diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9275902a..d56a53e5 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -105,7 +105,7 @@ jobs:
 
   build-macos:
     macos:
-      xcode: "10.0.0"
+      xcode: "13.0.0"
 
     working_directory: ~/go/src/github.com/RiV-chain/RiV-mesh
 
diff --git a/src/admin/admin.go b/src/admin/admin.go
index 4542044b..cd462b2e 100644
--- a/src/admin/admin.go
+++ b/src/admin/admin.go
@@ -38,8 +38,8 @@ type AdminSocketResponse struct {
 }
 
 type handler struct {
-	args    []string                                   // List of human-readable argument names
-	handler func(json.RawMessage) (interface{}, error) // First is input map, second is output
+	args    []string            // List of human-readable argument names
+	handler core.AddHandlerFunc // First is input map, second is output
 }
 
 type ListResponse struct {
@@ -51,7 +51,7 @@ type ListEntry struct {
 }
 
 // AddHandler is called for each admin function to add the handler and help documentation to the API.
-func (a *AdminSocket) AddHandler(name string, args []string, handlerfunc func(json.RawMessage) (interface{}, error)) error {
+func (a *AdminSocket) AddHandler(name string, args []string, handlerfunc core.AddHandlerFunc) error {
 	if _, ok := a.handlers[strings.ToLower(name)]; ok {
 		return errors.New("handler already exists")
 	}
diff --git a/src/core/api.go b/src/core/api.go
index 32280459..aac261fa 100644
--- a/src/core/api.go
+++ b/src/core/api.go
@@ -242,9 +242,11 @@ func (c *Core) PublicKey() ed25519.PublicKey {
 // Hack to get the admin stuff working, TODO something cleaner
 
 type AddHandler interface {
-	AddHandler(name string, args []string, handlerfunc func(json.RawMessage) (interface{}, error)) error
+	AddHandler(name string, args []string, handlerfunc AddHandlerFunc) error
 }
 
+type AddHandlerFunc func(json.RawMessage) (interface{}, error)
+
 // SetAdmin must be called after Init and before Start.
 // It sets the admin handler for NodeInfo and the Debug admin functions.
 func (c *Core) SetAdmin(a AddHandler) error {
diff --git a/src/core/debug.go b/src/core/debug.go
index 0fc08259..eb406798 100644
--- a/src/core/debug.go
+++ b/src/core/debug.go
@@ -1,3 +1,4 @@
+//go:build debug
 // +build debug
 
 package core
diff --git a/src/core/link.go b/src/core/link.go
index ce220dc5..417a1490 100644
--- a/src/core/link.go
+++ b/src/core/link.go
@@ -98,6 +98,22 @@ func (l *links) call(u *url.URL, sintf string) error {
 		l.tcp.call(pathtokens[0], tcpOpts, sintf)
 	case "tls":
 		tcpOpts.upgrade = l.tcp.tls.forDialer
+		// SNI headers must contain hostnames and not IP addresses, so we must make sure
+		// that we do not populate the SNI with an IP literal. We do this by splitting
+		// the host-port combo from the query option and then seeing if it parses to an
+		// IP address successfully or not.
+		if sni := u.Query().Get("sni"); sni != "" {
+			if net.ParseIP(sni) == nil {
+				tcpOpts.tlsSNI = sni
+			}
+		}
+		// If the SNI is not configured still because the above failed then we'll try
+		// again but this time we'll use the host part of the peering URI instead.
+		if tcpOpts.tlsSNI == "" {
+			if host, _, err := net.SplitHostPort(u.Host); err == nil && net.ParseIP(host) == nil {
+				tcpOpts.tlsSNI = host
+			}
+		}
 		l.tcp.call(u.Host, tcpOpts, sintf)
 	default:
 		return errors.New("unknown call scheme: " + u.Scheme)
diff --git a/src/core/proto.go b/src/core/proto.go
index 2b4f5f4c..69f2634f 100644
--- a/src/core/proto.go
+++ b/src/core/proto.go
@@ -34,21 +34,26 @@ type keyArray [ed25519.PublicKeySize]byte
 
 type protoHandler struct {
 	phony.Inbox
+
 	core     *Core
 	nodeinfo nodeinfo
-	sreqs    map[keyArray]*reqInfo
-	preqs    map[keyArray]*reqInfo
-	dreqs    map[keyArray]*reqInfo
+
+	selfRequests  map[keyArray]*reqInfo
+	peersRequests map[keyArray]*reqInfo
+	dhtRequests   map[keyArray]*reqInfo
 }
 
 func (p *protoHandler) init(core *Core) {
 	p.core = core
 	p.nodeinfo.init(p)
-	p.sreqs = make(map[keyArray]*reqInfo)
-	p.preqs = make(map[keyArray]*reqInfo)
-	p.dreqs = make(map[keyArray]*reqInfo)
+
+	p.selfRequests  = make(map[keyArray]*reqInfo)
+	p.peersRequests = make(map[keyArray]*reqInfo)
+	p.dhtRequests   = make(map[keyArray]*reqInfo)
 }
 
+// Common functions
+
 func (p *protoHandler) handleProto(from phony.Actor, key keyArray, bs []byte) {
 	if len(bs) == 0 {
 		return
@@ -85,22 +90,29 @@ func (p *protoHandler) _handleDebug(key keyArray, bs []byte) {
 	}
 }
 
+func (p *protoHandler) _sendDebug(key keyArray, dType uint8, data []byte) {
+	bs := append([]byte{typeSessionProto, typeProtoDebug, dType}, data...)
+	_, _ = p.core.PacketConn.WriteTo(bs, iwt.Addr(key[:]))
+}
+
+// Get self
+
 func (p *protoHandler) sendGetSelfRequest(key keyArray, callback func([]byte)) {
 	p.Act(nil, func() {
-		if info := p.sreqs[key]; info != nil {
+		if info := p.selfRequests[key]; info != nil {
 			info.timer.Stop()
-			delete(p.sreqs, key)
+			delete(p.selfRequests, key)
 		}
 		info := new(reqInfo)
 		info.callback = callback
 		info.timer = time.AfterFunc(time.Minute, func() {
 			p.Act(nil, func() {
-				if p.sreqs[key] == info {
-					delete(p.sreqs, key)
+				if p.selfRequests[key] == info {
+					delete(p.selfRequests, key)
 				}
 			})
 		})
-		p.sreqs[key] = info
+		p.selfRequests[key] = info
 		p._sendDebug(key, typeDebugGetSelfRequest, nil)
 	})
 }
@@ -119,29 +131,31 @@ func (p *protoHandler) _handleGetSelfRequest(key keyArray) {
 }
 
 func (p *protoHandler) _handleGetSelfResponse(key keyArray, bs []byte) {
-	if info := p.sreqs[key]; info != nil {
+	if info := p.selfRequests[key]; info != nil {
 		info.timer.Stop()
 		info.callback(bs)
-		delete(p.sreqs, key)
+		delete(p.selfRequests, key)
 	}
 }
 
+// Get peers
+
 func (p *protoHandler) sendGetPeersRequest(key keyArray, callback func([]byte)) {
 	p.Act(nil, func() {
-		if info := p.preqs[key]; info != nil {
+		if info := p.peersRequests[key]; info != nil {
 			info.timer.Stop()
-			delete(p.preqs, key)
+			delete(p.peersRequests, key)
 		}
 		info := new(reqInfo)
 		info.callback = callback
 		info.timer = time.AfterFunc(time.Minute, func() {
 			p.Act(nil, func() {
-				if p.preqs[key] == info {
-					delete(p.preqs, key)
+				if p.peersRequests[key] == info {
+					delete(p.peersRequests, key)
 				}
 			})
 		})
-		p.preqs[key] = info
+		p.peersRequests[key] = info
 		p._sendDebug(key, typeDebugGetPeersRequest, nil)
 	})
 }
@@ -161,29 +175,31 @@ func (p *protoHandler) _handleGetPeersRequest(key keyArray) {
 }
 
 func (p *protoHandler) _handleGetPeersResponse(key keyArray, bs []byte) {
-	if info := p.preqs[key]; info != nil {
+	if info := p.peersRequests[key]; info != nil {
 		info.timer.Stop()
 		info.callback(bs)
-		delete(p.preqs, key)
+		delete(p.peersRequests, key)
 	}
 }
 
+// Get DHT
+
 func (p *protoHandler) sendGetDHTRequest(key keyArray, callback func([]byte)) {
 	p.Act(nil, func() {
-		if info := p.dreqs[key]; info != nil {
+		if info := p.dhtRequests[key]; info != nil {
 			info.timer.Stop()
-			delete(p.dreqs, key)
+			delete(p.dhtRequests, key)
 		}
 		info := new(reqInfo)
 		info.callback = callback
 		info.timer = time.AfterFunc(time.Minute, func() {
 			p.Act(nil, func() {
-				if p.dreqs[key] == info {
-					delete(p.dreqs, key)
+				if p.dhtRequests[key] == info {
+					delete(p.dhtRequests, key)
 				}
 			})
 		})
-		p.dreqs[key] = info
+		p.dhtRequests[key] = info
 		p._sendDebug(key, typeDebugGetDHTRequest, nil)
 	})
 }
@@ -203,19 +219,14 @@ func (p *protoHandler) _handleGetDHTRequest(key keyArray) {
 }
 
 func (p *protoHandler) _handleGetDHTResponse(key keyArray, bs []byte) {
-	if info := p.dreqs[key]; info != nil {
+	if info := p.dhtRequests[key]; info != nil {
 		info.timer.Stop()
 		info.callback(bs)
-		delete(p.dreqs, key)
+		delete(p.dhtRequests, key)
 	}
 }
 
-func (p *protoHandler) _sendDebug(key keyArray, dType uint8, data []byte) {
-	bs := append([]byte{typeSessionProto, typeProtoDebug, dType}, data...)
-	_, _ = p.core.PacketConn.WriteTo(bs, iwt.Addr(key[:]))
-}
-
-// Admin socket stuff
+// Admin socket stuff for "Get self"
 
 type DebugGetSelfRequest struct {
 	Key string `json:"key"`
@@ -255,6 +266,8 @@ func (p *protoHandler) getSelfHandler(in json.RawMessage) (interface{}, error) {
 	}
 }
 
+// Admin socket stuff for "Get peers"
+
 type DebugGetPeersRequest struct {
 	Key string `json:"key"`
 }
@@ -303,6 +316,8 @@ func (p *protoHandler) getPeersHandler(in json.RawMessage) (interface{}, error)
 	}
 }
 
+// Admin socket stuff for "Get DHT"
+
 type DebugGetDHTRequest struct {
 	Key string `json:"key"`
 }
diff --git a/src/core/tcp.go b/src/core/tcp.go
index 66fe1955..a2a361aa 100644
--- a/src/core/tcp.go
+++ b/src/core/tcp.go
@@ -64,6 +64,7 @@ type tcpOptions struct {
 	socksProxyAddr string
 	socksProxyAuth *proxy.Auth
 	socksPeerAddr  string
+	tlsSNI         string
 }
 
 func (l *TcpListener) Stop() {
diff --git a/src/core/tcp_darwin.go b/src/core/tcp_darwin.go
index 6b85c621..2ea3abc8 100644
--- a/src/core/tcp_darwin.go
+++ b/src/core/tcp_darwin.go
@@ -1,3 +1,4 @@
+//go:build darwin
 // +build darwin
 
 package core
diff --git a/src/core/tcp_linux.go b/src/core/tcp_linux.go
index 558b4e56..e59c3121 100644
--- a/src/core/tcp_linux.go
+++ b/src/core/tcp_linux.go
@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 package core
diff --git a/src/core/tcp_other.go b/src/core/tcp_other.go
index 97b81ed1..8dd76f28 100644
--- a/src/core/tcp_other.go
+++ b/src/core/tcp_other.go
@@ -1,3 +1,4 @@
+//go:build !darwin && !linux
 // +build !darwin,!linux
 
 package core
diff --git a/src/core/tls.go b/src/core/tls.go
index 4c25225b..9e340ac4 100644
--- a/src/core/tls.go
+++ b/src/core/tls.go
@@ -78,7 +78,7 @@ func (t *tcptls) init(tcp *tcp) {
 }
 
 func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
-	config := *t.config
+	config := t.config.Clone()
 	config.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
 		if len(rawCerts) != 1 {
 			return errors.New("tls not exactly 1 cert")
@@ -103,7 +103,7 @@ func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
 		}
 		return nil
 	}
-	return &config
+	return config
 }
 
 func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, error) {
@@ -117,6 +117,7 @@ func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, err
 
 func (t *tcptls) upgradeDialer(c net.Conn, options *tcpOptions) (net.Conn, error) {
 	config := t.configForOptions(options)
+	config.ServerName = options.tlsSNI
 	conn := tls.Client(c, config)
 	if err := conn.Handshake(); err != nil {
 		return c, err
diff --git a/src/defaults/defaults_darwin.go b/src/defaults/defaults_darwin.go
index 1d73dbc2..ffcff274 100644
--- a/src/defaults/defaults_darwin.go
+++ b/src/defaults/defaults_darwin.go
@@ -1,3 +1,4 @@
+//go:build darwin
 // +build darwin
 
 package defaults
diff --git a/src/defaults/defaults_freebsd.go b/src/defaults/defaults_freebsd.go
index 4351c80d..eb761215 100644
--- a/src/defaults/defaults_freebsd.go
+++ b/src/defaults/defaults_freebsd.go
@@ -1,3 +1,4 @@
+//go:build freebsd
 // +build freebsd
 
 package defaults
diff --git a/src/defaults/defaults_linux.go b/src/defaults/defaults_linux.go
index 7e0f8e18..b0d755c2 100644
--- a/src/defaults/defaults_linux.go
+++ b/src/defaults/defaults_linux.go
@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 package defaults
diff --git a/src/defaults/defaults_openbsd.go b/src/defaults/defaults_openbsd.go
index c234a457..411c3b79 100644
--- a/src/defaults/defaults_openbsd.go
+++ b/src/defaults/defaults_openbsd.go
@@ -1,3 +1,4 @@
+//go:build openbsd
 // +build openbsd
 
 package defaults
diff --git a/src/defaults/defaults_other.go b/src/defaults/defaults_other.go
index 8a7a462f..50e23f49 100644
--- a/src/defaults/defaults_other.go
+++ b/src/defaults/defaults_other.go
@@ -1,3 +1,4 @@
+//go:build !linux && !darwin && !windows && !openbsd && !freebsd
 // +build !linux,!darwin,!windows,!openbsd,!freebsd
 
 package defaults
diff --git a/src/defaults/defaults_windows.go b/src/defaults/defaults_windows.go
index fabb7828..c7550fa2 100644
--- a/src/defaults/defaults_windows.go
+++ b/src/defaults/defaults_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package defaults
diff --git a/src/ipv6rwc/ipv6rwc.go b/src/ipv6rwc/ipv6rwc.go
index 713c9ae2..4e56fa12 100644
--- a/src/ipv6rwc/ipv6rwc.go
+++ b/src/ipv6rwc/ipv6rwc.go
@@ -132,6 +132,7 @@ func (k *keyStore) update(key ed25519.PublicKey) *keyInfo {
 	var kArray keyArray
 	copy(kArray[:], key)
 	var info *keyInfo
+	var packets [][]byte
 	if info = k.keyToInfo[kArray]; info == nil {
 		info = new(keyInfo)
 		info.key = kArray
@@ -140,19 +141,19 @@ func (k *keyStore) update(key ed25519.PublicKey) *keyInfo {
 		k.keyToInfo[info.key] = info
 		k.addrToInfo[info.address] = info
 		k.subnetToInfo[info.subnet] = info
-		k.resetTimeout(info)
-		k.mutex.Unlock()
 		if buf := k.addrBuffer[info.address]; buf != nil {
-			k.core.WriteTo(buf.packet, iwt.Addr(info.key[:]))
+			packets = append(packets, buf.packet)
 			delete(k.addrBuffer, info.address)
 		}
 		if buf := k.subnetBuffer[info.subnet]; buf != nil {
-			k.core.WriteTo(buf.packet, iwt.Addr(info.key[:]))
+			packets = append(packets, buf.packet)
 			delete(k.subnetBuffer, info.subnet)
 		}
-	} else {
-		k.resetTimeout(info)
-		k.mutex.Unlock()
+	}
+	k.resetTimeout(info)
+	k.mutex.Unlock()
+	for _, packet := range packets {
+		k.core.WriteTo(packet, iwt.Addr(info.key[:]))
 	}
 	return info
 }
diff --git a/src/multicast/multicast_darwin.go b/src/multicast/multicast_darwin.go
index 9ca04bb0..47c524de 100644
--- a/src/multicast/multicast_darwin.go
+++ b/src/multicast/multicast_darwin.go
@@ -1,3 +1,4 @@
+//go:build darwin
 // +build darwin
 
 package multicast
diff --git a/src/multicast/multicast_other.go b/src/multicast/multicast_other.go
index dfcf625f..9977951c 100644
--- a/src/multicast/multicast_other.go
+++ b/src/multicast/multicast_other.go
@@ -1,3 +1,4 @@
+//go:build !linux && !darwin && !netbsd && !freebsd && !openbsd && !dragonflybsd && !windows
 // +build !linux,!darwin,!netbsd,!freebsd,!openbsd,!dragonflybsd,!windows
 
 package multicast
diff --git a/src/multicast/multicast_unix.go b/src/multicast/multicast_unix.go
index 1ff48b17..9c822fcf 100644
--- a/src/multicast/multicast_unix.go
+++ b/src/multicast/multicast_unix.go
@@ -1,3 +1,4 @@
+//go:build linux || netbsd || freebsd || openbsd || dragonflybsd
 // +build linux netbsd freebsd openbsd dragonflybsd
 
 package multicast
diff --git a/src/multicast/multicast_windows.go b/src/multicast/multicast_windows.go
index 3666faaa..515412a4 100644
--- a/src/multicast/multicast_windows.go
+++ b/src/multicast/multicast_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package multicast
diff --git a/src/tuntap/tun_bsd.go b/src/tuntap/tun_bsd.go
index 75158857..fe36266b 100644
--- a/src/tuntap/tun_bsd.go
+++ b/src/tuntap/tun_bsd.go
@@ -1,3 +1,4 @@
+//go:build openbsd || freebsd
 // +build openbsd freebsd
 
 package tuntap
diff --git a/src/tuntap/tun_darwin.go b/src/tuntap/tun_darwin.go
index 75938881..6f6e2528 100644
--- a/src/tuntap/tun_darwin.go
+++ b/src/tuntap/tun_darwin.go
@@ -1,3 +1,4 @@
+//go:build !mobile
 // +build !mobile
 
 package tuntap
diff --git a/src/tuntap/tun_linux.go b/src/tuntap/tun_linux.go
index 0a845368..f849c00f 100644
--- a/src/tuntap/tun_linux.go
+++ b/src/tuntap/tun_linux.go
@@ -1,3 +1,4 @@
+//go:build !mobile
 // +build !mobile
 
 package tuntap
diff --git a/src/tuntap/tun_other.go b/src/tuntap/tun_other.go
index c0321267..8ce24953 100644
--- a/src/tuntap/tun_other.go
+++ b/src/tuntap/tun_other.go
@@ -1,3 +1,4 @@
+//go:build !linux && !darwin && !windows && !openbsd && !freebsd && !mobile
 // +build !linux,!darwin,!windows,!openbsd,!freebsd,!mobile
 
 package tuntap
diff --git a/src/tuntap/tun_windows.go b/src/tuntap/tun_windows.go
index aaddafc3..d82a55df 100644
--- a/src/tuntap/tun_windows.go
+++ b/src/tuntap/tun_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package tuntap