thread pool: add ExecutionContext

Signed-off-by: JUAN MÉNDEZ <vpsink@gmail.com>

CMakeLists.txt

@@ -71,8 +71,11 @@ if (NOT MSVC)
         )
     endif()
 
-    if (OPENDHT_HTTP)
+    if (OPENDHT_HTTP OR OPENDHT_PEER_DISCOVERY)
         find_path(ASIO_INCLUDE_DIR asio.hpp REQUIRED)
+    endif ()
+
+    if (OPENDHT_HTTP)
         find_package(Restinio REQUIRED)
         find_library(FMT_LIBRARY fmt)
         add_library(fmt SHARED IMPORTED)

docker/DockerfileDeps

@@ -17,9 +17,9 @@ RUN apt-get update && apt-get install -y \
 
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
-    && wget https://github.com/aberaud/restinio/archive/2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
-    && ls -l && tar -xzf 2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
-    && cd restinio-2c0b6f5e5ba04d7a74e8406a3df1fd433680599d/dev \
+    && wget https://github.com/aberaud/restinio/archive/2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
+    && ls -l && tar -xzf 2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
+    && cd restinio-2224ffedef52cb2b74645d63d871d61dbd0f165e/dev \
     && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=OFF -DRESTINIO_SAMPLE=OFF \
              -DRESTINIO_INSTALL_SAMPLES=OFF -DRESTINIO_BENCH=OFF -DRESTINIO_INSTALL_BENCHES=OFF \
              -DRESTINIO_FIND_DEPS=ON -DRESTINIO_ALLOW_SOBJECTIZER=Off -DRESTINIO_USE_BOOST_ASIO=none . \

docker/DockerfileDepsLlvm

@@ -18,9 +18,9 @@ ENV CXX c++
 
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
-    && wget https://github.com/aberaud/restinio/archive/2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
-    && ls -l && tar -xzf 2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
-    && cd restinio-2c0b6f5e5ba04d7a74e8406a3df1fd433680599d/dev \
+    && wget https://github.com/aberaud/restinio/archive/2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
+    && ls -l && tar -xzf 2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
+    && cd restinio-2224ffedef52cb2b74645d63d871d61dbd0f165e/dev \
     && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=OFF -DRESTINIO_SAMPLE=OFF \
              -DRESTINIO_INSTALL_SAMPLES=OFF -DRESTINIO_BENCH=OFF -DRESTINIO_INSTALL_BENCHES=OFF \
              -DRESTINIO_FIND_DEPS=ON -DRESTINIO_ALLOW_SOBJECTIZER=Off -DRESTINIO_USE_BOOST_ASIO=none . \

include/opendht/callbacks.h

@@ -164,6 +164,7 @@ using GetCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>
 using ValueCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired)>;
 using GetCallbackSimple = std::function<bool(std::shared_ptr<Value> value)>;
 using ShutdownCallback = std::function<void()>;
+using IdentityAnnouncedCb = std::function<void(bool)>;
 
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 

include/opendht/crypto.h

@@ -80,6 +80,8 @@ struct OPENDHT_PUBLIC PublicKey
      * Takes ownership of an existing gnutls_pubkey.
      */
     PublicKey(gnutls_pubkey_t k) : pk(k) {}
+
+    /** Import public key from serialized data */
     PublicKey(const uint8_t* dat, size_t dat_size);
     PublicKey(const Blob& pk) : PublicKey(pk.data(), pk.size()) {}
     PublicKey(PublicKey&& o) noexcept : pk(o.pk) { o.pk = nullptr; };
@@ -312,6 +314,24 @@ private:
     gnutls_x509_crq_t request {nullptr};
 };
 
+class OPENDHT_PUBLIC OcspRequest
+{
+public:
+    OcspRequest(gnutls_ocsp_req_t r) : request(r) {};
+    OcspRequest(const uint8_t* dat_ptr, size_t dat_size);
+    ~OcspRequest();
+
+    /*
+     * Get OCSP Request in readable format.
+     */
+    std::string toString(const bool compact = true) const;
+
+    Blob pack() const;
+    Blob getNonce() const;
+private:
+    gnutls_ocsp_req_t request;
+};
+
 class OPENDHT_PUBLIC OcspResponse
 {
 public:
@@ -333,11 +353,11 @@ public:
     gnutls_ocsp_cert_status_t getCertificateStatus() const;
 
     /*
-     * Verify OCSP response.
-     * Return OCSP verify reason.
+     * Verify OCSP response and return OCSP status.
+     * Throws CryptoException in case of error in the response.
      * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-verify-reason-t
      */
-    gnutls_ocsp_verify_reason_t verifyDirect(const Certificate& crt, const Blob& nonce);
+    gnutls_ocsp_cert_status_t verifyDirect(const Certificate& crt, const Blob& nonce);
 
 private:
     gnutls_ocsp_resp_t response;

include/opendht/default_types.h

@@ -144,7 +144,7 @@ public:
     static const ValueType TYPE;
 
     TrustRequest() {}
-    TrustRequest(std::string s, std::string ci) : service(s), conversationId(ci) {}
+    TrustRequest(std::string s, std::string ci = {}) : service(s), conversationId(ci) {}
     TrustRequest(std::string s, std::string ci, const Blob& d) : service(s), conversationId(ci), payload(d) {}
 
     static Value::Filter getFilter() {

include/opendht/dht.h

@@ -95,7 +95,7 @@ public:
     /**
      * Performs final operations before quitting.
      */
-    void shutdown(ShutdownCallback cb) override;
+    void shutdown(ShutdownCallback cb, bool stop = false) override;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -512,6 +512,8 @@ private:
 
     void confirmNodes();
     void expire();
+
+    void onConnected();
     void onDisconnected();
 
     /**

include/opendht/dht_interface.h

@@ -21,6 +21,8 @@
 #include "infohash.h"
 #include "log_enable.h"
 
+#include <queue>
+
 namespace dht {
 
 namespace net {
@@ -46,6 +48,10 @@ public:
     virtual NodeStatus getStatus(sa_family_t af) const = 0;
     virtual NodeStatus getStatus() const = 0;
 
+    void addOnConnectedCallback(std::function<void()> cb) {
+        onConnectCallbacks_.emplace(std::move(cb));
+    }
+
     virtual net::DatagramSocket* getSocket() const { return {}; };
 
     /**
@@ -55,8 +61,10 @@ public:
 
     /**
      * Performs final operations before quitting.
+     * stop: if true, cancel ongoing operations and call their 'done'
+     *       callbacks synchronously.
      */
-    virtual void shutdown(ShutdownCallback cb) = 0;
+    virtual void shutdown(ShutdownCallback cb, bool stop = false) = 0;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -264,6 +272,7 @@ public:
 
 protected:
     std::shared_ptr<Logger> logger_ {};
+    std::queue<std::function<void()>> onConnectCallbacks_ {};
 };
 
 } // namespace dht

include/opendht/dht_proxy_client.h

@@ -85,7 +85,7 @@ public:
     /**
      * Performs final operations before quitting.
      */
-    void shutdown(ShutdownCallback cb) override;
+    void shutdown(ShutdownCallback cb, bool) override;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -378,8 +378,8 @@ private:
      * Retrieve if we can connect to the proxy (update statusIpvX_)
      */
     void handleProxyConfirm(const asio::error_code &ec);
-    Sp<asio::steady_timer> nextProxyConfirmationTimer_;
-    Sp<asio::steady_timer> listenerRestartTimer_;
+    std::unique_ptr<asio::steady_timer> nextProxyConfirmationTimer_;
+    std::unique_ptr<asio::steady_timer> listenerRestartTimer_;
 
     /**
      * Relaunch LISTEN requests if the client disconnect/reconnect.

include/opendht/dht_proxy_server.h

@@ -445,7 +445,6 @@ private:
         std::map<InfoHash, std::vector<Listener>> listeners;
         MSGPACK_DEFINE_ARRAY(listeners)
     };
-    std::mutex lockPushListeners_;
     std::map<std::string, PushListener> pushListeners_;
     proxy::ListenToken tokenPushNotif_ {0};
 #endif //OPENDHT_PUSH_NOTIFICATIONS

include/opendht/dhtrunner.h

@@ -65,6 +65,7 @@ public:
         bool peer_publish {false};
         std::shared_ptr<dht::crypto::Certificate> server_ca;
         dht::crypto::Identity client_identity;
+        SockAddr bind4 {}, bind6 {};
     };
 
     struct Context {
@@ -73,6 +74,7 @@ public:
         std::shared_ptr<PeerDiscovery> peerDiscovery {};
         StatusCallback statusChangedCallback {};
         CertificateStoreQuery certificateStore {};
+        IdentityAnnouncedCb identityAnnouncedCb {};
         Context() {}
     };
 
@@ -359,6 +361,7 @@ public:
     std::string getSearchLog(const InfoHash&, sa_family_t af = AF_UNSPEC) const;
     std::vector<SockAddr> getPublicAddress(sa_family_t af = AF_UNSPEC);
     std::vector<std::string> getPublicAddressStr(sa_family_t af = AF_UNSPEC);
+    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);
 
     // securedht methods
 
@@ -379,22 +382,12 @@ public:
         config.threaded = threaded;
         run(port, config);
     }
-    void run(in_port_t port, const Config& config, Context&& context = {});
-
-    /**
-     * @param local4: Local IPv4 address and port to bind. Can be null.
-     * @param local6: Local IPv6 address and port to bind. Can be null.
-     *         You should allways bind to a global IPv6 address.
-     * @param identity: RSA key pair to use for cryptographic operations.
-     * @param threaded: If false, loop() must be called periodically. Otherwise a thread is launched.
-     * @param cb: Optional callback to receive general state information.
-     */
-    void run(SockAddr& local4, SockAddr& local6, const Config& config, Context&& context = {});
+    void run(in_port_t port, Config& config, Context&& context = {});
 
     /**
      * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service (port).
      */
-    void run(const char* ip4, const char* ip6, const char* service, const Config& config, Context&& context = {});
+    void run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context = {});
 
     void run(const Config& config, Context&& context);
 
@@ -415,7 +408,7 @@ public:
     /**
      * Gracefuly disconnect from network.
      */
-    void shutdown(ShutdownCallback cb = {});
+    void shutdown(ShutdownCallback cb = {}, bool stop = false);
 
     /**
      * Quit and wait for all threads to terminate.
@@ -481,6 +474,7 @@ private:
 
     /** Current configuration */
     Config config_;
+    IdentityAnnouncedCb identityAnnouncedCb_;
 
     /**
      * reset dht clients

include/opendht/securedht.h

@@ -45,15 +45,13 @@ public:
         return c;
     }
 
-    SecureDht() {}
-
     /**
      * s, s6: bound socket descriptors for IPv4 and IPv6, respectively.
      *        For the Dht to be initialised, at least one of them must be >= 0.
      * id:    the identity to use for the crypto layer and to compute
      *        our own hash on the Dht.
      */
-    SecureDht(std::unique_ptr<DhtInterface> dht, Config config);
+    SecureDht(std::unique_ptr<DhtInterface> dht, Config config, IdentityAnnouncedCb iacb = {}, const std::shared_ptr<Logger>& l = {});
 
     virtual ~SecureDht();
 
@@ -148,8 +146,8 @@ public:
     /**
      * SecureDht to Dht proxy
      */
-    void shutdown(ShutdownCallback cb) override {
-        dht_->shutdown(cb);
+    void shutdown(ShutdownCallback cb, bool stop = false) override {
+        dht_->shutdown(cb, stop);
     }
     void dumpTables() const override {
         dht_->dumpTables();

include/opendht/sockaddr.h

@@ -68,7 +68,7 @@ public:
      * Build from existing address.
      */
     SockAddr(const sockaddr* sa, socklen_t length) {
-        if (length > sizeof(sockaddr_storage))
+        if (length > static_cast<socklen_t>(sizeof(sockaddr_storage)))
             throw std::runtime_error("Socket address length is too large");
         set(sa, length);
     }
@@ -144,7 +144,7 @@ public:
             if (len) addr.reset((sockaddr*)::calloc(len, 1));
             else     addr.reset();
         }
-        if (len > sizeof(sa_family_t))
+        if (len)
             addr->sa_family = af;
     }
 
@@ -223,16 +223,16 @@ public:
      */
     sockaddr* get() { return addr.get(); }
 
-    const sockaddr_in& getIPv4() const {
+    inline const sockaddr_in& getIPv4() const {
         return *reinterpret_cast<const sockaddr_in*>(get());
     }
-    const sockaddr_in6& getIPv6() const {
+    inline const sockaddr_in6& getIPv6() const {
         return *reinterpret_cast<const sockaddr_in6*>(get());
     }
-    sockaddr_in& getIPv4() {
+    inline sockaddr_in& getIPv4() {
         return *reinterpret_cast<sockaddr_in*>(get());
     }
-    sockaddr_in6& getIPv6() {
+    inline sockaddr_in6& getIPv6() {
         return *reinterpret_cast<sockaddr_in6*>(get());
     }
 

include/opendht/thread_pool.h

@@ -93,4 +93,71 @@ private:
     void schedule();
 };
 
+class OPENDHT_PUBLIC ExecutionContext {
+public:
+    ExecutionContext(ThreadPool& pool)
+     : threadPool_(pool), state_(std::make_shared<SharedState>())
+    {}
+
+    ~ExecutionContext() {
+        state_->destroy();
+    }
+
+    /** Wait for ongoing tasks to complete execution and drop other pending tasks */
+    void stop() {
+        state_->destroy(false);
+    }
+
+    void run(std::function<void()>&& task) {
+        std::lock_guard<std::mutex> lock(state_->mtx);
+        if (state_->shutdown_) return;
+        state_->pendingTasks++;
+        threadPool_.get().run([task = std::move(task), state = state_] {
+            state->run(task);
+        });
+    }
+
+private:
+    struct SharedState {
+        std::mutex mtx {};
+        std::condition_variable cv {};
+        unsigned pendingTasks {0};
+        unsigned ongoingTasks {0};
+        /** When true, prevents new tasks to be scheduled */
+        bool shutdown_ {false};
+        /** When true, prevents scheduled tasks to be executed */
+        std::atomic_bool destroyed {false};
+
+        void destroy(bool wait = true) {
+            std::unique_lock<std::mutex> lock(mtx);
+            if (destroyed) return;
+            if (wait) {
+                cv.wait(lock, [this] { return pendingTasks == 0 && ongoingTasks == 0; });
+            }
+            shutdown_ = true;
+            if (not wait) {
+                cv.wait(lock, [this] { return ongoingTasks == 0; });
+            }
+            destroyed = true;
+        }
+
+        void run(const std::function<void()>& task) {
+            {
+                std::lock_guard<std::mutex> lock(mtx);
+                pendingTasks--;
+                ongoingTasks++;
+            }
+                if (destroyed) return;
+                task();
+            {
+                std::lock_guard<std::mutex> lock(mtx);
+                ongoingTasks--;
+                cv.notify_all();
+            }
+        }
+    };
+    std::reference_wrapper<ThreadPool> threadPool_;
+    std::shared_ptr<SharedState> state_;
+};
+
 }

python/opendht.pyx

@@ -36,6 +36,7 @@ from libcpp.memory cimport shared_ptr
 from cython.parallel import parallel, prange
 from cython.operator cimport dereference as deref, preincrement as inc, predecrement as dec
 from cpython cimport ref
+from datetime import timedelta
 
 cimport opendht_cpp as cpp
 
@@ -235,8 +236,9 @@ cdef class Where(object):
 
 cdef class Value(object):
     cdef shared_ptr[cpp.Value] _value
-    def __init__(self, bytes val=b''):
-        self._value.reset(new cpp.Value(val, len(val)))
+    def __init__(self, bytes val=b'', cpp.uint16_t id=0):
+        self._value.reset(new cpp.Value(id, val, len(val)))
+
     def __str__(self):
         return self._value.get().toString().decode()
     property owner:
@@ -270,6 +272,14 @@ cdef class Value(object):
         def __get__(self):
             return self._value.get().size()
 
+cdef class ValueType(object):
+    cdef cpp.ValueType * _value
+    def __init__(self, cpp.uint16_t id, str name, expiration: timedelta):
+        if not isinstance(expiration, timedelta):
+            raise TypeError("expiration argument must be of type timedelta")
+        cdef cpp.seconds duration = cpp.seconds(int(expiration.total_seconds()))
+        self._value =  new cpp.ValueType(id, name.encode(), duration)
+
 cdef class NodeSetIter(object):
     cdef map[cpp.InfoHash, shared_ptr[cpp.Node]]* _nodes
     cdef map[cpp.InfoHash, shared_ptr[cpp.Node]].iterator _curIter
@@ -513,6 +523,8 @@ cdef class DhtRunner(_WithID):
         cb_obj = {'shutdown':shutdown_cb}
         ref.Py_INCREF(cb_obj)
         self.thisptr.get().shutdown(cpp.bindShutdownCb(shutdown_callback, <void*>cb_obj))
+    def registerType(self, ValueType type):
+        self.thisptr.get().registerType(deref(type._value))
     def enableLogging(self):
         cpp.enableLogging(self.thisptr.get()[0])
     def disableLogging(self):

python/opendht_cpp.pxd

@@ -26,6 +26,14 @@ from libc.string cimport const_char, const_uchar
 ctypedef uint16_t in_port_t
 ctypedef unsigned short int sa_family_t;
 
+cdef extern from "<iostream>" namespace "std::chrono" nogil:
+    cdef cppclass duration[ulong]:
+        duration() except +
+
+    cdef cppclass seconds:
+        duration seconds(uint64_t) except +
+        duration seconds()
+
 cdef extern from "<memory>" namespace "std" nogil:
     cdef cppclass shared_ptr[T]:
         shared_ptr() except +
@@ -131,7 +139,6 @@ cdef extern from "opendht/value.h" namespace "dht::Value":
 cdef extern from "opendht/value.h" namespace "dht::Value::Field":
     cdef Field None
     cdef Field Id
-    cdef Field ValueType
     cdef Field OwnerPk
     cdef Field SeqNum
     cdef Field UserType
@@ -141,7 +148,7 @@ cdef extern from "opendht/value.h" namespace "dht":
     cdef cppclass Value:
         Value() except +
         Value(vector[uint8_t]) except +
-        Value(const uint8_t* dat_ptr, size_t dat_len) except +
+        Value(const uint16_t t, const uint8_t* dat_ptr, size_t dat_len) except +
         string toString() const
         size_t size() const
         uint64_t id
@@ -150,6 +157,12 @@ cdef extern from "opendht/value.h" namespace "dht":
         vector[uint8_t] data
         string user_type
 
+    cdef cppclass ValueType:
+        ValueType(uint16_t id, string name, seconds expiration) except +
+        uint16_t id
+        string name
+        seconds expiration
+
     cdef cppclass Query:
         Query() except +
         Query(Select s, Where w) except +
@@ -234,6 +247,7 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
         void run(const_char*, const_char*, const_char*, Config config)
         void join()
         void shutdown(ShutdownCallback)
+        void registerType(ValueType& value);
         bool isRunning()
         SockAddr getBound(sa_family_t af) const
         string getStorageLog() const

src/crypto.cpp

@@ -710,13 +710,13 @@ CertificateRequest::sign(const PrivateKey& key, const std::string& password)
 }
 
 bool
-CertificateRequest::verify() const 
+CertificateRequest::verify() const
 {
     return gnutls_x509_crq_verify(request, 0) >= 0;
 }
 
-Blob 
-CertificateRequest::pack() const 
+Blob
+CertificateRequest::pack() const
 {
     gnutls_datum_t dat {nullptr, 0};
     if (auto err = gnutls_x509_crq_export2(request, GNUTLS_X509_FMT_PEM, &dat))
@@ -727,7 +727,7 @@ CertificateRequest::pack() const
 }
 
 std::string
-CertificateRequest::toString() const 
+CertificateRequest::toString() const
 {
     gnutls_datum_t dat {nullptr, 0};
     if (auto err = gnutls_x509_crq_export2(request, GNUTLS_X509_FMT_PEM, &dat))
@@ -1147,8 +1147,8 @@ void
 setRandomSerial(gnutls_x509_crt_t cert)
 {
     random_device rdev;
-    std::uniform_int_distribution<uint64_t> dist{};
-    uint64_t cert_serial = dist(rdev);
+    std::uniform_int_distribution<int64_t> dist{1};
+    int64_t cert_serial = dist(rdev);
     gnutls_x509_crt_set_serial(cert, &cert_serial, sizeof(cert_serial));
 }
 
@@ -1240,6 +1240,70 @@ Certificate::getRevocationLists() const
     return ret;
 }
 
+// OcspRequest
+
+OcspRequest::OcspRequest(const uint8_t* dat_ptr, size_t dat_size)
+{
+    int ret = gnutls_ocsp_req_init(&request);
+    if (ret < 0)
+        throw CryptoException(gnutls_strerror(ret));
+    gnutls_datum_t dat = {(unsigned char*)dat_ptr,(unsigned int)dat_size};
+    ret = gnutls_ocsp_req_import(request, &dat);
+    if (ret < 0){
+        gnutls_ocsp_req_deinit(request);
+        throw CryptoException(gnutls_strerror(ret));
+    }
+}
+
+OcspRequest::~OcspRequest()
+{
+    if (request) {
+        gnutls_ocsp_req_deinit(request);
+        request = nullptr;
+    }
+}
+
+std::string
+OcspRequest::toString(const bool compact) const
+{
+    int ret;
+    gnutls_datum_t dat;
+    ret = gnutls_ocsp_req_print(request, compact ? GNUTLS_OCSP_PRINT_COMPACT : GNUTLS_OCSP_PRINT_FULL, &dat);
+
+    std::string str;
+    if (ret == 0) {
+        str = std::string((const char*)dat.data, (size_t)dat.size);
+        gnutls_free(dat.data);
+    } else
+        throw CryptoException(gnutls_strerror(ret));
+    return str;
+}
+
+Blob
+OcspRequest::pack() const
+{
+    gnutls_datum_t dat;
+    int err = gnutls_ocsp_req_export(request, &dat);
+    if (err < 0)
+        throw CryptoException(gnutls_strerror(err));
+    Blob ret {dat.data, dat.data + dat.size};
+    gnutls_free(dat.data);
+    return ret;
+}
+
+Blob
+OcspRequest::getNonce() const
+{
+    gnutls_datum_t dat;
+    unsigned critical;
+    int err = gnutls_ocsp_req_get_nonce(request, &critical, &dat);
+    if (err < 0)
+        throw CryptoException(gnutls_strerror(err));
+    Blob ret {dat.data, dat.data + dat.size};
+    gnutls_free(dat.data);
+    return ret;
+}
+
 // OcspResponse
 
 OcspResponse::OcspResponse(const uint8_t* dat_ptr, size_t dat_size)
@@ -1264,10 +1328,12 @@ Blob
 OcspResponse::pack() const
 {
     gnutls_datum_t dat;
-    int ret = gnutls_ocsp_resp_export(response, &dat);
-    if (ret < 0)
-        throw CryptoException(gnutls_strerror(ret));
-    return {dat.data, dat.data + dat.size};
+    int err = gnutls_ocsp_resp_export(response, &dat);
+    if (err < 0)
+        throw CryptoException(gnutls_strerror(err));
+    Blob ret {dat.data, dat.data + dat.size};
+    gnutls_free(dat.data);
+    return ret;
 }
 
 std::string
@@ -1297,7 +1363,7 @@ OcspResponse::getCertificateStatus() const
     return (gnutls_ocsp_cert_status_t) status;
 }
 
-gnutls_ocsp_verify_reason_t
+gnutls_ocsp_cert_status_t
 OcspResponse::verifyDirect(const Certificate& crt, const Blob& nonce)
 {
     // Check OCSP response
@@ -1308,39 +1374,52 @@ OcspResponse::verifyDirect(const Certificate& crt, const Blob& nonce)
     if (status != GNUTLS_OCSP_RESP_SUCCESSFUL)
         throw CryptoException("OCSP request unsuccessful: " + std::to_string(ret));
 
-    // Check whether the OCSP response is about the provided certificate.
-    if ((ret = gnutls_ocsp_resp_check_crt(response, 0, crt.cert)) < 0)
-        throw CryptoException(gnutls_strerror(ret));
+    if (not nonce.empty()) {
+        // Ensure no replay attack has been done
+        gnutls_datum_t rnonce;
+        ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
+        if (ret < 0)
+            throw CryptoException(gnutls_strerror(ret));
+        if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
+            gnutls_free(rnonce.data);
+            throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
+        }
+        gnutls_free(rnonce.data);
+    }
 
     // Verify signature of the Basic OCSP response against the public key in the issuer certificate.
     unsigned int verify = 0;
     ret = gnutls_ocsp_resp_verify_direct(response, crt.issuer->cert, &verify, 0);
     if (ret < 0)
         throw CryptoException(gnutls_strerror(ret));
+    if (verify) {
+        if (verify & GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND)
+            throw CryptoException("Signer cert not found");
+        if (verify & GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR)
+            throw CryptoException("Signer cert keyusage error");
+        if (verify & GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER)
+            throw CryptoException("Signer cert is not trusted");
+        if (verify & GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM)
+            throw CryptoException("Insecure algorithm");
+        if (verify & GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE)
+            throw CryptoException("Signature failure");
+        if (verify & GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED)
+            throw CryptoException("Signer cert not yet activated");
+        if (verify & GNUTLS_OCSP_VERIFY_CERT_EXPIRED)
+            throw CryptoException("Signer cert expired");
+        throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
+    }
+
+    // Check whether the OCSP response is about the provided certificate.
+    if ((ret = gnutls_ocsp_resp_check_crt(response, 0, crt.cert)) < 0)
+        throw CryptoException(gnutls_strerror(ret));
 
     // Check certificate revocation status
     unsigned status_ocsp;
     ret = gnutls_ocsp_resp_get_single(response, 0, NULL, NULL, NULL, NULL, &status_ocsp, NULL, NULL, NULL, NULL);
     if (ret < 0)
         throw CryptoException(gnutls_strerror(ret));
-    gnutls_ocsp_cert_status_t certStatus = (gnutls_ocsp_cert_status_t)ret;
-    if (certStatus == GNUTLS_OCSP_CERT_REVOKED)
-        throw CryptoException("Certificate was revoked");
-    else if (certStatus != GNUTLS_OCSP_CERT_GOOD)
-        throw CryptoException("Certificate is unknown");
-
-    // Ensure no replay attack has been done
-    gnutls_datum_t rnonce;
-    ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
-    if (ret < 0)
-        throw CryptoException(gnutls_strerror(ret));
-    if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
-        gnutls_free(rnonce.data);
-        throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
-    }
-    gnutls_free(rnonce.data);
-
-    return (gnutls_ocsp_verify_reason_t) verify;
+    return (gnutls_ocsp_cert_status_t)status_ocsp;
 }
 
 // RevocationList

src/dht.cpp

@@ -52,12 +52,7 @@ Dht::updateStatus(sa_family_t af)
         if (other.status == NodeStatus::Disconnected && d.status == NodeStatus::Disconnected)
             onDisconnected();
         else if (other.status == NodeStatus::Connected || d.status == NodeStatus::Connected) {
-            // On connected
-            if (bootstrapJob) {
-                bootstrapJob->cancel();
-                bootstrapJob.reset();
-            }
-            bootstrap_period = std::chrono::seconds(10);
+            onConnected();
         }
     }
     return d.status;
@@ -82,11 +77,27 @@ Dht::Kad::getStatus(time_point now) const
 }
 
 void
-Dht::shutdown(ShutdownCallback cb)
+Dht::shutdown(ShutdownCallback cb, bool stop)
 {
     if (not persistPath.empty())
         saveState(persistPath);
 
+    if (stop) {
+        for (auto dht : {&dht4, &dht6}) {
+            for (auto& sr : dht->searches) {
+                for (const auto& r : sr.second->callbacks)
+                    r.second.done_cb(false, {});
+                sr.second->callbacks.clear();
+                for (const auto& a : sr.second->announce) {
+                    if (a.callback) a.callback(false, {});
+                }
+                sr.second->announce.clear();
+                sr.second->listeners.clear();
+            }
+        }
+        network_engine.clear();
+    }
+
     if (not maintain_storage) {
         if (cb) cb();
         return;
@@ -382,7 +393,7 @@ Dht::searchSendGetValues(Sp<Search> sr, SearchNode* pn, bool update)
         }
 
         if (sr->callbacks.empty()) { /* 'find_node' request */
-            if (not n or n->isSynced(now))
+            if (not n)
                 return nullptr;
 
             /* if (logger_)
@@ -1981,6 +1992,21 @@ Dht::expire()
     scheduler.add(expire_stuff_time, std::bind(&Dht::expire, this));
 }
 
+void
+Dht::onConnected()
+{
+    if (bootstrapJob) {
+        bootstrapJob->cancel();
+        bootstrapJob.reset();
+    }
+    bootstrap_period = std::chrono::seconds(10);
+    auto callbacks = std::move(onConnectCallbacks_);
+    while (not callbacks.empty()) {
+        callbacks.front()();
+        callbacks.pop();
+    }
+}
+
 void
 Dht::onDisconnected()
 {

src/dht_proxy_client.cpp

@@ -155,10 +155,10 @@ DhtProxyClient::startProxy()
     if (logger_)
         logger_->d("[proxy:client] start proxy with %s", proxyUrl_.c_str());
 
-    nextProxyConfirmationTimer_ = std::make_shared<asio::steady_timer>(httpContext_, std::chrono::steady_clock::now());
+    nextProxyConfirmationTimer_ = std::make_unique<asio::steady_timer>(httpContext_, std::chrono::steady_clock::now());
     nextProxyConfirmationTimer_->async_wait(std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));
 
-    listenerRestartTimer_ = std::make_shared<asio::steady_timer>(httpContext_);
+    listenerRestartTimer_ = std::make_unique<asio::steady_timer>(httpContext_);
 
     loopSignal_();
 }
@@ -242,7 +242,7 @@ DhtProxyClient::cancelAllListeners()
 }
 
 void
-DhtProxyClient::shutdown(ShutdownCallback cb)
+DhtProxyClient::shutdown(ShutdownCallback cb, bool)
 {
     stop();
     if (cb)
@@ -723,6 +723,15 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
         if (oldStatus == NodeStatus::Disconnected || oldStatus == NodeStatus::Connecting) {
             listenerRestartTimer_->expires_at(std::chrono::steady_clock::now());
             listenerRestartTimer_->async_wait(std::bind(&DhtProxyClient::restartListeners, this, std::placeholders::_1));
+            if (not onConnectCallbacks_.empty()) {
+                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                callbacks_.emplace_back([cbs = std::move(onConnectCallbacks_)]() mutable {
+                    while (not cbs.empty()) {
+                        cbs.front()();
+                        cbs.pop();
+                    }
+                });
+            }
         }
         nextProxyConfirmationTimer_->expires_at(std::chrono::steady_clock::now() + std::chrono::minutes(15));
         nextProxyConfirmationTimer_->async_wait(std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));

src/dht_proxy_server.cpp

@@ -822,7 +822,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request,
             logger_->d("[proxy:server] [subscribe %s] [client %s] [session %s]", infoHash.toString().c_str(), clientId.c_str(), sessionId.c_str());
 
         // Insert new or return existing push listeners of a token
-        std::lock_guard<std::mutex> lock(lockPushListeners_);
+        std::lock_guard<std::mutex> lock(lockListener_);
         auto& pushListener = pushListeners_[pushToken];
         auto& pushListeners = pushListener.listeners[infoHash];
 

src/dhtrunner.cpp

@@ -76,19 +76,17 @@ DhtRunner::~DhtRunner()
 }
 
 void
-DhtRunner::run(in_port_t port, const Config& config, Context&& context)
+DhtRunner::run(in_port_t port, Config& config, Context&& context)
 {
-    SockAddr sin4;
-    sin4.setFamily(AF_INET);
-    sin4.setPort(port);
-    SockAddr sin6;
-    sin6.setFamily(AF_INET6);
-    sin6.setPort(port);
-    run(sin4, sin6, config, std::move(context));
+    config.bind4.setFamily(AF_INET);
+    config.bind4.setPort(port);
+    config.bind6.setFamily(AF_INET6);
+    config.bind6.setPort(port);
+    run(config, std::move(context));
 }
 
 void
-DhtRunner::run(const char* ip4, const char* ip6, const char* service, const Config& config, Context&& context)
+DhtRunner::run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context)
 {
     auto res4 = SockAddr::resolve(ip4, service);
     auto res6 = SockAddr::resolve(ip6, service);
@@ -96,44 +94,9 @@ DhtRunner::run(const char* ip4, const char* ip6, const char* service, const Conf
         res4.emplace_back();
     if (res6.empty())
         res6.emplace_back();
-    run(res4.front(), res6.front(), config, std::move(context));
-}
-
-void
-DhtRunner::run(SockAddr& local4, SockAddr& local6, const Config& config, Context&& context)
-{
-    if (running == State::Idle) {
-        auto state_path = config.dht_config.node_config.persist_path;
-        if (not state_path.empty()) {
-            state_path += "_port.txt";
-            std::ifstream inConfig(state_path);
-            if (inConfig.is_open()) {
-                in_port_t port;
-                if (inConfig >> port) {
-                    if (context.logger)
-                        context.logger->d("[runner %p] Using IPv4 port %hu from saved configuration", this, port);
-                    if (local4.getPort() == 0)
-                        local4.setPort(port);
-                }
-                if (inConfig >> port) {
-                    if (context.logger)
-                        context.logger->d("[runner %p] Using IPv6 port %hu from saved configuration", this, port);
-                    if (local6.getPort() == 0)
-                        local6.setPort(port);
-                }
-            }
-        }
-
-        if (not context.sock)
-            context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
-
-        if (not state_path.empty()) {
-            std::ofstream outConfig(state_path);
-            outConfig << context.sock->getBoundRef(AF_INET).getPort() << std::endl;
-            outConfig << context.sock->getBoundRef(AF_INET6).getPort() << std::endl;
-        }
-        run(config, std::move(context));
-    }
+    config.bind4 = std::move(res4.front());
+    config.bind6 = std::move(res6.front());
+    run(config, std::move(context));
 }
 
 void
@@ -141,8 +104,51 @@ DhtRunner::run(const Config& config, Context&& context)
 {
     std::lock_guard<std::mutex> lck(dht_mtx);
     auto expected = State::Idle;
-    if (not running.compare_exchange_strong(expected, State::Running))
+    if (not running.compare_exchange_strong(expected, State::Running)) {
+        if (context.logger)
+            context.logger->w("[runner %p] Node is already running. Call join() first before calling run() again.");
         return;
+    }
+
+    auto local4 = config.bind4;
+    auto local6 = config.bind6;
+    if (not local4 and not local6) {
+        if (context.logger)
+            context.logger->w("[runner %p] No address to bind specified in the configuration, using default addresses");
+        local4.setFamily(AF_INET);
+        local6.setFamily(AF_INET6);
+    }
+    auto state_path = config.dht_config.node_config.persist_path;
+    if (not state_path.empty() && (local4.getPort() == 0 || local6.getPort() == 0)) {
+        state_path += "_port.txt";
+        std::ifstream inConfig(state_path);
+        if (inConfig.is_open()) {
+            in_port_t port;
+            if (inConfig >> port) {
+                if (local4.getPort() == 0) {
+                    if (context.logger)
+                        context.logger->d("[runner %p] Using IPv4 port %hu from saved configuration", this, port);
+                    local4.setPort(port);
+                }
+            }
+            if (inConfig >> port) {
+                if (local6.getPort() == 0) {
+                    if (context.logger)
+                        context.logger->d("[runner %p] Using IPv6 port %hu from saved configuration", this, port);
+                    local6.setPort(port);
+                }
+            }
+        }
+    }
+
+    if (not context.sock)
+        context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
+
+    if (not state_path.empty()) {
+        std::ofstream outConfig(state_path);
+        outConfig << context.sock->getBoundRef(AF_INET).getPort() << std::endl;
+        outConfig << context.sock->getBoundRef(AF_INET6).getPort() << std::endl;
+    }
 
     if (context.logger) {
         logger_ = context.logger;
@@ -167,12 +173,13 @@ DhtRunner::run(const Config& config, Context&& context)
         return ret;
     });
 
-    auto dht = std::unique_ptr<DhtInterface>(new Dht(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger));
-    dht_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht), config.dht_config));
-
 #ifdef OPENDHT_PROXY_CLIENT
     config_ = config;
+    identityAnnouncedCb_ = context.identityAnnouncedCb;
 #endif
+    auto dht = std::unique_ptr<DhtInterface>(new Dht(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger));
+    dht_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht), config.dht_config, std::move(context.identityAnnouncedCb), context.logger));
+
     enableProxy(not config.proxy_server.empty());
     if (context.logger and dht_via_proxy_) {
         dht_via_proxy_->setLogger(context.logger);
@@ -261,29 +268,31 @@ DhtRunner::run(const Config& config, Context&& context)
 }
 
 void
-DhtRunner::shutdown(ShutdownCallback cb) {
+DhtRunner::shutdown(ShutdownCallback cb, bool stop) {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     auto expected = State::Running;
     if (not running.compare_exchange_strong(expected, State::Stopping)) {
         if (expected == State::Stopping and ongoing_ops) {
-            std::lock_guard<std::mutex> lck(storage_mtx);
             shutdownCallbacks_.emplace_back(std::move(cb));
         }
-        else if (cb) cb();
+        else if (cb) {
+            lck.unlock();
+            cb();
+        }
         return;
     }
     if (logger_)
         logger_->d("[runner %p] state changed to Stopping, %zu ongoing ops", this, ongoing_ops.load());
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     shutdownCallbacks_.emplace_back(std::move(cb));
-    pending_ops_prio.emplace([=](SecureDht&) mutable {
+    pending_ops.emplace([=](SecureDht&) mutable {
         auto onShutdown = [this]{ opEnded(); };
 #ifdef OPENDHT_PROXY_CLIENT
         if (dht_via_proxy_)
-            dht_via_proxy_->shutdown(onShutdown);
+            dht_via_proxy_->shutdown(onShutdown, stop);
 #endif
         if (dht_)
-            dht_->shutdown(onShutdown);
+            dht_->shutdown(onShutdown, stop);
     });
     cv.notify_all();
 }
@@ -312,11 +321,11 @@ DhtRunner::bindOpDoneCallback(DoneCallbackSimple&& cb) {
 
 bool
 DhtRunner::checkShutdown() {
-    if (running != State::Stopping or ongoing_ops)
-        return false;
     decltype(shutdownCallbacks_) cbs;
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
+        if (running != State::Stopping or ongoing_ops)
+            return false;
         cbs = std::move(shutdownCallbacks_);
     }
     for (auto& cb : cbs)
@@ -348,9 +357,13 @@ DhtRunner::join()
 
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
+        if (ongoing_ops and logger_) {
+            logger_->w("[runner %p] stopping with %zu remaining ops", this, ongoing_ops.load());
+        }
         pending_ops = decltype(pending_ops)();
         pending_ops_prio = decltype(pending_ops_prio)();
         ongoing_ops = 0;
+        shutdownCallbacks_.clear();
     }
     {
         std::lock_guard<std::mutex> lck(dht_mtx);
@@ -593,6 +606,18 @@ DhtRunner::getPublicAddressStr(sa_family_t af)
     return ret;
 }
 
+void
+DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_family_t af)
+{
+    std::lock_guard<std::mutex> lck(storage_mtx);
+    ongoing_ops++;
+    pending_ops_prio.emplace([cb = std::move(cb), this, af](SecureDht& dht){
+        cb(dht.getPublicAddress(af));
+        opEnded();
+    });
+    cv.notify_all();
+}
+
 void
 DhtRunner::registerCertificate(std::shared_ptr<crypto::Certificate> cert) {
     std::lock_guard<std::mutex> lck(dht_mtx);
@@ -690,11 +715,12 @@ DhtRunner::loop_()
 void
 DhtRunner::get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f, Where w)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (dcb) dcb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=](SecureDht& dht) mutable {
         dht.get(hash, std::move(vcb), bindOpDoneCallback(std::move(dcb)), std::move(f), std::move(w));
@@ -709,11 +735,12 @@ DhtRunner::get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb,
 }
 void
 DhtRunner::query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb, Query q) {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (done_cb) done_cb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=](SecureDht& dht) mutable {
         dht.query(hash, std::move(cb), bindOpDoneCallback(std::move(done_cb)), std::move(q));
@@ -725,11 +752,12 @@ std::future<size_t>
 DhtRunner::listen(InfoHash hash, ValueCallback vcb, Value::Filter f, Where w)
 {
     auto ret_token = std::make_shared<std::promise<size_t>>();
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         ret_token->set_value(0);
         return ret_token->get_future();
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     pending_ops.emplace([=](SecureDht& dht) mutable {
 #ifdef OPENDHT_PROXY_CLIENT
         auto tokenbGlobal = listener_token_++;
@@ -810,11 +838,12 @@ DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 void
 DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created, bool permanent)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -828,11 +857,12 @@ DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created
 void
 DhtRunner::put(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, time_point created, bool permanent)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=, cb = std::move(cb)](SecureDht& dht) mutable {
         dht.put(hash, value, bindOpDoneCallback(std::move(cb)), created, permanent);
@@ -869,11 +899,12 @@ DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 void
 DhtRunner::putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -899,11 +930,12 @@ DhtRunner::putSigned(const std::string& key, Value&& value, DoneCallbackSimple c
 void
 DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -989,11 +1021,12 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple&& cb)
 void
 DhtRunner::bootstrap(const SockAddr& addr, DoneCallbackSimple&& cb)
 {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         if (cb) cb(false);
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops_prio.emplace([addr, cb = bindOpDoneCallback(std::move(cb))](SecureDht& dht) mutable {
         dht.pingNode(std::move(addr), std::move(cb));
@@ -1004,9 +1037,9 @@ DhtRunner::bootstrap(const SockAddr& addr, DoneCallbackSimple&& cb)
 void
 DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 {
+    std::lock_guard<std::mutex> lck(storage_mtx);
     if (running != State::Running)
         return;
-    std::unique_lock<std::mutex> lck(storage_mtx);
     pending_ops_prio.emplace([id, address](SecureDht& dht) mutable {
         dht.insertNode(id, address);
     });
@@ -1016,9 +1049,9 @@ DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 void
 DhtRunner::bootstrap(const std::vector<NodeExport>& nodes)
 {
+    std::lock_guard<std::mutex> lck(storage_mtx);
     if (running != State::Running)
         return;
-    std::lock_guard<std::mutex> lck(storage_mtx);
     pending_ops_prio.emplace([=](SecureDht& dht) {
         for (auto& node : nodes)
             dht.insertNode(node);
@@ -1042,11 +1075,12 @@ DhtRunner::connectivityChanged()
 
 void
 DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb) {
+    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
+        lck.unlock();
         cb({});
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([this, hash, cb = std::move(cb)] (SecureDht& dht) {
         dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt){
@@ -1122,7 +1156,7 @@ DhtRunner::enableProxy(bool proxify)
         if (not config_.push_token.empty())
             dht_via_proxy->setPushNotificationToken(config_.push_token);
 #endif
-        dht_via_proxy_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht_via_proxy), config_.dht_config));
+        dht_via_proxy_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht_via_proxy), config_.dht_config, identityAnnouncedCb_, logger_));
         // add current listeners
         for (auto& l: listeners_)
             l.second.tokenProxyDht = dht_via_proxy_->listen(l.second.hash, l.second.gcb, l.second.f, l.second.w);

src/http.cpp

@@ -561,12 +561,63 @@ void
 Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, ConnectHandlerCb cb)
 {
     std::lock_guard<std::mutex> lock(mutex_);
-    if (ssl_socket_)
-        asio::async_connect(ssl_socket_->lowest_layer(), std::move(endpoints), wrapCallabck(std::move(cb)));
-    else if (socket_)
-        asio::async_connect(*socket_, std::move(endpoints), wrapCallabck(std::move(cb)));
-    else if (cb)
+    if (!ssl_socket_ && !socket_) {
         cb(asio::error::operation_aborted, {});
+        return;
+    }
+    auto& base = ssl_socket_? ssl_socket_->lowest_layer() : *socket_;
+
+    ConnectHandlerCb wcb = [&base, cb=std::move(cb)](const asio::error_code& ec, const asio::ip::tcp::endpoint& endpoint) {
+        if (!ec) {
+            auto socket = base.native_handle();
+            // Once connected, set a keep alive on the TCP socket with 30 seconds delay
+            // This will generate broken pipes as soon as possible.
+            // Note this needs to be done once connected to have a valid native_handle()
+            uint32_t start = 30;
+            uint32_t interval = 30;
+            uint32_t cnt = 1;
+#ifdef _WIN32
+            std::string val = "1";
+            setsockopt(socket, SOL_SOCKET, SO_KEEPALIVE, val.c_str(), sizeof(val));
+
+            // TCP_KEEPIDLE and TCP_KEEPINTVL are available since Win 10 version 1709
+            // TCP_KEEPCNT since Win 10 version 1703
+#ifdef TCP_KEEPIDLE
+            std::string start_str = std::to_string(start);
+            setsockopt(socket, IPPROTO_TCP, TCP_KEEPIDLE,
+                    start_str.c_str(), sizeof(start_str));
+#endif
+#ifdef TCP_KEEPINTVL
+            std::string interval_str = std::to_string(interval);
+            setsockopt(socket, IPPROTO_TCP, TCP_KEEPINTVL,
+                    interval_str.c_str(), sizeof(interval_str));
+#endif
+#ifdef TCP_KEEPCNT
+            std::string cnt_str = std::to_string(cnt);
+            setsockopt(socket, IPPROTO_TCP, TCP_KEEPCNT,
+                    cnt_str.c_str(), sizeof(cnt_str));
+#endif
+#else
+            uint32_t val = 1;
+            setsockopt(socket, SOL_SOCKET, SO_KEEPALIVE, &val, sizeof(uint32_t));
+#ifdef __APPLE__
+            // Apple devices only have one parameter
+            setsockopt(socket, IPPROTO_TCP, TCP_KEEPALIVE, &start, sizeof(uint32_t));
+#else
+            // Linux based systems
+            setsockopt(socket, SOL_TCP, TCP_KEEPIDLE, &start, sizeof(uint32_t));
+            setsockopt(socket, SOL_TCP, TCP_KEEPINTVL, &interval, sizeof(uint32_t));
+            setsockopt(socket, SOL_TCP, TCP_KEEPCNT, &cnt, sizeof(uint32_t));
+#endif
+#endif
+        }
+        if (cb)
+            cb(ec, endpoint);
+    };
+    if (ssl_socket_)
+        asio::async_connect(ssl_socket_->lowest_layer(), std::move(endpoints), wrapCallabck(std::move(wcb)));
+    else
+        asio::async_connect(*socket_, std::move(endpoints), wrapCallabck(std::move(wcb)));
 }
 
 void
@@ -1254,9 +1305,11 @@ Request::terminate(const asio::error_code& ec)
         return;
 
     response_.aborted = ec == asio::error::operation_aborted;
+    if (ec == asio::error::basic_errors::broken_pipe)
+        response_.status_code = 0U; // Avoid to give a successful answer (happen with a broken pipe, takes the last status)
 
     if (logger_) {
-        if (ec and ec != asio::error::eof and ec != asio::error::operation_aborted)
+        if (ec and ec != asio::error::eof and !response_.aborted)
             logger_->e("[http:request:%i] end with error: %s", id_, ec.message().c_str());
         else
             logger_->d("[http:request:%i] done with status code %u", id_, response_.status_code);
@@ -1415,7 +1468,7 @@ Request::await()
     std::unique_lock<std::mutex> lock(mtx);
     std::condition_variable cv;
     bool ok {false};
-    add_on_done_callback([&](const Response& resp){
+    add_on_done_callback([&](const Response&){
         std::lock_guard<std::mutex> lk(mtx);
         ok = true;
         cv.notify_all();

src/securedht.cpp

@@ -36,8 +36,8 @@ extern "C" {
 
 namespace dht {
 
-SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf)
-: dht_(std::move(dht)), key_(conf.id.first), certificate_(conf.id.second), enableCache_(conf.cert_cache_all)
+SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf, IdentityAnnouncedCb iacb, const std::shared_ptr<Logger>& l)
+: DhtInterface(l), dht_(std::move(dht)), key_(conf.id.first), certificate_(conf.id.second), enableCache_(conf.cert_cache_all)
 {
     if (!dht_) return;
     for (const auto& type : DEFAULT_TYPES)
@@ -52,16 +52,17 @@ SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf)
         auto certId = certificate_->getId();
         if (key_ and certId != key_->getPublicKey().getId())
             throw DhtException("SecureDht: provided certificate doesn't match private key.");
-
-        dht_->put(certId, Value {
-            CERTIFICATE_TYPE,
-            *certificate_,
-            1
-        }, [this, certId](bool ok) {
-            if (ok)
+        dht_->addOnConnectedCallback([this, certId, cb=std::move(iacb)]{
+            dht_->put(certId, Value {
+                CERTIFICATE_TYPE,
+                *certificate_,
+                1
+            }, [this, certId, cb=std::move(cb)](bool ok) {
+                if (cb) cb(ok);
                 if (logger_)
-                    logger_->d(certId, "SecureDht: public key announced successfully");
-        }, {}, true);
+                    logger_->d(certId, "SecureDht: certificate announcement %s", ok ? "succeeded" : "failed");
+            }, {}, true);
+        });
     }
 }
 

src/value.cpp

@@ -496,10 +496,10 @@ Query::msgpack_unpack(const msgpack::object& o)
 }
 
 template <typename T>
-bool subset(std::vector<T> fds, std::vector<T> qfds)
+bool subset(const std::vector<T>& fds, const std::vector<T>& qfds)
 {
-    for (auto& fd : fds) {
-        if (std::find_if(qfds.begin(), qfds.end(), [&fd](T& _vfd) { return fd == _vfd; }) == qfds.end())
+    for (const auto& fd : fds) {
+        if (std::find_if(qfds.begin(), qfds.end(), [&fd](const T& _vfd) { return fd == _vfd; }) == qfds.end())
             return false;
     }
     return true;

tests/cryptotester.cpp

@@ -44,6 +44,10 @@ CryptoTester::testSignatureEncryption() {
     // check signature
     CPPUNIT_ASSERT(public_key.checkSignature(data1, signature1));
     CPPUNIT_ASSERT(public_key.checkSignature(data2, signature2));
+    signature1[7]++;
+    signature2[8]--;
+    CPPUNIT_ASSERT(!public_key.checkSignature(data1, signature1));
+    CPPUNIT_ASSERT(!public_key.checkSignature(data2, signature2));
 
     // encrypt data
     {
@@ -161,6 +165,14 @@ void CryptoTester::testCertificateSerialNumber()
     CPPUNIT_ASSERT(std::equal(SERIAL.begin(), SERIAL.end(), serial.begin(), serial.end()));
 }
 
+void CryptoTester::testOcsp() {
+    auto ca = dht::crypto::generateIdentity("Test CA");
+    auto device = dht::crypto::generateIdentity("Test Device", ca);
+    auto ocspRequest = device.second->generateOcspRequest(ca.second->cert);
+    auto req = dht::crypto::OcspRequest((const uint8_t*)ocspRequest.first.data(), ocspRequest.first.size());
+    CPPUNIT_ASSERT(ocspRequest.second == req.getNonce());
+}
+
 void
 CryptoTester::tearDown() {
 

tests/cryptotester.h

@@ -32,6 +32,7 @@ class CryptoTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testCertificateRevocation);
     CPPUNIT_TEST(testCertificateRequest);
     CPPUNIT_TEST(testCertificateSerialNumber);
+    CPPUNIT_TEST(testOcsp);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -59,6 +60,10 @@ class CryptoTester : public CppUnit::TestFixture {
      * Test certificate serial number extraction
      */
     void testCertificateSerialNumber();
+    /**
+     * Test OCSP
+     */
+    void testOcsp();
 };
 
 }  // namespace test

tests/dhtproxytester.cpp

@@ -71,7 +71,7 @@ DhtProxyTester::tearDown() {
         cv.notify_all();
     });
     std::unique_lock<std::mutex> lk(cv_m);
-    CPPUNIT_ASSERT(cv.wait_for(lk, 5s, [&]{ return done; }));
+    CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&]{ return done; }));
     serverProxy.reset();
     nodeProxy.reset();
 }
@@ -289,4 +289,47 @@ DhtProxyTester::testFuzzy()
         CPPUNIT_ASSERT(value->data == mtu);
 }
 
+void
+DhtProxyTester::testShutdownStop()
+{
+    constexpr size_t N = 40000;
+    constexpr unsigned C = 100;
+
+    // Arrange
+    auto key = dht::InfoHash::get("testShutdownStop");
+    std::vector<std::shared_ptr<dht::Value>> values;
+    std::vector<uint8_t> mtu;
+    mtu.reserve(N);
+    for (size_t i = 0; i < N; i++)
+        mtu.emplace_back((i % 2) ? 'T' : 'M');
+
+    std::atomic_uint callback_count {0};
+
+    // Act
+    for (size_t i = 0; i < C; i++) {
+        auto nodeTest = std::make_shared<dht::DhtRunner>();
+        nodeTest->run(0, clientConfig);
+        nodeTest->put(key, dht::Value(mtu), [&](bool ok) {
+            callback_count++;
+        });
+        nodeTest->get(key, [&](const std::vector<std::shared_ptr<dht::Value>>& vals){
+            values.insert(values.end(), vals.begin(), vals.end());
+            return true;
+        },[&](bool ok){
+            callback_count++;
+        });
+        bool done = false;
+        std::condition_variable cv;
+        std::mutex cv_m;
+        nodeTest->shutdown([&]{
+            std::lock_guard<std::mutex> lk(cv_m);
+            done = true;
+            cv.notify_all();
+        }, true);
+        std::unique_lock<std::mutex> lk(cv_m);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&]{ return done; }));
+    }
+    CPPUNIT_ASSERT_EQUAL(2*C, callback_count.load());
+}
+
 }  // namespace test

tests/dhtproxytester.h

@@ -36,6 +36,7 @@ class DhtProxyTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testResubscribeGetValues);
     CPPUNIT_TEST(testPutGet40KChars);
     CPPUNIT_TEST(testFuzzy);
+    CPPUNIT_TEST(testShutdownStop);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -68,6 +69,8 @@ class DhtProxyTester : public CppUnit::TestFixture {
 
    void testFuzzy();
 
+   void testShutdownStop();
+
  private:
     dht::DhtRunner::Config clientConfig {};
     dht::DhtRunner nodePeer;

tests/dhtrunnertester.cpp

@@ -23,6 +23,7 @@
 #include <mutex>
 #include <condition_variable>
 using namespace std::chrono_literals;
+using namespace std::literals;
 
 namespace test {
 CPPUNIT_TEST_SUITE_REGISTRATION(DhtRunnerTester);
@@ -60,6 +61,12 @@ void
 DhtRunnerTester::testConstructors() {
     CPPUNIT_ASSERT(node1.getBoundPort() == 42222);
     CPPUNIT_ASSERT(node2.getBoundPort() == 42232);
+
+    dht::DhtRunner::Config config {};
+    dht::DhtRunner::Context context {};
+    dht::DhtRunner testNode;
+    testNode.run(config, std::move(context));
+    CPPUNIT_ASSERT(testNode.getBoundPort());
 }
 
 void
@@ -167,6 +174,76 @@ DhtRunnerTester::testListen() {
     node1.cancelListen(d, tokend);
 }
 
+void
+DhtRunnerTester::testIdOps() {
+    std::mutex mutex;
+    std::condition_variable cv;
+    unsigned valueCount(0);
+
+    dht::DhtRunner::Config config2;
+    config2.dht_config.node_config.max_peer_req_per_sec = -1;
+    config2.dht_config.node_config.max_req_per_sec = -1;
+    config2.dht_config.id = dht::crypto::generateIdentity();
+
+    dht::DhtRunner::Context context2;
+    context2.identityAnnouncedCb = [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard<std::mutex> lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    };
+
+    node2.join();
+    node2.run(42232, config2, std::move(context2));
+    node2.bootstrap(node1.getBound());
+
+    node1.findCertificate(node2.getId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt){
+        CPPUNIT_ASSERT(crt);
+        std::lock_guard<std::mutex> lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    {
+        std::unique_lock<std::mutex> lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&]{ return valueCount == 2; }));
+    }
+
+    dht::DhtRunner::Context context1;
+    context1.identityAnnouncedCb = [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard<std::mutex> lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    };
+
+    config2.dht_config.id = dht::crypto::generateIdentity();
+    node1.join();
+    node1.run(42222, config2, std::move(context1));
+    node1.bootstrap(node2.getBound());
+
+    auto key = dht::InfoHash::get("key");
+    node1.putEncrypted(key, node2.getId(), dht::Value("yo"), [&](bool ok){
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard<std::mutex> lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    node2.listen<std::string>(key, [&](std::string&& value){
+        CPPUNIT_ASSERT_EQUAL("yo"s, value);
+        std::lock_guard<std::mutex> lk(mutex);
+        valueCount++;
+        cv.notify_all();
+        return false;
+    });
+
+    {
+        std::unique_lock<std::mutex> lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&]{ return valueCount == 4; }));
+    }
+}
+
 void
 DhtRunnerTester::testListenLotOfBytes() {
     std::mutex mutex;

tests/dhtrunnertester.h

@@ -33,6 +33,7 @@ class DhtRunnerTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testGetPut);
     CPPUNIT_TEST(testListen);
     CPPUNIT_TEST(testListenLotOfBytes);
+    CPPUNIT_TEST(testIdOps);
     CPPUNIT_TEST_SUITE_END();
 
     dht::DhtRunner node1 {};
@@ -58,6 +59,10 @@ class DhtRunnerTester : public CppUnit::TestFixture {
      * Test listen method
      */
     void testListen();
+    /**
+     * Test methods requiring a node identity
+     */
+    void testIdOps();
     /**
      * Test listen method with lot of datas
      */

tests/threadpooltester.cpp

@@ -59,7 +59,7 @@ ThreadPoolTester::testExecutor()
     auto executor8 = std::make_shared<dht::Executor>(pool, 8);
 
     constexpr unsigned N = 64 * 1024;
-    std::atomic_uint count1 {0};
+    unsigned count1 {0};
     std::atomic_uint count4 {0};
     std::atomic_uint count8 {0};
     for (unsigned i=0; i<N; i++) {
@@ -69,7 +69,7 @@ ThreadPoolTester::testExecutor()
     }
 
     auto start = clock::now();
-    while ((count1.load() != N ||
+    while ((count1 != N ||
             count4.load() != N ||
             count8.load() != N) && clock::now() - start < std::chrono::seconds(20))
     {
@@ -78,11 +78,28 @@ ThreadPoolTester::testExecutor()
     executor1.reset();
     executor4.reset();
     executor8.reset();
-    CPPUNIT_ASSERT_EQUAL(N, count1.load());
+    CPPUNIT_ASSERT_EQUAL(N, count1);
     CPPUNIT_ASSERT_EQUAL(N, count4.load());
     CPPUNIT_ASSERT_EQUAL(N, count8.load());
 }
 
+void
+ThreadPoolTester::testContext()
+{
+    std::atomic_uint count {0};
+    constexpr unsigned N = 64 * 1024;
+
+    {
+        dht::ExecutionContext ctx(dht::ThreadPool::computation());
+        for (unsigned i=0; i<N; i++) {
+            ctx.run([&] { count++; });
+        }
+    }
+
+    CPPUNIT_ASSERT_EQUAL(N, count.load());
+
+}
+
 void
 ThreadPoolTester::tearDown() {
 }

tests/threadpooltester.h

@@ -29,6 +29,7 @@ class ThreadPoolTester : public CppUnit::TestFixture {
     CPPUNIT_TEST_SUITE(ThreadPoolTester);
     CPPUNIT_TEST(testThreadPool);
     CPPUNIT_TEST(testExecutor);
+    CPPUNIT_TEST(testContext);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -43,6 +44,7 @@ class ThreadPoolTester : public CppUnit::TestFixture {
 
     void testThreadPool();
     void testExecutor();
+    void testContext();
 };
 
 }  // namespace test