ci/github: add experimental docker build action

Current operator== creates a very weird warning about using an
uninitialized value (no warning without the reinterpret_cast).

.github/workflows/release-package.yml

@@ -0,0 +1,64 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Create and publish Docker images
+
+on:
+  push
+  #release:
+  #  types: [published]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME_DEPS: ${{ github.repository }}/opendht
+  IMAGE_NAME: ${{ github.repository }}/opendht-deps
+  IMAGE_NAME_DEPS_LLVM: ${{ github.repository }}/opendht-llvm
+  IMAGE_NAME_LLVM: ${{ github.repository }}/opendht-deps-llvm
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_LLVM }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LLVM }}
+
+      - name: Build and push Docker image for dependencies
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: docker/DockerfileDeps
+          #push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: docker/Dockerfile
+          #push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

CMakeLists.txt

@@ -1,10 +1,4 @@
-cmake_minimum_required (VERSION 3.10)
-if(POLICY CMP0065)
-  cmake_policy(SET CMP0065 NEW)
-endif()
-if(POLICY CMP0069)
-  cmake_policy(SET CMP0069 NEW)
-endif()
+cmake_minimum_required (VERSION 3.10..3.20)
 if(POLICY CMP0073)
   cmake_policy(SET CMP0073 NEW)
 endif()
@@ -15,11 +9,12 @@ project (opendht)
 
 include(CMakePackageConfigHelpers)
 include(CMakeDependentOption)
+include(CheckIncludeFileCXX)
 include(FindPkgConfig)
 include(cmake/CheckAtomic.cmake)
 
 set (opendht_VERSION_MAJOR 2)
-set (opendht_VERSION_MINOR 4.6)
+set (opendht_VERSION_MINOR 4.7)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -60,11 +55,15 @@ if (NOT MSVC)
     find_package (PkgConfig REQUIRED)
     find_package (GnuTLS 3.3 REQUIRED)
     pkg_search_module (Nettle REQUIRED nettle)
-    find_package (msgpack REQUIRED)
+    check_include_file_cxx(msgpack.hpp HAVE_MSGPACKCXX)
+    if (NOT HAVE_MSGPACKCXX)
+        find_package (msgpack REQUIRED)
+    endif()
     if (OPENDHT_TOOLS)
         find_package (Readline 6 REQUIRED)
     endif ()
     pkg_search_module(argon2 REQUIRED libargon2)
+    set(argon2_lib ", libargon2")
     pkg_search_module(Jsoncpp jsoncpp)
     if (Jsoncpp_FOUND)
         add_definitions(-DOPENDHT_JSONCPP)
@@ -84,9 +83,11 @@ if (NOT MSVC)
         add_library(fmt SHARED IMPORTED)
         find_library(HTTP_PARSER_LIBRARY http_parser)
         add_library(http_parser SHARED IMPORTED)
+        set(http_parser_lib "-lhttp_parser ")
         if (NOT Jsoncpp_FOUND)
             message(SEND_ERROR "Jsoncpp is required for DHT proxy support")
         endif()
+        set(jsoncpp_lib ", jsoncpp")
         if (OPENDHT_PROXY_OPENSSL)
             # https://cmake.org/cmake/help/latest/module/FindOpenSSL.html
             pkg_search_module(OPENSSL REQUIRED openssl)
@@ -97,6 +98,7 @@ if (NOT MSVC)
             else ()
                 message(SEND_ERROR "OpenSSL is required for DHT proxy as specified")
             endif()
+            set(openssl_lib ", openssl")
         endif()
     else ()
         set(OPENDHT_PROXY_OPENSSL OFF)

c/Makefile.am

@@ -1,7 +1,10 @@
 lib_LTLIBRARIES = libopendht-c.la
 noinst_HEADERS = opendht_c.h
 
-AM_CPPFLAGS = -isystem @top_srcdir@/include @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@
+AM_CPPFLAGS = -DOPENDHT_C_BUILD -isystem @top_srcdir@/include @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@
+if OPENDHT_SHARED
+AM_CPPFLAGS += -Dopendht_c_EXPORTS
+endif
 
 libopendht_c_la_LIBADD = $(LIBOBJS) ../src/.libs/libopendht.la
 

configure.ac

@@ -1,7 +1,7 @@
 dnl define macros
 m4_define([opendht_major_version], 2)
 m4_define([opendht_minor_version], 4)
-m4_define([opendht_patch_version], 6)
+m4_define([opendht_patch_version], 7)
 m4_define([opendht_version],
 		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
 
@@ -19,17 +19,25 @@ AC_SUBST(OPENDHT_PATCH_VERSION, opendht_patch_version)
 AC_ARG_ENABLE([debug], AS_HELP_STRING([--enable-debug], [Build in debug mode, adds stricter warnings, disables optimization]))
 AS_IF([test "x$enable_debug" = "xyes"],
       [CXXFLAGS="${CXXFLAGS} -g -Wno-return-type -Wall -Wextra -Wnon-virtual-dtor -O0 -pedantic-errors"],
-      [CXXFLAGS="${CXXFLAGS} -O3 -pedantic-errors"])
+      [CXXFLAGS="${CXXFLAGS} -O3 -pedantic-errors -fvisibility=hidden"])
+
+CPPFLAGS+=" -DOPENDHT_BUILD"
+AM_CONDITIONAL([OPENDHT_SHARED], [test "x$enable_shared" != xno])
+AM_COND_IF(OPENDHT_SHARED, [
+  CPPFLAGS+=" -Dopendht_EXPORTS"
+])
 
-AC_PROG_CXX
 AM_PROG_AR
+LT_INIT()
+LT_LANG(C++)
+AC_LANG(C++)
+AC_PROG_CXX
+AX_CXX_COMPILE_STDCXX(17,[noext],[mandatory])
 
 dnl Check for logs
 AC_ARG_ENABLE([logs], [AS_HELP_STRING([--disable-logs], [Disable DHT logs])])
-AS_IF([test "x$enable_logs" != "xno"], [
-	AC_DEFINE([OPENDHT_LOG], [true], [Define if DHT logs are enabled])
-], [
-	AC_DEFINE([OPENDHT_LOG], [false], [Define if DHT logs are enabled])
+AS_IF([test "x$enable_logs" != "xno"], [], [
+	AC_DEFINE([OPENDHT_LOG], [false], [Define if DHT logs are disabled])
 ])
 
 dnl Check for C binding
@@ -106,11 +114,6 @@ AM_CONDITIONAL(WIN32, [test "x$SYS" = "xmingw32"])
 AS_IF([test "x$SYS" = "xandroid"],
       [], [LDFLAGS="${LDFLAGS} -lpthread"])
 
-LT_INIT()
-LT_LANG(C++)
-
-AX_CXX_COMPILE_STDCXX(17,[noext],[mandatory])
-
 PKG_PROG_PKG_CONFIG()
 
 AC_ARG_ENABLE([proxy_server], AS_HELP_STRING([--enable-proxy-server], [Enable proxy server ability]), proxy_server=yes, proxy_server=no)
@@ -138,7 +141,9 @@ AM_CONDITIONAL(PROXY_CLIENT_OR_SERVER, test x$proxy_client == xyes || test x$pro
 
 PKG_CHECK_MODULES([Nettle], [nettle >= 2.4])
 PKG_CHECK_MODULES([GnuTLS], [gnutls >= 3.3])
-PKG_CHECK_MODULES([MsgPack], [msgpack >= 1.2])
+AC_CHECK_HEADERS([msgpack.hpp], [], [
+  PKG_CHECK_MODULES([MsgPack], [msgpack >= 1.2])
+])
 PKG_CHECK_MODULES([Argon2], [libargon2])
 AC_SUBST(argon2_lib, [", libargon2"])
 
@@ -167,7 +172,7 @@ AS_IF([test "x$have_openssl" = "xyes"], [
 ])
 
 AM_COND_IF([PROXY_CLIENT_OR_SERVER], [
-    AC_CHECK_HEADERS([asio.hpp], exit,, AC_MSG_ERROR([Missing Asio headers files]))
+    AC_CHECK_HEADERS([asio.hpp],, AC_MSG_ERROR([Missing Asio headers files]))
     CXXFLAGS="${CXXFLAGS} -DASIO_STANDALONE"
     PKG_CHECK_MODULES([Fmt], [fmt >= 5.3.0], [have_fmt=yes], [have_fmt=no])
     AS_IF([test "x$have_fmt" = "xyes"], [

include/opendht/crypto.h

@@ -32,6 +32,8 @@ extern "C" {
 
 #include <vector>
 #include <memory>
+#include <atomic>
+#include <mutex>
 
 #ifdef _WIN32
 #include <iso646.h>
@@ -100,12 +102,12 @@ struct OPENDHT_PUBLIC PublicKey
     /**
      * Get public key fingerprint
      */
-    InfoHash getId() const;
+   const InfoHash& getId() const;
 
     /**
      * Get public key long fingerprint
      */
-    PkId getLongId() const;
+    const PkId& getLongId() const;
 
     bool checkSignature(const uint8_t* data, size_t data_len, const uint8_t* signature, size_t signature_len) const;
     inline bool checkSignature(const Blob& data, const Blob& signature) const {
@@ -138,6 +140,11 @@ struct OPENDHT_PUBLIC PublicKey
 
     gnutls_pubkey_t pk {nullptr};
 private:
+    mutable InfoHash cachedId_ {};
+    mutable PkId cachedLongId_ {};
+    mutable std::atomic_bool idCached_ {false};
+    mutable std::atomic_bool longIdCached_ {false};
+
     PublicKey(const PublicKey&) = delete;
     PublicKey& operator=(const PublicKey&) = delete;
     void encryptBloc(const uint8_t* src, size_t src_size, uint8_t* dst, size_t dst_size) const;
@@ -201,6 +208,7 @@ private:
     PrivateKey& operator=(const PrivateKey&) = delete;
     Blob decryptBloc(const uint8_t* src, size_t src_size) const;
 
+    mutable std::mutex publicKeyMutex_ {};
     mutable std::shared_ptr<PublicKey> publicKey_ {};
 };
 
@@ -486,9 +494,9 @@ struct OPENDHT_PUBLIC Certificate {
     PublicKey getPublicKey() const;
 
     /** Same as getPublicKey().getId() */
-    InfoHash getId() const;
+    const InfoHash& getId() const;
     /** Same as getPublicKey().getLongId() */
-    PkId getLongId() const;
+    const PkId& getLongId() const;
 
     Blob getSerialNumber() const;
 
@@ -606,6 +614,8 @@ private:
     Certificate& operator=(const Certificate&) = delete;
     mutable InfoHash cachedId_ {};
     mutable PkId cachedLongId_ {};
+    mutable std::atomic_bool idCached_ {false};
+    mutable std::atomic_bool longIdCached_ {false};
 
     struct crlNumberCmp {
         bool operator() (const std::shared_ptr<RevocationList>& lhs, const std::shared_ptr<RevocationList>& rhs) const {

include/opendht/infohash.h

@@ -103,13 +103,7 @@ public:
     static constexpr inline Hash zero() noexcept { return Hash{}; }
 
     bool operator==(const Hash& h) const {
-        auto a = reinterpret_cast<const uint32_t*>(data_.data());
-        auto b = reinterpret_cast<const uint32_t*>(h.data_.data());
-        constexpr unsigned n = N / sizeof(uint32_t);
-        for (unsigned i=0; i < n; i++)
-            if (a[i] != b[i])
-                return false;
-        return true;
+        return data_ == h.data_;
     }
     bool operator!=(const Hash& h) const { return !(*this == h); }
 

opendht.pc.in

@@ -3,7 +3,7 @@ exec_prefix=@exec_prefix@
 libdir=@libdir@
 includedir=@includedir@
 Name: OpenDHT
-Description: C++14 Distributed Hash Table library
+Description: C++17 Distributed Hash Table library
 Version: @VERSION@
 Libs: -L${libdir} -lopendht
 Libs.private: @http_parser_lib@ -pthread

src/Makefile.am

@@ -84,6 +84,3 @@ if ENABLE_INDEXATION
 libopendht_la_SOURCES += indexation/pht.cpp
 nobase_include_HEADERS += ../include/opendht/indexation/pht.h
 endif
-
-clean-local:
-	rm -rf libargon2.la

src/crypto.cpp

@@ -43,18 +43,6 @@ static std::uniform_int_distribution<int> rand_byte{ 0, std::numeric_limits<uint
 static std::uniform_int_distribution<uint8_t> rand_byte;
 #endif
 
-// support for GnuTLS < 3.4.
-#if GNUTLS_VERSION_NUMBER < 0x030400
-#define GNUTLS_PKCS_PKCS12_3DES GNUTLS_PKCS_USE_PKCS12_3DES
-#define GNUTLS_PKCS_PKCS12_ARCFOUR GNUTLS_PKCS_USE_PKCS12_ARCFOUR
-#define GNUTLS_PKCS_PKCS12_RC2_40 GNUTLS_PKCS_USE_PKCS12_RC2_40
-#define GNUTLS_PKCS_PBES2_3DES GNUTLS_PKCS_USE_PBES2_3DES
-#define GNUTLS_PKCS_PBES2_AES_128 GNUTLS_PKCS_USE_PBES2_AES_128
-#define GNUTLS_PKCS_PBES2_AES_192 GNUTLS_PKCS_USE_PBES2_AES_192
-#define GNUTLS_PKCS_PBES2_AES_256 GNUTLS_PKCS_USE_PBES2_AES_256
-#endif
-
-#define DHT_AES_LEGACY_ENCRYPT 0
 #define DHT_AES_LEGACY_DECRYPT 1
 
 namespace dht {
@@ -110,10 +98,6 @@ Blob aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
     struct gcm_aes_ctx aes;
     gcm_aes_set_key(&aes, key.size(), key.data());
     gcm_aes_set_iv(&aes, GCM_IV_SIZE, ret.data());
-#if DHT_AES_LEGACY_ENCRYPT
-    gcm_aes_update(&aes, data_length, data);
-#endif
-
     gcm_aes_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
     gcm_aes_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
     return ret;
@@ -377,12 +361,13 @@ PrivateKey::getPublicKey() const
 const std::shared_ptr<PublicKey>&
 PrivateKey::getSharedPublicKey() const
 {
-    if (publicKey_)
-        return publicKey_;
-    auto pk = std::make_shared<PublicKey>();
-    if (auto err = gnutls_pubkey_import_privkey(pk->pk, key, GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN, 0))
-        throw CryptoException(std::string("Can't retreive public key: ") + gnutls_strerror(err));
-    publicKey_ = pk;
+    std::lock_guard<std::mutex> lock(publicKeyMutex_);
+    if (not publicKey_) {
+        auto pk = std::make_shared<PublicKey>();
+        if (auto err = gnutls_pubkey_import_privkey(pk->pk, key, GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN, 0))
+            throw CryptoException(std::string("Can't retreive public key: ") + gnutls_strerror(err));
+        publicKey_ = pk;
+    }
     return publicKey_;
 }
 
@@ -542,36 +527,36 @@ PublicKey::encrypt(const uint8_t* data, size_t data_len) const
     return ret;
 }
 
-InfoHash
+const InfoHash&
 PublicKey::getId() const
 {
-    if (not pk)
-        return {};
-    InfoHash id;
-    size_t sz = id.size();
-    if (auto err = gnutls_pubkey_get_key_id(pk, 0, id.data(), &sz))
-        throw CryptoException(std::string("Can't get public key ID: ") + gnutls_strerror(err));
-    if (sz != id.size())
-        throw CryptoException("Can't get public key ID: wrong output length.");
-    return id;
+    if (pk and not idCached_.load()) {
+        InfoHash id;
+        size_t sz = id.size();
+        if (auto err = gnutls_pubkey_get_key_id(pk, 0, id.data(), &sz))
+            throw CryptoException(std::string("Can't get public key ID: ") + gnutls_strerror(err));
+        if (sz != id.size())
+            throw CryptoException("Can't get public key ID: wrong output length.");
+        cachedId_ = id;
+        idCached_.store(true);
+    }
+    return cachedId_;
 }
 
-PkId
+const PkId&
 PublicKey::getLongId() const
 {
-    if (not pk)
-        return {};
-#if GNUTLS_VERSION_NUMBER < 0x030401
-    throw CryptoException("Can't get 256 bits public key ID: GnuTLS 3.4.1 or higher required.");
-#else
-    PkId h;
-    size_t sz = h.size();
-    if (auto err = gnutls_pubkey_get_key_id(pk, GNUTLS_KEYID_USE_SHA256, h.data(), &sz))
-        throw CryptoException(std::string("Can't get 256 bits public key ID: ") + gnutls_strerror(err));
-    if (sz != h.size())
-        throw CryptoException("Can't get 256 bits public key ID: wrong output length.");
-    return h;
-#endif
+    if (pk and not longIdCached_.load()) {
+        PkId h;
+        size_t sz = h.size();
+        if (auto err = gnutls_pubkey_get_key_id(pk, GNUTLS_KEYID_USE_SHA256, h.data(), &sz))
+            throw CryptoException(std::string("Can't get 256 bits public key ID: ") + gnutls_strerror(err));
+        if (sz != h.size())
+            throw CryptoException("Can't get 256 bits public key ID: wrong output length.");
+        cachedLongId_ = h;
+        longIdCached_.store(true);
+    }
+    return cachedLongId_;
 }
 
 gnutls_digest_algorithm_t
@@ -848,42 +833,36 @@ Certificate::getPublicKey() const
     return pk_ret;
 }
 
-InfoHash
+const InfoHash&
 Certificate::getId() const
 {
-    if (not cert)
-        return {};
-    if (cachedId_)
-        return cachedId_;
-    InfoHash id;
-    size_t sz = id.size();
-    if (auto err = gnutls_x509_crt_get_key_id(cert, 0, id.data(), &sz))
-        throw CryptoException(std::string("Can't get certificate public key ID: ") + gnutls_strerror(err));
-    if (sz != id.size())
-        throw CryptoException("Can't get certificate public key ID: wrong output length.");
-    cachedId_ = id;
-    return id;
+    if (cert and not idCached_.load()) {
+        InfoHash id;
+        size_t sz = id.size();
+        if (auto err = gnutls_x509_crt_get_key_id(cert, 0, id.data(), &sz))
+            throw CryptoException(std::string("Can't get certificate public key ID: ") + gnutls_strerror(err));
+        if (sz != id.size())
+            throw CryptoException("Can't get certificate public key ID: wrong output length.");
+        cachedId_ = id;
+        idCached_.store(true);
+    }
+    return cachedId_;
 }
 
-PkId
+const PkId&
 Certificate::getLongId() const
 {
-    if (not cert)
-        return {};
-    if (cachedLongId_)
-        return cachedLongId_;
-#if GNUTLS_VERSION_NUMBER < 0x030401
-    throw CryptoException("Can't get certificate 256 bits public key ID: GnuTLS 3.4.1 or higher required.");
-#else
-    PkId id;
-    size_t sz = id.size();
-    if (auto err = gnutls_x509_crt_get_key_id(cert, GNUTLS_KEYID_USE_SHA256, id.data(), &sz))
-        throw CryptoException(std::string("Can't get certificate 256 bits public key ID: ") + gnutls_strerror(err));
-    if (sz != id.size())
-        throw CryptoException("Can't get certificate 256 bits public key ID: wrong output length.");
-    cachedLongId_ = id;
-    return id;
-#endif
+    if (cert and not longIdCached_.load()) {
+        PkId id;
+        size_t sz = id.size();
+        if (auto err = gnutls_x509_crt_get_key_id(cert, GNUTLS_KEYID_USE_SHA256, id.data(), &sz))
+            throw CryptoException(std::string("Can't get certificate 256 bits public key ID: ") + gnutls_strerror(err));
+        if (sz != id.size())
+            throw CryptoException("Can't get certificate 256 bits public key ID: wrong output length.");
+        cachedLongId_ = id;
+        longIdCached_.store(true);
+    }
+    return cachedLongId_;
 }
 
 Blob
@@ -1771,10 +1750,8 @@ std::ostream& operator<< (std::ostream& o, const TrustList::VerifyResult& h)
             o << "* Certificate has expired" << std::endl;
         if (h.result & GNUTLS_CERT_UNEXPECTED_OWNER)
             o << "* The owner is not the expected one" << std::endl;
-#if GNUTLS_VERSION_NUMBER >= 0x030401
         if (h.result & GNUTLS_CERT_PURPOSE_MISMATCH)
             o << "* Certificate or an intermediate does not match the intended purpose" << std::endl;
-#endif
         if (h.result & GNUTLS_CERT_MISMATCH)
             o << "* Certificate presented isn't the expected one" << std::endl;
     } else {