEL_LINK_NONE)
+            run_hook("down");
+        break;
+    }
+    fflush(stdout);
+}
+#endif /* VTESSE_WITH_TAP */
+
+
+int main(int argc, char **argv)
+{
+    const char *config = DEFAULT_CONFIG, *id_from = NULL, *ip_arg = NULL, *gw_arg = NULL;
+    uint32_t st_addr = 0, st_mask = 0, st_gw = 0;
+    nc_routes_t st_routes;
+    double seconds = 0;
+    cfg_file_t c;
+    vt_cfg_t vc;
+    uint8_t mac[6];
+    tunnel_t t;
+    nc_source_t src;
+    int i, err, rc, use_tap = !VTESSE_WITH_LWIP, lwip_opts = 0;
+#if VTESSE_WITH_LWIP
+    nc_stack_cfg_t sc;
+    nc_proxy_cfg_t pc;
+    nc_proxy_t *px = NULL;
+#endif
+#if VTESSE_WITH_TAP
+    nc_tap_cfg_t tc;
+
+    memset(&tc, 0, sizeof(tc));
+#endif
+#if VTESSE_WITH_LWIP
+    memset(&sc, 0, sizeof(sc));
+    memset(&pc, 0, sizeof(pc));
+#endif
+    for (i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "--config") && i + 1 < argc)
+            config = argv[++i];
+        else if (!strcmp(argv[i], "--seconds") && i + 1 < argc)
+            seconds = atof(argv[++i]);
+        else if (!strcmp(argv[i], "-v"))
+            verbose = 1;
+        else if (!strcmp(argv[i], "--id-from") && i + 1 < argc)
+            id_from = argv[++i];
+        else if (!strcmp(argv[i], "--version")) {
+            printf("vtesse-cli %s (%s%s%s%s%s)\n", VTESSE_VERSION,
+                   VTESSE_WITH_LWIP ? "lwip, forwards" : "",
+                   VTESSE_WITH_LWIP && NC_WITH_SOCKS ? ", socks5" : "",
+                   VTESSE_WITH_LWIP && VTESSE_WITH_UDP_RELAY ? ", udp-relay" : "",
+                   VTESSE_WITH_LWIP && VTESSE_WITH_TAP ? ", " : "",
+                   VTESSE_WITH_TAP ? "tap" : "");
+            return 0;
+        }
+#if VTESSE_WITH_TAP
+        else if (!strcmp(argv[i], "--tap"))
+            use_tap = 1;
+        else if (!strcmp(argv[i], "--ifname") && i + 1 < argc)
+            tc.ifname = argv[++i];
+        else if (!strcmp(argv[i], "--hook") && i + 1 < argc)
+            hook = argv[++i];
+#else
+        else if (!strcmp(argv[i], "--tap") || !strcmp(argv[i], "--ifname") || !strcmp(argv[i], "--hook")) {
+            fprintf(stderr, "%s: built without the TAP/TUN backend (make TAP=0)\n", argv[i]);
+            return 2;
+        }
+#endif
+#if VTESSE_WITH_LWIP
+        else if (!strcmp(argv[i], "--fetch") && i + 1 < argc) {
+            if (parse_url(argv[++i]) < 0) {
+                fprintf(stderr, "--fetch: expected http://IPv4[:port]/path\n");
+                return 2;
+            }
+            fetch.wanted = lwip_opts = 1;
+        } else if (!strcmp(argv[i], "--socks") && i + 1 < argc && !NC_WITH_SOCKS) {
+            fprintf(stderr, "--socks: built without SOCKS5 (make SOCKS=0)\n");
+            return 2;
+        } else if (!strcmp(argv[i], "--socks") && i + 1 < argc) {
+            int p = atoi(argv[++i]);
+            if (p <= 0 || p > 65535) {
+                fprintf(stderr, "--socks: expected a port\n");
+                return 2;
+            }
+            pc.socks_port = (uint16_t)p;
+            lwip_opts = 1;
+        } else if (!strcmp(argv[i], "--forward") && i + 1 < argc) {
+            if (pc.forward_count >= NC_PROXY_MAX_FORWARDS ||
+                parse_forward(argv[++i], &pc.forwards[pc.forward_count]) < 0) {
+                fprintf(stderr, "--forward: expected LPORT:A.B.C.D:RPORT (max %d)\n", NC_PROXY_MAX_FORWARDS);
+                return 2;
+            }
+            pc.forward_count++;
+            lwip_opts = 1;
+        } else if (!strcmp(argv[i], "--udp-relay") && !VTESSE_WITH_UDP_RELAY) {
+            fprintf(stderr, "--udp-relay: built without the UDP relay (make UDP_RELAY=0)\n");
+            return 2;
+        } else if (!strcmp(argv[i], "--udp-relay") && i + 1 < argc) {
+            if (nrelays >= NC_UDP_RELAY_MAX ||
+                nc_udp_relay_parse(argv[++i], &relays[nrelays].port, &relays[nrelays].local) < 0) {
+                fprintf(stderr, "--udp-relay: expected PORT[:LOCAL_PORT] (max %d)\n", NC_UDP_RELAY_MAX);
+                return 2;
+            }
+            nrelays++;
+            lwip_opts = 1;
+        } else if (!strcmp(argv[i], "--listen") && i + 1 < argc) {
+            pc.listen_addr = argv[++i];
+            lwip_opts = 1;
+        } else if ((!strcmp(argv[i], "--ip") || !strcmp(argv[i], "--debug-ip")) && i + 1 < argc) {
+            ip_arg = argv[++i];
+        } else if ((!strcmp(argv[i], "--gw") || !strcmp(argv[i], "--debug-gw")) && i + 1 < argc) {
+            gw_arg = argv[++i];
+        }
+#endif
+        else {
+            usage();
+            return 2;
+        }
+    }
+    if (use_tap && lwip_opts) {
+        fprintf(stderr, "--tap cannot be combined with --socks/--forward/--listen/--fetch/--udp-relay\n");
+        return 2;
+    }
+    if (!VTESSE_WITH_TAP && use_tap) {
+        fprintf(stderr, "built without any backend\n");
+        return 2;
+    }
+    if (load_config(config, &c) < 0)
+        return 2;
+    if (c.udp_relay_count && !(VTESSE_WITH_LWIP && VTESSE_WITH_UDP_RELAY)) {
+        fprintf(stderr, "%s: udp_relay: built without the UDP relay\n", config);
+        return 2;
+    }
+    if (c.udp_relay_count && use_tap) {
+        fprintf(stderr, "%s: udp_relay needs the lwIP backend (with --tap the kernel receives UDP itself)\n", config);
+        return 2;
+    }
+    if (id_from)
+        snprintf(c.id_from, sizeof(c.id_from), "%s", id_from);
+    if (c.id_from[0]) {
+        if (c.session[0] && !id_from) {
+            fprintf(stderr, "%s: session and id_from are mutually exclusive\n", config);
+            return 2;
+        }
+        if (id_from_interface(c.id_from, c.session, sizeof(c.session)) < 0)
+            return 2;
+        printf("device ID %s (MAC of %s)\n", c.session, c.id_from);
+    } else if (!c.session[0]) {
+        fprintf(stderr, "%s: session or id_from is required\n", config);
+        return 2;
+    }
+    /* manual IPv4: command line overrides the file */
+    if (ip_arg)
+        snprintf(c.ip, sizeof(c.ip), "%s", ip_arg);
+    if (gw_arg)
+        snprintf(c.gw, sizeof(c.gw), "%s", gw_arg);
+    memset(&st_routes, 0, sizeof(st_routes));
+    if (!c.ip[0] && (c.gw[0] || c.route_count)) {
+        fprintf(stderr, "gw/route need ip\n");
+        return 2;
+    }
+    if (c.ip[0] && parse_prefix(c.ip, &st_addr, &st_mask) < 0) {
+        fprintf(stderr, "ip: expected A.B.C.D/P, got '%s'\n", c.ip);
+        return 2;
+    }
+    if (c.gw[0] && parse_ip4(c.gw, &st_gw) < 0) {
+        fprintf(stderr, "gw: expected A.B.C.D, got '%s'\n", c.gw);
+        return 2;
+    }
+    for (i = 0; i < c.route_count; i++) {
+        uint32_t net, m;
+        int p = 0;
+
+        if (parse_prefix(c.route[i], &net, &m) < 0) {
+            fprintf(stderr, "route: expected NET/P, got '%s'\n", c.route[i]);
+            return 2;
+        }
+        while (p < 32 && (m & (0x80000000u >> p)))
+            p++;
+        nc_routes_add(&st_routes, net, (uint8_t)p, st_gw);
+    }
+
+    if (nc_devid_to_mac(c.session, mac) < 0) {
+        /* not a device ID: still usable as a session name, MAC is derived */
+        uint8_t h = 0;
+        for (i = 0; c.session[i]; i++)
+            h = (uint8_t)(h * 31 + (uint8_t)c.session[i]);
+        memcpy(mac, "\x02\x00\x5e\x00\x00\x00", 6);
+        mac[5] = h;
+        fprintf(stderr, "warning: session name is not a device ID (12 x 0-9A-F); using MAC 02:00:5e:00:00:%02x\n", h);
+    }
+
+    memset(&vc, 0, sizeof(vc));
+    vc.host = c.host;
+    vc.port = (uint16_t)c.port;
+    vc.session = c.session;
+    vc.password = c.password;
+    vc.auth = VT_AUTH_XOR;
+    vt = vt_create(&vc, &err);
+    memset(c.password, 0, sizeof(c.password));
+    if (!vt) {
+        fprintf(stderr, "configuration error: %s\n", tunnel_strerror(err));
+        return 2;
+    }
+    t = vt_tunnel(vt);
+
+    signal(SIGINT, on_signal);
+    signal(SIGTERM, on_signal);
+    signal(SIGPIPE, SIG_IGN);
+    nc_loop_init(&loop);
+    src = nc_source_from_tunnel(&t);
+    nc_loop_add(&loop, &src);
+
+#if VTESSE_WITH_TAP
+    if (use_tap) {
+        memcpy(tc.mac, mac, 6);
+        /* manual IPv4 for the hook (it configures the interface) */
+        if (c.ip[0]) {
+            char routes[16 * 32 + 16] = "";
+
+            for (i = 0; i < c.route_count; i++) {
+                strcat(routes, i ? " " : "");
+                strcat(routes, c.route[i]);
+            }
+            setenv("VTESSE_IP", c.ip, 1);
+            if (c.gw[0])
+                setenv("VTESSE_GW", c.gw, 1);
+            if (routes[0])
+                setenv("VTESSE_ROUTES", routes, 1);
+        }
+        session_name = c.session;
+        tap = nc_tap_create(&t, &tc, on_tap_event, NULL);
+        if (!tap) {
+            fprintf(stderr, "out of memory\n");
+            return 2;
+        }
+        src = nc_tap_source(tap);
+        nc_loop_add(&loop, &src);
+    }
+#endif
+#if VTESSE_WITH_LWIP
+    if (!use_tap) {
+        memcpy(sc.mac, mac, 6);
+        if (c.ip[0]) {
+            sc.static_ip = manual_ip = 1;
+            sc.addr = st_addr;
+            sc.mask = st_mask;
+            sc.gw = st_gw;
+            sc.routes = st_routes;
+        }
+        if (nc_stack_init(&t, &sc, on_stack_event, NULL) < 0) {
+            fprintf(stderr, "stack initialisation failed\n");
+            return 2;
+        }
+        src = nc_stack_timer_source();
+        nc_loop_add(&loop, &src);
+        /* UDP relays from the file come after the command line ones */
+        for (i = 0; i < c.udp_relay_count; i++) {
+            if (nrelays >= NC_UDP_RELAY_MAX ||
+                nc_udp_relay_parse(c.udp_relay[i], &relays[nrelays].port, &relays[nrelays].local) < 0) {
+                fprintf(stderr, "%s: udp_relay: expected PORT[:LOCAL_PORT] (max %d)\n", config, NC_UDP_RELAY_MAX);
+                return 2;
+            }
+            nrelays++;
+        }
+        for (i = 0; i < nrelays; i++) {
+            char msg[128];
+
+            relays[i].r = nc_udp_relay_create(relays[i].port, NULL, relays[i].local, msg, sizeof(msg));
+            if (!relays[i].r) {
+                fprintf(stderr, "%s\n", msg);
+                return 2;
+            }
+            printf("udp relay :%u -> 127.0.0.1:%u\n", (unsigned)relays[i].port, (unsigned)relays[i].local);
+        }
+        if (pc.socks_port || pc.forward_count) {
+            pc.socks_user = c.socks_user;
+            pc.socks_password = c.socks_password;
+            px = nc_proxy_create(&pc, on_proxy_log, NULL);
+            memset(c.socks_password, 0, sizeof(c.socks_password));
+            if (!px) {
+                fprintf(stderr, "cannot start the local proxy\n");
+                return 2;
+            }
+            if (pc.socks_port)
+                printf("socks5 on %s:%u%s\n", pc.listen_addr ? pc.listen_addr : "127.0.0.1",
+                       (unsigned)pc.socks_port, c.socks_user[0] ? " (user/password)" : "");
+            for (i = 0; i < pc.forward_count; i++) {
+                char ip[16];
+                nc_ip4_format(pc.forwards[i].ip, ip, sizeof(ip));
+                printf("forward %s:%u -> %s:%u\n", pc.listen_addr ? pc.listen_addr : "127.0.0.1",
+                       (unsigned)pc.forwards[i].local_port, ip, (unsigned)pc.forwards[i].port);
+            }
+            src = nc_proxy_source(px);
+            nc_loop_add(&loop, &src);
+        }
+    }
+#endif
+
+    t_start = nc_now_ms();
+    vt_start(vt);
+    nc_loop_run(&loop, seconds > 0 ? t_start + (uint64_t)(seconds * 1000) : 0);
+
+    rc = vt_is_up(vt) ? 0 : 1;
+#if VTESSE_WITH_LWIP
+    if (px) {
+        nc_proxy_stats_t ps;
+        nc_proxy_get_stats(px, &ps);
+        printf("[%8.3f] proxy: accepted %lu, connected %lu, failed %lu, rejected %lu, up %llu B, down %llu B\n",
+               elapsed(t_start), ps.accepted, ps.connected, ps.failed, ps.rejected, ps.bytes_up, ps.bytes_down);
+        nc_proxy_destroy(px);
+    }
+    if (fetch.wanted && (!fetch.done || strncmp(fetch.status, "HTTP/", 5) != 0))
+        rc = 1;
+    for (i = 0; i < nrelays; i++) {
+        nc_udp_relay_stats_t us;
+
+        nc_udp_relay_get_stats(relays[i].r, &us);
+        printf("[%8.3f] udp relay :%u: datagrams %lu, %llu B, dropped %lu\n", elapsed(t_start),
+               (unsigned)relays[i].port, us.datagrams, us.bytes, us.dropped);
+        nc_udp_relay_destroy(relays[i].r);
+    }
+#endif
+#if VTESSE_WITH_TAP
+    if (tap) {
+        nc_tap_stats_t ts;
+        nc_tap_get_stats(tap, &ts);
+        printf("[%8.3f] interface %s: frames in %lu, out %lu, dropped %lu\n", elapsed(t_start),
+               nc_tap_ifname(tap), ts.frames_in, ts.frames_out, ts.dropped);
+        if (nc_tap_link(tap) == TUNNEL_LINK_NONE && vt_is_up(vt))
+            rc = 1;     /* interface creation failed */
+        run_hook("stop");
+        nc_tap_destroy(tap);
+        reap_children();
+    }
+#endif
+    t.ops->close(vt);
+    vt_destroy(vt);
+    return rc;
+}
diff --git a/include/netcore/loop.h b/include/netcore/loop.h
new file mode 100644
index 0000000..5eccf25
--- /dev/null
+++ b/include/netcore/loop.h
@@ -0,0 +1,53 @@
+/*
+ * Minimal poll()-based loop helper.
+ *
+ * Libraries never call this themselves; it exists for the CLI and tests.
+ * Hosts with their own loop drive the same callbacks directly.
+ */
+#ifndef NETCORE_LOOP_H
+#define NETCORE_LOOP_H
+
+#include <poll.h>
+#include <stdint.h>
+
+#include "netcore/tunnel.h"
+
+#define NC_LOOP_MAX_SOURCES 16
+#define NC_LOOP_MAX_FDS     512
+
+typedef struct nc_source {
+    int  (*get_fd)(void *ctx);          /* -1: no fd (timer-only source) */
+    int  (*wants_write)(void *ctx);     /* may be NULL */
+    void (*on_readable)(void *ctx);     /* may be NULL */
+    void (*on_writable)(void *ctx);     /* may be NULL */
+    int  (*next_timeout_ms)(void *ctx); /* may be NULL; 0 = due, -1 = none */
+    void (*on_timer)(void *ctx);        /* may be NULL */
+    /* Multi-fd sources (e.g. the proxy) set these instead of get_fd:
+     * poll_fill() writes up to max entries and returns how many;
+     * poll_dispatch() receives the same entries with revents filled in. */
+    int  (*poll_fill)(void *ctx, struct pollfd *pfd, int max);
+    void (*poll_dispatch)(void *ctx, const struct pollfd *pfd, int n);
+    void *ctx;
+} nc_source_t;
+
+typedef struct nc_loop {
+    nc_source_t src[NC_LOOP_MAX_SOURCES];
+    int count;
+    volatile int stop;
+} nc_loop_t;
+
+/* Monotonic milliseconds. */
+uint64_t nc_now_ms(void);
+
+void nc_loop_init(nc_loop_t *loop);
+int  nc_loop_add(nc_loop_t *loop, const nc_source_t *src);
+nc_source_t nc_source_from_tunnel(const tunnel_t *t);
+
+/* One poll() round, waiting at most max_wait_ms (-1 = until an fd or timer fires).
+ * Returns the poll() result (< 0 on error other than EINTR). */
+int  nc_loop_run_once(nc_loop_t *loop, int max_wait_ms);
+
+/* Run until loop->stop is set or until deadline_ms (monotonic, 0 = no deadline). */
+void nc_loop_run(nc_loop_t *loop, uint64_t deadline_ms);
+
+#endif
diff --git a/include/netcore/proxy.h b/include/netcore/proxy.h
new file mode 100644
index 0000000..cbdcc7d
--- /dev/null
+++ b/include/netcore/proxy.h
@@ -0,0 +1,50 @@
+/*
+ * Local proxy: SOCKS5 (CONNECT) and static TCP port forwards from host
+ * sockets to destinations behind the tunnel, through the lwIP stack.
+ *
+ * Outbound TCP only, IPv4 only. Flow control is end to end: data is read from
+ * a local socket only when lwIP has send buffer space, and data received from
+ * lwIP is acknowledged (window reopened) only after it was written locally.
+ */
+#ifndef NETCORE_PROXY_H
+#define NETCORE_PROXY_H
+
+#include <stdint.h>
+
+#include "netcore/loop.h"
+
+#define NC_PROXY_MAX_FORWARDS 16
+
+typedef struct nc_forward {
+    uint16_t local_port;
+    uint32_t ip;                /* host byte order */
+    uint16_t port;
+} nc_forward_t;
+
+typedef struct nc_proxy_cfg {
+    const char *listen_addr;    /* default "127.0.0.1" */
+    uint16_t socks_port;        /* 0 = no SOCKS5 server */
+    const char *socks_user;     /* optional RFC 1929 credentials (both or none) */
+    const char *socks_password;
+    nc_forward_t forwards[NC_PROXY_MAX_FORWARDS];
+    int forward_count;
+    int max_conns;              /* default 24 (bounded by lwIP TCP PCBs) */
+    int connect_timeout_ms;     /* default 15000 */
+} nc_proxy_cfg_t;
+
+typedef struct nc_proxy_stats {
+    unsigned long accepted, rejected, connected, failed, active;
+    unsigned long long bytes_up, bytes_down;
+} nc_proxy_stats_t;
+
+typedef struct nc_proxy nc_proxy_t;
+
+typedef void (*nc_proxy_log_cb)(void *user, const char *msg);
+
+/* Opens the listening sockets. NULL on error (errno-style message via log). */
+nc_proxy_t *nc_proxy_create(const nc_proxy_cfg_t *cfg, nc_proxy_log_cb log, void *user);
+void        nc_proxy_destroy(nc_proxy_t *px);
+nc_source_t nc_proxy_source(nc_proxy_t *px);
+void        nc_proxy_get_stats(const nc_proxy_t *px, nc_proxy_stats_t *st);
+
+#endif
diff --git a/include/netcore/route.h b/include/netcore/route.h
new file mode 100644
index 0000000..99bd756
--- /dev/null
+++ b/include/netcore/route.h
@@ -0,0 +1,50 @@
+/*
+ * Route table for the tunnel: classless static routes from DHCP option 121
+ * (RFC 3442) or 249, plus helpers for the device ID / MAC format.
+ * Addresses are IPv4 in host byte order.
+ */
+#ifndef NETCORE_ROUTE_H
+#define NETCORE_ROUTE_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define NC_ROUTES_MAX 32
+
+typedef struct nc_route {
+    uint32_t net;       /* network, masked */
+    uint32_t mask;
+    uint32_t gw;        /* 0 = on-link */
+    uint8_t  prefix;
+} nc_route_t;
+
+typedef struct nc_routes {
+    nc_route_t r[NC_ROUTES_MAX];
+    int count;
+} nc_routes_t;
+
+/* Parse an option 121/249 payload. Returns 0, or -1 if malformed (the whole
+ * option must then be ignored, RFC 3442). */
+int nc_routes_parse_classless(const uint8_t *opt, size_t len, nc_routes_t *out);
+
+/* Add a route (net is masked). -1 if the table is full or prefix > 32. */
+int nc_routes_add(nc_routes_t *rt, uint32_t net, uint8_t prefix, uint32_t gw);
+
+/* Longest-prefix match, NULL if no route. */
+const nc_route_t *nc_routes_lookup(const nc_routes_t *rt, uint32_t dst);
+
+/* "a.b.c.d/p via g" */
+void nc_route_format(const nc_route_t *r, char *out, size_t size);
+void nc_ip4_format(uint32_t ip, char *out, size_t size);
+
+/* Device ID: 12 characters 0-9A-F (upper case), no separators; the first
+ * byte must not have the multicast bit set. Fills mac. 0 on success. */
+int nc_devid_to_mac(const char *id, uint8_t mac[6]);
+
+/* Device ID from a MAC in the form "aa:bb:cc:dd:ee:ff" (as in
+ * /sys/class/net/<if>/address; either case, trailing newline allowed).
+ * Writes 12 upper case characters and a NUL to id. -1 for a malformed,
+ * multicast or all-zero MAC. */
+int nc_devid_from_mac_str(const char *mac, char id[13]);
+
+#endif
diff --git a/include/netcore/stack.h b/include/netcore/stack.h
new file mode 100644
index 0000000..a189e49
--- /dev/null
+++ b/include/netcore/stack.h
@@ -0,0 +1,54 @@
+/*
+ * Userspace IPv4 stack (lwIP) on top of a tunnel.
+ *
+ * lwIP keeps global state, so there is exactly one stack per process.
+ * The stack takes over the tunnel's rx and event callbacks and forwards
+ * tunnel events to its own callback.
+ */
+#ifndef NETCORE_STACK_H
+#define NETCORE_STACK_H
+
+#include <stdint.h>
+
+#include "netcore/loop.h"
+#include "netcore/route.h"
+#include "netcore/tunnel.h"
+
+enum nc_stack_event {
+    NC_STACK_EV_TUNNEL = 1,     /* tunnel event; see tunnel_event / err */
+    NC_STACK_EV_ADDR_BOUND,     /* address (and routes) configured */
+    NC_STACK_EV_ADDR_LOST
+};
+
+typedef void (*nc_stack_event_cb)(void *user, int event, int tunnel_event, int err);
+
+typedef struct nc_stack_cfg {
+    uint8_t mac[6];             /* own MAC for L2 links (from the device ID) */
+    int static_ip;              /* 1: use addr/mask/gw/routes below instead of DHCP */
+    uint32_t addr, mask, gw;    /* host byte order */
+    nc_routes_t routes;         /* static routes (static_ip only); none: default route via gw */
+    int opt3_default_route;     /* debug: keep option 3 as default route even with 121 */
+} nc_stack_cfg_t;
+
+typedef struct nc_stack_info {
+    int bound;
+    uint32_t addr, mask, gw;    /* gw: option 3 (informational when routes come from 121) */
+    int default_route;          /* a default route via the tunnel is in effect */
+    nc_routes_t routes;         /* classless routes in effect */
+} nc_stack_info_t;
+
+/* Initialise lwIP and attach it to the tunnel. Call once. */
+int  nc_stack_init(const tunnel_t *t, const nc_stack_cfg_t *cfg, nc_stack_event_cb cb, void *user);
+
+/* lwIP timers as a loop source. */
+nc_source_t nc_stack_timer_source(void);
+
+/* Is dst (host order) reachable through the tunnel? */
+int  nc_stack_route_ok(uint32_t dst);
+
+void nc_stack_get_info(nc_stack_info_t *info);
+
+/* Opaque access for protocol code built on lwIP (proxy, tests). */
+struct netif *nc_stack_netif(void);
+
+#endif
diff --git a/include/netcore/tapdev.h b/include/netcore/tapdev.h
new file mode 100644
index 0000000..a5194c7
--- /dev/null
+++ b/include/netcore/tapdev.h
@@ -0,0 +1,50 @@
+/*
+ * TAP/TUN backend (Linux): passes tunnel frames to a kernel interface
+ * created through /dev/net/tun instead of the userspace stack.
+ *
+ * The kernel owns addressing and routing; every program on the device uses
+ * the tunnel, inbound connections included. The interface is created on the
+ * first tunnel UP (TAP for L2 sessions, TUN for L3) and kept across reconnects;
+ * while the tunnel is down the carrier is off, which also makes the kernel
+ * forget its ARP neighbours (the remote bridge MAC may change).
+ *
+ * Requires root or CAP_NET_ADMIN and the tun driver. Not for Android.
+ */
+#ifndef NETCORE_TAPDEV_H
+#define NETCORE_TAPDEV_H
+
+#include <stdint.h>
+
+#include "netcore/loop.h"
+#include "netcore/tunnel.h"
+
+enum nc_tap_event {
+    NC_TAP_EV_TUNNEL = 1,   /* tunnel event; see tunnel_event / err */
+    NC_TAP_EV_CREATED,      /* interface created and up (first tunnel UP) */
+    NC_TAP_EV_RECONNECTED,  /* tunnel up again, same interface */
+    NC_TAP_EV_ERROR         /* interface could not be created; err = errno */
+};
+
+typedef void (*nc_tap_event_cb)(void *user, int event, int tunnel_event, int err);
+
+typedef struct nc_tap_cfg {
+    uint8_t mac[6];         /* TAP MAC (from the device ID) */
+    const char *ifname;     /* requested name, default "vtesse%d" */
+    int mtu;                /* default 1500 */
+} nc_tap_cfg_t;
+
+typedef struct nc_tap_stats {
+    unsigned long frames_in, frames_out, dropped;
+} nc_tap_stats_t;
+
+typedef struct nc_tap nc_tap_t;
+
+/* Attaches to the tunnel (takes over its rx and event callbacks). */
+nc_tap_t   *nc_tap_create(const tunnel_t *t, const nc_tap_cfg_t *cfg, nc_tap_event_cb cb, void *user);
+void        nc_tap_destroy(nc_tap_t *tap);
+nc_source_t nc_tap_source(nc_tap_t *tap);
+const char *nc_tap_ifname(const nc_tap_t *tap);    /* "" before creation */
+int         nc_tap_link(const nc_tap_t *tap);      /* enum tunnel_link of the interface */
+void        nc_tap_get_stats(const nc_tap_t *tap, nc_tap_stats_t *st);
+
+#endif
diff --git a/include/netcore/tunnel.h b/include/netcore/tunnel.h
new file mode 100644
index 0000000..99dc296
--- /dev/null
+++ b/include/netcore/tunnel.h
@@ -0,0 +1,80 @@
+/*
+ * Protocol-agnostic tunnel interface.
+ *
+ * Everything above the transport (userspace stack, proxy, JNI) talks to a
+ * tunnel only through tunnel_ops_t, so the same layers can serve VTun or
+ * another tunnel protocol. A tunnel never blocks and never owns a loop: the
+ * host drives it through its file descriptor, readiness handlers and timers.
+ */
+#ifndef NETCORE_TUNNEL_H
+#define NETCORE_TUNNEL_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+enum tunnel_link {
+    TUNNEL_LINK_NONE = 0,   /* not established yet */
+    TUNNEL_LINK_L2 = 1,     /* Ethernet frames */
+    TUNNEL_LINK_L3 = 2      /* raw IPv4 packets */
+};
+
+enum tunnel_event {
+    TUNNEL_EV_CONNECTING = 1,   /* a connection attempt has started */
+    TUNNEL_EV_UP,               /* link established, packets may flow */
+    TUNNEL_EV_DOWN,             /* link lost; the tunnel will retry by itself */
+    TUNNEL_EV_FAILED            /* stopped for good (configuration or server policy) */
+};
+
+enum tunnel_err {
+    TUNNEL_OK = 0,
+    TUNNEL_ERR_CONFIG,
+    TUNNEL_ERR_NOMEM,
+    TUNNEL_ERR_RESOLVE,
+    TUNNEL_ERR_CONNECT,
+    TUNNEL_ERR_TIMEOUT,
+    TUNNEL_ERR_IO,
+    TUNNEL_ERR_PEER_CLOSED,
+    TUNNEL_ERR_KEEPALIVE,
+    TUNNEL_ERR_PROTOCOL,
+    TUNNEL_ERR_AUTH,
+    TUNNEL_ERR_UNSUPPORTED_TYPE,
+    TUNNEL_ERR_UNSUPPORTED_TRANSPORT,
+    TUNNEL_ERR_COMPRESSION,
+    TUNNEL_ERR_ENCRYPTION,
+    TUNNEL_ERR_CLOSED,           /* closed locally */
+    TUNNEL_ERR_NETWORK           /* local network changed: reconnecting at once */
+};
+
+const char *tunnel_strerror(int err);
+const char *tunnel_event_name(int event);
+
+typedef void (*tunnel_rx_cb)(void *user, const uint8_t *pkt, size_t len);
+typedef void (*tunnel_event_cb)(void *user, int event, int err);
+
+typedef struct tunnel_ops {
+    /* Socket to poll, or -1 when there is none (e.g. waiting to reconnect).
+     * May change between calls: re-query on every loop iteration. */
+    int  (*get_fd)(void *ctx);
+    /* Non-zero when POLLOUT is needed (connect in progress, pending output). */
+    int  (*wants_write)(void *ctx);
+    void (*on_readable)(void *ctx);
+    void (*on_writable)(void *ctx);
+    /* Milliseconds until on_timer must run: 0 = due now, -1 = no timer. */
+    int  (*next_timeout_ms)(void *ctx);
+    void (*on_timer)(void *ctx);
+    void (*set_rx_cb)(void *ctx, tunnel_rx_cb cb, void *user);
+    void (*set_event_cb)(void *ctx, tunnel_event_cb cb, void *user);
+    /* Queue one whole packet. Returns 0 if accepted, -1 if dropped
+     * (link not up, too large, or output buffer full). Never splits. */
+    int  (*send)(void *ctx, const uint8_t *pkt, size_t len);
+    int  (*link_type)(void *ctx);    /* enum tunnel_link */
+    int  (*mtu)(void *ctx);          /* payload MTU of the link layer */
+    void (*close)(void *ctx);        /* stop; no further events except none */
+} tunnel_ops_t;
+
+typedef struct tunnel {
+    const tunnel_ops_t *ops;
+    void *ctx;
+} tunnel_t;
+
+#endif
diff --git a/include/netcore/udprelay.h b/include/netcore/udprelay.h
new file mode 100644
index 0000000..30a4920
--- /dev/null
+++ b/include/netcore/udprelay.h
@@ -0,0 +1,41 @@
+/*
+ * UDP relay (#28): receive UDP datagrams addressed to the client's tunnel
+ * address (lwIP stack) on a port and send each one, unchanged, to a host
+ * address (by default 127.0.0.1) on the device.
+ *
+ * Use: a camera pushes RTP over UDP (OpenIPC Majestic "outgoing") to
+ * udp://<tunnel address>:PORT; a local player listens on 127.0.0.1:LOCAL_PORT
+ * (OpenIPC Decoder: udp://@:LOCAL_PORT). One direction only: nothing is sent
+ * back to the camera.
+ *
+ * Inside the TCP tunnel the datagrams arrive reliably and in order; a datagram
+ * is dropped only if the local socket's buffer is full (the reader is slow).
+ */
+#ifndef NETCORE_UDPRELAY_H
+#define NETCORE_UDPRELAY_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define NC_UDP_RELAY_MAX 3          /* lwIP UDP PCBs left besides DHCP */
+
+typedef struct nc_udp_relay_stats {
+    unsigned long datagrams;        /* relayed */
+    unsigned long dropped;          /* local send failed */
+    unsigned long long bytes;
+} nc_udp_relay_stats_t;
+
+typedef struct nc_udp_relay nc_udp_relay_t;
+
+/* Listen on UDP port `port` of the stack (call after nc_stack_init) and relay to
+ * dst_addr:dst_port (dst_addr NULL = "127.0.0.1", dst_port 0 = port).
+ * NULL on error, with a message in err. */
+nc_udp_relay_t *nc_udp_relay_create(uint16_t port, const char *dst_addr, uint16_t dst_port,
+                                    char *err, size_t err_size);
+void nc_udp_relay_destroy(nc_udp_relay_t *r);
+void nc_udp_relay_get_stats(const nc_udp_relay_t *r, nc_udp_relay_stats_t *st);
+
+/* "PORT" or "PORT:LOCAL_PORT" -> 0 on success. */
+int nc_udp_relay_parse(const char *s, uint16_t *port, uint16_t *local_port);
+
+#endif
diff --git a/include/vtesse/version.h b/include/vtesse/version.h
new file mode 100644
index 0000000..bf444d1
--- /dev/null
+++ b/include/vtesse/version.h
@@ -0,0 +1,8 @@
+#ifndef VTESSE_VERSION_H
+#define VTESSE_VERSION_H
+
+/* MAJOR.MM. Shown by --version and in the title of the "latest" release (CI);
+ * record each bump in CHANGELOG.md. */
+#define VTESSE_VERSION "1.11"
+
+#endif
diff --git a/include/vtesse/vtun_client.h b/include/vtesse/vtun_client.h
new file mode 100644
index 0000000..7487592
--- /dev/null
+++ b/include/vtesse/vtun_client.h
@@ -0,0 +1,61 @@
+/*
+ * VTun client (TCP transport, type tun / ether, no compression/encryption).
+ *
+ * Non-blocking, single-threaded, no global state. Exposes tunnel_ops_t.
+ * Name resolution uses getaddrinfo() and may block briefly at connect time.
+ */
+#ifndef VTESSE_VTUN_CLIENT_H
+#define VTESSE_VTUN_CLIENT_H
+
+#include <stdint.h>
+
+#include "netcore/tunnel.h"
+#include "vtesse/vtun_proto.h"
+
+enum vt_auth {
+    VT_AUTH_XOR = 0        /* servers built without OpenSSL */
+};
+
+typedef struct vt_cfg {
+    const char *host;
+    uint16_t    port;
+    const char *session;
+    const char *password;
+    int         auth;                   /* enum vt_auth */
+
+    /* Optional tuning; 0 selects the default. */
+    int handshake_timeout_ms;           /* per step, default 15000 (CHAL step >= 10000) */
+    int ka_interval_ms;                 /* own ECHO_REQ period, default 10000 */
+    int ka_count;                       /* dead after ka_count * interval silence, default 5 */
+    int data_delay_ms;                  /* OK FLAGS -> TUNNEL_EV_UP delay, default 500 */
+    int reconnect_min_ms;               /* default 1000 */
+    int reconnect_max_ms;               /* default 30000 */
+    int out_buffer_size;                /* default 65536 */
+    int no_reconnect;                   /* 1: report FAILED instead of retrying */
+} vt_cfg_t;
+
+typedef struct vt vt_t;
+
+/* Copies the configuration. Returns NULL and sets *err on invalid config / OOM. */
+vt_t *vt_create(const vt_cfg_t *cfg, int *err);
+void  vt_destroy(vt_t *vt);
+
+/* Start connecting (first attempt happens immediately). */
+int   vt_start(vt_t *vt);
+
+/* Tunnel interface. */
+const tunnel_ops_t *vt_tunnel_ops(void);
+tunnel_t vt_tunnel(vt_t *vt);
+
+/* The host's network changed (e.g. Wi-Fi <-> mobile on Android): the current
+ * connection is bound to the old network, so drop it (TUNNEL_EV_DOWN with
+ * TUNNEL_ERR_NETWORK) and reconnect at once with the back-off reset; a pending
+ * retry is brought forward. No effect on a stopped tunnel. */
+void  vt_network_changed(vt_t *vt);
+
+/* Diagnostics. */
+const char       *vt_greeting(const vt_t *vt);     /* last server greeting, "" if none */
+const vt_flags_t *vt_session_flags(const vt_t *vt); /* flags of the last session */
+int               vt_is_up(const vt_t *vt);
+
+#endif
diff --git a/include/vtesse/vtun_proto.h b/include/vtesse/vtun_proto.h
new file mode 100644
index 0000000..f7db928
--- /dev/null
+++ b/include/vtesse/vtun_proto.h
@@ -0,0 +1,73 @@
+/*
+ * VTun wire format helpers (verified against VTun 3.0.2).
+ * Pure functions, no I/O, explicit byte order.
+ */
+#ifndef VTESSE_VTUN_PROTO_H
+#define VTESSE_VTUN_PROTO_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define VT_MESG_SIZE        50      /* every control message, NUL padded */
+#define VT_CHAL_SIZE        16
+#define VT_CHAL_TEXT_SIZE   (VT_CHAL_SIZE * 2 + 3)  /* "<" + 32 + ">" + NUL */
+#define VT_FRAME_SIZE       2048    /* max payload we send */
+#define VT_FRAME_OVERHEAD   100     /* receivers accept up to SIZE + OVERHEAD */
+#define VT_FRAME_MAX_RX     (VT_FRAME_SIZE + VT_FRAME_OVERHEAD)
+#define VT_FSIZE_MASK       0x0fff
+#define VT_FLAGS_MASK       0xf000
+#define VT_CONN_CLOSE       0x1000
+#define VT_ECHO_REQ         0x2000
+#define VT_ECHO_REP         0x4000
+#define VT_BAD_FRAME        0x8000  /* never on the wire in 3.0.2 */
+#define VT_SESSION_MAX      42      /* "HOST: " + name + "\n" must fit 49 bytes */
+
+/* Session names: 1..42 printable characters, no space, ':', control chars. */
+int vt_session_name_valid(const char *name);
+
+/* Build "<prefix><arg>\n" padded with NUL to 50 bytes. -1 if longer than 49. */
+int vt_mesg_build(uint8_t out[VT_MESG_SIZE], const char *prefix, const char *arg);
+
+/* Challenge text "<" + 32 chars 'a'..'p' + ">" <-> 16 bytes. */
+void vt_chal_encode(const uint8_t chal[VT_CHAL_SIZE], char out[VT_CHAL_TEXT_SIZE]);
+/* Finds '<' in msg; requires exactly 32 chars 'a'..'p' followed by '>'. 0 on success. */
+int  vt_chal_decode(const char *msg, uint8_t chal[VT_CHAL_SIZE]);
+
+/* XOR challenge response (servers built without OpenSSL). pwd must be non-empty. */
+void vt_chal_xor(uint8_t chal[VT_CHAL_SIZE], const char *pwd);
+
+typedef struct vt_flags {
+    char transport;     /* 'T' or 'U', 0 if absent */
+    char type;          /* 'u' tun, 'e' ether, 't' tty, 'p' pipe, 0 if absent */
+    int  keepalive;
+    int  shaper;        /* S<n>, 0 if absent */
+    int  zlib;          /* C<n> present */
+    int  lzo;           /* L<n> present */
+    int  zlevel;
+    int  encrypt;       /* E or E<n> present */
+    int  cipher;        /* 0 = legacy */
+} vt_flags_t;
+
+/* Parse "OK FLAGS: <...>". Same grammar as VTun cf2bf: unknown characters,
+ * a missing number after C/L/S or a missing '>' are errors. 0 on success. */
+int vt_flags_parse(const char *msg, vt_flags_t *f);
+
+/* Policy check: TCP, type tun or ether, no compression, no encryption.
+ * Returns TUNNEL_OK or a TUNNEL_ERR_* code. */
+int vt_flags_check(const vt_flags_t *f);
+
+/* Format flags back as "<...>" in VTun server order (for logs/tests). */
+void vt_flags_format(const vt_flags_t *f, char *out, size_t size);
+
+static inline void vt_hdr_put(uint8_t b[2], uint16_t v)
+{
+    b[0] = (uint8_t)(v >> 8);
+    b[1] = (uint8_t)v;
+}
+
+static inline uint16_t vt_hdr_get(const uint8_t b[2])
+{
+    return (uint16_t)((b[0] << 8) | b[1]);
+}
+
+#endif
diff --git a/netcore/loop.c b/netcore/loop.c
new file mode 100644
index 0000000..e758b13
--- /dev/null
+++ b/netcore/loop.c
@@ -0,0 +1,133 @@
+#include "netcore/loop.h"
+
+#include <errno.h>
+#include <string.h>
+#include <time.h>
+
+uint64_t nc_now_ms(void)
+{
+    struct timespec ts;
+
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (uint64_t)ts.tv_sec * 1000u + (uint64_t)(ts.tv_nsec / 1000000);
+}
+
+void nc_loop_init(nc_loop_t *loop)
+{
+    memset(loop, 0, sizeof(*loop));
+}
+
+int nc_loop_add(nc_loop_t *loop, const nc_source_t *src)
+{
+    if (loop->count >= NC_LOOP_MAX_SOURCES)
+        return -1;
+    loop->src[loop->count++] = *src;
+    return 0;
+}
+
+nc_source_t nc_source_from_tunnel(const tunnel_t *t)
+{
+    nc_source_t s;
+
+    s.get_fd = t->ops->get_fd;
+    s.wants_write = t->ops->wants_write;
+    s.on_readable = t->ops->on_readable;
+    s.on_writable = t->ops->on_writable;
+    s.next_timeout_ms = t->ops->next_timeout_ms;
+    s.on_timer = t->ops->on_timer;
+    s.poll_fill = NULL;
+    s.poll_dispatch = NULL;
+    s.ctx = t->ctx;
+    return s;
+}
+
+int nc_loop_run_once(nc_loop_t *loop, int max_wait_ms)
+{
+    struct pollfd pfd[NC_LOOP_MAX_FDS];
+    int first[NC_LOOP_MAX_SOURCES], count[NC_LOOP_MAX_SOURCES];
+    int nfds = 0, timeout = max_wait_ms, i, j, rc;
+
+    for (i = 0; i < loop->count; i++) {
+        nc_source_t *s = &loop->src[i];
+        int fd;
+
+        first[i] = nfds;
+        count[i] = 0;
+        if (s->next_timeout_ms) {
+            int t = s->next_timeout_ms(s->ctx);
+            if (t >= 0 && (timeout < 0 || t < timeout))
+                timeout = t;
+        }
+        if (s->poll_fill) {
+            count[i] = s->poll_fill(s->ctx, pfd + nfds, NC_LOOP_MAX_FDS - nfds);
+            for (j = 0; j < count[i]; j++)
+                pfd[nfds + j].revents = 0;
+            nfds += count[i];
+            continue;
+        }
+        fd = s->get_fd ? s->get_fd(s->ctx) : -1;
+        if (fd < 0 || nfds >= NC_LOOP_MAX_FDS)
+            continue;
+        pfd[nfds].fd = fd;
+        pfd[nfds].events = POLLIN;
+        if (s->wants_write && s->wants_write(s->ctx))
+            pfd[nfds].events |= POLLOUT;
+        pfd[nfds].revents = 0;
+        count[i] = 1;
+        nfds++;
+    }
+
+    rc = poll(pfd, (nfds_t)nfds, timeout);
+    if (rc < 0 && errno == EINTR)
+        rc = 0;
+    if (rc < 0)
+        return rc;
+
+    for (i = 0; i < loop->count; i++) {
+        nc_source_t *s = &loop->src[i];
+        struct pollfd *p = &pfd[first[i]];
+        short re;
+
+        if (!count[i])
+            continue;
+        if (s->poll_fill) {
+            if (s->poll_dispatch)
+                s->poll_dispatch(s->ctx, p, count[i]);
+            continue;
+        }
+        re = p->revents;
+        /* The fd may have changed inside an earlier handler of the same source. */
+        if (!re || !s->get_fd || s->get_fd(s->ctx) != p->fd)
+            continue;
+        if ((re & (POLLOUT | POLLERR | POLLHUP)) && s->on_writable &&
+            s->wants_write && s->wants_write(s->ctx))
+            s->on_writable(s->ctx);
+        if (s->get_fd(s->ctx) != p->fd)
+            continue;
+        if ((re & (POLLIN | POLLERR | POLLHUP)) && s->on_readable)
+            s->on_readable(s->ctx);
+    }
+
+    for (i = 0; i < loop->count; i++) {
+        nc_source_t *s = &loop->src[i];
+        if (s->next_timeout_ms && s->on_timer && s->next_timeout_ms(s->ctx) == 0)
+            s->on_timer(s->ctx);
+    }
+    return rc;
+}
+
+void nc_loop_run(nc_loop_t *loop, uint64_t deadline_ms)
+{
+    while (!loop->stop) {
+        int wait = -1;
+
+        if (deadline_ms) {
+            uint64_t now = nc_now_ms();
+            if (now >= deadline_ms)
+                break;
+            wait = (int)(deadline_ms - now);
+        }
+        if (nc_loop_run_once(loop, wait) < 0)
+            break;
+    }
+}
diff --git a/netcore/proxy.c b/netcore/proxy.c
new file mode 100644
index 0000000..b9c5cab
--- /dev/null
+++ b/netcore/proxy.c
@@ -0,0 +1,778 @@
+#include "netcore/proxy.h"
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "lwip/tcp.h"
+#include "netcore/route.h"
+#include "netcore/stack.h"
+
+#ifndef NC_WITH_SOCKS
+#define NC_WITH_SOCKS 1     /* make SOCKS=0 leaves out the SOCKS5 server */
+#endif
+
+#ifndef MSG_NOSIGNAL
+#define MSG_NOSIGNAL 0
+#endif
+
+#define DEF_MAX_CONNS       24
+#define DEF_CONNECT_MS      15000
+#define HS_MAX              600     /* SOCKS handshake + early data */
+#define TX_MAX              8192    /* local -> lwIP staging */
+#define READ_BUDGET         65536   /* per dispatch and connection */
+#define LISTEN_MAX          (1 + NC_PROXY_MAX_FORWARDS)
+
+/* SOCKS5 reply codes (RFC 1928) */
+#define REP_OK              0x00
+#define REP_FAILURE         0x01
+#define REP_NET_UNREACH     0x03
+#define REP_HOST_UNREACH    0x04
+#define REP_REFUSED         0x05
+#define REP_CMD_UNSUPP      0x07
+#define REP_ATYP_UNSUPP     0x08
+
+enum conn_state {
+    C_GREETING,
+    C_AUTH,
+    C_REQUEST,
+    C_CONNECTING,
+    C_RELAY
+};
+
+typedef struct conn {
+    nc_proxy_t *px;
+    int fd;
+    struct tcp_pcb *pcb;
+    int state;
+    int socks;                  /* SOCKS5 client: a reply is owed */
+    int replied;
+
+    uint8_t hs[HS_MAX];
+    size_t hs_len;
+
+    uint8_t tx[TX_MAX];         /* local -> remote, not yet accepted by lwIP */
+    size_t tx_off, tx_len;
+    struct pbuf *rx;            /* remote -> local, not yet written */
+
+    int local_eof, remote_eof, fin_sent, shut_wr;
+    int dead, abort;
+
+    uint64_t deadline;
+    uint32_t dst;
+    uint16_t dport;
+} conn_t;
+
+typedef struct slot {
+    int listener;               /* -1: connection, 0: SOCKS, 1..: forward index + 1 */
+    conn_t *conn;
+} slot_t;
+
+struct nc_proxy {
+    nc_proxy_cfg_t cfg;
+    char listen_addr[64];
+    char user[256], pass[256];
+    int auth;
+
+    int lfd[LISTEN_MAX];        /* [0] SOCKS, [1 + i] forward i; -1 if unused */
+
+    conn_t **conns;
+    int nconns;
+
+    slot_t slots[NC_LOOP_MAX_FDS];
+    nc_proxy_stats_t st;
+    nc_proxy_log_cb log;
+    void *log_user;
+};
+
+static void logf_(nc_proxy_t *px, const char *fmt, ...)
+{
+    char buf[256];
+    va_list ap;
+
+    if (!px->log)
+        return;
+    va_start(ap, fmt);
+    vsnprintf(buf, sizeof(buf), fmt, ap);
+    va_end(ap);
+    px->log(px->log_user, buf);
+}
+
+static void set_nonblock(int fd)
+{
+    fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
+    fcntl(fd, F_SETFD, FD_CLOEXEC);
+}
+
+static void dst_str(const conn_t *c, char *out, size_t size)
+{
+    char ip[16];
+
+    nc_ip4_format(c->dst, ip, sizeof(ip));
+    snprintf(out, size, "%s:%u", ip, (unsigned)c->dport);
+}
+
+/* ---- SOCKS replies ---- */
+
+static void socks_reply(conn_t *c, uint8_t rep)
+{
+    uint8_t r[10] = { 5, 0, 0, 1, 0, 0, 0, 0, 0, 0 };
+
+    if (!c->socks || c->replied)
+        return;
+    c->replied = 1;
+    r[1] = rep;
+    if (rep == REP_OK && c->pcb) {
+        uint32_t a = ip4_addr_get_u32(ip_2_ip4(&c->pcb->local_ip));    /* network order */
+        memcpy(r + 4, &a, 4);
+        r[8] = (uint8_t)(c->pcb->local_port >> 8);
+        r[9] = (uint8_t)c->pcb->local_port;
+    }
+    if (send(c->fd, r, sizeof(r), MSG_NOSIGNAL) != (ssize_t)sizeof(r) && rep == REP_OK)
+        c->dead = c->abort = 1;
+}
+
+static void fail_conn(conn_t *c, uint8_t rep, const char *why)
+{
+    char d[24];
+
+    dst_str(c, d, sizeof(d));
+    logf_(c->px, "%s %s: %s", c->socks ? "socks" : "forward", d, why);
+    socks_reply(c, rep);
+    c->px->st.failed++;
+    c->dead = 1;
+    c->abort = 1;
+}
+
+/* ---- data pumps ---- */
+
+static void pump_down(conn_t *c)
+{
+    while (c->rx) {
+        struct pbuf *q = c->rx;
+        ssize_t w = send(c->fd, q->payload, q->len, MSG_NOSIGNAL);
+
+        if (w < 0) {
+            if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)
+                return;
+            c->dead = c->abort = 1;
+            return;
+        }
+        c->px->st.bytes_down += (unsigned long long)w;
+        c->rx = pbuf_free_header(c->rx, (u16_t)w);
+        if (c->pcb)
+            tcp_recved(c->pcb, (u16_t)w);
+    }
+    if (c->remote_eof && !c->shut_wr) {
+        shutdown(c->fd, SHUT_WR);
+        c->shut_wr = 1;
+    }
+}
+
+static void flush_tx(conn_t *c)
+{
+    while (c->tx_len && c->pcb) {
+        size_t n = tcp_sndbuf(c->pcb);
+
+        if (n == 0)
+            break;
+        if (n > c->tx_len)
+            n = c->tx_len;
+        if (tcp_write(c->pcb, c->tx + c->tx_off, (u16_t)n, TCP_WRITE_FLAG_COPY) != ERR_OK)
+            break;                      /* out of segments: retry later */
+        c->tx_off += n;
+        c->tx_len -= n;
+        c->px->st.bytes_up += n;
+    }
+    if (!c->tx_len)
+        c->tx_off = 0;
+    if (c->pcb && c->local_eof && !c->tx_len && !c->fin_sent) {
+        tcp_shutdown(c->pcb, 0, 1);
+        c->fin_sent = 1;
+    }
+    if (c->pcb)
+        tcp_output(c->pcb);
+}
+
+static int can_read_local(const conn_t *c)
+{
+    return c->state == C_RELAY && c->pcb && !c->local_eof && !c->tx_len &&
+           tcp_sndbuf(c->pcb) > 0 && tcp_sndqueuelen(c->pcb) < TCP_SND_QUEUELEN - 4;
+}
+
+static void pump_up(conn_t *c)
+{
+    size_t budget = READ_BUDGET;
+
+    flush_tx(c);
+    while (budget && can_read_local(c)) {
+        size_t want = tcp_sndbuf(c->pcb);
+        ssize_t r;
+
+        if (want > TX_MAX)
+            want = TX_MAX;
+        r = recv(c->fd, c->tx, want, 0);
+        if (r == 0) {
+            c->local_eof = 1;
+        } else if (r < 0) {
+            if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)
+                c->dead = c->abort = 1;
+            break;
+        } else {
+            c->tx_off = 0;
+            c->tx_len = (size_t)r;
+            budget -= (size_t)r < budget ? (size_t)r : budget;
+        }
+        flush_tx(c);
+    }
+}
+
+/* ---- lwIP callbacks (never free the connection here) ---- */
+
+static err_t on_recv(void *arg, struct tcp_pcb *pcb, struct pbuf *p, err_t err)
+{
+    conn_t *c = arg;
+
+    (void)err;
+    if (!c) {
+        if (p) {
+            tcp_recved(pcb, p->tot_len);
+            pbuf_free(p);
+        }
+        return ERR_OK;
+    }
+    if (!p) {
+        c->remote_eof = 1;
+    } else if (c->dead) {
+        tcp_recved(pcb, p->tot_len);
+        pbuf_free(p);
+        return ERR_OK;
+    } else if (c->rx) {
+        pbuf_cat(c->rx, p);
+    } else {
+        c->rx = p;
+    }
+    pump_down(c);
+    return ERR_OK;
+}
+
+static void on_err(void *arg, err_t err)
+{
+    conn_t *c = arg;
+
+    if (!c)
+        return;
+    c->pcb = NULL;              /* already freed by lwIP */
+    if (c->state == C_CONNECTING)
+        fail_conn(c, err == ERR_RST ? REP_REFUSED : REP_HOST_UNREACH,
+                  err == ERR_RST ? "connection refused" :
+                  err == ERR_ABRT ? "connect timeout" : "host unreachable");
+    else
+        c->dead = c->abort = 1;
+}
+
+static err_t on_connected(void *arg, struct tcp_pcb *pcb, err_t err)
+{
+    conn_t *c = arg;
+
+    (void)pcb;
+    (void)err;
+    if (!c)
+        return ERR_OK;
+    c->state = C_RELAY;
+    c->deadline = 0;
+    c->px->st.connected++;
+    socks_reply(c, REP_OK);
+    flush_tx(c);                /* data the client sent before the reply */
+    return ERR_OK;
+}
+
+static void start_connect(conn_t *c)
+{
+    ip4_addr_t a;
+    struct tcp_pcb *pcb;
+
+    if (!nc_stack_route_ok(c->dst)) {
+        fail_conn(c, REP_NET_UNREACH, "no route via tunnel (or no address yet)");
+        return;
+    }
+    pcb = tcp_new();
+    if (!pcb) {
+        fail_conn(c, REP_FAILURE, "out of TCP PCBs");
+        return;
+    }
+    tcp_arg(pcb, c);
+    tcp_recv(pcb, on_recv);
+    tcp_err(pcb, on_err);
+    tcp_nagle_disable(pcb);
+    ip4_addr_set_u32(&a, lwip_htonl(c->dst));
+    c->pcb = pcb;
+    c->state = C_CONNECTING;
+    c->deadline = nc_now_ms() + (uint64_t)c->px->cfg.connect_timeout_ms;
+    if (tcp_connect(pcb, &a, c->dport, on_connected) != ERR_OK) {
+        c->pcb = NULL;
+        tcp_arg(pcb, NULL);
+        tcp_abort(pcb);
+        fail_conn(c, REP_FAILURE, "connect failed");
+    }
+}
+
+#if NC_WITH_SOCKS
+/* ---- SOCKS5 handshake ---- */
+
+static void consume(conn_t *c, size_t n)
+{
+    memmove(c->hs, c->hs + n, c->hs_len - n);
+    c->hs_len -= n;
+}
+
+static void socks_send(conn_t *c, const uint8_t *p, size_t n)
+{
+    if (send(c->fd, p, n, MSG_NOSIGNAL) != (ssize_t)n)
+        c->dead = c->abort = 1;
+}
+
+static int parse_ip4_text(const uint8_t *s, size_t len, uint32_t *out)
+{
+    char buf[16];
+    unsigned a, b, cc, d;
+    char tail;
+
+    if (len == 0 || len >= sizeof(buf))
+        return -1;
+    memcpy(buf, s, len);
+    buf[len] = '\0';
+    if (sscanf(buf, "%u.%u.%u.%u%c", &a, &b, &cc, &d, &tail) != 4 || a > 255 || b > 255 || cc > 255 || d > 255)
+        return -1;
+    *out = a << 24 | b << 16 | cc << 8 | d;
+    return 0;
+}
+
+static void socks_process(conn_t *c)
+{
+    nc_proxy_t *px = c->px;
+
+    while (!c->dead) {
+        uint8_t *h = c->hs;
+        size_t need;
+
+        if (c->state == C_GREETING) {
+            uint8_t rep[2] = { 5, 0xff };
+            size_t i;
+
+            if (c->hs_len < 2)
+                return;
+            if (h[0] != 5) {
+                c->dead = c->abort = 1;
+                return;
+            }
+            need = 2u + h[1];
+            if (c->hs_len < need)
+                return;
+            for (i = 2; i < need; i++)
+                if (h[i] == (px->auth ? 0x02 : 0x00))
+                    rep[1] = px->auth ? 0x02 : 0x00;
+            socks_send(c, rep, 2);
+            consume(c, need);
+            if (rep[1] == 0xff) {
+                logf_(px, "socks: no acceptable authentication method");
+                c->dead = 1;
+                return;
+            }
+            c->state = px->auth ? C_AUTH : C_REQUEST;
+        } else if (c->state == C_AUTH) {
+            uint8_t rep[2] = { 1, 1 };
+            size_t ul, pl;
+
+            if (c->hs_len < 2)
+                return;
+            ul = h[1];
+            if (c->hs_len < 3 + ul)
+                return;
+            pl = h[2 + ul];
+            need = 3 + ul + pl;
+            if (c->hs_len < need)
+                return;
+            if (h[0] == 1 && ul == strlen(px->user) && pl == strlen(px->pass) &&
+                memcmp(h + 2, px->user, ul) == 0 && memcmp(h + 3 + ul, px->pass, pl) == 0)
+                rep[1] = 0;
+            socks_send(c, rep, 2);
+            consume(c, need);
+            if (rep[1]) {
+                logf_(px, "socks: authentication failed");
+                c->dead = 1;
+                return;
+            }
+            c->state = C_REQUEST;
+        } else if (c->state == C_REQUEST) {
+            uint8_t atyp;
+
+            if (c->hs_len < 5)
+                return;
+            atyp = h[3];
+            need = atyp == 1 ? 10 : atyp == 3 ? 7u + h[4] : atyp == 4 ? 22 : 0;
+            if (!need || h[0] != 5) {
+                c->socks = 1;
+                fail_conn(c, REP_ATYP_UNSUPP, "unsupported address type");
+                return;
+            }
+            if (c->hs_len < need)
+                return;
+            c->dport = (uint16_t)(h[need - 2] << 8 | h[need - 1]);
+            if (h[1] != 1) {
+                fail_conn(c, REP_CMD_UNSUPP, "only CONNECT is supported");
+                return;
+            }
+            if (atyp == 1) {
+                c->dst = (uint32_t)h[4] << 24 | (uint32_t)h[5] << 16 | (uint32_t)h[6] << 8 | h[7];
+            } else if (atyp == 3 && parse_ip4_text(h + 5, h[4], &c->dst) == 0) {
+                /* domain field holding an IPv4 literal (socks5h clients) */
+            } else {
+                fail_conn(c, REP_ATYP_UNSUPP, atyp == 4 ? "IPv6 is not supported" :
+                                                          "host names are not supported (no DNS)");
+                return;
+            }
+            consume(c, need);
+            /* anything after the request is early application data */
+            memcpy(c->tx, c->hs, c->hs_len);
+            c->tx_off = 0;
+            c->tx_len = c->hs_len;
+            c->hs_len = 0;
+            start_connect(c);
+            return;
+        } else {
+            return;
+        }
+    }
+}
+
+static void read_handshake(conn_t *c)
+{
+    ssize_t r = recv(c->fd, c->hs + c->hs_len, sizeof(c->hs) - c->hs_len, 0);
+
+    if (r == 0 || (r < 0 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) {
+        c->dead = 1;
+        return;
+    }
+    if (r < 0)
+        return;
+    c->hs_len += (size_t)r;
+    socks_process(c);
+    if (!c->dead && c->state < C_CONNECTING && c->hs_len == sizeof(c->hs))
+        c->dead = c->abort = 1;     /* oversized handshake */
+}
+#else
+/* built without SOCKS5 (make SOCKS=0): no SOCKS listener is ever opened */
+static void read_handshake(conn_t *c)
+{
+    c->dead = c->abort = 1;
+}
+#endif
+
+/* ---- connection table ---- */
+
+static void destroy_conn(nc_proxy_t *px, int idx)
+{
+    conn_t *c = px->conns[idx];
+
+    if (c->pcb) {
+        tcp_arg(c->pcb, NULL);
+        tcp_recv(c->pcb, NULL);
+        tcp_err(c->pcb, NULL);
+        if (c->abort || tcp_close(c->pcb) != ERR_OK)
+            tcp_abort(c->pcb);
+    }
+    if (c->rx)
+        pbuf_free(c->rx);
+    if (c->fd >= 0)
+        close(c->fd);
+    free(c);
+    px->conns[idx] = px->conns[--px->nconns];
+    px->st.active--;
+}
+
+static void service(nc_proxy_t *px)
+{
+    int i;
+
+    for (i = 0; i < px->nconns; i++) {
+        conn_t *c = px->conns[i];
+
+        if (!c->dead && c->state == C_RELAY) {
+            if (!c->pcb)
+                c->dead = 1;
+            else if (c->tx_len || (c->local_eof && !c->fin_sent))
+                flush_tx(c);
+            if (c->rx)
+                pump_down(c);
+            if (c->local_eof && c->remote_eof && !c->rx && !c->tx_len && c->fin_sent)
+                c->dead = 1;        /* both directions finished */
+            else if (c->remote_eof && c->shut_wr && !c->pcb)
+                c->dead = 1;
+        }
+        if (c->dead) {
+            destroy_conn(px, i);
+            i--;
+        }
+    }
+}
+
+static void accept_on(nc_proxy_t *px, int which)
+{
+    for (;;) {
+        int fd = accept(px->lfd[which], NULL, NULL), one = 1;
+        conn_t *c;
+
+        if (fd < 0)
+            return;
+        set_nonblock(fd);
+        setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+        if (px->nconns >= px->cfg.max_conns || !(c = calloc(1, sizeof(*c)))) {
+            close(fd);
+            px->st.rejected++;
+            logf_(px, "connection limit reached (%d)", px->cfg.max_conns);
+            continue;
+        }
+        c->px = px;
+        c->fd = fd;
+        px->conns[px->nconns++] = c;
+        px->st.accepted++;
+        px->st.active++;
+        if (which == 0) {
+            c->socks = 1;
+            c->state = C_GREETING;
+        } else {
+            const nc_forward_t *f = &px->cfg.forwards[which - 1];
+            c->dst = f->ip;
+            c->dport = f->port;
+            start_connect(c);
+        }
+    }
+}
+
+/* ---- loop source ---- */
+
+static int px_fill(void *ctx, struct pollfd *pfd, int max)
+{
+    nc_proxy_t *px = ctx;
+    int n = 0, i;
+
+    service(px);
+    for (i = 0; i < LISTEN_MAX && n < max; i++) {
+        if (px->lfd[i] < 0)
+            continue;
+        pfd[n].fd = px->lfd[i];
+        pfd[n].events = POLLIN;
+        px->slots[n].listener = i;
+        px->slots[n].conn = NULL;
+        n++;
+    }
+    for (i = 0; i < px->nconns && n < max; i++) {
+        conn_t *c = px->conns[i];
+        short ev = 0;
+
+        if (c->state < C_CONNECTING)
+            ev = POLLIN;
+        else if (c->state == C_RELAY) {
+            if (can_read_local(c))
+                ev |= POLLIN;
+            if (c->rx)
+                ev |= POLLOUT;
+        }
+        pfd[n].fd = c->fd;
+        pfd[n].events = ev;
+        px->slots[n].listener = -1;
+        px->slots[n].conn = c;
+        n++;
+    }
+    return n;
+}
+
+static void px_dispatch(void *ctx, const struct pollfd *pfd, int n)
+{
+    nc_proxy_t *px = ctx;
+    int i;
+
+    for (i = 0; i < n; i++) {
+        short re = pfd[i].revents;
+        conn_t *c = px->slots[i].conn;
+
+        if (!re)
+            continue;
+        if (px->slots[i].listener >= 0) {
+            accept_on(px, px->slots[i].listener);
+            continue;
+        }
+        if (c->dead)
+            continue;
+        if (re & POLLERR) {
+            c->dead = c->abort = 1;
+            continue;
+        }
+        if (re & POLLOUT)
+            pump_down(c);
+        if (re & (POLLIN | POLLHUP)) {
+            if (c->state < C_CONNECTING)
+                read_handshake(c);
+            else if (c->state == C_RELAY)
+                pump_up(c);
+            else if (re & POLLHUP)
+                c->dead = c->abort = 1;     /* client gave up while connecting */
+        }
+    }
+    service(px);
+}
+
+static int px_next_timeout(void *ctx)
+{
+    nc_proxy_t *px = ctx;
+    uint64_t now = nc_now_ms(), next = 0;
+    int i;
+
+    for (i = 0; i < px->nconns; i++) {
+        const conn_t *c = px->conns[i];
+        if (c->state == C_CONNECTING && c->deadline && (!next || c->deadline < next))
+            next = c->deadline;
+    }
+    if (!next)
+        return -1;
+    return next <= now ? 0 : (int)(next - now);
+}
+
+static void px_timer(void *ctx)
+{
+    nc_proxy_t *px = ctx;
+    uint64_t now = nc_now_ms();
+    int i;
+
+    for (i = 0; i < px->nconns; i++) {
+        conn_t *c = px->conns[i];
+        if (c->state == C_CONNECTING && c->deadline && now >= c->deadline && c->pcb) {
+            struct tcp_pcb *pcb = c->pcb;
+            c->deadline = 0;
+            tcp_abort(pcb);         /* calls on_err(ERR_ABRT) -> "connect timeout" */
+        }
+    }
+    service(px);
+}
+
+nc_source_t nc_proxy_source(nc_proxy_t *px)
+{
+    nc_source_t s;
+
+    memset(&s, 0, sizeof(s));
+    s.poll_fill = px_fill;
+    s.poll_dispatch = px_dispatch;
+    s.next_timeout_ms = px_next_timeout;
+    s.on_timer = px_timer;
+    s.ctx = px;
+    return s;
+}
+
+/* ---- create / destroy ---- */
+
+static int open_listener(nc_proxy_t *px, uint16_t port)
+{
+    struct sockaddr_in a;
+    int fd, one = 1;
+
+    memset(&a, 0, sizeof(a));
+    a.sin_family = AF_INET;
+    a.sin_port = htons(port);
+    if (inet_pton(AF_INET, px->listen_addr, &a.sin_addr) != 1) {
+        logf_(px, "invalid listen address %s", px->listen_addr);
+        return -1;
+    }
+    fd = socket(AF_INET, SOCK_STREAM, 0);
+    if (fd < 0)
+        return -1;
+    setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+    if (bind(fd, (struct sockaddr *)&a, sizeof(a)) < 0 || listen(fd, 16) < 0) {
+        logf_(px, "cannot listen on %s:%u: %s", px->listen_addr, (unsigned)port, strerror(errno));
+        close(fd);
+        return -1;
+    }
+    set_nonblock(fd);
+    return fd;
+}
+
+nc_proxy_t *nc_proxy_create(const nc_proxy_cfg_t *cfg, nc_proxy_log_cb log, void *user)
+{
+    nc_proxy_t *px = calloc(1, sizeof(*px));
+    int i;
+
+    if (!px)
+        return NULL;
+    px->cfg = *cfg;
+    px->log = log;
+    px->log_user = user;
+    for (i = 0; i < LISTEN_MAX; i++)
+        px->lfd[i] = -1;
+    snprintf(px->listen_addr, sizeof(px->listen_addr), "%s",
+             cfg->listen_addr && *cfg->listen_addr ? cfg->listen_addr : "127.0.0.1");
+    if (cfg->socks_user && *cfg->socks_user) {
+        if (strlen(cfg->socks_user) > 255 || !cfg->socks_password || strlen(cfg->socks_password) > 255) {
+            logf_(px, "invalid SOCKS credentials");
+            goto fail;
+        }
+        snprintf(px->user, sizeof(px->user), "%s", cfg->socks_user);
+        snprintf(px->pass, sizeof(px->pass), "%s", cfg->socks_password);
+        px->auth = 1;
+    }
+    px->cfg.listen_addr = px->cfg.socks_user = px->cfg.socks_password = NULL;
+    if (px->cfg.max_conns <= 0)
+        px->cfg.max_conns = DEF_MAX_CONNS;
+    if (px->cfg.connect_timeout_ms <= 0)
+        px->cfg.connect_timeout_ms = DEF_CONNECT_MS;
+    if (px->cfg.forward_count < 0 || px->cfg.forward_count > NC_PROXY_MAX_FORWARDS)
+        goto fail;
+    px->conns = calloc((size_t)px->cfg.max_conns, sizeof(*px->conns));
+    if (!px->conns)
+        goto fail;
+#if !NC_WITH_SOCKS
+    if (cfg->socks_port) {
+        logf_(px, "built without SOCKS5 (make SOCKS=0)");
+        goto fail;
+    }
+#endif
+    if (cfg->socks_port && (px->lfd[0] = open_listener(px, cfg->socks_port)) < 0)
+        goto fail;
+    for (i = 0; i < px->cfg.forward_count; i++)
+        if ((px->lfd[1 + i] = open_listener(px, px->cfg.forwards[i].local_port)) < 0)
+            goto fail;
+    return px;
+fail:
+    nc_proxy_destroy(px);
+    return NULL;
+}
+
+void nc_proxy_destroy(nc_proxy_t *px)
+{
+    int i;
+
+    if (!px)
+        return;
+    while (px->nconns > 0) {
+        px->conns[0]->abort = 1;
+        destroy_conn(px, 0);
+    }
+    for (i = 0; i < LISTEN_MAX; i++)
+        if (px->lfd[i] >= 0)
+            close(px->lfd[i]);
+    memset(px->pass, 0, sizeof(px->pass));
+    free(px->conns);
+    free(px);
+}
+
+void nc_proxy_get_stats(const nc_proxy_t *px, nc_proxy_stats_t *st)
+{
+    *st = px->st;
+}
diff --git a/netcore/route.c b/netcore/route.c
new file mode 100644
index 0000000..4517992
--- /dev/null
+++ b/netcore/route.c
@@ -0,0 +1,139 @@
+#include "netcore/route.h"
+
+#include <ctype.h>
+#include <stdio.h>
+#include <string.h>
+
+static uint32_t prefix_mask(uint8_t prefix)
+{
+    return prefix ? 0xffffffffu << (32 - prefix) : 0;
+}
+
+int nc_routes_add(nc_routes_t *rt, uint32_t net, uint8_t prefix, uint32_t gw)
+{
+    nc_route_t *r;
+
+    if (prefix > 32 || rt->count >= NC_ROUTES_MAX)
+        return -1;
+    r = &rt->r[rt->count++];
+    r->mask = prefix_mask(prefix);
+    r->net = net & r->mask;
+    r->gw = gw;
+    r->prefix = prefix;
+    return 0;
+}
+
+int nc_routes_parse_classless(const uint8_t *opt, size_t len, nc_routes_t *out)
+{
+    size_t i = 0;
+
+    memset(out, 0, sizeof(*out));
+    while (i < len) {
+        uint8_t width = opt[i++];
+        size_t n = (size_t)(width + 7) / 8, k;
+        uint32_t net = 0, gw;
+
+        if (width > 32 || i + n + 4 > len)
+            goto bad;
+        for (k = 0; k < n; k++)
+            net |= (uint32_t)opt[i + k] << (24 - 8 * k);
+        i += n;
+        gw = ((uint32_t)opt[i] << 24) | ((uint32_t)opt[i + 1] << 16) |
+             ((uint32_t)opt[i + 2] << 8) | opt[i + 3];
+        i += 4;
+        if (nc_routes_add(out, net, width, gw) < 0)
+            goto bad;
+    }
+    return 0;
+bad:
+    memset(out, 0, sizeof(*out));
+    return -1;
+}
+
+const nc_route_t *nc_routes_lookup(const nc_routes_t *rt, uint32_t dst)
+{
+    const nc_route_t *best = NULL;
+    int i;
+
+    for (i = 0; i < rt->count; i++) {
+        const nc_route_t *r = &rt->r[i];
+        if ((dst & r->mask) == r->net && (!best || r->prefix > best->prefix))
+            best = r;
+    }
+    return best;
+}
+
+void nc_ip4_format(uint32_t ip, char *out, size_t size)
+{
+    snprintf(out, size, "%u.%u.%u.%u", (unsigned)(ip >> 24), (unsigned)(ip >> 16) & 255,
+             (unsigned)(ip >> 8) & 255, (unsigned)ip & 255);
+}
+
+void nc_route_format(const nc_route_t *r, char *out, size_t size)
+{
+    char net[16], gw[16];
+
+    nc_ip4_format(r->net, net, sizeof(net));
+    nc_ip4_format(r->gw, gw, sizeof(gw));
+    if (r->gw)
+        snprintf(out, size, "%s/%u via %s", net, (unsigned)r->prefix, gw);
+    else
+        snprintf(out, size, "%s/%u on-link", net, (unsigned)r->prefix);
+}
+
+static int hexval(char c)
+{
+    if (c >= '0' && c <= '9')
+        return c - '0';
+    if (c >= 'A' && c <= 'F')
+        return c - 'A' + 10;
+    return -1;
+}
+
+int nc_devid_to_mac(const char *id, uint8_t mac[6])
+{
+    int i;
+
+    if (!id || strlen(id) != 12)
+        return -1;
+    for (i = 0; i < 6; i++) {
+        int hi = hexval(id[i * 2]), lo = hexval(id[i * 2 + 1]);
+        if (hi < 0 || lo < 0)
+            return -1;
+        mac[i] = (uint8_t)(hi << 4 | lo);
+    }
+    if (mac[0] & 1)
+        return -1;  /* multicast */
+    return 0;
+}
+
+int nc_devid_from_mac_str(const char *mac, char id[13])
+{
+    static const char hex[] = "0123456789ABCDEF";
+    uint8_t b[6];
+    int i, any = 0;
+
+    if (!mac)
+        return -1;
+    /* character by character: a short string stops at its NUL */
+    for (i = 0; i < 6; i++) {
+        const char *p = mac + i * 3;
+        int hi, lo;
+
+        if ((hi = hexval((char)toupper((unsigned char)p[0]))) < 0 ||
+            (lo = hexval((char)toupper((unsigned char)p[1]))) < 0)
+            return -1;
+        if (i < 5 ? p[2] != ':' : (p[2] && (p[2] != '\n' || p[3])))
+            return -1;
+        b[i] = (uint8_t)(hi << 4 | lo);
+        any |= b[i];
+    }
+    if (!any || (b[0] & 1))
+        return -1;  /* unset or multicast */
+    for (i = 0; i < 6; i++) {
+        id[i * 2] = hex[b[i] >> 4];
+        id[i * 2 + 1] = hex[b[i] & 15];
+    }
+    id[12] = '\0';
+    return 0;
+}
diff --git a/netcore/stack.c b/netcore/stack.c
new file mode 100644
index 0000000..7dab90a
--- /dev/null
+++ b/netcore/stack.c
@@ -0,0 +1,366 @@
+#include "netcore/stack.h"
+
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "lwip/dhcp.h"
+#include "lwip/etharp.h"
+#include "lwip/init.h"
+#include "lwip/ip4.h"
+#include "lwip/netif.h"
+#include "lwip/pbuf.h"
+#include "lwip/prot/dhcp.h"
+#include "lwip/timeouts.h"
+#include "netif/ethernet.h"
+
+#define FRAME_MAX 2048
+
+static struct {
+    int initialised;
+    tunnel_t tun;
+    nc_stack_cfg_t cfg;
+    nc_stack_event_cb cb;
+    void *user;
+
+    struct netif netif;
+    int link;                   /* enum tunnel_link the netif is configured for */
+    int dhcp_started;
+    int bound;
+
+    nc_routes_t routes;         /* in effect */
+    int use_default;            /* default route via netif gw */
+    ip4_addr_t gw_addr[NC_ROUTES_MAX];
+
+    nc_routes_t pending;        /* from the last DHCPACK */
+    int pending_valid;          /* 121 (2) or 249 (1) seen, 0 none */
+    u32_t pending_xid;
+
+    uint8_t txbuf[FRAME_MAX];
+} st;
+
+/* ---- platform functions required by lwIP ---- */
+
+u32_t sys_now(void)
+{
+    return (u32_t)nc_now_ms();
+}
+
+uint32_t nc_random32(void)
+{
+    static uint32_t s;
+
+    if (!s) {
+        int fd = open("/dev/urandom", O_RDONLY);
+        if (fd >= 0) {
+            if (read(fd, &s, sizeof(s)) != (ssize_t)sizeof(s))
+                s = 0;
+            close(fd);
+        }
+        s ^= (uint32_t)nc_now_ms() ^ ((uint32_t)getpid() << 16);
+        if (!s)
+            s = 0x9e3779b9u;
+    }
+    s ^= s << 13;   /* xorshift32 */
+    s ^= s >> 17;
+    s ^= s << 5;
+    return s;
+}
+
+static void emit(int ev, int tev, int err)
+{
+    if (st.cb)
+        st.cb(st.user, ev, tev, err);
+}
+
+/* ---- routes ---- */
+
+static void apply_routes(const nc_routes_t *rt, int use_default)
+{
+    int i;
+
+    st.routes = *rt;
+    st.use_default = use_default;
+    for (i = 0; i < rt->count; i++)
+        ip4_addr_set_u32(&st.gw_addr[i], lwip_htonl(rt->r[i].gw));
+}
+
+struct netif *nc_hook_ip4_route(const ip4_addr_t *src, const ip4_addr_t *dest)
+{
+    (void)src;
+    if (!st.initialised || !netif_is_up(&st.netif) || !netif_is_link_up(&st.netif))
+        return NULL;
+    return nc_stack_route_ok(lwip_ntohl(ip4_addr_get_u32(dest))) ? &st.netif : NULL;
+}
+
+const ip4_addr_t *nc_hook_etharp_get_gw(struct netif *netif, const ip4_addr_t *dest)
+{
+    const nc_route_t *r;
+
+    if (netif != &st.netif)
+        return NULL;
+    r = nc_routes_lookup(&st.routes, lwip_ntohl(ip4_addr_get_u32(dest)));
+    if (!r)
+        return NULL;                    /* default route: netif gateway */
+    if (!r->gw)
+        return dest;                    /* on-link route */
+    return &st.gw_addr[r - st.routes.r];
+}
+
+void nc_hook_dhcp_parse_option(struct netif *netif, struct dhcp *dhcp, u8_t state,
+                               struct dhcp_msg *msg, u8_t msg_type, u8_t option,
+                               u8_t len, struct pbuf *p, u16_t offset)
+{
+    uint8_t buf[255];
+    nc_routes_t rt;
+    int prio = option == 121 ? 2 : option == 249 ? 1 : 0;
+
+    (void)dhcp;
+    (void)state;
+    if (netif != &st.netif || !prio || msg_type != DHCP_ACK)
+        return;
+    if (pbuf_copy_partial(p, buf, len, offset) != len)
+        return;
+    if (nc_routes_parse_classless(buf, len, &rt) != 0)
+        return;                         /* malformed: ignore the option (RFC 3442) */
+    if (st.pending_xid != lwip_ntohl(msg->xid))
+        st.pending_valid = 0;
+    if (prio < st.pending_valid)
+        return;                         /* 121 wins over 249 */
+    st.pending = rt;
+    st.pending_valid = prio;
+    st.pending_xid = lwip_ntohl(msg->xid);
+}
+
+int nc_stack_route_ok(uint32_t dst)
+{
+    uint32_t addr, mask;
+
+    if (!st.bound)
+        return 0;
+    addr = lwip_ntohl(ip4_addr_get_u32(netif_ip4_addr(&st.netif)));
+    mask = lwip_ntohl(ip4_addr_get_u32(netif_ip4_netmask(&st.netif)));
+    if ((dst & mask) == (addr & mask))
+        return 1;
+    if (nc_routes_lookup(&st.routes, dst))
+        return 1;
+    return st.use_default && !ip4_addr_isany_val(*netif_ip4_gw(&st.netif));
+}
+
+/* ---- netif ---- */
+
+static const uint8_t *flatten(struct pbuf *p, size_t *len)
+{
+    if (p->tot_len > sizeof(st.txbuf))
+        return NULL;
+    *len = p->tot_len;
+    if (!p->next)
+        return p->payload;
+    pbuf_copy_partial(p, st.txbuf, p->tot_len, 0);
+    return st.txbuf;
+}
+
+static err_t l2_linkoutput(struct netif *netif, struct pbuf *p)
+{
+    size_t len;
+    const uint8_t *d = flatten(p, &len);
+
+    (void)netif;
+    if (d)
+        st.tun.ops->send(st.tun.ctx, d, len);   /* drops are like lost frames */
+    return ERR_OK;
+}
+
+static err_t l3_output(struct netif *netif, struct pbuf *p, const ip4_addr_t *ipaddr)
+{
+    (void)ipaddr;
+    return l2_linkoutput(netif, p);
+}
+
+static void configure_link(int link)
+{
+    struct netif *n = &st.netif;
+
+    st.link = link;
+    if (link == TUNNEL_LINK_L2) {
+        n->flags |= NETIF_FLAG_BROADCAST | NETIF_FLAG_ETHARP | NETIF_FLAG_ETHERNET;
+        n->output = etharp_output;
+        n->linkoutput = l2_linkoutput;
+        n->input = ethernet_input;
+    } else {
+        n->flags &= (u8_t)~(NETIF_FLAG_BROADCAST | NETIF_FLAG_ETHARP | NETIF_FLAG_ETHERNET);
+        n->output = l3_output;
+        n->linkoutput = NULL;
+        n->input = ip_input;
+    }
+}
+
+static err_t netif_init_cb(struct netif *n)
+{
+    n->name[0] = 'v';
+    n->name[1] = 't';
+    n->mtu = 1500;
+    n->hwaddr_len = ETH_HWADDR_LEN;
+    memcpy(n->hwaddr, st.cfg.mac, ETH_HWADDR_LEN);
+    st.link = TUNNEL_LINK_NONE;
+    configure_link(TUNNEL_LINK_L2);
+    return ERR_OK;
+}
+
+static void status_cb(struct netif *n)
+{
+    int has_addr = netif_is_up(n) && !ip4_addr_isany_val(*netif_ip4_addr(n));
+
+    if (has_addr && !st.bound) {
+        if (!st.cfg.static_ip) {
+            struct dhcp *d = netif_dhcp_data(n);
+            int have121 = st.pending_valid && d && st.pending_xid == d->xid;
+            nc_routes_t none;
+
+            memset(&none, 0, sizeof(none));
+            /* RFC 3442: with classless routes the router option is ignored */
+            apply_routes(have121 ? &st.pending : &none, !have121 || st.cfg.opt3_default_route);
+            st.pending_valid = 0;
+        }
+        st.bound = 1;
+        emit(NC_STACK_EV_ADDR_BOUND, 0, 0);
+    } else if (!has_addr && st.bound) {
+        st.bound = 0;
+        emit(NC_STACK_EV_ADDR_LOST, 0, 0);
+    }
+}
+
+/* ---- tunnel callbacks ---- */
+
+static int l2_accept(const uint8_t *f, size_t len)
+{
+    static const uint8_t bcast[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+    uint16_t type;
+
+    if (len < 14)
+        return 0;
+    if (memcmp(f, st.cfg.mac, 6) != 0 && memcmp(f, bcast, 6) != 0)
+        return 0;                       /* shared bridge: not for us */
+    type = (uint16_t)(f[12] << 8 | f[13]);
+    return type == 0x0800 || type == 0x0806;
+}
+
+static void on_rx(void *user, const uint8_t *pkt, size_t len)
+{
+    struct pbuf *p;
+
+    (void)user;
+    if (st.link == TUNNEL_LINK_L2 ? !l2_accept(pkt, len) : (len < 20 || (pkt[0] >> 4) != 4))
+        return;
+    p = pbuf_alloc(PBUF_RAW, (u16_t)len, PBUF_POOL);
+    if (!p)
+        return;
+    pbuf_take(p, pkt, (u16_t)len);
+    if (st.netif.input(p, &st.netif) != ERR_OK)
+        pbuf_free(p);
+}
+
+static void on_tunnel_event(void *user, int ev, int err)
+{
+    (void)user;
+    if (ev == TUNNEL_EV_UP) {
+        int link = st.tun.ops->link_type(st.tun.ctx);
+
+        if (link != st.link)
+            configure_link(link);
+        /* The L2 segment may have changed while we were away: a Linux bridge
+         * without a fixed MAC takes a port's MAC, so the gateway MAC changes
+         * when taps come and go. Forget all neighbours. */
+        if (link == TUNNEL_LINK_L2)
+            etharp_cleanup_netif(&st.netif);
+        netif_set_up(&st.netif);
+        netif_set_link_up(&st.netif);   /* restarts DHCP with the previous address */
+        if (st.cfg.static_ip) {
+            ip4_addr_t a, m, g;
+
+            ip4_addr_set_u32(&a, lwip_htonl(st.cfg.addr));
+            ip4_addr_set_u32(&m, lwip_htonl(st.cfg.mask));
+            ip4_addr_set_u32(&g, lwip_htonl(st.cfg.gw));
+            /* like option 121: explicit routes, or a default route via gw */
+            apply_routes(&st.cfg.routes, st.cfg.gw != 0 && st.cfg.routes.count == 0);
+            netif_set_addr(&st.netif, &a, &m, &g);
+        } else if (link == TUNNEL_LINK_L2 && !st.dhcp_started) {
+            st.dhcp_started = 1;
+            dhcp_start(&st.netif);
+        }
+    } else if (ev == TUNNEL_EV_DOWN || ev == TUNNEL_EV_FAILED) {
+        /* keep the lease; it is requested again after reconnect */
+        netif_set_link_down(&st.netif);
+    }
+    emit(NC_STACK_EV_TUNNEL, ev, err);
+}
+
+/* ---- timers ---- */
+
+static int timer_next(void *ctx)
+{
+    u32_t t = sys_timeouts_sleeptime();
+
+    (void)ctx;
+    if (t == SYS_TIMEOUTS_SLEEPTIME_INFINITE)
+        return -1;
+    return t > 0x7fffffff ? 0x7fffffff : (int)t;
+}
+
+static void timer_run(void *ctx)
+{
+    (void)ctx;
+    sys_check_timeouts();
+}
+
+nc_source_t nc_stack_timer_source(void)
+{
+    nc_source_t s;
+
+    memset(&s, 0, sizeof(s));
+    s.next_timeout_ms = timer_next;
+    s.on_timer = timer_run;
+    return s;
+}
+
+/* ---- public ---- */
+
+int nc_stack_init(const tunnel_t *t, const nc_stack_cfg_t *cfg, nc_stack_event_cb cb, void *user)
+{
+    if (st.initialised)
+        return -1;
+    memset(&st, 0, sizeof(st));
+    st.tun = *t;
+    st.cfg = *cfg;
+    st.cb = cb;
+    st.user = user;
+
+    lwip_init();
+    if (!netif_add_noaddr(&st.netif, NULL, netif_init_cb, ethernet_input))
+        return -1;
+    netif_set_status_callback(&st.netif, status_cb);
+    /* no netif_set_default(): only routed destinations use the tunnel */
+
+    t->ops->set_rx_cb(t->ctx, on_rx, NULL);
+    t->ops->set_event_cb(t->ctx, on_tunnel_event, NULL);
+    st.initialised = 1;
+    return 0;
+}
+
+void nc_stack_get_info(nc_stack_info_t *info)
+{
+    memset(info, 0, sizeof(*info));
+    info->bound = st.bound;
+    if (!st.bound)
+        return;
+    info->addr = lwip_ntohl(ip4_addr_get_u32(netif_ip4_addr(&st.netif)));
+    info->mask = lwip_ntohl(ip4_addr_get_u32(netif_ip4_netmask(&st.netif)));
+    info->gw = lwip_ntohl(ip4_addr_get_u32(netif_ip4_gw(&st.netif)));
+    info->default_route = st.use_default && info->gw != 0;
+    info->routes = st.routes;
+}
+
+struct netif *nc_stack_netif(void)
+{
+    return &st.netif;
+}
diff --git a/netcore/tapdev.c b/netcore/tapdev.c
new file mode 100644
index 0000000..8fb4c47
--- /dev/null
+++ b/netcore/tapdev.c
@@ -0,0 +1,257 @@
+#include "netcore/tapdev.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>     /* before linux/if.h: old kernel headers need struct sockaddr */
+#include <unistd.h>
+
+#include <linux/if.h>
+#include <linux/if_tun.h>
+
+#ifndef ARPHRD_ETHER
+#define ARPHRD_ETHER 1      /* linux/if_arp.h drags in netlink headers */
+#endif
+
+#ifndef TUNSETCARRIER
+#define TUNSETCARRIER _IOW('T', 226, int)
+#endif
+
+#define FRAME_BUF   (2048 + 64)
+#define READ_BUDGET 64          /* frames per readiness event */
+
+struct nc_tap {
+    tunnel_t tun;
+    nc_tap_cfg_t cfg;
+    char req_name[IFNAMSIZ];
+    nc_tap_event_cb cb;
+    void *user;
+
+    int fd;
+    char ifname[IFNAMSIZ];
+    int link;
+    int carrier_ok;             /* TUNSETCARRIER supported */
+    nc_tap_stats_t st;
+    uint8_t buf[FRAME_BUF];
+};
+
+static void emit(nc_tap_t *tap, int ev, int tev, int err)
+{
+    if (tap->cb)
+        tap->cb(tap->user, ev, tev, err);
+}
+
+static int ifreq_ioctl(unsigned long req, struct ifreq *ifr)
+{
+    int s = socket(AF_INET, SOCK_DGRAM, 0), rc;
+
+    if (s < 0)
+        return -1;
+    rc = ioctl(s, req, ifr);
+    if (rc < 0) {
+        int e = errno;
+        close(s);
+        errno = e;
+        return -1;
+    }
+    close(s);
+    return 0;
+}
+
+static void disable_ipv6(const char *ifname)
+{
+    char path[96];
+    int fd;
+
+    /* IPv4 only; best effort (keeps router solicitations off the bridge) */
+    snprintf(path, sizeof(path), "/proc/sys/net/ipv6/conf/%s/disable_ipv6", ifname);
+    fd = open(path, O_WRONLY | O_CLOEXEC);
+    if (fd >= 0) {
+        (void)!write(fd, "1", 1);
+        close(fd);
+    }
+}
+
+static void set_carrier(nc_tap_t *tap, int on)
+{
+    if (tap->fd < 0 || !tap->carrier_ok)
+        return;
+    if (ioctl(tap->fd, TUNSETCARRIER, &on) < 0)
+        tap->carrier_ok = 0;    /* old kernel: interface stays up */
+}
+
+static int create_iface(nc_tap_t *tap, int link)
+{
+    struct ifreq ifr;
+    int fd, e;
+
+    fd = open("/dev/net/tun", O_RDWR | O_NONBLOCK | O_CLOEXEC);
+    if (fd < 0)
+        return -errno;
+    memset(&ifr, 0, sizeof(ifr));
+    ifr.ifr_flags = (short)((link == TUNNEL_LINK_L2 ? IFF_TAP : IFF_TUN) | IFF_NO_PI);
+    snprintf(ifr.ifr_name, IFNAMSIZ, "%s", tap->req_name);
+    if (ioctl(fd, TUNSETIFF, &ifr) < 0)
+        goto fail;
+    snprintf(tap->ifname, sizeof(tap->ifname), "%s", ifr.ifr_name);
+
+    if (link == TUNNEL_LINK_L2) {
+        memset(&ifr.ifr_ifru, 0, sizeof(ifr.ifr_ifru));
+        ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
+        memcpy(ifr.ifr_hwaddr.sa_data, tap->cfg.mac, 6);
+        if (ifreq_ioctl(SIOCSIFHWADDR, &ifr) < 0)
+            goto fail;
+    }
+    memset(&ifr.ifr_ifru, 0, sizeof(ifr.ifr_ifru));
+    ifr.ifr_mtu = tap->cfg.mtu;
+    if (ifreq_ioctl(SIOCSIFMTU, &ifr) < 0)
+        goto fail;
+    disable_ipv6(tap->ifname);
+    memset(&ifr.ifr_ifru, 0, sizeof(ifr.ifr_ifru));
+    if (ifreq_ioctl(SIOCGIFFLAGS, &ifr) < 0)
+        goto fail;
+    ifr.ifr_flags |= IFF_UP;
+    if (ifreq_ioctl(SIOCSIFFLAGS, &ifr) < 0)
+        goto fail;
+
+    tap->fd = fd;
+    tap->link = link;
+    tap->carrier_ok = 1;
+    set_carrier(tap, 1);
+    return 0;
+fail:
+    e = errno;
+    close(fd);
+    tap->ifname[0] = '\0';
+    return -e;
+}
+
+/* ---- tunnel callbacks ---- */
+
+static void on_rx(void *user, const uint8_t *pkt, size_t len)
+{
+    nc_tap_t *tap = user;
+
+    if (tap->fd < 0)
+        return;
+    if (write(tap->fd, pkt, len) == (ssize_t)len)
+        tap->st.frames_in++;
+    else
+        tap->st.dropped++;      /* EAGAIN: kernel queue full, like a lost frame */
+}
+
+static void on_tunnel_event(void *user, int ev, int err)
+{
+    nc_tap_t *tap = user;
+
+    if (ev == TUNNEL_EV_UP) {
+        int link = tap->tun.ops->link_type(tap->tun.ctx);
+
+        if (tap->fd < 0) {
+            int rc = create_iface(tap, link);
+            emit(tap, NC_TAP_EV_TUNNEL, ev, err);
+            if (rc < 0)
+                emit(tap, NC_TAP_EV_ERROR, 0, -rc);
+            else
+                emit(tap, NC_TAP_EV_CREATED, 0, 0);
+            return;
+        }
+        if (link != tap->link) {
+            emit(tap, NC_TAP_EV_TUNNEL, ev, err);
+            emit(tap, NC_TAP_EV_ERROR, 0, EPROTOTYPE);  /* session type changed */
+            return;
+        }
+        set_carrier(tap, 1);
+        emit(tap, NC_TAP_EV_TUNNEL, ev, err);
+        emit(tap, NC_TAP_EV_RECONNECTED, 0, 0);
+        return;
+    }
+    if (ev == TUNNEL_EV_DOWN || ev == TUNNEL_EV_FAILED)
+        set_carrier(tap, 0);
+    emit(tap, NC_TAP_EV_TUNNEL, ev, err);
+}
+
+/* ---- loop source ---- */
+
+static int tap_get_fd(void *ctx)
+{
+    return ((nc_tap_t *)ctx)->fd;
+}
+
+static void tap_readable(void *ctx)
+{
+    nc_tap_t *tap = ctx;
+    int i;
+
+    for (i = 0; i < READ_BUDGET && tap->fd >= 0; i++) {
+        ssize_t n = read(tap->fd, tap->buf, sizeof(tap->buf));
+
+        if (n <= 0)
+            return;             /* EAGAIN or error: wait for the next event */
+        if (tap->tun.ops->send(tap->tun.ctx, tap->buf, (size_t)n) == 0)
+            tap->st.frames_out++;
+        else
+            tap->st.dropped++;  /* tunnel down or output buffer full */
+    }
+}
+
+nc_source_t nc_tap_source(nc_tap_t *tap)
+{
+    nc_source_t s;
+
+    memset(&s, 0, sizeof(s));
+    s.get_fd = tap_get_fd;
+    s.on_readable = tap_readable;
+    s.ctx = tap;
+    return s;
+}
+
+/* ---- public ---- */
+
+nc_tap_t *nc_tap_create(const tunnel_t *t, const nc_tap_cfg_t *cfg, nc_tap_event_cb cb, void *user)
+{
+    nc_tap_t *tap = calloc(1, sizeof(*tap));
+
+    if (!tap)
+        return NULL;
+    tap->tun = *t;
+    tap->cfg = *cfg;
+    tap->cb = cb;
+    tap->user = user;
+    tap->fd = -1;
+    snprintf(tap->req_name, sizeof(tap->req_name), "%s",
+             cfg->ifname && *cfg->ifname ? cfg->ifname : "vtesse%d");
+    tap->cfg.ifname = NULL;
+    if (tap->cfg.mtu <= 0)
+        tap->cfg.mtu = 1500;
+    t->ops->set_rx_cb(t->ctx, on_rx, tap);
+    t->ops->set_event_cb(t->ctx, on_tunnel_event, tap);
+    return tap;
+}
+
+void nc_tap_destroy(nc_tap_t *tap)
+{
+    if (!tap)
+        return;
+    if (tap->fd >= 0)
+        close(tap->fd);         /* a non-persistent interface disappears */
+    free(tap);
+}
+
+const char *nc_tap_ifname(const nc_tap_t *tap)
+{
+    return tap->ifname;
+}
+
+int nc_tap_link(const nc_tap_t *tap)
+{
+    return tap->fd >= 0 ? tap->link : TUNNEL_LINK_NONE;
+}
+
+void nc_tap_get_stats(const nc_tap_t *tap, nc_tap_stats_t *st)
+{
+    *st = tap->st;
+}
diff --git a/netcore/tunnel.c b/netcore/tunnel.c
new file mode 100644
index 0000000..bf92140
--- /dev/null
+++ b/netcore/tunnel.c
@@ -0,0 +1,36 @@
+#include "netcore/tunnel.h"
+
+const char *tunnel_strerror(int err)
+{
+    switch (err) {
+    case TUNNEL_OK:                         return "ok";
+    case TUNNEL_ERR_CONFIG:                 return "invalid configuration";
+    case TUNNEL_ERR_NOMEM:                  return "out of memory";
+    case TUNNEL_ERR_RESOLVE:                return "cannot resolve server address";
+    case TUNNEL_ERR_CONNECT:                return "cannot connect to server";
+    case TUNNEL_ERR_TIMEOUT:                return "timeout";
+    case TUNNEL_ERR_IO:                     return "connection error";
+    case TUNNEL_ERR_PEER_CLOSED:            return "closed by server (possibly taken over by another connection)";
+    case TUNNEL_ERR_KEEPALIVE:              return "no response from server (keepalive)";
+    case TUNNEL_ERR_PROTOCOL:               return "protocol error (not a VTun server?)";
+    case TUNNEL_ERR_AUTH:                   return "wrong session name or password";
+    case TUNNEL_ERR_UNSUPPORTED_TYPE:       return "unsupported session type";
+    case TUNNEL_ERR_UNSUPPORTED_TRANSPORT:  return "unsupported transport (UDP)";
+    case TUNNEL_ERR_COMPRESSION:            return "compression is enabled on the server";
+    case TUNNEL_ERR_ENCRYPTION:             return "encryption is enabled on the server";
+    case TUNNEL_ERR_CLOSED:                 return "closed";
+    case TUNNEL_ERR_NETWORK:                return "local network changed, reconnecting";
+    default:                                return "unknown error";
+    }
+}
+
+const char *tunnel_event_name(int event)
+{
+    switch (event) {
+    case TUNNEL_EV_CONNECTING: return "connecting";
+    case TUNNEL_EV_UP:         return "up";
+    case TUNNEL_EV_DOWN:       return "down";
+    case TUNNEL_EV_FAILED:     return "failed";
+    default:                   return "?";
+    }
+}
diff --git a/netcore/udprelay.c b/netcore/udprelay.c
new file mode 100644
index 0000000..2947f67
--- /dev/null
+++ b/netcore/udprelay.c
@@ -0,0 +1,139 @@
+/*
+ * UDP relay: lwIP UDP PCB on the tunnel side, a connected UDP socket on the
+ * host side. Runs in the loop thread (lwIP input calls on_recv); the host
+ * socket is non-blocking, so a slow reader drops datagrams instead of
+ * stalling the tunnel.
+ */
+#include "netcore/udprelay.h"
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "lwip/pbuf.h"
+#include "lwip/udp.h"
+
+struct nc_udp_relay {
+    struct udp_pcb *pcb;
+    int fd;
+    nc_udp_relay_stats_t st;
+    uint8_t buf[65536];
+};
+
+static void on_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
+{
+    nc_udp_relay_t *r = arg;
+    u16_t len;
+
+    (void)pcb;
+    (void)addr;
+    (void)port;
+    if (!p)
+        return;
+    len = pbuf_copy_partial(p, r->buf, sizeof(r->buf) < 0xffff ? sizeof(r->buf) : 0xffff, 0);
+    pbuf_free(p);
+    if (send(r->fd, r->buf, len, MSG_DONTWAIT) == (ssize_t)len) {
+        r->st.datagrams++;
+        r->st.bytes += len;
+    } else {
+        r->st.dropped++;            /* buffer full, or nobody listens (ECONNREFUSED) */
+    }
+}
+
+nc_udp_relay_t *nc_udp_relay_create(uint16_t port, const char *dst_addr, uint16_t dst_port,
+                                    char *err, size_t err_size)
+{
+    struct sockaddr_in dst;
+    nc_udp_relay_t *r;
+    int sndbuf = 1 << 20;
+
+    if (!port) {
+        snprintf(err, err_size, "udp relay: port 0");
+        return NULL;
+    }
+    memset(&dst, 0, sizeof(dst));
+    dst.sin_family = AF_INET;
+    dst.sin_port = htons(dst_port ? dst_port : port);
+    if (inet_pton(AF_INET, dst_addr ? dst_addr : "127.0.0.1", &dst.sin_addr) != 1) {
+        snprintf(err, err_size, "udp relay: bad address '%s'", dst_addr);
+        return NULL;
+    }
+    r = calloc(1, sizeof(*r));
+    if (!r) {
+        snprintf(err, err_size, "udp relay: out of memory");
+        return NULL;
+    }
+    r->fd = socket(AF_INET, SOCK_DGRAM, 0);
+    if (r->fd < 0 || connect(r->fd, (struct sockaddr *)&dst, sizeof(dst)) < 0) {
+        snprintf(err, err_size, "udp relay: local socket: %s", strerror(errno));
+        goto fail;
+    }
+    fcntl(r->fd, F_SETFL, fcntl(r->fd, F_GETFL) | O_NONBLOCK);
+    (void)setsockopt(r->fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(sndbuf));
+
+    r->pcb = udp_new();
+    if (!r->pcb) {
+        snprintf(err, err_size, "udp relay: no lwIP UDP PCB left (max %d relays)", NC_UDP_RELAY_MAX);
+        goto fail;
+    }
+    if (udp_bind(r->pcb, IP4_ADDR_ANY, port) != ERR_OK) {
+        snprintf(err, err_size, "udp relay: port %u in use", (unsigned)port);
+        goto fail;
+    }
+    udp_recv(r->pcb, on_recv, r);
+    return r;
+
+fail:
+    nc_udp_relay_destroy(r);
+    return NULL;
+}
+
+void nc_udp_relay_destroy(nc_udp_relay_t *r)
+{
+    if (!r)
+        return;
+    if (r->pcb)
+        udp_remove(r->pcb);
+    if (r->fd >= 0)
+        close(r->fd);
+    free(r);
+}
+
+void nc_udp_relay_get_stats(const nc_udp_relay_t *r, nc_udp_relay_stats_t *st)
+{
+    *st = r->st;
+}
+
+static int parse_port(const char *s, char **end, uint16_t *out)
+{
+    unsigned long v;
+
+    if (*s < '0' || *s > '9')
+        return -1;
+    v = strtoul(s, end, 10);
+    if (!v || v > 65535)
+        return -1;
+    *out = (uint16_t)v;
+    return 0;
+}
+
+int nc_udp_relay_parse(const char *s, uint16_t *port, uint16_t *local_port)
+{
+    char *end;
+
+    if (parse_port(s, &end, port) < 0)
+        return -1;
+    if (!*end) {
+        *local_port = *port;
+        return 0;
+    }
+    if (*end != ':' || parse_port(end + 1, &end, local_port) < 0 || *end)
+        return -1;
+    return 0;
+}
diff --git a/port/lwip/arch/cc.h b/port/lwip/arch/cc.h
new file mode 100644
index 0000000..a30090e
--- /dev/null
+++ b/port/lwip/arch/cc.h
@@ -0,0 +1,26 @@
+/* lwIP architecture glue for VTesse (POSIX, GCC/Clang). */
+#ifndef VTESSE_LWIP_ARCH_CC_H
+#define VTESSE_LWIP_ARCH_CC_H
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifndef BYTE_ORDER
+#if defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+#define BYTE_ORDER BIG_ENDIAN
+#else
+#define BYTE_ORDER LITTLE_ENDIAN
+#endif
+#endif
+
+#define LWIP_PLATFORM_DIAG(x)   do { printf x; } while (0)
+#define LWIP_PLATFORM_ASSERT(x) do { \
+        fprintf(stderr, "lwIP assertion \"%s\" failed at %s:%d\n", x, __FILE__, __LINE__); \
+        abort(); \
+    } while (0)
+
+uint32_t nc_random32(void);
+#define LWIP_RAND() ((u32_t)nc_random32())
+
+#endif
diff --git a/port/lwip/lwipopts.h b/port/lwip/lwipopts.h
new file mode 100644
index 0000000..e3dac8d
--- /dev/null
+++ b/port/lwip/lwipopts.h
@@ -0,0 +1,113 @@
+/* lwIP configuration for VTesse: NO_SYS, raw API, IPv4 only. */
+#ifndef VTESSE_LWIPOPTS_H
+#define VTESSE_LWIPOPTS_H
+
+/* ---- system ---- */
+#define NO_SYS                          1
+#define LWIP_TIMERS                     1
+#define SYS_LIGHTWEIGHT_PROT            0
+#define LWIP_NETCONN                    0
+#define LWIP_SOCKET                     0
+#define LWIP_STATS                      0
+#define LWIP_DONT_PROVIDE_BYTEORDER_FUNCTIONS 1   /* use the system htons/ntohl */
+#define LWIP_HOOK_FILENAME              "nc_lwip_hooks.h"   /* prototypes */
+#define LWIP_HOOK_IP4_ROUTE_SRC(src, dest)      nc_hook_ip4_route(src, dest)
+#define LWIP_HOOK_ETHARP_GET_GW(netif, dest)    nc_hook_etharp_get_gw(netif, dest)
+#define LWIP_HOOK_DHCP_PARSE_OPTION(netif, dhcp, state, msg, msg_type, option, len, pbuf, offset) \
+    nc_hook_dhcp_parse_option(netif, dhcp, state, msg, msg_type, option, len, pbuf, offset)
+
+/* ---- memory ----
+ * Profiles (#12), chosen with VTESSE_LWIP_PROFILE (make LWIP_PROFILE=...):
+ *   2 large  (default; PCs, Android): ~125 KiB window with scaling, ~7 Mbit/s per
+ *            connection at 140 ms RTT (#24); ~1.4 MiB of static pools.
+ *   1 medium (cameras, routers): 64 KiB window, ~3.4 Mbit/s at 150 ms, a few
+ *            parallel streams; ~0.3 MiB.
+ *   0 small  (tight devices; also -DVTESSE_LWIP_SMALL): 4 x MSS window; ~0.1 MiB.
+ * Throughput of one connection is at most window / RTT. The proxy acknowledges
+ * data only after writing it locally, so pbufs pile up only while a local reader
+ * is slow. */
+#ifndef VTESSE_LWIP_PROFILE
+#ifdef VTESSE_LWIP_SMALL
+#define VTESSE_LWIP_PROFILE             0
+#else
+#define VTESSE_LWIP_PROFILE             2
+#endif
+#endif
+
+#if VTESSE_LWIP_PROFILE >= 2
+#define MEM_SIZE                        (512 * 1024)
+#define PBUF_POOL_SIZE                  512
+#define MEMP_NUM_PBUF                   64
+#define MEMP_NUM_TCP_PCB                32
+#define LWIP_WND_SCALE                  1
+#define TCP_RCV_SCALE                   2
+#define TCP_WND                         (88 * TCP_MSS)
+#define TCP_SND_BUF                     (64 * TCP_MSS)
+#define MEMP_NUM_TCP_SEG                512
+#elif VTESSE_LWIP_PROFILE == 1
+#define MEM_SIZE                        (96 * 1024)
+#define PBUF_POOL_SIZE                  96
+#define MEMP_NUM_PBUF                   32
+#define MEMP_NUM_TCP_PCB                16
+#define TCP_WND                         (44 * TCP_MSS)      /* 64240: no window scaling */
+#define TCP_SND_BUF                     (16 * TCP_MSS)
+#define MEMP_NUM_TCP_SEG                128
+#else
+#define MEM_SIZE                        (48 * 1024)
+#define PBUF_POOL_SIZE                  24
+#define MEMP_NUM_PBUF                   16
+#define MEMP_NUM_TCP_PCB                8
+#define TCP_WND                         (4 * TCP_MSS)
+#define TCP_SND_BUF                     (4 * TCP_MSS)
+#define MEMP_NUM_TCP_SEG                40
+#endif
+/* lwIP structs hold pointers: align to the pointer size (8 on 64-bit) */
+#if defined(__SIZEOF_POINTER__) && __SIZEOF_POINTER__ == 8
+#define MEM_ALIGNMENT                   8
+#else
+#define MEM_ALIGNMENT                   4
+#endif
+#define MEMP_NUM_UDP_PCB                4
+#define MEMP_NUM_TCP_PCB_LISTEN         1
+#define TCP_SND_QUEUELEN                ((4 * (TCP_SND_BUF) + (TCP_MSS - 1)) / (TCP_MSS))
+
+/* ---- protocols ---- */
+#define LWIP_IPV4                       1
+#define LWIP_IPV6                       0
+#define LWIP_ARP                        1
+#define LWIP_ETHERNET                   1
+#define ARP_QUEUEING                    1
+#define LWIP_ICMP                       1
+#define LWIP_RAW                        0
+#define LWIP_UDP                        1
+#define LWIP_TCP                        1
+#define LWIP_IGMP                       0
+#define LWIP_DNS                        0
+#define LWIP_AUTOIP                     0
+#define LWIP_ACD                        0
+#define IP_FORWARD                      0
+#define IP_REASSEMBLY                   1
+#define IP_FRAG                         1
+
+/* TCP over a TCP tunnel: be patient, no aggressive retransmits. */
+#define TCP_MSS                         1460
+#define LWIP_TCP_KEEPALIVE              1
+#define TCP_MAXRTX                      12
+#define TCP_SYNMAXRTX                   6
+
+/* ---- DHCP ---- */
+#define LWIP_DHCP                       1
+#define LWIP_DHCP_DOES_ACD_CHECK        0
+#define LWIP_DHCP_CHECK_LINK_UP         1
+/* request classless static routes (RFC 3442) and the Microsoft variant */
+#define DHCP_ADD_EXTRA_REQUEST_OPTIONS  , 121, 249
+
+/* ---- netif ---- */
+#define LWIP_SINGLE_NETIF               0   /* routing goes through LWIP_HOOK_IP4_ROUTE_SRC */
+#define LWIP_HAVE_LOOPIF                0
+#define LWIP_NETIF_LOOPBACK             0
+#define LWIP_NETIF_STATUS_CALLBACK      1
+#define LWIP_NETIF_LINK_CALLBACK        0
+#define LWIP_NETIF_HOSTNAME             0
+
+#endif
diff --git a/port/lwip/nc_lwip_hooks.h b/port/lwip/nc_lwip_hooks.h
new file mode 100644
index 0000000..e848530
--- /dev/null
+++ b/port/lwip/nc_lwip_hooks.h
@@ -0,0 +1,24 @@
+/* lwIP hooks implemented by netcore/stack.c. */
+#ifndef VTESSE_NC_LWIP_HOOKS_H
+#define VTESSE_NC_LWIP_HOOKS_H
+
+#include "lwip/arch.h"
+#include "lwip/ip4_addr.h"
+
+struct netif;
+struct dhcp;
+struct dhcp_msg;
+struct pbuf;
+
+/* Only destinations covered by the route table go to the tunnel netif. */
+struct netif *nc_hook_ip4_route(const ip4_addr_t *src, const ip4_addr_t *dest);
+/* Next hop for off-subnet destinations (per-route gateway). */
+const ip4_addr_t *nc_hook_etharp_get_gw(struct netif *netif, const ip4_addr_t *dest);
+/* Options 121 / 249 in DHCP replies. */
+void nc_hook_dhcp_parse_option(struct netif *netif, struct dhcp *dhcp, u8_t state,
+                               struct dhcp_msg *msg, u8_t msg_type, u8_t option,
+                               u8_t len, struct pbuf *p, u16_t offset);
+
+/* The LWIP_HOOK_* macros are defined in lwipopts.h (ip4.h must see them). */
+
+#endif
diff --git a/scripts/S99vtesse b/scripts/S99vtesse
new file mode 100755
index 0000000..8e1134e
--- /dev/null
+++ b/scripts/S99vtesse
@@ -0,0 +1,44 @@
+#!/bin/sh
+# /etc/init.d/S99vtesse — start VTesse at boot (OpenIPC and other BusyBox systems).
+#
+#   /etc/init.d/S99vtesse start|stop|restart|status
+#
+# Runs the TAP backend with the hook scripts from /usr/share/vtesse.
+# Settings can be overridden in /etc/default/vtesse.
+
+DAEMON=/usr/bin/vtesse
+CONFIG=/etc/vtesse.conf
+PIDFILE=/var/run/vtesse.pid
+ARGS="--tap --ifname vtesse0 --hook /usr/share/vtesse/vtesse-hook.sh"
+[ -f /etc/default/vtesse ] && . /etc/default/vtesse
+
+start() {
+    if [ ! -f "$CONFIG" ]; then
+        echo "vtesse: $CONFIG not found, not starting"
+        return 1
+    fi
+    printf "Starting vtesse: "
+    start-stop-daemon -S -q -b -m -p "$PIDFILE" -x "$DAEMON" -- --config "$CONFIG" $ARGS \
+        && echo "OK" || echo "FAIL"
+}
+
+stop() {
+    printf "Stopping vtesse: "
+    start-stop-daemon -K -q -p "$PIDFILE" && echo "OK" || echo "not running"
+    rm -f "$PIDFILE"
+}
+
+case "$1" in
+    start)   start ;;
+    stop)    stop ;;
+    restart) stop; sleep 1; start ;;
+    status)
+        if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
+            echo "vtesse is running (pid $(cat "$PIDFILE"))"
+        else
+            echo "vtesse is not running"
+            exit 1
+        fi
+        ;;
+    *) echo "Usage: $0 {start|stop|restart|status}"; exit 1 ;;
+esac
diff --git a/scripts/vtesse-hook.sh b/scripts/vtesse-hook.sh
new file mode 100755
index 0000000..2cd9795
--- /dev/null
+++ b/scripts/vtesse-hook.sh
@@ -0,0 +1,76 @@
+#!/bin/sh
+# vtesse-cli --tap --hook scripts/vtesse-hook.sh
+#
+# Called as "$0 <event>" with VTESSE_IFNAME, VTESSE_LINK (ether|tun),
+# VTESSE_SESSION and VTESSE_EVENT in the environment:
+#   up         interface created (first tunnel UP): start the DHCP client
+#   reconnect  tunnel up again: forget neighbours (the remote bridge MAC may
+#              have changed), ask the DHCP client to renew
+#   down       tunnel lost (the interface stays, the lease is kept)
+#   stop       vtesse-cli exits: stop the DHCP client
+#
+# DHCP: BusyBox udhcpc with vtesse-udhcpc.script (address and option 121/249
+# routes only; DNS and the default route are left alone, see the script).
+# dhclient is a fallback: its stock script may rewrite /etc/resolv.conf with
+# the tunnel DNS and install a default route through the tunnel.
+# Manual IPv4 (ip=, gw=, route= in the vtesse-cli config; required for type tun,
+# which has no DHCP over L3) arrives as VTESSE_IP (A.B.C.D/P), VTESSE_GW and
+# VTESSE_ROUTES ("NET/P NET/P ..."): the address and routes are set here instead of
+# DHCP. Without routes and with VTESSE_GW a default route through the tunnel is
+# installed only with VTESSE_DEFAULT_ROUTE=1 (as in vtesse-udhcpc.script).
+
+IF=$VTESSE_IFNAME
+PIDFILE=/var/run/vtesse-dhcp.$IF.pid
+UDHCPC_SCRIPT=$(dirname "$0")/vtesse-udhcpc.script
+
+dhcp_start() {
+    if command -v udhcpc >/dev/null 2>&1; then
+        udhcpc -i "$IF" -b -p "$PIDFILE" -s "$UDHCPC_SCRIPT" -O staticroutes -O msstaticroutes
+    elif command -v dhclient >/dev/null 2>&1; then
+        dhclient -nw -pf "$PIDFILE" -lf "/var/lib/dhcp/vtesse.$IF.leases" "$IF"
+    else
+        echo "vtesse-hook: no DHCP client (udhcpc or dhclient) found" >&2
+        exit 1
+    fi
+}
+
+static_up() {
+    ip addr replace "$VTESSE_IP" dev "$IF"
+    for r in $VTESSE_ROUTES; do
+        if [ "$VTESSE_LINK" = tun ] || [ -z "$VTESSE_GW" ]; then
+            ip route replace "$r" dev "$IF"
+        else
+            ip route replace "$r" via "$VTESSE_GW" dev "$IF"
+        fi
+    done
+    if [ -z "$VTESSE_ROUTES" ] && [ -n "$VTESSE_GW" ] && [ "${VTESSE_DEFAULT_ROUTE:-0}" = 1 ]; then
+        ip route replace default via "$VTESSE_GW" dev "$IF"
+    fi
+}
+
+dhcp_pid() {
+    [ -f "$PIDFILE" ] && cat "$PIDFILE"
+}
+
+case "$1" in
+    up)
+        if [ -n "$VTESSE_IP" ]; then
+            static_up
+        elif [ "$VTESSE_LINK" = ether ]; then
+            dhcp_start
+        else
+            echo "vtesse-hook: type tun needs ip= (and route=) in the config" >&2
+        fi
+        ;;
+    reconnect)
+        ip neigh flush dev "$IF" 2>/dev/null
+        pid=$(dhcp_pid) && [ -n "$pid" ] && command -v udhcpc >/dev/null 2>&1 && kill -USR1 "$pid" 2>/dev/null
+        ;;
+    down)
+        ;;
+    stop)
+        pid=$(dhcp_pid) && [ -n "$pid" ] && kill "$pid" 2>/dev/null
+        rm -f "$PIDFILE"
+        ;;
+esac
+exit 0
diff --git a/scripts/vtesse-udhcpc.script b/scripts/vtesse-udhcpc.script
new file mode 100755
index 0000000..1d8c5fc
--- /dev/null
+++ b/scripts/vtesse-udhcpc.script
@@ -0,0 +1,55 @@
+#!/bin/sh
+# udhcpc script for VTesse tap interfaces (BusyBox udhcpc -s ...).
+#
+# Configures the address and the routes of the tunnel interface only:
+#  - never touches /etc/resolv.conf (the tunnel DNS must not replace the
+#    device's resolver: it may be unreachable and would break resolving the
+#    VTun server itself);
+#  - classless routes (option 121 "staticroutes", or 249 "msstaticroutes")
+#    are installed via the interface; with them the router option is ignored
+#    (RFC 3442);
+#  - a default route through the tunnel is installed only when
+#    VTESSE_DEFAULT_ROUTE=1: it would also capture the connection to the VTun
+#    server unless a host route to the server exists.
+
+STATE=/var/run/vtesse-routes.$interface
+
+routes_del() {
+    [ -f "$STATE" ] || return 0
+    while read -r dst gw; do
+        ip route del "$dst" via "$gw" dev "$interface" 2>/dev/null
+    done < "$STATE"
+    rm -f "$STATE"
+}
+
+routes_add() {
+    : > "$STATE"
+    list=${staticroutes:-$msstaticroutes}
+    if [ -n "$list" ]; then
+        set -- $list
+        while [ $# -ge 2 ]; do
+            ip route add "$1" via "$2" dev "$interface" && echo "$1 $2" >> "$STATE"
+            shift 2
+        done
+    elif [ -n "$router" ] && [ "$VTESSE_DEFAULT_ROUTE" = 1 ]; then
+        set -- $router
+        ip route add default via "$1" dev "$interface" metric 500 && echo "default $1" >> "$STATE"
+    fi
+}
+
+case "$1" in
+    deconfig)
+        routes_del
+        ip -4 addr flush dev "$interface"
+        ip link set "$interface" up
+        ;;
+    bound|renew)
+        if ! ip -4 addr show dev "$interface" | grep -q "inet $ip/"; then
+            ip -4 addr flush dev "$interface"
+            ip addr add "$ip/${mask:-24}" ${broadcast:+broadcast "$broadcast"} dev "$interface"
+        fi
+        routes_del
+        routes_add
+        ;;
+esac
+exit 0
diff --git a/scripts/vtesse.init b/scripts/vtesse.init
new file mode 100755
index 0000000..b7767c1
--- /dev/null
+++ b/scripts/vtesse.init
@@ -0,0 +1,21 @@
+#!/bin/sh /etc/rc.common
+# /etc/init.d/vtesse — VTesse service for OpenWrt (procd).
+#
+#   /etc/init.d/vtesse enable && /etc/init.d/vtesse start
+#
+# Runs the TAP backend with the hook scripts from /usr/share/vtesse and
+# restarts it if it exits.
+
+START=99
+USE_PROCD=1
+
+start_service() {
+    [ -f /etc/vtesse.conf ] || { echo "vtesse: /etc/vtesse.conf not found"; return 1; }
+    procd_open_instance
+    procd_set_param command /usr/bin/vtesse --config /etc/vtesse.conf \
+        --tap --ifname vtesse0 --hook /usr/share/vtesse/vtesse-hook.sh
+    procd_set_param respawn
+    procd_set_param stdout 1
+    procd_set_param stderr 1
+    procd_close_instance
+}
diff --git a/server/README.md b/server/README.md
new file mode 100644
index 0000000..4e6144a
--- /dev/null
+++ b/server/README.md
@@ -0,0 +1,54 @@
+# VTun server (vtund) with VTesse patches
+
+VTesse talks to an unmodified VTun server, but every vtund **we** build — the
+Docker test bench and the release binaries — is VTun with the patches from
+[`patches/`](patches/). There is one build script for all of them:
+
+```sh
+server/build-vtund.sh build/vtund                                  # native
+server/build-vtund.sh --cross /path/to/bin/aarch64-linux- --static build/vtund-arm64
+server/build-vtund.sh --version                                    # VTun version it builds: 3.0.2
+```
+
+It downloads the original `vtun-3.0.2.tar.gz` (sha256 checked), applies every
+`patches/vtun-3.0.2-*.patch` in name order — the build fails if there is none or one
+does not apply — and configures VTun like the target deployment: no OpenSSL (XOR
+challenge response), no LZO, no zlib. Requirements: a C compiler, `bison`, `flex`,
+`patch`, `curl`; for `--cross` also `autotools-dev` or `automake` (current
+`config.sub`/`config.guess`; the 2001 ones in the tarball do not know aarch64 or musl).
+
+## Releases
+
+CI builds a static musl vtund for PCs and servers only (x86_64, `ci/build-musl.sh`)
+and attaches it to the [`latest`](https://github.com/compot-dev/vtesse/releases/tag/latest)
+release as `vtund-<VTun version>-x86_64`, e.g. `vtund-3.0.2-x86_64`. The name carries the
+original VTun version, not the VTesse version; the applied patches are listed below.
+The binary reports itself as upstream does (`VTun ver 3.X <build date>`),
+and the protocol is unchanged, so stock and patched servers and clients mix freely.
+
+Cameras and routers: vtund is not released for them; when needed it is built in the
+OpenIPC environment with the same patches, e.g. with the OpenIPC toolchain:
+
+```sh
+server/build-vtund.sh --cross /path/to/toolchain/bin/arm-openipc-linux-musleabi- --static vtund
+VTUND=1 ci/build-musl.sh arm32      # or together with VTesse, OpenIPC toolchain downloaded by the script
+```
+
+## Patches
+
+| Patch | What it does |
+|---|---|
+| [`vtun-3.0.2-denied-log.patch`](patches/vtun-3.0.2-denied-log.patch) | A refused login is logged with the session name the client sent and the reason instead of only `Denied connection from IP:PORT` (#22). |
+
+Log lines with `vtun-3.0.2-denied-log.patch`:
+
+```
+Denied connection from 172.28.0.1:33016: session 02BE0C000001: wrong password
+Denied connection from 172.28.0.1:53086: session 02BE0C0000FF: unknown session
+Denied connection from 172.28.0.1:42658: session 02BE0C000005: already connected (multi no) or lock error
+Denied connection from 172.28.0.1:40112: no session name received
+```
+
+A new patch: `patches/vtun-<version>-<topic>.patch`, `-p1` against the unpacked
+tarball, with a first line that summarises it, a row in the table above and an entry
+in [CHANGELOG.md](../CHANGELOG.md).
diff --git a/server/build-vtund.sh b/server/build-vtund.sh
new file mode 100755
index 0000000..5d7507f
--- /dev/null
+++ b/server/build-vtund.sh
@@ -0,0 +1,86 @@
+#!/bin/sh
+# Build the VTun server (vtund) with our patches. Every vtund build in this
+# repository goes through this script: the bench image and the CI release builds.
+#
+#   server/build-vtund.sh [--cross PREFIX] [--static] OUTFILE
+#
+#   --cross PREFIX  cross compiler prefix, e.g. /opt/tc/bin/aarch64-linux-  (default: native cc)
+#   --static        link statically
+#
+# Downloads vtun-$VTUN_VERSION.tar.gz (cached in $VTUN_CACHE, sha256 checked),
+# applies every server/patches/vtun-$VTUN_VERSION-*.patch in name order (the build
+# fails if there are none or one does not apply) and configures it like the target
+# deployment: no OpenSSL (XOR challenge response), no LZO, no zlib.
+# Needs bison and flex; for --cross also current config.sub/config.guess
+# (autotools-dev or automake), since the 2001 ones in the tarball do not know
+# aarch64 or musl.
+#
+#   server/build-vtund.sh --version   prints the VTun version this script builds
+set -eu
+
+VTUN_VERSION=3.0.2
+VTUN_SHA256=db26d4dbc35a2b3d65519f68b8ae55c80d7ec4e6569aeec7a432aa82f24c56d6
+VTUN_URL=http://prdownloads.sourceforge.net/vtun/vtun-$VTUN_VERSION.tar.gz
+HERE=$(cd "$(dirname "$0")" && pwd)
+CACHE=${VTUN_CACHE:-$HOME/.cache/vtesse-vtun}
+
+CROSS= STATIC=0 OUT=
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --cross) CROSS=$2; shift ;;
+        --static) STATIC=1 ;;
+        --version) echo "$VTUN_VERSION"; exit 0 ;;
+        -*) echo "unknown option: $1" >&2; exit 2 ;;
+        *) OUT=$1 ;;
+    esac
+    shift
+done
+[ -n "$OUT" ] || { sed -n '5,10p' "$0"; exit 2; }
+case "$OUT" in /*) ;; *) OUT=$(pwd)/$OUT ;; esac
+
+PATCHES=$(ls "$HERE"/patches/vtun-"$VTUN_VERSION"-*.patch 2>/dev/null || true)
+[ -n "$PATCHES" ] || { echo "no patches for vtun $VTUN_VERSION in $HERE/patches" >&2; exit 1; }
+
+TARBALL=$CACHE/vtun-$VTUN_VERSION.tar.gz
+if ! echo "$VTUN_SHA256  $TARBALL" | sha256sum -c - >/dev/null 2>&1; then
+    mkdir -p "$CACHE"
+    curl -fsSL --retry 3 -o "$TARBALL.tmp" "$VTUN_URL"
+    echo "$VTUN_SHA256  $TARBALL.tmp" | sha256sum -c - >/dev/null \
+        || { echo "sha256 mismatch for $VTUN_URL" >&2; rm -f "$TARBALL.tmp"; exit 1; }
+    mv "$TARBALL.tmp" "$TARBALL"
+fi
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+tar -xzf "$TARBALL" -C "$WORK"
+SRC=$WORK/vtun-$VTUN_VERSION
+cd "$SRC"
+for p in $PATCHES; do
+    echo "applying $(basename "$p")"
+    patch -p1 --no-backup-if-mismatch --quiet < "$p"
+done
+
+BUILD_TRIPLE=$(uname -m)-pc-linux-gnu
+set -- --build="$BUILD_TRIPLE" --disable-lzo --disable-zlib --disable-ssl --prefix=''
+CC=${CROSS}gcc STRIP=${CROSS}strip
+if [ -n "$CROSS" ]; then
+    for f in config.sub config.guess; do
+        new=$(ls /usr/share/misc/$f /usr/share/automake-*/$f 2>/dev/null | head -1)
+        [ -n "$new" ] || { echo "$f not found: install autotools-dev or automake" >&2; exit 1; }
+        cp "$new" "$f"
+    done
+    HOST=$("$CC" -dumpmachine)
+    set -- "$@" --host="$HOST"
+    [ "$(uname -m)" = x86_64 ] && BUILD_TRIPLE=x86_64-pc-linux-gnu
+fi
+# The vtun Makefile sets LDFLAGS to @LIBS@ and links with $(CFLAGS): -static goes in CFLAGS.
+CFLAGS="-Os -fcommon -std=gnu89"
+[ $STATIC = 1 ] && CFLAGS="$CFLAGS -static"
+# -fcommon: the 2008 sources define globals in headers (modern GCC defaults to -fno-common);
+# -std=gnu89: they also rely on implicit declarations, an error in C99+ since GCC 14.
+CC=$CC CFLAGS=$CFLAGS ./configure "$@" >configure.log 2>&1 \
+    || { tail -30 configure.log; exit 1; }
+make -s >make.log 2>&1 || { tail -30 make.log; exit 1; }
+mkdir -p "$(dirname "$OUT")"
+"$STRIP" --strip-unneeded -o "$OUT" vtund
+echo "$(basename "$OUT"): vtun $VTUN_VERSION + $(echo "$PATCHES" | wc -l) patch(es), $(wc -c < "$OUT") bytes"
diff --git a/server/patches/vtun-3.0.2-denied-log.patch b/server/patches/vtun-3.0.2-denied-log.patch
new file mode 100644
index 0000000..dbdf427
--- /dev/null
+++ b/server/patches/vtun-3.0.2-denied-log.patch
@@ -0,0 +1,135 @@
+vtund server: say who was denied and why.
+
+Stock 3.0.2 logs a failed login only as "Denied connection from IP:PORT", so a
+wrong password, an unknown session and a refused second login look the same
+and the device cannot be identified. Log the session name the client sent
+(sanitised to printable ASCII) and the reason:
+
+  Denied connection from 1.2.3.4:5678: session 02BE0C000001: wrong password
+  Denied connection from 1.2.3.4:5678: session 02BE0C0000FF: unknown session
+  Denied connection from 1.2.3.4:5678: session 02BE0C000005: already connected (multi no) or lock error
+  Denied connection from 1.2.3.4:5678: no session name received
+
+The wire protocol is unchanged: the client still gets a bare "ERR".
+
+--- a/auth.h
++++ b/auth.h
+@@ -26,5 +26,5 @@
+ #define ST_HOST  1
+ #define ST_CHAL  2
+ 
+-struct vtun_host * auth_server(int fd);
++struct vtun_host * auth_server(int fd, char *why, int why_len);
+ int auth_client(int fd, struct vtun_host *host);
+--- a/auth.c
++++ b/auth.c
+@@ -309,17 +309,32 @@
+      return 1;
+ }   
+ 
+-/* Authentication (Server side) */
+-struct vtun_host * auth_server(int fd)
++/* Client-supplied session name, made safe for syslog: printable ASCII only. */
++static void log_name(char *dst, int len, const char *src)
++{
++	int i;
++
++	for(i=0; i < len-1 && src[i]; i++)
++	   dst[i] = ((unsigned char)src[i] > 0x20 && (unsigned char)src[i] < 0x7f) ? src[i] : '?';
++	dst[i] = '\0';
++}
++
++/* Authentication (Server side).
++ * On failure returns NULL and leaves the reason, with the session name the
++ * client sent, in why[] for the "Denied connection" log line. */
++struct vtun_host * auth_server(int fd, char *why, int why_len)
+ {
+         char chal_req[VTUN_CHAL_SIZE], chal_res[VTUN_CHAL_SIZE];	
+ 	char buf[VTUN_MESG_SIZE], *str1, *str2;
+         struct vtun_host *h = NULL;
+ 	char *host = NULL;
++	char name[VTUN_MESG_SIZE];
+ 	int  stage;
+ 
+         set_title("authentication");
+ 
++	snprintf(why, why_len, "no session name received");
++
+ 	print_p(fd,"VTUN server ver %s\n",VTUN_VER);
+ 
+ 	stage = ST_HOST;
+@@ -337,6 +352,8 @@
+ 	     case ST_HOST:
+ 	        if( !strcmp(str1,"HOST") ){
+ 		   host = strdup(str2);
++		   log_name(name, sizeof(name), host);
++		   snprintf(why, why_len, "session %s: no challenge response", name);
+ 
+ 		   gen_chal(chal_req);
+ 		   print_p(fd,"OK CHAL: %s\n", cl2cs(chal_req));
+@@ -347,11 +364,15 @@
+ 		break;
+ 	     case ST_CHAL:
+ 	        if( !strcmp(str1,"CHAL") ){
+-		   if( !cs2cl(str2,chal_res) )
++		   if( !cs2cl(str2,chal_res) ){
++		      snprintf(why, why_len, "session %s: malformed challenge response", name);
+ 		      break; 
++		   }
+ 		   
+-		   if( !(h = find_host(host)) )
++		   if( !(h = find_host(host)) ){
++		      snprintf(why, why_len, "session %s: unknown session", name);
+ 		      break;
++		   }
+ 
+ 		   decrypt_chal(chal_res, h->passwd);   		
+ 	
+@@ -361,12 +382,15 @@
+ 		      /* Lock host */	
+ 		      if( lock_host(h) < 0 ){
+ 		         /* Multiple connections are denied */
++		         snprintf(why, why_len, "session %s: already connected (multi no) or lock error", name);
+ 		         h = NULL;
+ 		         break;
+ 		      }	
+ 		      print_p(fd,"OK FLAGS: %s\n", bf2cf(h)); 
+- 		   } else
++ 		   } else {
++		      snprintf(why, why_len, "session %s: wrong password", name);
+ 		      h = NULL;
++		   }
+ 	        }
+ 		break;
+  	   }
+--- a/server.c
++++ b/server.c
+@@ -62,7 +62,7 @@
+      struct sockaddr_in my_addr, cl_addr;
+      struct vtun_host *host;
+      struct sigaction sa;
+-     char *ip;
++     char *ip, why[VTUN_MESG_SIZE + 64];
+      int opt;
+ 
+      opt = sizeof(struct sockaddr_in);
+@@ -80,7 +80,7 @@
+ 
+      io_init();
+ 
+-     if( (host=auth_server(sock)) ){	
++     if( (host=auth_server(sock, why, sizeof(why))) ){	
+         sa.sa_handler=SIG_IGN;
+ 	sa.sa_flags=SA_NOCLDWAIT;;
+         sigaction(SIGHUP,&sa,NULL);
+@@ -102,8 +102,8 @@
+ 	/* Unlock host. (locked in auth_server) */	
+ 	unlock_host(host);
+      } else {
+-        vtun_syslog(LOG_INFO,"Denied connection from %s:%d", ip,
+-					ntohs(cl_addr.sin_port) );
++        vtun_syslog(LOG_INFO,"Denied connection from %s:%d: %s", ip,
++					ntohs(cl_addr.sin_port), why );
+      }
+      close(sock);
+ 
diff --git a/tests/test_client.c b/tests/test_client.c
new file mode 100644
index 0000000..bf3c540
--- /dev/null
+++ b/tests/test_client.c
@@ -0,0 +1,563 @@
+/*
+ * vtun_client scenarios against a scripted VTun server running in a child
+ * process on a loopback socket.
+ */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "netcore/loop.h"
+#include "unit.h"
+#include "vtesse/vtun_client.h"
+
+#define PASSWORD "testpassword-0123456789"
+#define SESSION  "02BE0C000001"
+
+static const uint8_t server_chal[VT_CHAL_SIZE] = {
+    0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
+    0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff
+};
+
+/* ---------- scripted server (child process, blocking I/O) ---------- */
+
+static void die(const char *what)
+{
+    fprintf(stderr, "server: %s\n", what);
+    _exit(1);
+}
+
+static void sleep_ms(int ms)
+{
+    struct timespec ts;
+
+    ts.tv_sec = ms / 1000;
+    ts.tv_nsec = (long)(ms % 1000) * 1000000L;
+    nanosleep(&ts, NULL);
+}
+
+static void srv_write(int fd, const void *p, size_t n)
+{
+    if (write(fd, p, n) != (ssize_t)n)
+        die("write");
+}
+
+static void srv_read(int fd, void *p, size_t n)
+{
+    size_t got = 0;
+
+    while (got < n) {
+        ssize_t r = read(fd, (uint8_t *)p + got, n - got);
+        if (r <= 0)
+            die("read");
+        got += (size_t)r;
+    }
+}
+
+static void srv_mesg(int fd, const char *text)
+{
+    uint8_t m[VT_MESG_SIZE];
+
+    memset(m, 0, sizeof(m));
+    memcpy(m, text, strlen(text));
+    srv_write(fd, m, sizeof(m));
+}
+
+static void srv_flag(int fd, uint16_t flag)
+{
+    uint8_t h[2];
+
+    vt_hdr_put(h, flag);
+    srv_write(fd, h, 2);
+}
+
+/* Full handshake; final_reply is sent after a correct CHAL response. */
+static void srv_handshake(int fd, const char *final_reply)
+{
+    uint8_t m[VT_MESG_SIZE], expect[VT_CHAL_SIZE], got[VT_CHAL_SIZE];
+    char text[VT_CHAL_TEXT_SIZE], line[VT_MESG_SIZE + 16];
+    int i;
+
+    srv_mesg(fd, "VTUN server ver 3.X 10/13/2026\n");
+    srv_read(fd, m, sizeof(m));
+    if (memcmp(m, "HOST: " SESSION "\n", 19) != 0)
+        die("bad HOST");
+    for (i = 19; i < VT_MESG_SIZE; i++)
+        if (m[i])
+            die("HOST not NUL padded");
+    vt_chal_encode(server_chal, text);
+    snprintf(line, sizeof(line), "OK CHAL: %s\n", text);
+    srv_mesg(fd, line);
+    srv_read(fd, m, sizeof(m));
+    m[VT_MESG_SIZE - 1] = 0;
+    if (strncmp((char *)m, "CHAL: ", 6) != 0 || vt_chal_decode((char *)m, got) != 0)
+        die("bad CHAL");
+    memcpy(expect, server_chal, sizeof(expect));
+    vt_chal_xor(expect, PASSWORD);
+    if (memcmp(expect, got, sizeof(got)) != 0)
+        die("wrong XOR response");
+    srv_mesg(fd, final_reply);
+}
+
+/* Read frames until a data frame arrives; flag frames are recorded. */
+static size_t srv_read_data(int fd, uint8_t *buf, size_t cap, int *seen_req, int *seen_rep)
+{
+    for (;;) {
+        uint8_t h[2];
+        uint16_t hdr, len;
+
+        srv_read(fd, h, 2);
+        hdr = vt_hdr_get(h);
+        if (hdr & VT_FLAGS_MASK) {
+            if (hdr & VT_ECHO_REQ)
+                (*seen_req)++;
+            if (hdr & VT_ECHO_REP)
+                (*seen_rep)++;
+            continue;
+        }
+        len = hdr & VT_FSIZE_MASK;
+        if (len > cap)
+            die("frame too large");
+        srv_read(fd, buf, len);
+        return len;
+    }
+}
+
+typedef void (*script_fn)(int listen_fd);
+
+static pid_t start_server(script_fn script, uint16_t *port)
+{
+    struct sockaddr_in a;
+    socklen_t l = sizeof(a);
+    int one = 1, lfd = socket(AF_INET, SOCK_STREAM, 0);
+    pid_t pid;
+
+    memset(&a, 0, sizeof(a));
+    a.sin_family = AF_INET;
+    a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+    if (bind(lfd, (struct sockaddr *)&a, sizeof(a)) < 0 || listen(lfd, 4) < 0 ||
+        getsockname(lfd, (struct sockaddr *)&a, &l) < 0) {
+        perror("listen");
+        exit(1);
+    }
+    *port = ntohs(a.sin_port);
+    pid = fork();
+    if (pid == 0) {
+        alarm(10);
+        script(lfd);
+        _exit(0);
+    }
+    close(lfd);
+    return pid;
+}
+
+static int server_status(pid_t pid)
+{
+    int st = 0;
+
+    waitpid(pid, &st, 0);
+    return WIFEXITED(st) ? WEXITSTATUS(st) : 128;
+}
+
+/* ---------- client side ---------- */
+
+typedef struct rec {
+    int events[32];
+    int errs[32];
+    int nev;
+    uint8_t rx[8][64];
+    size_t rxlen[8];
+    int nrx;
+} rec_t;
+
+static void on_event(void *user, int ev, int err)
+{
+    rec_t *r = user;
+
+    if (r->nev < 32) {
+        r->events[r->nev] = ev;
+        r->errs[r->nev++] = err;
+    }
+}
+
+static void on_rx(void *user, const uint8_t *p, size_t n)
+{
+    rec_t *r = user;
+
+    if (r->nrx < 8 && n <= 64) {
+        memcpy(r->rx[r->nrx], p, n);
+        r->rxlen[r->nrx++] = n;
+    }
+}
+
+static int last_event(const rec_t *r)
+{
+    return r->nev ? r->events[r->nev - 1] : 0;
+}
+
+static vt_t *make_client(uint16_t port, rec_t *r, int no_reconnect)
+{
+    vt_cfg_t cfg;
+    vt_t *vt;
+    int err;
+    tunnel_t t;
+
+    memset(&cfg, 0, sizeof(cfg));
+    cfg.host = "127.0.0.1";
+    cfg.port = port;
+    cfg.session = SESSION;
+    cfg.password = PASSWORD;
+    cfg.auth = VT_AUTH_XOR;
+    cfg.handshake_timeout_ms = 400;
+    cfg.ka_interval_ms = 200;
+    cfg.ka_count = 3;
+    cfg.data_delay_ms = 200;
+    cfg.reconnect_min_ms = 100;
+    cfg.no_reconnect = no_reconnect;
+    vt = vt_create(&cfg, &err);
+    if (!vt) {
+        fprintf(stderr, "vt_create: %s\n", tunnel_strerror(err));
+        exit(1);
+    }
+    memset(r, 0, sizeof(*r));
+    t = vt_tunnel(vt);
+    t.ops->set_event_cb(vt, on_event, r);
+    t.ops->set_rx_cb(vt, on_rx, r);
+    return vt;
+}
+
+/* Run the loop until pred() is true or timeout_ms passes. */
+static int run_until(vt_t *vt, int (*pred)(vt_t *, rec_t *), rec_t *r, int timeout_ms)
+{
+    nc_loop_t loop;
+    tunnel_t t = vt_tunnel(vt);
+    nc_source_t s = nc_source_from_tunnel(&t);
+    uint64_t end = nc_now_ms() + (uint64_t)timeout_ms;
+
+    nc_loop_init(&loop);
+    nc_loop_add(&loop, &s);
+    while (nc_now_ms() < end) {
+        if (pred(vt, r))
+            return 1;
+        nc_loop_run_once(&loop, 20);
+    }
+    return pred(vt, r);
+}
+
+static int pred_up(vt_t *vt, rec_t *r) { (void)r; return vt_is_up(vt); }
+static int pred_failed(vt_t *vt, rec_t *r) { (void)vt; return last_event(r) == TUNNEL_EV_FAILED; }
+static int pred_rx2(vt_t *vt, rec_t *r) { (void)vt; return r->nrx >= 2; }
+static int pred_ups2(vt_t *vt, rec_t *r)
+{
+    int i, n = 0;
+
+    (void)vt;
+    for (i = 0; i < r->nev; i++)
+        n += r->events[i] == TUNNEL_EV_UP;
+    return n >= 2;
+}
+
+/* ---------- scenarios ---------- */
+
+static void script_happy(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL), req = 0, rep = 0;
+    uint8_t buf[64], big[3000];
+    size_t n;
+
+    srv_handshake(fd, "OK FLAGS: <TeK>\n");
+    srv_flag(fd, VT_ECHO_REQ);
+    /* data frame split across two writes */
+    srv_write(fd, "\x00\x05", 2);
+    sleep_ms(30);
+    srv_write(fd, "hello", 5);
+    /* oversized frame (3000 > 2148) must be skipped, framing preserved */
+    memset(big, 0xab, sizeof(big));
+    srv_write(fd, "\x0b\xb8", 2);
+    srv_write(fd, big, sizeof(big));
+    srv_write(fd, "\x00\x05" "after", 7);
+    /* client data frame after the data delay */
+    n = srv_read_data(fd, buf, sizeof(buf), &req, &rep);
+    if (n != 4 || memcmp(buf, "ping", 4) != 0)
+        die("bad client frame");
+    if (req < 1 || rep < 1)
+        die("missing ECHO_REQ/ECHO_REP from client");
+    srv_flag(fd, VT_CONN_CLOSE);
+    sleep_ms(100);
+    close(fd);
+}
+
+static void test_happy_path(void)
+{
+    uint16_t port;
+    pid_t pid = start_server(script_happy, &port);
+    rec_t r;
+    vt_t *vt = make_client(port, &r, 1);
+    tunnel_t t = vt_tunnel(vt);
+    uint64_t t0;
+
+    t0 = nc_now_ms();
+    vt_start(vt);
+    CHECK_EQ_INT(t.ops->send(vt, (const uint8_t *)"early", 5), -1);   /* not up */
+    /* frames are delivered while UP is still held back by the data delay */
+    CHECK(run_until(vt, pred_rx2, &r, 2000));
+    CHECK(!vt_is_up(vt));
+    CHECK_EQ_INT(t.ops->send(vt, (const uint8_t *)"early", 5), -1);
+    CHECK_EQ_INT(r.nrx, 2);
+    CHECK(r.rxlen[0] == 5 && memcmp(r.rx[0], "hello", 5) == 0);
+    CHECK(r.rxlen[1] == 5 && memcmp(r.rx[1], "after", 5) == 0);
+
+    CHECK(run_until(vt, pred_up, &r, 2000));
+    CHECK(nc_now_ms() - t0 >= 190);                                    /* data delay */
+    CHECK_EQ_INT(t.ops->link_type(vt), TUNNEL_LINK_L2);
+    CHECK_EQ_STR(vt_greeting(vt), "VTUN server ver 3.X 10/13/2026");
+    CHECK_EQ_INT(vt_session_flags(vt)->type, 'e');
+    CHECK_EQ_INT(t.ops->send(vt, (const uint8_t *)"ping", 4), 0);
+    CHECK(run_until(vt, pred_failed, &r, 2000));
+    CHECK_EQ_INT(r.errs[r.nev - 1], TUNNEL_ERR_PEER_CLOSED);
+    CHECK_EQ_INT(r.events[0], TUNNEL_EV_CONNECTING);
+    CHECK_EQ_INT(r.events[1], TUNNEL_EV_UP);
+    CHECK_EQ_INT(server_status(pid), 0);
+    vt_destroy(vt);
+}
+
+static void script_err(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    srv_handshake(fd, "ERR\n");
+    sleep_ms(100);
+    close(fd);
+}
+
+static void script_compress(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    srv_handshake(fd, "OK FLAGS: <TeC9K>\n");
+    sleep_ms(100);
+    close(fd);
+}
+
+static void script_bad_greeting(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    srv_mesg(fd, "SSH-2.0-OpenSSH\n");
+    sleep_ms(100);
+    close(fd);
+}
+
+static void script_silent(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    sleep_ms(1500);
+    close(fd);
+}
+
+static void expect_failure(script_fn script, int want_err, int no_reconnect)
+{
+    uint16_t port;
+    pid_t pid = start_server(script, &port);
+    rec_t r;
+    vt_t *vt = make_client(port, &r, no_reconnect);
+
+    vt_start(vt);
+    CHECK(run_until(vt, pred_failed, &r, 3000));
+    CHECK_EQ_INT(r.errs[r.nev - 1], want_err);
+    vt_destroy(vt);
+    kill(pid, SIGTERM);
+    server_status(pid);
+}
+
+static void test_auth_error_is_final(void)
+{
+    /* ERR must not be retried even with reconnect enabled */
+    expect_failure(script_err, TUNNEL_ERR_AUTH, 0);
+}
+
+static void test_compression_refused(void)
+{
+    expect_failure(script_compress, TUNNEL_ERR_COMPRESSION, 0);
+}
+
+/* A server built with OpenSSL can switch encryption on for a session; the bench
+ * server (--disable-ssl) cannot, so this synthetic one stands in (#9). */
+static void script_encrypt(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    srv_handshake(fd, "OK FLAGS: <TeKE1>\n");
+    sleep_ms(100);
+    close(fd);
+}
+
+static void test_encryption_refused(void)
+{
+    expect_failure(script_encrypt, TUNNEL_ERR_ENCRYPTION, 0);
+}
+
+static void test_bad_greeting(void)
+{
+    expect_failure(script_bad_greeting, TUNNEL_ERR_PROTOCOL, 0);
+}
+
+static void test_handshake_timeout(void)
+{
+    expect_failure(script_silent, TUNNEL_ERR_TIMEOUT, 1);
+}
+
+static void script_keepalive_dead(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    srv_handshake(fd, "OK FLAGS: <TuK>\n");
+    sleep_ms(2000);     /* never answer */
+    close(fd);
+}
+
+static void test_keepalive_timeout(void)
+{
+    uint16_t port;
+    pid_t pid = start_server(script_keepalive_dead, &port);
+    rec_t r;
+    vt_t *vt = make_client(port, &r, 1);
+    uint64_t t0;
+
+    t0 = nc_now_ms();
+    vt_start(vt);
+    CHECK(run_until(vt, pred_up, &r, 2000));
+    CHECK_EQ_INT(vt_tunnel(vt).ops->link_type(vt), TUNNEL_LINK_L3);
+    CHECK(run_until(vt, pred_failed, &r, 3000));
+    CHECK_EQ_INT(r.errs[r.nev - 1], TUNNEL_ERR_KEEPALIVE);
+    CHECK(nc_now_ms() - t0 >= 550);    /* 3 x 200 ms of silence after OK FLAGS */
+    vt_destroy(vt);
+    kill(pid, SIGTERM);
+    server_status(pid);
+}
+
+static void script_reconnect(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL);
+
+    close(fd);                          /* first attempt: dropped at once */
+    fd = accept(lfd, NULL, NULL);
+    srv_handshake(fd, "OK FLAGS: <TeK>\n");
+    sleep_ms(300);                      /* client reports UP after the data delay */
+    srv_flag(fd, VT_CONN_CLOSE);        /* e.g. taken over by killold */
+    fd = accept(lfd, NULL, NULL);
+    srv_handshake(fd, "OK FLAGS: <TeK>\n");
+    sleep_ms(1000);
+    close(fd);
+}
+
+static void test_reconnect(void)
+{
+    uint16_t port;
+    pid_t pid = start_server(script_reconnect, &port);
+    rec_t r;
+    vt_t *vt = make_client(port, &r, 0);
+    int i, downs = 0;
+
+    vt_start(vt);
+    CHECK(run_until(vt, pred_ups2, &r, 4000));
+    for (i = 0; i < r.nev; i++) {
+        if (r.events[i] == TUNNEL_EV_DOWN) {
+            downs++;
+            CHECK_EQ_INT(r.errs[i], TUNNEL_ERR_PEER_CLOSED);
+        }
+        CHECK(r.events[i] != TUNNEL_EV_FAILED);
+    }
+    CHECK_EQ_INT(downs, 2);
+    vt_tunnel(vt).ops->close(vt);
+    vt_destroy(vt);
+    kill(pid, SIGTERM);
+    server_status(pid);
+}
+
+static void script_network_change(int lfd)
+{
+    int fd = accept(lfd, NULL, NULL), fd2;
+
+    srv_handshake(fd, "OK FLAGS: <TeK>\n");
+    /* the first connection stays open on our side: the client drops it itself */
+    fd2 = accept(lfd, NULL, NULL);
+    srv_handshake(fd2, "OK FLAGS: <TeK>\n");
+    sleep_ms(1000);
+    close(fd2);
+    close(fd);
+}
+
+static void test_network_changed(void)
+{
+    uint16_t port;
+    pid_t pid = start_server(script_network_change, &port);
+    rec_t r;
+    vt_t *vt = make_client(port, &r, 0);
+    uint64_t t0;
+    int i, downs = 0;
+
+    vt_start(vt);
+    CHECK(run_until(vt, pred_up, &r, 2000));
+    t0 = nc_now_ms();
+    vt_network_changed(vt);
+    CHECK(!vt_is_up(vt));
+    CHECK(run_until(vt, pred_ups2, &r, 2000));
+    /* well before the keepalive timeout (600 ms) could explain a reconnect */
+    CHECK(nc_now_ms() - t0 < 500);
+    for (i = 0; i < r.nev; i++)
+        if (r.events[i] == TUNNEL_EV_DOWN) {
+            downs++;
+            CHECK_EQ_INT(r.errs[i], TUNNEL_ERR_NETWORK);
+        }
+    CHECK_EQ_INT(downs, 1);
+    vt_tunnel(vt).ops->close(vt);
+    vt_network_changed(vt);             /* stopped: no effect */
+    CHECK(!vt_is_up(vt));
+    vt_destroy(vt);
+    kill(pid, SIGTERM);
+    server_status(pid);
+}
+
+static void test_config_validation(void)
+{
+    vt_cfg_t cfg;
+    int err;
+
+    memset(&cfg, 0, sizeof(cfg));
+    cfg.host = "127.0.0.1";
+    cfg.port = 1;
+    cfg.session = "bad name";
+    cfg.password = "x";
+    CHECK(vt_create(&cfg, &err) == NULL);
+    CHECK_EQ_INT(err, TUNNEL_ERR_CONFIG);
+    cfg.session = SESSION;
+    cfg.password = "";
+    CHECK(vt_create(&cfg, &err) == NULL);
+    CHECK_EQ_INT(err, TUNNEL_ERR_CONFIG);
+}
+
+int main(void)
+{
+    signal(SIGPIPE, SIG_IGN);
+    RUN(test_config_validation);
+    RUN(test_happy_path);
+    RUN(test_network_changed);
+    RUN(test_auth_error_is_final);
+    RUN(test_compression_refused);
+    RUN(test_encryption_refused);
+    RUN(test_bad_greeting);
+    RUN(test_handshake_timeout);
+    RUN(test_keepalive_timeout);
+    RUN(test_reconnect);
+    return UNIT_SUMMARY();
+}
diff --git a/tests/test_proto.c b/tests/test_proto.c
new file mode 100644
index 0000000..098192c
--- /dev/null
+++ b/tests/test_proto.c
@@ -0,0 +1,173 @@
+#include <stdint.h>
+
+#include "netcore/tunnel.h"
+#include "unit.h"
+#include "vtesse/vtun_proto.h"
+
+/* Captured from the stock VTun 3.0.2 client on the bench (bench/vectors). */
+#define REF_PASSWORD "c79e01d2e49d80eafd192c043c5142bd5a65b5a9"
+#define REF_CHAL     "OK CHAL: <djhdglocepfoaejahdbnealodcbnjgbl>\n"
+#define REF_RESP     "<fkeefcihhpgpgakcbgcjhjnkakcnpdhk>"
+
+static void test_mesg_build(void)
+{
+    uint8_t m[VT_MESG_SIZE];
+    char name43[44];
+    int i;
+
+    CHECK_EQ_INT(vt_mesg_build(m, "HOST: ", "02BE0C000001"), 0);
+    CHECK(memcmp(m, "HOST: 02BE0C000001\n", 19) == 0);
+    for (i = 19; i < VT_MESG_SIZE; i++)
+        CHECK_EQ_INT(m[i], 0);
+
+    memset(name43, 'A', 43);
+    name43[43] = '\0';
+    CHECK_EQ_INT(vt_mesg_build(m, "HOST: ", name43), -1);   /* 6 + 43 + 1 > 49 */
+    name43[42] = '\0';
+    CHECK_EQ_INT(vt_mesg_build(m, "HOST: ", name43), 0);    /* exactly 49 */
+    CHECK_EQ_INT(m[48], '\n');
+    CHECK_EQ_INT(m[49], 0);
+}
+
+static void test_session_name(void)
+{
+    char n[44];
+
+    CHECK(vt_session_name_valid("02BE0C000001"));
+    CHECK(!vt_session_name_valid(""));
+    CHECK(!vt_session_name_valid("a b"));
+    CHECK(!vt_session_name_valid("a:b"));
+    CHECK(!vt_session_name_valid("a\nb"));
+    memset(n, 'x', 43);
+    n[43] = '\0';
+    CHECK(!vt_session_name_valid(n));
+    n[42] = '\0';
+    CHECK(vt_session_name_valid(n));
+}
+
+static void test_chal_codec(void)
+{
+    uint8_t c[VT_CHAL_SIZE], d[VT_CHAL_SIZE];
+    char text[VT_CHAL_TEXT_SIZE];
+    int i;
+
+    for (i = 0; i < VT_CHAL_SIZE; i++)
+        c[i] = (uint8_t)(i * 17 + 3);
+    c[0] = 0x00;
+    c[1] = 0xff;
+    vt_chal_encode(c, text);
+    CHECK_EQ_INT(strlen(text), 34);
+    CHECK(strncmp(text, "<aapp", 5) == 0);
+    CHECK_EQ_INT(vt_chal_decode(text, d), 0);
+    CHECK(memcmp(c, d, sizeof(c)) == 0);
+
+    CHECK_EQ_INT(vt_chal_decode("OK CHAL: <abc>", d), -1);
+    CHECK_EQ_INT(vt_chal_decode("OK CHAL: no bracket", d), -1);
+    CHECK_EQ_INT(vt_chal_decode("OK CHAL: <djhdglocepfoaejahdbnealodcbnjgbq>", d), -1); /* 'q' */
+    CHECK_EQ_INT(vt_chal_decode("OK CHAL: <djhdglocepfoaejahdbnealodcbnjgbll>", d), -1); /* 33 chars */
+}
+
+static void test_xor_reference(void)
+{
+    uint8_t c[VT_CHAL_SIZE];
+    char text[VT_CHAL_TEXT_SIZE];
+
+    CHECK_EQ_INT(vt_chal_decode(REF_CHAL, c), 0);
+    vt_chal_xor(c, REF_PASSWORD);
+    vt_chal_encode(c, text);
+    CHECK_EQ_STR(text, REF_RESP);
+}
+
+static void test_xor_password_lengths(void)
+{
+    uint8_t c[VT_CHAL_SIZE], z[VT_CHAL_SIZE];
+    int i;
+
+    /* short password repeats */
+    memset(c, 0, sizeof(c));
+    vt_chal_xor(c, "ab");
+    for (i = 0; i < VT_CHAL_SIZE; i++)
+        CHECK_EQ_INT(c[i], i % 2 ? 'b' : 'a');
+
+    /* only the first 16 characters matter */
+    memset(c, 0x55, sizeof(c));
+    memset(z, 0x55, sizeof(z));
+    vt_chal_xor(c, "0123456789abcdefXYZ");
+    vt_chal_xor(z, "0123456789abcdef");
+    CHECK(memcmp(c, z, sizeof(c)) == 0);
+}
+
+static void test_flags(void)
+{
+    vt_flags_t f;
+    char out[64];
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeK>\n", &f), 0);
+    CHECK_EQ_INT(f.transport, 'T');
+    CHECK_EQ_INT(f.type, 'e');
+    CHECK_EQ_INT(f.keepalive, 1);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_OK);
+    vt_flags_format(&f, out, sizeof(out));
+    CHECK_EQ_STR(out, "<TeK>");
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TuK>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_OK);
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeS512K>\n", &f), 0);
+    CHECK_EQ_INT(f.shaper, 512);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_OK);
+    vt_flags_format(&f, out, sizeof(out));
+    CHECK_EQ_STR(out, "<TeS512K>");
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeC9K>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_COMPRESSION);
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TuL1K>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_COMPRESSION);
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TuKE1>\n", &f), 0);
+    CHECK_EQ_INT(f.cipher, 1);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_ENCRYPTION);
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TuKE>\n", &f), 0);   /* legacy form */
+    CHECK_EQ_INT(f.cipher, 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_ENCRYPTION);
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <UuK>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_UNSUPPORTED_TRANSPORT);
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <Tt>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_UNSUPPORTED_TYPE);
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TpK>\n", &f), 0);
+    CHECK_EQ_INT(vt_flags_check(&f), TUNNEL_ERR_UNSUPPORTED_TYPE);
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TFeK>\n", &f), 0);   /* F reserved */
+
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeX>\n", &f), -1);   /* unknown */
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeK\n", &f), -1);    /* no '>' */
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: TeK\n", &f), -1);     /* no '<' */
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeCK>\n", &f), -1);  /* C without level */
+    CHECK_EQ_INT(vt_flags_parse("OK FLAGS: <TeSK>\n", &f), -1);  /* S without speed */
+}
+
+static void test_header(void)
+{
+    uint8_t b[2];
+
+    vt_hdr_put(b, 1514);
+    CHECK_EQ_INT(b[0], 0x05);
+    CHECK_EQ_INT(b[1], 0xea);
+    CHECK_EQ_INT(vt_hdr_get(b), 1514);
+    vt_hdr_put(b, VT_ECHO_REQ);
+    CHECK_EQ_INT(b[0], 0x20);
+    CHECK_EQ_INT(b[1], 0x00);
+    CHECK_EQ_INT(vt_hdr_get(b) & VT_FSIZE_MASK, 0);
+}
+
+int main(void)
+{
+    RUN(test_mesg_build);
+    RUN(test_session_name);
+    RUN(test_chal_codec);
+    RUN(test_xor_reference);
+    RUN(test_xor_password_lengths);
+    RUN(test_flags);
+    RUN(test_header);
+    return UNIT_SUMMARY();
+}
diff --git a/tests/test_route.c b/tests/test_route.c
new file mode 100644
index 0000000..17f465f
--- /dev/null
+++ b/tests/test_route.c
@@ -0,0 +1,157 @@
+#include "netcore/route.h"
+#include "unit.h"
+
+#ifndef VTESSE_WITH_LWIP
+#define VTESSE_WITH_LWIP 1
+#endif
+#ifndef VTESSE_WITH_UDP_RELAY
+#define VTESSE_WITH_UDP_RELAY VTESSE_WITH_LWIP
+#endif
+#if VTESSE_WITH_UDP_RELAY
+#include "netcore/udprelay.h"
+#endif
+
+#define IP(a, b, c, d) (((uint32_t)(a) << 24) | ((uint32_t)(b) << 16) | ((uint32_t)(c) << 8) | (uint32_t)(d))
+
+static void test_parse_121(void)
+{
+    /* 10.78.0.0/24 via 10.77.0.1, 10.79.0.0/24 via 10.77.0.1 (bench) */
+    static const uint8_t opt[] = {
+        24, 10, 78, 0, 10, 77, 0, 1,
+        24, 10, 79, 0, 10, 77, 0, 1
+    };
+    nc_routes_t rt;
+    char s[48];
+
+    CHECK_EQ_INT(nc_routes_parse_classless(opt, sizeof(opt), &rt), 0);
+    CHECK_EQ_INT(rt.count, 2);
+    CHECK_EQ_INT(rt.r[0].net, IP(10, 78, 0, 0));
+    CHECK_EQ_INT(rt.r[0].prefix, 24);
+    CHECK_EQ_INT(rt.r[0].gw, IP(10, 77, 0, 1));
+    nc_route_format(&rt.r[1], s, sizeof(s));
+    CHECK_EQ_STR(s, "10.79.0.0/24 via 10.77.0.1");
+}
+
+static void test_parse_widths(void)
+{
+    static const uint8_t opt[] = {
+        0, 192, 168, 1, 1,                  /* default via 192.168.1.1 */
+        8, 10, 192, 168, 1, 2,              /* 10.0.0.0/8 */
+        32, 1, 2, 3, 4, 0, 0, 0, 0,         /* host route, on-link */
+        20, 172, 16, 16, 192, 168, 1, 3     /* 172.16.16.0/20, 3 significant octets */
+    };
+    nc_routes_t rt;
+    char s[48];
+
+    CHECK_EQ_INT(nc_routes_parse_classless(opt, sizeof(opt), &rt), 0);
+    CHECK_EQ_INT(rt.count, 4);
+    CHECK_EQ_INT(rt.r[0].prefix, 0);
+    CHECK_EQ_INT(rt.r[0].mask, 0);
+    CHECK_EQ_INT(rt.r[1].net, IP(10, 0, 0, 0));
+    CHECK_EQ_INT(rt.r[2].net, IP(1, 2, 3, 4));
+    CHECK_EQ_INT(rt.r[2].gw, 0);
+    nc_route_format(&rt.r[2], s, sizeof(s));
+    CHECK_EQ_STR(s, "1.2.3.4/32 on-link");
+    CHECK_EQ_INT(rt.r[3].net, IP(172, 16, 16, 0));
+    CHECK_EQ_INT(rt.r[3].mask, 0xfffff000u);
+
+    /* longest prefix wins, default catches the rest */
+    CHECK(nc_routes_lookup(&rt, IP(1, 2, 3, 4)) == &rt.r[2]);
+    CHECK(nc_routes_lookup(&rt, IP(10, 1, 1, 1)) == &rt.r[1]);
+    CHECK(nc_routes_lookup(&rt, IP(172, 16, 31, 255)) == &rt.r[3]);
+    CHECK(nc_routes_lookup(&rt, IP(172, 16, 32, 0)) == &rt.r[0]);
+}
+
+static void test_parse_malformed(void)
+{
+    static const uint8_t truncated[] = { 24, 10, 78, 0, 10, 77, 0 };
+    static const uint8_t width33[] = { 33, 1, 2, 3, 4, 5, 1, 2, 3, 4 };
+    static const uint8_t trailing[] = { 24, 10, 78, 0, 10, 77, 0, 1, 24 };
+    nc_routes_t rt;
+
+    CHECK_EQ_INT(nc_routes_parse_classless(truncated, sizeof(truncated), &rt), -1);
+    CHECK_EQ_INT(rt.count, 0);
+    CHECK_EQ_INT(nc_routes_parse_classless(width33, sizeof(width33), &rt), -1);
+    CHECK_EQ_INT(nc_routes_parse_classless(trailing, sizeof(trailing), &rt), -1);
+    CHECK_EQ_INT(nc_routes_parse_classless(truncated, 0, &rt), 0);    /* empty is valid */
+    CHECK_EQ_INT(rt.count, 0);
+}
+
+static void test_lookup_none(void)
+{
+    nc_routes_t rt;
+
+    memset(&rt, 0, sizeof(rt));
+    nc_routes_add(&rt, IP(10, 78, 0, 77), 24, IP(10, 77, 0, 1));   /* host bits masked */
+    CHECK_EQ_INT(rt.r[0].net, IP(10, 78, 0, 0));
+    CHECK(nc_routes_lookup(&rt, IP(10, 78, 0, 10)) != NULL);
+    CHECK(nc_routes_lookup(&rt, IP(8, 8, 8, 8)) == NULL);
+}
+
+static void test_devid(void)
+{
+    uint8_t mac[6];
+
+    CHECK_EQ_INT(nc_devid_to_mac("02BE0C000001", mac), 0);
+    CHECK(mac[0] == 0x02 && mac[1] == 0xbe && mac[5] == 0x01);
+    CHECK_EQ_INT(nc_devid_to_mac("02be0c000001", mac), -1);     /* lower case */
+    CHECK_EQ_INT(nc_devid_to_mac("02:BE:0C:00:00:01", mac), -1);
+    CHECK_EQ_INT(nc_devid_to_mac("02BE0C00000", mac), -1);      /* 11 chars */
+    CHECK_EQ_INT(nc_devid_to_mac("02BE0C0000011", mac), -1);    /* 13 chars */
+    CHECK_EQ_INT(nc_devid_to_mac("01BE0C000001", mac), -1);     /* multicast */
+    CHECK_EQ_INT(nc_devid_to_mac("02BE0C00000G", mac), -1);
+    CHECK_EQ_INT(nc_devid_to_mac(NULL, mac), -1);
+}
+
+static void test_devid_from_mac(void)
+{
+    char id[13];
+
+    CHECK_EQ_INT(nc_devid_from_mac_str("a4:5e:60:12:34:5c\n", id), 0);  /* sysfs form */
+    CHECK_EQ_STR(id, "A45E6012345C");
+    CHECK_EQ_INT(nc_devid_from_mac_str("02:BE:0C:00:00:01", id), 0);
+    CHECK_EQ_STR(id, "02BE0C000001");
+    CHECK_EQ_INT(nc_devid_from_mac_str("01:00:5e:00:00:01", id), -1);    /* multicast */
+    CHECK_EQ_INT(nc_devid_from_mac_str("00:00:00:00:00:00", id), -1);    /* unset */
+    CHECK_EQ_INT(nc_devid_from_mac_str("02:be:0c:00:00", id), -1);       /* short */
+    CHECK_EQ_INT(nc_devid_from_mac_str("02:be:0c:00:00:01:", id), -1);
+    CHECK_EQ_INT(nc_devid_from_mac_str("02:be:0c:00:00:01\nx", id), -1);
+    CHECK_EQ_INT(nc_devid_from_mac_str("02-be-0c-00-00-01", id), -1);
+    CHECK_EQ_INT(nc_devid_from_mac_str("aa:", id), -1);
+    CHECK_EQ_INT(nc_devid_from_mac_str("", id), -1);
+    CHECK_EQ_INT(nc_devid_from_mac_str(NULL, id), -1);
+}
+
+#if VTESSE_WITH_UDP_RELAY
+static void test_udp_relay_parse(void)
+{
+    uint16_t p = 0, l = 0;
+
+    CHECK_EQ_INT(nc_udp_relay_parse("1559", &p, &l), 0);
+    CHECK(p == 1559 && l == 1559);
+    CHECK_EQ_INT(nc_udp_relay_parse("5600:1559", &p, &l), 0);
+    CHECK(p == 5600 && l == 1559);
+    CHECK_EQ_INT(nc_udp_relay_parse("0", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("65536", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("1559x", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("1559:", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("1559:0", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse(":1559", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("-1", &p, &l), -1);
+    CHECK_EQ_INT(nc_udp_relay_parse("", &p, &l), -1);
+}
+#endif
+
+int main(void)
+{
+    RUN(test_parse_121);
+    RUN(test_parse_widths);
+    RUN(test_parse_malformed);
+    RUN(test_lookup_none);
+    RUN(test_devid);
+    RUN(test_devid_from_mac);
+#if VTESSE_WITH_UDP_RELAY
+    RUN(test_udp_relay_parse);
+#endif
+    return UNIT_SUMMARY();
+}
diff --git a/tests/unit.h b/tests/unit.h
new file mode 100644
index 0000000..7d45b16
--- /dev/null
+++ b/tests/unit.h
@@ -0,0 +1,49 @@
+/* Minimal unit test helpers. */
+#ifndef VTESSE_TESTS_UNIT_H
+#define VTESSE_TESTS_UNIT_H
+
+#include <stdio.h>
+#include <string.h>
+
+static int unit_failures;
+static int unit_checks;
+
+#define CHECK(cond) do { \
+    unit_checks++; \
+    if (!(cond)) { \
+        unit_failures++; \
+        fprintf(stderr, "%s:%d: CHECK failed: %s\n", __FILE__, __LINE__, #cond); \
+    } \
+} while (0)
+
+#define CHECK_EQ_INT(a, b) do { \
+    long long va_ = (long long)(a), vb_ = (long long)(b); \
+    unit_checks++; \
+    if (va_ != vb_) { \
+        unit_failures++; \
+        fprintf(stderr, "%s:%d: %s == %s failed: %lld != %lld\n", \
+                __FILE__, __LINE__, #a, #b, va_, vb_); \
+    } \
+} while (0)
+
+#define CHECK_EQ_STR(a, b) do { \
+    const char *sa_ = (a), *sb_ = (b); \
+    unit_checks++; \
+    if (strcmp(sa_, sb_) != 0) { \
+        unit_failures++; \
+        fprintf(stderr, "%s:%d: %s == %s failed: \"%s\" != \"%s\"\n", \
+                __FILE__, __LINE__, #a, #b, sa_, sb_); \
+    } \
+} while (0)
+
+#define RUN(test) do { \
+    int before_ = unit_failures; \
+    test(); \
+    printf("%s  %s\n", unit_failures == before_ ? "PASS" : "FAIL", #test); \
+} while (0)
+
+#define UNIT_SUMMARY() ( \
+    printf("%d checks, %d failure(s)\n", unit_checks, unit_failures), \
+    unit_failures ? 1 : 0)
+
+#endif
diff --git a/tools/vtun_probe.py b/tools/vtun_probe.py
new file mode 100755
index 0000000..9dd2cdd
--- /dev/null
+++ b/tools/vtun_probe.py
@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""VTun 3.0.2 probe: handshake (XOR auth), flags, keepalive, optional DHCPDISCOVER.
+
+Credentials are read from ~/.config/vtesse/probe.conf (key=value):
+  host, port, session, password
+Usage: vtun_probe.py [--dhcp] [--seconds N] [--config PATH]
+
+WARNING: with `multi killold` on the server, connecting with a production
+session name kicks the real device off. Use a dedicated test session.
+"""
+import argparse
+import os
+import random
+import select
+import socket
+import struct
+import time
+
+MESG_SIZE = 50
+CONN_CLOSE, ECHO_REQ, ECHO_REP = 0x1000, 0x2000, 0x4000
+CHARS = "abcdefghijklmnop"
+
+
+def load_cfg(path):
+    cfg = {}
+    with open(os.path.expanduser(path)) as f:
+        for line in f:
+            line = line.strip()
+            if line and not line.startswith("#") and "=" in line:
+                k, v = line.split("=", 1)
+                cfg[k.strip()] = v.strip()
+    return cfg
+
+
+def msg(text):
+    b = text.encode()
+    if len(b) > MESG_SIZE - 1:
+        raise ValueError("message too long: %r" % text)
+    return b + b"\0" * (MESG_SIZE - len(b))
+
+
+def read_exact(s, n):
+    b = b""
+    while len(b) < n:
+        c = s.recv(n - len(b))
+        if not c:
+            raise EOFError("EOF after %d of %d bytes" % (len(b), n))
+        b += c
+    return b
+
+
+def read_mesg(s):
+    return read_exact(s, MESG_SIZE).rstrip(b"\0").decode("latin1")
+
+
+def cl2cs(chal):
+    return "<" + "".join(CHARS[x >> 4] + CHARS[x & 15] for x in chal) + ">"
+
+
+def cs2cl(text):
+    body = text[text.index("<") + 1:text.index(">")]
+    if len(body) != 32:
+        raise ValueError("bad challenge: %r" % text)
+    return bytes(((ord(body[i]) - 97) << 4) | (ord(body[i + 1]) - 97) for i in range(0, 32, 2))
+
+
+def xor_chal(chal, password):
+    pw = password.encode()
+    return bytes(chal[i] ^ pw[i % len(pw)] for i in range(16))
+
+
+def ip_csum(b):
+    if len(b) % 2:
+        b += b"\0"
+    t = sum(struct.unpack("!%dH" % (len(b) // 2), b))
+    t = (t >> 16) + (t & 0xFFFF)
+    t += t >> 16
+    return (~t) & 0xFFFF
+
+
+def dhcp_discover(mac):
+    xid = random.getrandbits(32)
+    opts = bytes([53, 1, 1, 61, 7, 1]) + mac + bytes([55, 7, 1, 3, 6, 15, 28, 121, 249, 255])
+    bootp = struct.pack("!BBBBIHH4s4s4s4s16s64s128s", 1, 1, 6, 0, xid, 0, 0x8000,
+                        b"\0" * 4, b"\0" * 4, b"\0" * 4, b"\0" * 4, mac + b"\0" * 10, b"", b"")
+    bootp += b"\x63\x82\x53\x63" + opts
+    bootp += b"\0" * max(0, 300 - len(bootp))
+    udp = struct.pack("!HHHH", 68, 67, 8 + len(bootp), 0) + bootp
+    ip = struct.pack("!BBHHHBBH4s4s", 0x45, 0, 20 + len(udp), 0, 0, 64, 17, 0, b"\0" * 4, b"\xff" * 4)
+    ip = ip[:10] + struct.pack("!H", ip_csum(ip)) + ip[12:]
+    return b"\xff" * 6 + mac + b"\x08\x00" + ip + udp
+
+
+def decode_121(v):
+    routes, i = [], 0
+    while i < len(v):
+        width = v[i]
+        n = (width + 7) // 8
+        net = list(v[i + 1:i + 1 + n]) + [0] * (4 - n)
+        gw = v[i + 1 + n:i + 5 + n]
+        routes.append("%s/%d via %s" % (".".join(map(str, net)), width, socket.inet_ntoa(gw)))
+        i += 5 + n
+    return routes
+
+
+def print_dhcp(fr):
+    if fr[12:14] != b"\x08\x00" or fr[23] != 17:
+        return
+    ihl = (fr[14] & 15) * 4
+    u = fr[14 + ihl:]
+    if struct.unpack("!H", u[2:4])[0] != 68:
+        return
+    b = u[8:]
+    o, i, opts = b[240:], 0, {}
+    while i < len(o) and o[i] != 255:
+        if o[i] == 0:
+            i += 1
+            continue
+        opts[o[i]] = o[i + 2:i + 2 + o[i + 1]]
+        i += 2 + o[i + 1]
+    print("DHCP type %s from %s, yiaddr %s" % (opts.get(53, b"?").hex(), socket.inet_ntoa(fr[26:30]),
+                                               socket.inet_ntoa(b[16:20])))
+    for k, v in sorted(opts.items()):
+        if k in (1, 3, 6, 28, 54):
+            print("  opt %d: %s" % (k, ", ".join(socket.inet_ntoa(v[j:j + 4]) for j in range(0, len(v), 4))))
+        elif k in (121, 249):
+            print("  opt %d: %s" % (k, "; ".join(decode_121(v))))
+        else:
+            print("  opt %d: %s" % (k, v.hex()))
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--config", default="~/.config/vtesse/probe.conf")
+    ap.add_argument("--dhcp", action="store_true", help="send one DHCPDISCOVER (type ether)")
+    ap.add_argument("--seconds", type=float, default=12)
+    ap.add_argument("--delay", type=float, default=1.0,
+                    help="wait before the first data frame: the server brings the tap up "
+                         "asynchronously and drops the session if a frame arrives earlier")
+    a = ap.parse_args()
+    cfg = load_cfg(a.config)
+
+    s = socket.create_connection((cfg["host"], int(cfg["port"])), timeout=15)
+    print("peer", s.getpeername())
+    print("S:", repr(read_mesg(s)))
+    s.sendall(msg("HOST: %s\n" % cfg["session"]))
+    chal = read_mesg(s)
+    print("S:", repr(chal))
+    t0 = time.time()
+    s.sendall(msg("CHAL: %s\n" % cl2cs(xor_chal(cs2cl(chal), cfg["password"]))))
+    flags = read_mesg(s)
+    print("S:", repr(flags), "after %.2fs" % (time.time() - t0))
+    if not flags.startswith("OK"):
+        raise SystemExit("authentication failed")
+
+    if a.dhcp:
+        time.sleep(a.delay)
+        frame = dhcp_discover(bytes.fromhex(cfg["session"]))
+        s.sendall(struct.pack(">H", len(frame)) + frame)
+        print("sent DHCPDISCOVER (%d bytes)" % len(frame))
+
+    buf, end = b"", time.time() + a.seconds
+    while time.time() < end:
+        r, _, _ = select.select([s], [], [], 0.5)
+        if not r:
+            continue
+        c = s.recv(65536)
+        if not c:
+            print("EOF from server")
+            break
+        buf += c
+        while len(buf) >= 2:
+            hdr = struct.unpack(">H", buf[:2])[0]
+            fl, ln = hdr & 0xF000, hdr & 0x0FFF
+            if fl:
+                buf = buf[2:]
+                print("%.2fs flag 0x%04x" % (time.time() - t0, fl))
+                if fl == ECHO_REQ:
+                    s.sendall(struct.pack(">H", ECHO_REP))
+                elif fl == CONN_CLOSE:
+                    print("server closed the session")
+                    return
+                continue
+            if len(buf) < 2 + ln:
+                break
+            fr, buf = buf[2:2 + ln], buf[2 + ln:]
+            print("%.2fs frame len=%d src=%s type=%s" % (time.time() - t0, ln, fr[6:12].hex(), fr[12:14].hex()))
+            print_dhcp(fr)
+
+    s.sendall(struct.pack(">H", CONN_CLOSE))
+    s.close()
+    print("sent CONN_CLOSE")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/vtun/vtun_client.c b/vtun/vtun_client.c
new file mode 100644
index 0000000..7e68b6d
--- /dev/null
+++ b/vtun/vtun_client.c
@@ -0,0 +1,682 @@
+#include "vtesse/vtun_client.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "netcore/loop.h"
+
+#ifndef MSG_NOSIGNAL
+#define MSG_NOSIGNAL 0
+#endif
+
+#define DEF_HANDSHAKE_MS    15000
+#define MIN_CHAL_STEP_MS    10000   /* multi killold: the server may wait ~5 s */
+#define DEF_KA_INTERVAL_MS  10000
+#define DEF_KA_COUNT        5
+#define DEF_DATA_DELAY_MS   500     /* the server brings the tap up asynchronously */
+#define DEF_RECONNECT_MIN   1000
+#define DEF_RECONNECT_MAX   30000
+#define DEF_OUTBUF          65536
+#define STABLE_SESSION_MS   30000   /* reset backoff only after a stable session */
+#define INBUF_SIZE          (2 + VT_FRAME_MAX_RX + 2048)
+#define LINK_MTU            1500
+
+enum vt_state {
+    ST_STOPPED = 0,
+    ST_WAIT_RECONNECT,
+    ST_CONNECTING,
+    ST_WAIT_GREETING,
+    ST_WAIT_CHAL,
+    ST_WAIT_FLAGS,
+    ST_ESTABLISHED
+};
+
+struct vt {
+    char *host, *session, *password;
+    uint16_t port;
+    vt_cfg_t cfg;
+
+    int state;
+    int fd;
+
+    uint8_t inbuf[INBUF_SIZE];
+    size_t in_len;
+    size_t skip;                /* bytes of an oversized frame still to discard */
+
+    uint8_t *out;
+    size_t out_cap, out_off, out_len;
+
+    uint64_t deadline;          /* handshake step deadline */
+    uint64_t reconnect_at;
+    uint64_t up_at;
+    uint64_t data_ok_at;
+    int up_emitted;             /* UP is reported once data may flow */
+    uint64_t last_rx;
+    uint64_t last_ka_tx;
+    int backoff_ms;
+
+    char greeting[VT_MESG_SIZE];
+    vt_flags_t flags;
+
+    tunnel_rx_cb rx_cb;
+    void *rx_user;
+    tunnel_event_cb ev_cb;
+    void *ev_user;
+};
+
+static void emit(vt_t *vt, int event, int err)
+{
+    if (vt->ev_cb)
+        vt->ev_cb(vt->ev_user, event, err);
+}
+
+static int fatal_error(int err)
+{
+    switch (err) {
+    case TUNNEL_ERR_CONFIG:
+    case TUNNEL_ERR_AUTH:
+    case TUNNEL_ERR_PROTOCOL:
+    case TUNNEL_ERR_UNSUPPORTED_TYPE:
+    case TUNNEL_ERR_UNSUPPORTED_TRANSPORT:
+    case TUNNEL_ERR_COMPRESSION:
+    case TUNNEL_ERR_ENCRYPTION:
+        return 1;
+    default:
+        return 0;
+    }
+}
+
+static void close_socket(vt_t *vt)
+{
+    if (vt->fd >= 0)
+        close(vt->fd);
+    vt->fd = -1;
+    vt->in_len = vt->skip = 0;
+    vt->out_off = vt->out_len = 0;
+}
+
+/* Tear down the connection; retry later unless the error is final. */
+static void fail(vt_t *vt, int err)
+{
+    int was_up = vt->state == ST_ESTABLISHED;
+    uint64_t now = nc_now_ms();
+
+    close_socket(vt);
+    if (fatal_error(err) || vt->cfg.no_reconnect) {
+        vt->state = ST_STOPPED;
+        emit(vt, TUNNEL_EV_FAILED, err);
+        return;
+    }
+    if (was_up && now - vt->up_at >= STABLE_SESSION_MS)
+        vt->backoff_ms = vt->cfg.reconnect_min_ms;
+    vt->state = ST_WAIT_RECONNECT;
+    vt->reconnect_at = now + (uint64_t)vt->backoff_ms;
+    vt->backoff_ms *= 2;
+    if (vt->backoff_ms > vt->cfg.reconnect_max_ms)
+        vt->backoff_ms = vt->cfg.reconnect_max_ms;
+    emit(vt, TUNNEL_EV_DOWN, err);
+}
+
+/* ---- output buffer ---- */
+
+static void flush(vt_t *vt)
+{
+    while (vt->out_len > 0) {
+        ssize_t n = send(vt->fd, vt->out + vt->out_off, vt->out_len, MSG_NOSIGNAL);
+        if (n < 0) {
+            if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)
+                return;
+            fail(vt, TUNNEL_ERR_IO);
+            return;
+        }
+        vt->out_off += (size_t)n;
+        vt->out_len -= (size_t)n;
+    }
+    vt->out_off = 0;
+}
+
+/* Append a+b atomically (both or nothing). */
+static int queue2(vt_t *vt, const uint8_t *a, size_t al, const uint8_t *b, size_t bl)
+{
+    if (vt->out_len + al + bl > vt->out_cap)
+        return -1;
+    if (vt->out_off + vt->out_len + al + bl > vt->out_cap) {
+        memmove(vt->out, vt->out + vt->out_off, vt->out_len);
+        vt->out_off = 0;
+    }
+    memcpy(vt->out + vt->out_off + vt->out_len, a, al);
+    vt->out_len += al;
+    if (bl) {
+        memcpy(vt->out + vt->out_off + vt->out_len, b, bl);
+        vt->out_len += bl;
+    }
+    return 0;
+}
+
+static int queue_mesg(vt_t *vt, const char *prefix, const char *arg)
+{
+    uint8_t m[VT_MESG_SIZE];
+
+    if (vt_mesg_build(m, prefix, arg) < 0 || queue2(vt, m, sizeof(m), NULL, 0) < 0)
+        return -1;
+    return 0;
+}
+
+static void queue_flag(vt_t *vt, uint16_t flag)
+{
+    uint8_t h[2];
+
+    vt_hdr_put(h, flag);
+    queue2(vt, h, 2, NULL, 0);  /* a full buffer means the link is stuck anyway */
+}
+
+/* ---- connection ---- */
+
+static void start_connect(vt_t *vt)
+{
+    struct addrinfo hints, *res = NULL, *ai;
+    char port[8];
+    int fd = -1, one = 1;
+
+    vt->state = ST_CONNECTING;
+    emit(vt, TUNNEL_EV_CONNECTING, TUNNEL_OK);
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET;          /* VTun 3.0.x is IPv4 only */
+    hints.ai_socktype = SOCK_STREAM;
+    snprintf(port, sizeof(port), "%u", (unsigned)vt->port);
+    if (getaddrinfo(vt->host, port, &hints, &res) != 0 || !res) {
+        fail(vt, TUNNEL_ERR_RESOLVE);
+        return;
+    }
+    for (ai = res; ai; ai = ai->ai_next) {
+        fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
+        if (fd < 0)
+            continue;
+        fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
+        fcntl(fd, F_SETFD, FD_CLOEXEC);
+        setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+        if (connect(fd, ai->ai_addr, ai->ai_addrlen) == 0 || errno == EINPROGRESS)
+            break;
+        close(fd);
+        fd = -1;
+    }
+    freeaddrinfo(res);
+    if (fd < 0) {
+        fail(vt, TUNNEL_ERR_CONNECT);
+        return;
+    }
+    vt->fd = fd;
+    vt->deadline = nc_now_ms() + (uint64_t)vt->cfg.handshake_timeout_ms;
+}
+
+static void establish(vt_t *vt)
+{
+    uint64_t now = nc_now_ms();
+
+    vt->state = ST_ESTABLISHED;
+    vt->up_at = now;
+    vt->data_ok_at = now + (uint64_t)vt->cfg.data_delay_ms;
+    vt->last_rx = now;
+    vt->last_ka_tx = now;
+    vt->up_emitted = 0;
+    queue_flag(vt, VT_ECHO_REQ);    /* like the stock client */
+    /* TUNNEL_EV_UP follows from on_timer after data_delay_ms: the server brings
+     * the tap up asynchronously and drops the session if data arrives earlier. */
+}
+
+/* One 50-byte control message during the handshake. */
+static void handle_mesg(vt_t *vt, char *m)
+{
+    uint8_t chal[VT_CHAL_SIZE];
+    char text[VT_CHAL_TEXT_SIZE];
+    uint64_t step;
+    int err;
+
+    m[VT_MESG_SIZE - 1] = '\0';
+    switch (vt->state) {
+    case ST_WAIT_GREETING:
+        if (strncmp(m, "VTUN", 4) != 0) {
+            fail(vt, TUNNEL_ERR_PROTOCOL);
+            return;
+        }
+        snprintf(vt->greeting, sizeof(vt->greeting), "%s", m);
+        vt->greeting[strcspn(vt->greeting, "\r\n")] = '\0';
+        queue_mesg(vt, "HOST: ", vt->session);
+        vt->state = ST_WAIT_CHAL;
+        vt->deadline = nc_now_ms() + (uint64_t)vt->cfg.handshake_timeout_ms;
+        break;
+
+    case ST_WAIT_CHAL:
+        if (strncmp(m, "OK", 2) != 0 || vt_chal_decode(m, chal) != 0) {
+            fail(vt, strncmp(m, "ERR", 3) == 0 ? TUNNEL_ERR_AUTH : TUNNEL_ERR_PROTOCOL);
+            return;
+        }
+        vt_chal_xor(chal, vt->password);
+        vt_chal_encode(chal, text);
+        queue_mesg(vt, "CHAL: ", text);
+        vt->state = ST_WAIT_FLAGS;
+        step = (uint64_t)vt->cfg.handshake_timeout_ms;
+        if (step < MIN_CHAL_STEP_MS)
+            step = MIN_CHAL_STEP_MS;
+        vt->deadline = nc_now_ms() + step;
+        break;
+
+    case ST_WAIT_FLAGS:
+        if (strncmp(m, "OK", 2) != 0) {
+            fail(vt, strncmp(m, "ERR", 3) == 0 ? TUNNEL_ERR_AUTH : TUNNEL_ERR_PROTOCOL);
+            return;
+        }
+        if (vt_flags_parse(m, &vt->flags) != 0) {
+            fail(vt, TUNNEL_ERR_PROTOCOL);
+            return;
+        }
+        err = vt_flags_check(&vt->flags);
+        if (err != TUNNEL_OK) {
+            fail(vt, err);
+            return;
+        }
+        establish(vt);
+        break;
+
+    default:
+        break;
+    }
+}
+
+/* Frames after OK FLAGS. Returns bytes consumed. */
+static size_t handle_frames(vt_t *vt, const uint8_t *p, size_t len)
+{
+    size_t used = 0;
+
+    while (vt->state == ST_ESTABLISHED) {
+        uint16_t hdr, flen, fl;
+
+        if (vt->skip) {
+            size_t n = len - used < vt->skip ? len - used : vt->skip;
+            used += n;
+            vt->skip -= n;
+            if (vt->skip)
+                break;
+            continue;
+        }
+        if (len - used < 2)
+            break;
+        hdr = vt_hdr_get(p + used);
+        fl = hdr & VT_FLAGS_MASK;
+        flen = hdr & VT_FSIZE_MASK;
+        if (fl) {
+            used += 2;
+            if (fl & VT_CONN_CLOSE) {
+                fail(vt, TUNNEL_ERR_PEER_CLOSED);
+                break;
+            }
+            if (fl & VT_ECHO_REQ)
+                queue_flag(vt, VT_ECHO_REP);
+            continue;   /* ECHO_REP and unknown flags carry no payload */
+        }
+        if (flen > VT_FRAME_MAX_RX) {
+            used += 2;
+            vt->skip = flen;
+            continue;
+        }
+        if (len - used < 2u + flen)
+            break;
+        if (flen && vt->rx_cb)
+            vt->rx_cb(vt->rx_user, p + used + 2, flen);
+        used += 2u + flen;
+    }
+    return used;
+}
+
+static void process_input(vt_t *vt)
+{
+    size_t used = 0;
+
+    while (vt->state >= ST_WAIT_GREETING && vt->state <= ST_WAIT_FLAGS &&
+           vt->in_len - used >= VT_MESG_SIZE) {
+        char m[VT_MESG_SIZE];
+
+        memcpy(m, vt->inbuf + used, VT_MESG_SIZE);
+        used += VT_MESG_SIZE;
+        handle_mesg(vt, m);
+    }
+    if (vt->state == ST_ESTABLISHED)
+        used += handle_frames(vt, vt->inbuf + used, vt->in_len - used);
+    if (vt->fd < 0)
+        return;     /* failed while processing; buffers already reset */
+    if (used) {
+        memmove(vt->inbuf, vt->inbuf + used, vt->in_len - used);
+        vt->in_len -= used;
+    }
+}
+
+/* ---- tunnel_ops ---- */
+
+static int op_get_fd(void *ctx)
+{
+    return ((vt_t *)ctx)->fd;
+}
+
+static int op_wants_write(void *ctx)
+{
+    vt_t *vt = ctx;
+
+    return vt->fd >= 0 && (vt->state == ST_CONNECTING || vt->out_len > 0);
+}
+
+static void op_on_writable(void *ctx)
+{
+    vt_t *vt = ctx;
+
+    if (vt->fd < 0)
+        return;
+    if (vt->state == ST_CONNECTING) {
+        int err = 0;
+        socklen_t l = sizeof(err);
+
+        if (getsockopt(vt->fd, SOL_SOCKET, SO_ERROR, &err, &l) < 0 || err) {
+            fail(vt, TUNNEL_ERR_CONNECT);
+            return;
+        }
+        vt->state = ST_WAIT_GREETING;
+        vt->deadline = nc_now_ms() + (uint64_t)vt->cfg.handshake_timeout_ms;
+        return;
+    }
+    flush(vt);
+}
+
+static void op_on_readable(void *ctx)
+{
+    vt_t *vt = ctx;
+
+    if (vt->fd < 0 || vt->state == ST_CONNECTING)
+        return;
+    for (;;) {
+        ssize_t n;
+
+        if (vt->in_len == sizeof(vt->inbuf)) {
+            fail(vt, TUNNEL_ERR_PROTOCOL);  /* cannot happen with valid framing */
+            return;
+        }
+        n = recv(vt->fd, vt->inbuf + vt->in_len, sizeof(vt->inbuf) - vt->in_len, 0);
+        if (n == 0) {
+            fail(vt, TUNNEL_ERR_PEER_CLOSED);   /* retriable, also during the handshake */
+            return;
+        }
+        if (n < 0) {
+            if (errno == EAGAIN || errno == EWOULDBLOCK)
+                break;
+            if (errno == EINTR)
+                continue;
+            fail(vt, TUNNEL_ERR_IO);
+            return;
+        }
+        vt->in_len += (size_t)n;
+        vt->last_rx = nc_now_ms();
+        process_input(vt);
+        if (vt->fd < 0)
+            return;
+    }
+    if (vt->out_len)
+        flush(vt);
+}
+
+static int ms_until(uint64_t t, uint64_t now)
+{
+    if (t <= now)
+        return 0;
+    return t - now > 0x7fffffff ? 0x7fffffff : (int)(t - now);
+}
+
+static int op_next_timeout_ms(void *ctx)
+{
+    vt_t *vt = ctx;
+    uint64_t now = nc_now_ms();
+    int a, b;
+
+    switch (vt->state) {
+    case ST_WAIT_RECONNECT:
+        return ms_until(vt->reconnect_at, now);
+    case ST_CONNECTING:
+    case ST_WAIT_GREETING:
+    case ST_WAIT_CHAL:
+    case ST_WAIT_FLAGS:
+        return ms_until(vt->deadline, now);
+    case ST_ESTABLISHED:
+        a = ms_until(vt->last_ka_tx + (uint64_t)vt->cfg.ka_interval_ms, now);
+        b = ms_until(vt->last_rx + (uint64_t)vt->cfg.ka_interval_ms * (uint64_t)vt->cfg.ka_count, now);
+        if (a > b)
+            a = b;
+        if (!vt->up_emitted && ms_until(vt->data_ok_at, now) < a)
+            a = ms_until(vt->data_ok_at, now);
+        return a;
+    default:
+        return -1;
+    }
+}
+
+static void op_on_timer(void *ctx)
+{
+    vt_t *vt = ctx;
+    uint64_t now = nc_now_ms();
+
+    switch (vt->state) {
+    case ST_WAIT_RECONNECT:
+        if (now >= vt->reconnect_at)
+            start_connect(vt);
+        break;
+    case ST_CONNECTING:
+    case ST_WAIT_GREETING:
+    case ST_WAIT_CHAL:
+    case ST_WAIT_FLAGS:
+        if (now >= vt->deadline)
+            fail(vt, vt->state == ST_CONNECTING ? TUNNEL_ERR_CONNECT : TUNNEL_ERR_TIMEOUT);
+        break;
+    case ST_ESTABLISHED:
+        if (now - vt->last_rx >= (uint64_t)vt->cfg.ka_interval_ms * (uint64_t)vt->cfg.ka_count) {
+            fail(vt, TUNNEL_ERR_KEEPALIVE);
+            break;
+        }
+        if (now - vt->last_ka_tx >= (uint64_t)vt->cfg.ka_interval_ms) {
+            vt->last_ka_tx = now;
+            queue_flag(vt, VT_ECHO_REQ);
+            flush(vt);
+        }
+        if (vt->state == ST_ESTABLISHED && !vt->up_emitted && now >= vt->data_ok_at) {
+            vt->up_emitted = 1;
+            emit(vt, TUNNEL_EV_UP, TUNNEL_OK);
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+static void op_set_rx_cb(void *ctx, tunnel_rx_cb cb, void *user)
+{
+    vt_t *vt = ctx;
+
+    vt->rx_cb = cb;
+    vt->rx_user = user;
+}
+
+static void op_set_event_cb(void *ctx, tunnel_event_cb cb, void *user)
+{
+    vt_t *vt = ctx;
+
+    vt->ev_cb = cb;
+    vt->ev_user = user;
+}
+
+static int op_send(void *ctx, const uint8_t *pkt, size_t len)
+{
+    vt_t *vt = ctx;
+    uint8_t h[2];
+
+    if (vt->state != ST_ESTABLISHED || !vt->up_emitted || len == 0 || len > VT_FRAME_SIZE)
+        return -1;
+    vt_hdr_put(h, (uint16_t)len);
+    if (queue2(vt, h, 2, pkt, len) < 0)
+        return -1;
+    flush(vt);
+    return 0;
+}
+
+static int op_link_type(void *ctx)
+{
+    vt_t *vt = ctx;
+
+    if (vt->state != ST_ESTABLISHED || !vt->up_emitted)
+        return TUNNEL_LINK_NONE;
+    return vt->flags.type == 'e' ? TUNNEL_LINK_L2 : TUNNEL_LINK_L3;
+}
+
+static int op_mtu(void *ctx)
+{
+    (void)ctx;
+    return LINK_MTU;
+}
+
+static void op_close(void *ctx)
+{
+    vt_t *vt = ctx;
+
+    if (vt->state == ST_ESTABLISHED && vt->fd >= 0) {
+        uint8_t h[2];
+
+
+        flush(vt);
+        vt_hdr_put(h, VT_CONN_CLOSE);
+        if (vt->fd >= 0 && vt->out_len == 0)
+            (void)!send(vt->fd, h, 2, MSG_NOSIGNAL);
+    }
+    close_socket(vt);
+    vt->state = ST_STOPPED;
+}
+
+static const tunnel_ops_t vt_ops = {
+    op_get_fd, op_wants_write, op_on_readable, op_on_writable,
+    op_next_timeout_ms, op_on_timer, op_set_rx_cb, op_set_event_cb,
+    op_send, op_link_type, op_mtu, op_close
+};
+
+/* ---- public ---- */
+
+const tunnel_ops_t *vt_tunnel_ops(void)
+{
+    return &vt_ops;
+}
+
+tunnel_t vt_tunnel(vt_t *vt)
+{
+    tunnel_t t;
+
+    t.ops = &vt_ops;
+    t.ctx = vt;
+    return t;
+}
+
+vt_t *vt_create(const vt_cfg_t *cfg, int *err)
+{
+    vt_t *vt;
+
+    *err = TUNNEL_ERR_CONFIG;
+    if (!cfg || !cfg->host || !*cfg->host || !cfg->port ||
+        !vt_session_name_valid(cfg->session) || !cfg->password || !*cfg->password ||
+        cfg->auth != VT_AUTH_XOR)
+        return NULL;
+
+    *err = TUNNEL_ERR_NOMEM;
+    vt = calloc(1, sizeof(*vt));
+    if (!vt)
+        return NULL;
+    vt->cfg = *cfg;
+    vt->host = strdup(cfg->host);
+    vt->session = strdup(cfg->session);
+    vt->password = strdup(cfg->password);
+    vt->port = cfg->port;
+    vt->cfg.host = vt->cfg.session = vt->cfg.password = NULL;
+    if (!vt->cfg.handshake_timeout_ms)
+        vt->cfg.handshake_timeout_ms = DEF_HANDSHAKE_MS;
+    if (!vt->cfg.ka_interval_ms)
+        vt->cfg.ka_interval_ms = DEF_KA_INTERVAL_MS;
+    if (!vt->cfg.ka_count)
+        vt->cfg.ka_count = DEF_KA_COUNT;
+    if (!vt->cfg.data_delay_ms)
+        vt->cfg.data_delay_ms = DEF_DATA_DELAY_MS;
+    if (!vt->cfg.reconnect_min_ms)
+        vt->cfg.reconnect_min_ms = DEF_RECONNECT_MIN;
+    if (!vt->cfg.reconnect_max_ms)
+        vt->cfg.reconnect_max_ms = DEF_RECONNECT_MAX;
+    if (!vt->cfg.out_buffer_size)
+        vt->cfg.out_buffer_size = DEF_OUTBUF;
+    vt->out_cap = (size_t)vt->cfg.out_buffer_size;
+    vt->out = malloc(vt->out_cap);
+    vt->fd = -1;
+    vt->state = ST_STOPPED;
+    vt->backoff_ms = vt->cfg.reconnect_min_ms;
+    if (!vt->host || !vt->session || !vt->password || !vt->out ||
+        vt->out_cap < VT_MESG_SIZE + 2 + VT_FRAME_SIZE) {
+        vt_destroy(vt);
+        return NULL;
+    }
+    *err = TUNNEL_OK;
+    return vt;
+}
+
+void vt_destroy(vt_t *vt)
+{
+    if (!vt)
+        return;
+    close_socket(vt);
+    if (vt->password)
+        memset(vt->password, 0, strlen(vt->password));
+    free(vt->host);
+    free(vt->session);
+    free(vt->password);
+    free(vt->out);
+    free(vt);
+}
+
+int vt_start(vt_t *vt)
+{
+    if (vt->state != ST_STOPPED)
+        return -1;
+    vt->backoff_ms = vt->cfg.reconnect_min_ms;
+    start_connect(vt);
+    return 0;
+}
+
+void vt_network_changed(vt_t *vt)
+{
+    if (vt->state == ST_STOPPED)
+        return;
+    vt->backoff_ms = vt->cfg.reconnect_min_ms;
+    if (vt->state != ST_WAIT_RECONNECT)
+        fail(vt, TUNNEL_ERR_NETWORK);
+    vt->reconnect_at = nc_now_ms();
+}
+
+const char *vt_greeting(const vt_t *vt)
+{
+    return vt->greeting;
+}
+
+const vt_flags_t *vt_session_flags(const vt_t *vt)
+{
+    return &vt->flags;
+}
+
+int vt_is_up(const vt_t *vt)
+{
+    return vt->state == ST_ESTABLISHED && vt->up_emitted;
+}
diff --git a/vtun/vtun_proto.c b/vtun/vtun_proto.c
new file mode 100644
index 0000000..ca8344f
--- /dev/null
+++ b/vtun/vtun_proto.c
@@ -0,0 +1,193 @@
+#include "vtesse/vtun_proto.h"
+
+#include <stdio.h>
+#include <string.h>
+
+#include "netcore/tunnel.h"
+
+static const char chal_chars[] = "abcdefghijklmnop";
+
+int vt_session_name_valid(const char *name)
+{
+    size_t len;
+    const char *p;
+
+    if (!name)
+        return 0;
+    len = strlen(name);
+    if (len == 0 || len > VT_SESSION_MAX)
+        return 0;
+    for (p = name; *p; p++) {
+        unsigned char c = (unsigned char)*p;
+        if (c <= ' ' || c >= 0x7f || c == ':')
+            return 0;
+    }
+    return 1;
+}
+
+int vt_mesg_build(uint8_t out[VT_MESG_SIZE], const char *prefix, const char *arg)
+{
+    size_t pl = strlen(prefix), al = arg ? strlen(arg) : 0;
+
+    if (pl + al + 1 > VT_MESG_SIZE - 1)
+        return -1;
+    memset(out, 0, VT_MESG_SIZE);
+    memcpy(out, prefix, pl);
+    if (al)
+        memcpy(out + pl, arg, al);
+    out[pl + al] = '\n';
+    return 0;
+}
+
+void vt_chal_encode(const uint8_t chal[VT_CHAL_SIZE], char out[VT_CHAL_TEXT_SIZE])
+{
+    int i;
+
+    out[0] = '<';
+    for (i = 0; i < VT_CHAL_SIZE; i++) {
+        out[1 + i * 2] = chal_chars[chal[i] >> 4];
+        out[2 + i * 2] = chal_chars[chal[i] & 0x0f];
+    }
+    out[1 + VT_CHAL_SIZE * 2] = '>';
+    out[2 + VT_CHAL_SIZE * 2] = '\0';
+}
+
+int vt_chal_decode(const char *msg, uint8_t chal[VT_CHAL_SIZE])
+{
+    const char *p = strchr(msg, '<');
+    int i;
+
+    if (!p)
+        return -1;
+    p++;
+    for (i = 0; i < VT_CHAL_SIZE * 2; i++)
+        if (p[i] < 'a' || p[i] > 'p')
+            return -1;
+    if (p[VT_CHAL_SIZE * 2] != '>')
+        return -1;
+    for (i = 0; i < VT_CHAL_SIZE; i++)
+        chal[i] = (uint8_t)(((p[i * 2] - 'a') << 4) | (p[i * 2 + 1] - 'a'));
+    return 0;
+}
+
+void vt_chal_xor(uint8_t chal[VT_CHAL_SIZE], const char *pwd)
+{
+    size_t len = strlen(pwd);
+    int i;
+
+    for (i = 0; i < VT_CHAL_SIZE; i++)
+        chal[i] ^= (uint8_t)pwd[i % len];
+}
+
+/* Decimal number at *pp (optional when 'optional'); advances *pp. */
+static int parse_num(const char **pp, int *out, int optional)
+{
+    const char *p = *pp;
+    long v = 0;
+    int digits = 0;
+
+    while (*p >= '0' && *p <= '9') {
+        if (v < 100000000)
+            v = v * 10 + (*p - '0');
+        p++;
+        digits++;
+    }
+    if (!digits && !optional)
+        return -1;
+    *out = (int)v;
+    *pp = p;
+    return 0;
+}
+
+int vt_flags_parse(const char *msg, vt_flags_t *f)
+{
+    const char *p = strchr(msg, '<');
+
+    memset(f, 0, sizeof(*f));
+    if (!p)
+        return -1;
+    p++;
+    while (*p) {
+        char c = *p++;
+        int n;
+
+        switch (c) {
+        case 't': case 'p': case 'e': case 'u':
+            f->type = c;
+            break;
+        case 'T': case 'U':
+            f->transport = c;
+            break;
+        case 'K':
+            f->keepalive = 1;
+            break;
+        case 'C':
+            if (parse_num(&p, &n, 0))
+                return -1;
+            f->zlib = 1;
+            f->zlevel = n;
+            break;
+        case 'L':
+            if (parse_num(&p, &n, 0))
+                return -1;
+            f->lzo = 1;
+            f->zlevel = n;
+            break;
+        case 'E':
+            parse_num(&p, &n, 1);
+            f->encrypt = 1;
+            f->cipher = n;
+            break;
+        case 'S':
+            if (parse_num(&p, &n, 0))
+                return -1;
+            f->shaper = n;
+            break;
+        case 'F':   /* reserved */
+            break;
+        case '>':
+            return 0;
+        default:
+            return -1;
+        }
+    }
+    return -1;  /* no closing '>' */
+}
+
+int vt_flags_check(const vt_flags_t *f)
+{
+    if (f->zlib || f->lzo)
+        return TUNNEL_ERR_COMPRESSION;
+    if (f->encrypt)
+        return TUNNEL_ERR_ENCRYPTION;
+    if (f->transport == 'U')
+        return TUNNEL_ERR_UNSUPPORTED_TRANSPORT;
+    if (f->type != 'u' && f->type != 'e')
+        return TUNNEL_ERR_UNSUPPORTED_TYPE;
+    return TUNNEL_OK;
+}
+
+void vt_flags_format(const vt_flags_t *f, char *out, size_t size)
+{
+    char tmp[64];
+    size_t n = 0;
+
+    tmp[n++] = '<';
+    if (f->transport)
+        tmp[n++] = f->transport;
+    if (f->type)
+        tmp[n++] = f->type;
+    if (f->shaper)
+        n += (size_t)sprintf(tmp + n, "S%d", f->shaper);
+    if (f->zlib)
+        n += (size_t)sprintf(tmp + n, "C%d", f->zlevel);
+    if (f->lzo)
+        n += (size_t)sprintf(tmp + n, "L%d", f->zlevel);
+    if (f->keepalive)
+        tmp[n++] = 'K';
+    if (f->encrypt)
+        n += (size_t)sprintf(tmp + n, "E%d", f->cipher);
+    tmp[n++] = '>';
+    tmp[n] = '\0';
+    snprintf(out, size, "%s", tmp);
+}