http: use local cache to store pre-decoded certs

- pre-decode certs from DER->PEM and store them so http connections
  can add them the ssl context x509 store
- fixes the windows build by adding the crypto/x509 header

CMakeLists.txt

@@ -1,13 +1,11 @@
 cmake_minimum_required (VERSION 3.1)
-project (opendht)
-
 include(CMakePackageConfigHelpers)
 include(CMakeDependentOption)
 include(FindPkgConfig)
-include(cmake/CheckAtomic.cmake)
 
+project (opendht)
 set (opendht_VERSION_MAJOR 2)
-set (opendht_VERSION_MINOR 2.0)
+set (opendht_VERSION_MINOR 1.6)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -42,7 +40,6 @@ option (OPENDHT_DOCUMENTATION "Create and install the HTML based API documentati
 # Dependencies
 list (APPEND CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake")
 if (NOT MSVC)
-    set (THREADS_PREFER_PTHREAD_FLAG TRUE)
     find_package (Threads)
     find_package (PkgConfig REQUIRED)
     find_package (GnuTLS 3.3 REQUIRED)
@@ -71,11 +68,8 @@ if (NOT MSVC)
         )
     endif()
 
-    if (OPENDHT_HTTP OR OPENDHT_PEER_DISCOVERY)
-        find_path(ASIO_INCLUDE_DIR asio.hpp REQUIRED)
-    endif ()
-
     if (OPENDHT_HTTP)
+        find_path(ASIO_INCLUDE_DIR asio.hpp REQUIRED)
         find_package(Restinio REQUIRED)
         find_library(FMT_LIBRARY fmt)
         add_library(fmt SHARED IMPORTED)
@@ -88,8 +82,8 @@ if (NOT MSVC)
             # https://cmake.org/cmake/help/latest/module/FindOpenSSL.html
             pkg_search_module(OPENSSL REQUIRED openssl)
             if (OPENSSL_FOUND)
-                message(STATUS "Found OpenSSL ${OPENSSL_VERSION} ${OPENSSL_INCLUDE_DIRS}")
-                include_directories(SYSTEM ${OPENSSL_INCLUDE_DIRS})
+                message(STATUS "Found OpenSSL ${OPENSSL_VERSION}")
+                include_directories(${OPENSSL_INCLUDE_DIRS})
                 link_directories (${OPENSSL_LIBRARY_DIRS})
             else ()
                 message(SEND_ERROR "OpenSSL is required for DHT proxy as specified")
@@ -306,11 +300,9 @@ if (OPENDHT_HTTP)
   list (APPEND opendht_HEADERS
     include/opendht/proxy.h
     include/opendht/http.h
-    src/compat/os_cert.h
   )
   list (APPEND opendht_SOURCES
     src/http.cpp
-    src/compat/os_cert.cpp
   )
 endif ()
 
@@ -331,8 +323,13 @@ if(OPENDHT_ARGON2)
     include_directories(argon2/include/)
 endif()
 
+# cross-platform compatibility sources
+set (COMPAT_DIR ${PROJECT_SOURCE_DIR}/src/compat/)
+list (APPEND opendht_SOURCES ${COMPAT_DIR}/os_cert.cpp)
+
 if (MSVC)
-    list (APPEND opendht_HEADERS src/compat/msvc/unistd.h)
+    set (MSC_COMPAT_DIR ${COMPAT_DIR}/msvc/)
+    list (APPEND opendht_SOURCES ${MSC_COMPAT_DIR}/unistd.h)
 endif ()
 
 # Targets

cmake/CheckAtomic.cmake

@@ -1,95 +0,0 @@
-# University of Illinois/NCSA
-# Open Source License
-#
-# Copyright (c) 2003-2017 University of Illinois at Urbana-Champaign.
-# All rights reserved.
-#
-# Developed by:
-#
-#     LLVM Team
-#
-#     University of Illinois at Urbana-Champaign
-#
-#     http://llvm.org
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy of
-# this software and associated documentation files (the "Software"), to deal with
-# the Software without restriction, including without limitation the rights to
-# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-# of the Software, and to permit persons to whom the Software is furnished to do
-# so, subject to the following conditions:
-#
-#     * Redistributions of source code must retain the above copyright notice,
-#       this list of conditions and the following disclaimers.
-#
-#     * Redistributions in binary form must reproduce the above copyright notice,
-#       this list of conditions and the following disclaimers in the
-#       documentation and/or other materials provided with the distribution.
-#
-#     * Neither the names of the LLVM Team, University of Illinois at
-#       Urbana-Champaign, nor the names of its contributors may be used to
-#       endorse or promote products derived from this Software without specific
-#       prior written permission.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
-# SOFTWARE.
-
-include(CheckCXXSourceCompiles)
-include(CheckLibraryExists)
-
-# Sometimes linking against libatomic is required for atomic ops, if
-# the platform doesn't support lock-free atomics.
-
-function(check_working_cxx_atomics varname)
-  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  get_directory_property(compile_options COMPILE_OPTIONS)
-  set(CMAKE_REQUIRED_FLAGS ${compile_options})
-  CHECK_CXX_SOURCE_COMPILES("
-#include <atomic>
-#include <cstdint>
-std::atomic<int64_t> v1;
-std::atomic<int64_t> v2;
-int main(int, char**) {
-  return v1 + v2;
-}" ${varname})
-  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
-endfunction(check_working_cxx_atomics)
-
-
-if(NOT DEFINED PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
-  if(CMAKE_COMPILER_IS_GNUCXX)
-    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
-  elseif(MSVC)
-    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE OFF)
-  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
-    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
-  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Intel")
-    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
-  endif()
-endif()
-
-# This isn't necessary on MSVC, so avoid command-line switch annoyance
-# by only running on GCC-like hosts.
-if(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
-  # First check if atomics work without the library.
-  check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITHOUT_LIB)
-  # If not, check if the library exists, and atomics work with it.
-  if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB)
-    check_library_exists(atomic __atomic_fetch_add_4 "" HAVE_LIBATOMIC)
-    if(HAVE_LIBATOMIC)
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
-      check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITH_LIB)
-      if (NOT HAVE_CXX_ATOMICS_WITH_LIB)
-	message(FATAL_ERROR "Host compiler must support std::atomic!")
-      endif()
-      list(APPEND CMAKE_CXX_STANDARD_LIBRARIES -latomic)
-    else()
-      message(FATAL_ERROR "Host compiler appears to require libatomic, but cannot find it.")
-    endif()
-  endif()
-endif()

configure.ac

@@ -1,7 +1,7 @@
 dnl define macros
 m4_define([opendht_major_version], 2)
-m4_define([opendht_minor_version], 2)
-m4_define([opendht_patch_version], 0)
+m4_define([opendht_minor_version], 1)
+m4_define([opendht_patch_version], 6)
 m4_define([opendht_version],
 		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
 

docker/DockerfileDeps

@@ -17,9 +17,9 @@ RUN apt-get update && apt-get install -y \
 
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
-    && wget https://github.com/aberaud/restinio/archive/2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
-    && ls -l && tar -xzf 2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
-    && cd restinio-2224ffedef52cb2b74645d63d871d61dbd0f165e/dev \
+    && wget https://github.com/aberaud/restinio/archive/2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
+    && ls -l && tar -xzf 2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
+    && cd restinio-2c0b6f5e5ba04d7a74e8406a3df1fd433680599d/dev \
     && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=OFF -DRESTINIO_SAMPLE=OFF \
              -DRESTINIO_INSTALL_SAMPLES=OFF -DRESTINIO_BENCH=OFF -DRESTINIO_INSTALL_BENCHES=OFF \
              -DRESTINIO_FIND_DEPS=ON -DRESTINIO_ALLOW_SOBJECTIZER=Off -DRESTINIO_USE_BOOST_ASIO=none . \

docker/DockerfileDepsLlvm

@@ -18,9 +18,9 @@ ENV CXX c++
 
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
-    && wget https://github.com/aberaud/restinio/archive/2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
-    && ls -l && tar -xzf 2224ffedef52cb2b74645d63d871d61dbd0f165e.tar.gz \
-    && cd restinio-2224ffedef52cb2b74645d63d871d61dbd0f165e/dev \
+    && wget https://github.com/aberaud/restinio/archive/2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
+    && ls -l && tar -xzf 2c0b6f5e5ba04d7a74e8406a3df1fd433680599d.tar.gz \
+    && cd restinio-2c0b6f5e5ba04d7a74e8406a3df1fd433680599d/dev \
     && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=OFF -DRESTINIO_SAMPLE=OFF \
              -DRESTINIO_INSTALL_SAMPLES=OFF -DRESTINIO_BENCH=OFF -DRESTINIO_INSTALL_BENCHES=OFF \
              -DRESTINIO_FIND_DEPS=ON -DRESTINIO_ALLOW_SOBJECTIZER=Off -DRESTINIO_USE_BOOST_ASIO=none . \

include/opendht/callbacks.h

@@ -132,7 +132,7 @@ struct OPENDHT_PUBLIC Config {
     /* If non-0, overrides the default maximum store size. -1 means no limit.  */
     ssize_t max_store_size {0};
 
-    /**
+    /** 
      * Use appropriate bahavior for a public IP, stable node:
      *   - No connectivity change triggered when a search fails
      *   - Larger listen refresh time
@@ -148,7 +148,7 @@ struct OPENDHT_PUBLIC SecureDhtConfig
     Config node_config {};
     crypto::Identity id {};
 
-    /**
+    /** 
      * Cache all encountered public keys and certificates,
      * for use by the certificate store, putEncrypted and putSigned
      */
@@ -164,7 +164,6 @@ using GetCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>
 using ValueCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired)>;
 using GetCallbackSimple = std::function<bool(std::shared_ptr<Value> value)>;
 using ShutdownCallback = std::function<void()>;
-using IdentityAnnouncedCb = std::function<void(bool)>;
 
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 
@@ -179,13 +178,13 @@ typedef bool (*FilterRaw)(const Value&, void *user_data);
 
 using DoneCallbackSimple = std::function<void(bool success)>;
 
-OPENDHT_PUBLIC GetCallbackSimple bindGetCb(GetCallbackRaw raw_cb, void* user_data);
-OPENDHT_PUBLIC GetCallback bindGetCb(GetCallbackSimple cb);
-OPENDHT_PUBLIC ValueCallback bindValueCb(ValueCallbackRaw raw_cb, void* user_data);
-OPENDHT_PUBLIC ShutdownCallback bindShutdownCb(ShutdownCallbackRaw shutdown_cb_raw, void* user_data);
+OPENDHT_PUBLIC GetCallbackSimple bindGetCb(const GetCallbackRaw& raw_cb, void* user_data);
+OPENDHT_PUBLIC GetCallback bindGetCb(const GetCallbackSimple& cb);
+OPENDHT_PUBLIC ValueCallback bindValueCb(const ValueCallbackRaw& raw_cb, void* user_data);
+OPENDHT_PUBLIC ShutdownCallback bindShutdownCb(const ShutdownCallbackRaw& shutdown_cb_raw, void* user_data);
 OPENDHT_PUBLIC DoneCallback bindDoneCb(DoneCallbackSimple donecb);
-OPENDHT_PUBLIC DoneCallback bindDoneCb(DoneCallbackRaw raw_cb, void* user_data);
-OPENDHT_PUBLIC DoneCallbackSimple bindDoneCbSimple(DoneCallbackSimpleRaw raw_cb, void* user_data);
-OPENDHT_PUBLIC Value::Filter bindFilterRaw(FilterRaw raw_filter, void* user_data);
+OPENDHT_PUBLIC DoneCallback bindDoneCb(const DoneCallbackRaw& raw_cb, void* user_data);
+OPENDHT_PUBLIC DoneCallbackSimple bindDoneCbSimple(const DoneCallbackSimpleRaw& raw_cb, void* user_data);
+OPENDHT_PUBLIC Value::Filter bindFilterRaw(const FilterRaw& raw_filter, void* user_data);
 
 }

include/opendht/crypto.h

@@ -80,8 +80,6 @@ struct OPENDHT_PUBLIC PublicKey
      * Takes ownership of an existing gnutls_pubkey.
      */
     PublicKey(gnutls_pubkey_t k) : pk(k) {}
-
-    /** Import public key from serialized data */
     PublicKey(const uint8_t* dat, size_t dat_size);
     PublicKey(const Blob& pk) : PublicKey(pk.data(), pk.size()) {}
     PublicKey(PublicKey&& o) noexcept : pk(o.pk) { o.pk = nullptr; };
@@ -108,12 +106,12 @@ struct OPENDHT_PUBLIC PublicKey
     PkId getLongId() const;
 
     bool checkSignature(const uint8_t* data, size_t data_len, const uint8_t* signature, size_t signature_len) const;
-    inline bool checkSignature(const Blob& data, const Blob& signature) const {
+    bool checkSignature(const Blob& data, const Blob& signature) const {
         return checkSignature(data.data(), data.size(), signature.data(), signature.size());
     }
 
     Blob encrypt(const uint8_t* data, size_t data_len) const;
-    inline Blob encrypt(const Blob& data) const {
+    Blob encrypt(const Blob& data) const {
         return encrypt(data.data(), data.size());
     }
 
@@ -172,16 +170,14 @@ struct OPENDHT_PUBLIC PrivateKey
      * Sign the provided binary object.
      * @returns the signature data.
      */
-    Blob sign(const uint8_t* data, size_t data_len) const;
-    inline Blob sign(const Blob& dat) const { return sign(dat.data(), dat.size()); }
+    Blob sign(const Blob&) const;
 
     /**
      * Try to decrypt the provided cypher text.
      * In case of failure a CryptoException is thrown.
      * @returns the decrypted data.
      */
-    Blob decrypt(const uint8_t* cypher, size_t cypher_len) const;
-    Blob decrypt(const Blob& cypher) const { return decrypt(cypher.data(), cypher.size()); }
+    Blob decrypt(const Blob& cypher) const;
 
     /**
      * Generate a new RSA key pair
@@ -314,29 +310,10 @@ private:
     gnutls_x509_crq_t request {nullptr};
 };
 
-class OPENDHT_PUBLIC OcspRequest
-{
-public:
-    OcspRequest(gnutls_ocsp_req_t r) : request(r) {};
-    OcspRequest(const uint8_t* dat_ptr, size_t dat_size);
-    ~OcspRequest();
-
-    /*
-     * Get OCSP Request in readable format.
-     */
-    std::string toString(const bool compact = true) const;
-
-    Blob pack() const;
-    Blob getNonce() const;
-private:
-    gnutls_ocsp_req_t request;
-};
-
 class OPENDHT_PUBLIC OcspResponse
 {
 public:
     OcspResponse(const uint8_t* dat_ptr, size_t dat_size);
-    OcspResponse(const std::string& response) : OcspResponse((const uint8_t*)response.data(), response.size()) {};
     ~OcspResponse();
 
     Blob pack() const;
@@ -353,11 +330,11 @@ public:
     gnutls_ocsp_cert_status_t getCertificateStatus() const;
 
     /*
-     * Verify OCSP response and return OCSP status.
-     * Throws CryptoException in case of error in the response.
+     * Verify OCSP response.
+     * Return OCSP verify reason.
      * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-verify-reason-t
      */
-    gnutls_ocsp_cert_status_t verifyDirect(const Certificate& crt, const Blob& nonce);
+    gnutls_ocsp_verify_reason_t verifyDirect(const Certificate& crt, const Blob& nonce);
 
 private:
     gnutls_ocsp_resp_t response;
@@ -588,7 +565,7 @@ struct OPENDHT_PUBLIC Certificate {
      * Return GnuTLS error code.
      * https://www.gnutls.org/manual/html_node/Error-codes.html
      */
-    std::pair<std::string, Blob> generateOcspRequest(gnutls_x509_crt_t& issuer);
+    std::pair<Blob,Blob> generateOcspRequest(gnutls_x509_crt_t& issuer);
 
     gnutls_x509_crt_t cert {nullptr};
     std::shared_ptr<Certificate> issuer {};
@@ -771,10 +748,8 @@ OPENDHT_PUBLIC Blob aesEncrypt(const Blob& data, const std::string& password);
 /**
  * AES-GCM decryption.
  */
-OPENDHT_PUBLIC Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key);
-OPENDHT_PUBLIC inline Blob aesDecrypt(const Blob& data, const Blob& key) { return aesDecrypt(data.data(), data.size(), key); }
-OPENDHT_PUBLIC Blob aesDecrypt(const uint8_t* data, size_t data_length, const std::string& password);
-OPENDHT_PUBLIC inline Blob aesDecrypt(const Blob& data, const std::string& password) { return aesDecrypt(data.data(), data.size(), password); }
+OPENDHT_PUBLIC Blob aesDecrypt(const Blob& data, const Blob& key);
+OPENDHT_PUBLIC Blob aesDecrypt(const Blob& data, const std::string& password);
 
 }
 }

include/opendht/default_types.h

@@ -144,18 +144,17 @@ public:
     static const ValueType TYPE;
 
     TrustRequest() {}
-    TrustRequest(std::string s, std::string ci = {}) : service(s), conversationId(ci) {}
-    TrustRequest(std::string s, std::string ci, const Blob& d) : service(s), conversationId(ci), payload(d) {}
+    TrustRequest(std::string s) : service(s) {}
+    TrustRequest(std::string s, const Blob& d) : service(s), payload(d) {}
 
     static Value::Filter getFilter() {
         return EncryptedValue::getFilter();
     }
 
     std::string service;
-    std::string conversationId;
     Blob payload;
     bool confirm {false};
-    MSGPACK_DEFINE_MAP(service, conversationId, payload, confirm)
+    MSGPACK_DEFINE_MAP(service, payload, confirm)
 };
 
 class OPENDHT_PUBLIC IceCandidates : public EncryptedValue<IceCandidates>

include/opendht/dht.h

@@ -61,6 +61,9 @@ struct LocalListener;
  */
 class OPENDHT_PUBLIC Dht final : public DhtInterface {
 public:
+
+    Dht();
+
     /**
      * Initialise the Dht with two open sockets (for IPv4 and IP6)
      * and an ID for the node.
@@ -95,7 +98,7 @@ public:
     /**
      * Performs final operations before quitting.
      */
-    void shutdown(ShutdownCallback cb, bool stop = false) override;
+    void shutdown(ShutdownCallback cb) override;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -512,8 +515,6 @@ private:
 
     void confirmNodes();
     void expire();
-
-    void onConnected();
     void onDisconnected();
 
     /**

include/opendht/dht_interface.h

@@ -21,8 +21,6 @@
 #include "infohash.h"
 #include "log_enable.h"
 
-#include <queue>
-
 namespace dht {
 
 namespace net {
@@ -48,10 +46,6 @@ public:
     virtual NodeStatus getStatus(sa_family_t af) const = 0;
     virtual NodeStatus getStatus() const = 0;
 
-    void addOnConnectedCallback(std::function<void()> cb) {
-        onConnectCallbacks_.emplace(std::move(cb));
-    }
-
     virtual net::DatagramSocket* getSocket() const { return {}; };
 
     /**
@@ -61,10 +55,8 @@ public:
 
     /**
      * Performs final operations before quitting.
-     * stop: if true, cancel ongoing operations and call their 'done'
-     *       callbacks synchronously.
      */
-    virtual void shutdown(ShutdownCallback cb, bool stop = false) = 0;
+    virtual void shutdown(ShutdownCallback cb) = 0;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -272,7 +264,6 @@ public:
 
 protected:
     std::shared_ptr<Logger> logger_ {};
-    std::queue<std::function<void()>> onConnectCallbacks_ {};
 };
 
 } // namespace dht

include/opendht/dht_proxy_client.h

@@ -85,7 +85,7 @@ public:
     /**
      * Performs final operations before quitting.
      */
-    void shutdown(ShutdownCallback cb, bool) override;
+    void shutdown(ShutdownCallback cb) override;
 
     /**
      * Returns true if the node is running (have access to an open socket).
@@ -107,13 +107,13 @@ public:
      */
     virtual void get(const InfoHash& key, GetCallback cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override;
     virtual void get(const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
-        get(key, cb, bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+        get(key, cb, bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
     virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb={}, Value::Filter&& f={}, Where&& w = {}) override {
-        get(key, bindGetCb(cb), std::move(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
+        get(key, bindGetCb(cb), donecb, std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
     virtual void get(const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f={}, Where&& w = {}) override {
-        get(key, bindGetCb(cb), bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+        get(key, bindGetCb(cb), bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
 
     /**
@@ -134,7 +134,7 @@ public:
             time_point created=time_point::max(),
             bool permanent = false) override
     {
-        put(key, v, bindDoneCb(std::move(cb)), created, permanent);
+        put(key, v, bindDoneCb(cb), created, permanent);
     }
 
     void put(const InfoHash& key,
@@ -143,7 +143,7 @@ public:
             time_point created=time_point::max(),
             bool permanent = false) override
     {
-        put(key, std::make_shared<Value>(std::move(v)), std::move(cb), created, permanent);
+        put(key, std::make_shared<Value>(std::move(v)), cb, created, permanent);
     }
     void put(const InfoHash& key,
             Value&& v,
@@ -151,7 +151,7 @@ public:
             time_point created=time_point::max(),
             bool permanent = false) override
     {
-        put(key, std::forward<Value>(v), bindDoneCb(std::move(cb)), created, permanent);
+        put(key, std::forward<Value>(v), bindDoneCb(cb), created, permanent);
     }
 
     /**
@@ -176,14 +176,14 @@ public:
     virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter={}, Where={}) override;
 
     virtual size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f={}, Where w={}) override {
-        return listen(key, [cb=std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired){
+        return listen(key, [cb](const std::vector<Sp<Value>>& vals, bool expired){
             if (not expired)
                 return cb(vals);
             return true;
         }, std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
     virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f={}, Where w={}) override {
-        return listen(key, bindGetCb(std::move(cb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+        return listen(key, bindGetCb(cb), std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
     /*
      * This function relies on the cache implementation.
@@ -214,7 +214,7 @@ public:
      */
     virtual void query(const InfoHash& /*key*/, QueryCallback /*cb*/, DoneCallback /*done_cb*/ = {}, Query&& /*q*/ = {}) override { }
     virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override {
-        query(key, cb, bindDoneCb(std::move(done_cb)), std::forward<Query>(q));
+        query(key, cb, bindDoneCb(done_cb), std::forward<Query>(q));
     }
 
     /**
@@ -378,8 +378,8 @@ private:
      * Retrieve if we can connect to the proxy (update statusIpvX_)
      */
     void handleProxyConfirm(const asio::error_code &ec);
-    std::unique_ptr<asio::steady_timer> nextProxyConfirmationTimer_;
-    std::unique_ptr<asio::steady_timer> listenerRestartTimer_;
+    Sp<asio::steady_timer> nextProxyConfirmationTimer_;
+    Sp<asio::steady_timer> listenerRestartTimer_;
 
     /**
      * Relaunch LISTEN requests if the client disconnect/reconnect.

include/opendht/dht_proxy_server.h

@@ -445,6 +445,7 @@ private:
         std::map<InfoHash, std::vector<Listener>> listeners;
         MSGPACK_DEFINE_ARRAY(listeners)
     };
+    std::mutex lockPushListeners_;
     std::map<std::string, PushListener> pushListeners_;
     proxy::ListenToken tokenPushNotif_ {0};
 #endif //OPENDHT_PUSH_NOTIFICATIONS

include/opendht/dhtrunner.h

@@ -65,7 +65,6 @@ public:
         bool peer_publish {false};
         std::shared_ptr<dht::crypto::Certificate> server_ca;
         dht::crypto::Identity client_identity;
-        SockAddr bind4 {}, bind6 {};
     };
 
     struct Context {
@@ -74,7 +73,6 @@ public:
         std::shared_ptr<PeerDiscovery> peerDiscovery {};
         StatusCallback statusChangedCallback {};
         CertificateStoreQuery certificateStore {};
-        IdentityAnnouncedCb identityAnnouncedCb {};
         Context() {}
     };
 
@@ -99,7 +97,7 @@ public:
     template <class T>
     void get(InfoHash hash, std::function<bool(std::vector<T>&&)> cb, DoneCallbackSimple dcb={})
     {
-        get(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+        get(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
             return cb(unpackVector<T>(vals));
         },
         dcb,
@@ -108,7 +106,7 @@ public:
     template <class T>
     void get(InfoHash hash, std::function<bool(T&&)> cb, DoneCallbackSimple dcb={})
     {
-        get(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+        get(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
             for (const auto& v : vals) {
                 try {
                     if (not cb(Value::unpack<T>(*v)))
@@ -157,7 +155,7 @@ public:
     std::future<size_t> listen(InfoHash key, ValueCallback vcb, Value::Filter f = {}, Where w = {});
 
     std::future<size_t> listen(InfoHash key, GetCallback cb, Value::Filter f={}, Where w={}) {
-        return listen(key, [cb=std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired){
+        return listen(key, [cb](const std::vector<Sp<Value>>& vals, bool expired){
             if (not expired)
                 return cb(vals);
             return true;
@@ -171,7 +169,7 @@ public:
     template <class T>
     std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&)> cb)
     {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
             return cb(unpackVector<T>(vals));
         },
         getFilterSet<T>());
@@ -179,7 +177,7 @@ public:
     template <class T>
     std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&, bool)> cb)
     {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
             return cb(unpackVector<T>(vals), expired);
         },
         getFilterSet<T>());
@@ -188,7 +186,7 @@ public:
     template <typename T>
     std::future<size_t> listen(InfoHash hash, std::function<bool(T&&)> cb, Value::Filter f = {}, Where w = {})
     {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
             for (const auto& v : vals) {
                 try {
                     if (not cb(Value::unpack<T>(*v)))
@@ -204,7 +202,7 @@ public:
     template <typename T>
     std::future<size_t> listen(InfoHash hash, std::function<bool(T&&, bool)> cb, Value::Filter f = {}, Where w = {})
     {
-        return listen(hash, [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
             for (const auto& v : vals) {
                 try {
                     if (not cb(Value::unpack<T>(*v), expired))
@@ -361,7 +359,6 @@ public:
     std::string getSearchLog(const InfoHash&, sa_family_t af = AF_UNSPEC) const;
     std::vector<SockAddr> getPublicAddress(sa_family_t af = AF_UNSPEC);
     std::vector<std::string> getPublicAddressStr(sa_family_t af = AF_UNSPEC);
-    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);
 
     // securedht methods
 
@@ -382,12 +379,22 @@ public:
         config.threaded = threaded;
         run(port, config);
     }
-    void run(in_port_t port, Config& config, Context&& context = {});
+    void run(in_port_t port, const Config& config, Context&& context = {});
+
+    /**
+     * @param local4: Local IPv4 address and port to bind. Can be null.
+     * @param local6: Local IPv6 address and port to bind. Can be null.
+     *         You should allways bind to a global IPv6 address.
+     * @param identity: RSA key pair to use for cryptographic operations.
+     * @param threaded: If false, loop() must be called periodically. Otherwise a thread is launched.
+     * @param cb: Optional callback to receive general state information.
+     */
+    void run(SockAddr& local4, SockAddr& local6, const Config& config, Context&& context = {});
 
     /**
      * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service (port).
      */
-    void run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context = {});
+    void run(const char* ip4, const char* ip6, const char* service, const Config& config, Context&& context = {});
 
     void run(const Config& config, Context&& context);
 
@@ -408,7 +415,7 @@ public:
     /**
      * Gracefuly disconnect from network.
      */
-    void shutdown(ShutdownCallback cb = {}, bool stop = false);
+    void shutdown(ShutdownCallback cb = {});
 
     /**
      * Quit and wait for all threads to terminate.
@@ -474,7 +481,6 @@ private:
 
     /** Current configuration */
     Config config_;
-    IdentityAnnouncedCb identityAnnouncedCb_;
 
     /**
      * reset dht clients

include/opendht/http.h

@@ -96,7 +96,6 @@ public:
     inline unsigned int id() const { return  id_; };
     bool is_open() const;
     bool is_ssl() const;
-    void checkOcsp(bool check = true) { checkOcsp_ = check; }
 
     void set_ssl_verification(const std::string& hostname, const asio::ssl::verify_mode verify_mode);
 
@@ -144,7 +143,6 @@ private:
 
     std::unique_ptr<asio::steady_timer> timeout_timer_;
     std::shared_ptr<dht::Logger> logger_;
-    bool checkOcsp_ {false};
 };
 
 /**

include/opendht/indexation/pht.h

@@ -335,7 +335,7 @@ public:
     void lookup(Key k, LookupCallback cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true);
     void lookup(Key k, LookupCallbackSimple cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true)
     {
-        lookup(k, [cb=std::move(cb)](std::vector<std::shared_ptr<Value>>& values, Prefix) { cb(values); }, done_cb, exact_match);
+        lookup(k, [=](std::vector<std::shared_ptr<Value>>& values, Prefix) { cb(values); }, done_cb, exact_match);
     }
 
     /**

include/opendht/infohash.h

@@ -54,9 +54,9 @@ namespace crypto {
 }
 
 /**
- * Represents an Hash,
- * a byte array of N bytes.
- * Hashes identify nodes and values in the Dht.
+ * Represents an InfoHash.
+ * An InfoHash is a byte array of HASH_LEN bytes.
+ * InfoHashes identify nodes and values in the Dht.
  */
 template <size_t N>
 class OPENDHT_PUBLIC Hash {
@@ -93,8 +93,6 @@ public:
     iterator end() { return data_.end(); }
     const_iterator cend() const { return data_.cend(); }
 
-    static constexpr inline Hash zero() noexcept { return Hash{}; }
-
     bool operator==(const Hash& h) const {
         auto a = reinterpret_cast<const uint32_t*>(data_.data());
         auto b = reinterpret_cast<const uint32_t*>(h.data_.data());
@@ -114,14 +112,6 @@ public:
         return false;
     }
 
-    Hash operator^(const Hash& o) const {
-        Hash result;
-        for(auto i = 0u; i < N; i++) {
-            result[i] = data_[i] ^ o.data_[i];
-        }
-        return result;
-    }
-
     explicit operator bool() const {
         auto a = reinterpret_cast<const uint32_t*>(data_.data());
         auto b = reinterpret_cast<const uint32_t*>(data_.data() + N);
@@ -152,6 +142,10 @@ public:
         return 8 * i + j;
     }
 
+    /**
+     * Forget about the ``XOR-metric''.  An id is just a path from the
+     * root of the tree, so bits are numbered from the start.
+     */
     static inline int cmp(const Hash& id1, const Hash& id2) {
         return std::memcmp(id1.data_.data(), id2.data_.data(), N);
     }
@@ -185,12 +179,16 @@ public:
     int
     xorCmp(const Hash& id1, const Hash& id2) const
     {
-        for (unsigned i = 0; i < N; i++) {
+        for(unsigned i = 0; i < N; i++) {
+            uint8_t xor1, xor2;
             if(id1.data_[i] == id2.data_[i])
                 continue;
-            uint8_t xor1 = id1.data_[i] ^ data_[i];
-            uint8_t xor2 = id2.data_[i] ^ data_[i];
-            return (xor1 < xor2) ? -1 : 1;
+            xor1 = id1.data_[i] ^ data_[i];
+            xor2 = id2.data_[i] ^ data_[i];
+            if(xor1 < xor2)
+                return -1;
+            else
+                return 1;
         }
         return 0;
     }
@@ -356,22 +354,6 @@ private:
 
 OPENDHT_PUBLIC extern const HexMap hex_map;
 
-inline std::string
-toHex(const uint8_t* data, size_t size) {
-    std::string ret(size * 2, '\0');
-    for (size_t i=0; i<size; i++) {
-        auto b = ret.data()+i*2;
-        const auto& m = hex_map[data[i]];
-        *((uint16_t*)b) = *((uint16_t*)&m);
-    }
-    return ret;
-}
-
-inline std::string
-toHex(const std::vector<uint8_t>& data) {
-    return toHex(data.data(), data.size());
-}
-
 template <size_t N>
 const char*
 Hash<N>::to_c_str() const
@@ -392,6 +374,8 @@ Hash<N>::toString() const
     return std::string(to_c_str(), N*2);
 }
 
+const InfoHash zeroes {};
+
 struct OPENDHT_PUBLIC NodeExport {
     InfoHash id;
     sockaddr_storage ss;

include/opendht/network_engine.h

@@ -214,6 +214,7 @@ public:
     using RequestErrorCb = std::function<bool(const Request&, DhtProtocolException&&)>;
     using RequestExpiredCb = std::function<void(const Request&, bool)>;
 
+    NetworkEngine(const Sp<Logger>& log, std::mt19937_64& rd, Scheduler& scheduler, std::unique_ptr<DatagramSocket>&& sock);
     NetworkEngine(
             InfoHash& myid,
             NetworkConfig config,
@@ -292,7 +293,7 @@ public:
      */
     Sp<Request>
     sendPing(SockAddr&& sa, RequestCb&& on_done, RequestExpiredCb&& on_expired) {
-        return sendPing(std::make_shared<Node>(InfoHash::zero(), std::move(sa), rd),
+        return sendPing(std::make_shared<Node>(zeroes, std::move(sa), rd),
                 std::forward<RequestCb>(on_done),
                 std::forward<RequestExpiredCb>(on_expired));
     }

include/opendht/securedht.h

@@ -45,13 +45,15 @@ public:
         return c;
     }
 
+    SecureDht() {}
+
     /**
      * s, s6: bound socket descriptors for IPv4 and IPv6, respectively.
      *        For the Dht to be initialised, at least one of them must be >= 0.
      * id:    the identity to use for the crypto layer and to compute
      *        our own hash on the Dht.
      */
-    SecureDht(std::unique_ptr<DhtInterface> dht, Config config, IdentityAnnouncedCb iacb = {}, const std::shared_ptr<Logger>& l = {});
+    SecureDht(std::unique_ptr<DhtInterface> dht, Config config);
 
     virtual ~SecureDht();
 
@@ -146,8 +148,8 @@ public:
     /**
      * SecureDht to Dht proxy
      */
-    void shutdown(ShutdownCallback cb, bool stop = false) override {
-        dht_->shutdown(cb, stop);
+    void shutdown(ShutdownCallback cb) override {
+        dht_->shutdown(cb);
     }
     void dumpTables() const override {
         dht_->dumpTables();

include/opendht/sockaddr.h

@@ -68,7 +68,7 @@ public:
      * Build from existing address.
      */
     SockAddr(const sockaddr* sa, socklen_t length) {
-        if (length > static_cast<socklen_t>(sizeof(sockaddr_storage)))
+        if (length > sizeof(sockaddr_storage))
             throw std::runtime_error("Socket address length is too large");
         set(sa, length);
     }
@@ -144,7 +144,7 @@ public:
             if (len) addr.reset((sockaddr*)::calloc(len, 1));
             else     addr.reset();
         }
-        if (len)
+        if (len > sizeof(sa_family_t))
             addr->sa_family = af;
     }
 
@@ -223,16 +223,16 @@ public:
      */
     sockaddr* get() { return addr.get(); }
 
-    inline const sockaddr_in& getIPv4() const {
+    const sockaddr_in& getIPv4() const {
         return *reinterpret_cast<const sockaddr_in*>(get());
     }
-    inline const sockaddr_in6& getIPv6() const {
+    const sockaddr_in6& getIPv6() const {
         return *reinterpret_cast<const sockaddr_in6*>(get());
     }
-    inline sockaddr_in& getIPv4() {
+    sockaddr_in& getIPv4() {
         return *reinterpret_cast<sockaddr_in*>(get());
     }
-    inline sockaddr_in6& getIPv6() {
+    sockaddr_in6& getIPv6() {
         return *reinterpret_cast<sockaddr_in6*>(get());
     }
 

include/opendht/thread_pool.h

@@ -93,71 +93,4 @@ private:
     void schedule();
 };
 
-class OPENDHT_PUBLIC ExecutionContext {
-public:
-    ExecutionContext(ThreadPool& pool)
-     : threadPool_(pool), state_(std::make_shared<SharedState>())
-    {}
-
-    ~ExecutionContext() {
-        state_->destroy();
-    }
-
-    /** Wait for ongoing tasks to complete execution and drop other pending tasks */
-    void stop() {
-        state_->destroy(false);
-    }
-
-    void run(std::function<void()>&& task) {
-        std::lock_guard<std::mutex> lock(state_->mtx);
-        if (state_->shutdown_) return;
-        state_->pendingTasks++;
-        threadPool_.get().run([task = std::move(task), state = state_] {
-            state->run(task);
-        });
-    }
-
-private:
-    struct SharedState {
-        std::mutex mtx {};
-        std::condition_variable cv {};
-        unsigned pendingTasks {0};
-        unsigned ongoingTasks {0};
-        /** When true, prevents new tasks to be scheduled */
-        bool shutdown_ {false};
-        /** When true, prevents scheduled tasks to be executed */
-        std::atomic_bool destroyed {false};
-
-        void destroy(bool wait = true) {
-            std::unique_lock<std::mutex> lock(mtx);
-            if (destroyed) return;
-            if (wait) {
-                cv.wait(lock, [this] { return pendingTasks == 0 && ongoingTasks == 0; });
-            }
-            shutdown_ = true;
-            if (not wait) {
-                cv.wait(lock, [this] { return ongoingTasks == 0; });
-            }
-            destroyed = true;
-        }
-
-        void run(const std::function<void()>& task) {
-            {
-                std::lock_guard<std::mutex> lock(mtx);
-                pendingTasks--;
-                ongoingTasks++;
-            }
-                if (destroyed) return;
-                task();
-            {
-                std::lock_guard<std::mutex> lock(mtx);
-                ongoingTasks--;
-                cv.notify_all();
-            }
-        }
-    };
-    std::reference_wrapper<ThreadPool> threadPool_;
-    std::shared_ptr<SharedState> state_;
-};
-
 }

include/opendht/value.h

@@ -205,7 +205,7 @@ struct OPENDHT_PUBLIC Value
         }
         static Filter chainOr(Filter&& f1, Filter&& f2) {
             if (not f1 or not f2) return {};
-            return [f1=std::move(f1),f2=std::move(f2)](const Value& v) {
+            return [f1,f2](const Value& v) {
                 return f1(v) or f2(v);
             };
         }
@@ -231,7 +231,8 @@ struct OPENDHT_PUBLIC Value
     }
 
     static Filter TypeFilter(const ValueType& t) {
-        return [tid = t.id](const Value& v) {
+        const auto tid = t.id;
+        return [tid](const Value& v) {
             return v.type == tid;
         };
     }

python/opendht.pyx

@@ -36,7 +36,6 @@ from libcpp.memory cimport shared_ptr
 from cython.parallel import parallel, prange
 from cython.operator cimport dereference as deref, preincrement as inc, predecrement as dec
 from cpython cimport ref
-from datetime import timedelta
 
 cimport opendht_cpp as cpp
 
@@ -236,9 +235,8 @@ cdef class Where(object):
 
 cdef class Value(object):
     cdef shared_ptr[cpp.Value] _value
-    def __init__(self, bytes val=b'', cpp.uint16_t id=0):
-        self._value.reset(new cpp.Value(id, val, len(val)))
-
+    def __init__(self, bytes val=b''):
+        self._value.reset(new cpp.Value(val, len(val)))
     def __str__(self):
         return self._value.get().toString().decode()
     property owner:
@@ -272,14 +270,6 @@ cdef class Value(object):
         def __get__(self):
             return self._value.get().size()
 
-cdef class ValueType(object):
-    cdef cpp.ValueType * _value
-    def __init__(self, cpp.uint16_t id, str name, expiration: timedelta):
-        if not isinstance(expiration, timedelta):
-            raise TypeError("expiration argument must be of type timedelta")
-        cdef cpp.seconds duration = cpp.seconds(int(expiration.total_seconds()))
-        self._value =  new cpp.ValueType(id, name.encode(), duration)
-
 cdef class NodeSetIter(object):
     cdef map[cpp.InfoHash, shared_ptr[cpp.Node]]* _nodes
     cdef map[cpp.InfoHash, shared_ptr[cpp.Node]].iterator _curIter
@@ -523,8 +513,6 @@ cdef class DhtRunner(_WithID):
         cb_obj = {'shutdown':shutdown_cb}
         ref.Py_INCREF(cb_obj)
         self.thisptr.get().shutdown(cpp.bindShutdownCb(shutdown_callback, <void*>cb_obj))
-    def registerType(self, ValueType type):
-        self.thisptr.get().registerType(deref(type._value))
     def enableLogging(self):
         cpp.enableLogging(self.thisptr.get()[0])
     def disableLogging(self):

python/opendht_cpp.pxd

@@ -26,14 +26,6 @@ from libc.string cimport const_char, const_uchar
 ctypedef uint16_t in_port_t
 ctypedef unsigned short int sa_family_t;
 
-cdef extern from "<iostream>" namespace "std::chrono" nogil:
-    cdef cppclass duration[ulong]:
-        duration() except +
-
-    cdef cppclass seconds:
-        duration seconds(uint64_t) except +
-        duration seconds()
-
 cdef extern from "<memory>" namespace "std" nogil:
     cdef cppclass shared_ptr[T]:
         shared_ptr() except +
@@ -139,6 +131,7 @@ cdef extern from "opendht/value.h" namespace "dht::Value":
 cdef extern from "opendht/value.h" namespace "dht::Value::Field":
     cdef Field None
     cdef Field Id
+    cdef Field ValueType
     cdef Field OwnerPk
     cdef Field SeqNum
     cdef Field UserType
@@ -148,7 +141,7 @@ cdef extern from "opendht/value.h" namespace "dht":
     cdef cppclass Value:
         Value() except +
         Value(vector[uint8_t]) except +
-        Value(const uint16_t t, const uint8_t* dat_ptr, size_t dat_len) except +
+        Value(const uint8_t* dat_ptr, size_t dat_len) except +
         string toString() const
         size_t size() const
         uint64_t id
@@ -157,12 +150,6 @@ cdef extern from "opendht/value.h" namespace "dht":
         vector[uint8_t] data
         string user_type
 
-    cdef cppclass ValueType:
-        ValueType(uint16_t id, string name, seconds expiration) except +
-        uint16_t id
-        string name
-        seconds expiration
-
     cdef cppclass Query:
         Query() except +
         Query(Select s, Where w) except +
@@ -247,7 +234,6 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
         void run(const_char*, const_char*, const_char*, Config config)
         void join()
         void shutdown(ShutdownCallback)
-        void registerType(ValueType& value);
         bool isRunning()
         SockAddr getBound(sa_family_t af) const
         string getStorageLog() const

src/Makefile.am

@@ -71,8 +71,8 @@ endif
 
 libopendht_la_SOURCES += base64.h base64.cpp
 if PROXY_CLIENT_OR_SERVER
-libopendht_la_SOURCES += http.cpp compat/os_cert.cpp
-nobase_include_HEADERS += ../include/opendht/proxy.h ../include/opendht/http.h compat/os_cert.h
+libopendht_la_SOURCES += http.cpp
+nobase_include_HEADERS += ../include/opendht/proxy.h ../include/opendht/http.h
 endif
 
 if ENABLE_PEER_DISCOVERY

src/callbacks.cpp

@@ -26,7 +26,7 @@ namespace dht {
 
 
 GetCallbackSimple
-bindGetCb(GetCallbackRaw raw_cb, void* user_data)
+bindGetCb(const GetCallbackRaw& raw_cb, void* user_data)
 {
     if (not raw_cb) return {};
     return [=](const std::shared_ptr<Value>& value) {
@@ -35,10 +35,10 @@ bindGetCb(GetCallbackRaw raw_cb, void* user_data)
 }
 
 GetCallback
-bindGetCb(GetCallbackSimple cb)
+bindGetCb(const GetCallbackSimple& cb)
 {
     if (not cb) return {};
-    return [cb=std::move(cb)](const std::vector<std::shared_ptr<Value>>& values) {
+    return [=](const std::vector<std::shared_ptr<Value>>& values) {
         for (const auto& v : values)
             if (not cb(v))
                 return false;
@@ -47,7 +47,7 @@ bindGetCb(GetCallbackSimple cb)
 }
 
 ValueCallback
-bindValueCb(ValueCallbackRaw raw_cb, void* user_data)
+bindValueCb(const ValueCallbackRaw& raw_cb, void* user_data)
 {
     if (not raw_cb) return {};
     return [=](const std::vector<std::shared_ptr<Value>>& values, bool expired) {
@@ -59,7 +59,7 @@ bindValueCb(ValueCallbackRaw raw_cb, void* user_data)
 }
 
 ShutdownCallback
-bindShutdownCb(ShutdownCallbackRaw shutdown_cb_raw, void* user_data)
+bindShutdownCb(const ShutdownCallbackRaw& shutdown_cb_raw, void* user_data)
 {
     return [=]() { shutdown_cb_raw(user_data); };
 }
@@ -69,11 +69,11 @@ bindDoneCb(DoneCallbackSimple donecb)
 {
     if (not donecb) return {};
     using namespace std::placeholders;
-    return std::bind(std::move(donecb), _1);
+    return std::bind(donecb, _1);
 }
 
 DoneCallback
-bindDoneCb(DoneCallbackRaw raw_cb, void* user_data)
+bindDoneCb(const DoneCallbackRaw& raw_cb, void* user_data)
 {
     if (not raw_cb) return {};
     return [=](bool success, const std::vector<std::shared_ptr<Node>>& nodes) {
@@ -82,7 +82,7 @@ bindDoneCb(DoneCallbackRaw raw_cb, void* user_data)
 }
 
 DoneCallbackSimple
-bindDoneCbSimple(DoneCallbackSimpleRaw raw_cb, void* user_data) {
+bindDoneCbSimple(const DoneCallbackSimpleRaw& raw_cb, void* user_data) {
     if (not raw_cb) return {};
     return [=](bool success) {
         raw_cb(success, user_data);

src/compat/os_cert.cpp

@@ -27,20 +27,34 @@
 #endif
 #include <openssl/ssl.h>
 
-#ifdef TARGET_OS_OSX
+#ifdef __APPLE__
 #include <CoreFoundation/CoreFoundation.h>
 #include <Security/Security.h>
-#endif /*TARGET_OS_OSX*/
+#endif /*__APPLE__*/
 
-#if EMBEDDED_ASN1_TIME_PARSE
+#ifdef _WIN32
 #undef X509_NAME
 #undef OCSP_REQUEST
 #undef OCSP_RESPONSE
 #define GENTIME_LENGTH 15
 #define UTCTIME_LENGTH 13
 #define ATOI2(ar)      ((ar) += 2, ((ar)[-2] - '0') * 10 + ((ar)[-1] - '0'))
-extern "C" {
 // Taken from libressl/src/crypto/asn1/a_time_tm.c
+/*
+ * Parse an RFC 5280 format ASN.1 time string.
+ *
+ * mode must be:
+ * 0 if we expect to parse a time as specified in RFC 5280 for an X509 object.
+ * V_ASN1_UTCTIME if we wish to parse an RFC5280 format UTC time.
+ * V_ASN1_GENERALIZEDTIME if we wish to parse an RFC5280 format Generalized time.
+ *
+ * Returns:
+ * -1 if the string was invalid.
+ * V_ASN1_UTCTIME if the string validated as a UTC time string.
+ * V_ASN1_GENERALIZEDTIME if the string validated as a Generalized time string.
+ *
+ * Fills in *tm with the corresponding time if tm is non NULL.
+ */
 int
 ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode)
 {
@@ -117,10 +131,9 @@ ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode)
         return (-1);
     }
 
-    return type;
+    return (type);
 }
-}
-#endif /* EMBEDDED_ASN1_TIME_PARSE */
+#endif /*_WIN32*/
 
 namespace dht {
 namespace http {
@@ -128,6 +141,7 @@ namespace http {
 PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
  : logger(l)
 {
+    X509* x509cert;
 #ifdef _WIN32
     PCCERT_CONTEXT pContext = NULL;
     HCERTSTORE hSystemStore;
@@ -138,13 +152,14 @@ PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
         return;
     }
     while (pContext = CertEnumCertificatesInStore(hSystemStore, pContext)) {
+        x509cert = nullptr;
         const uint8_t* encoded_cert = pContext->pbCertEncoded;
-        X509Ptr x509cert(d2i_X509(nullptr, &encoded_cert, pContext->cbCertEncoded), &X509_free);
+        x509cert = d2i_X509(nullptr, &encoded_cert, pContext->cbCertEncoded);
         if (x509cert)
-            pems_.emplace_back(std::move(x509cert));
+            pems_.push_back(x509cert);
     }
     CertCloseStore(hSystemStore, 0);
-#elif TARGET_OS_OSX
+#elif __APPLE__
     CFArrayRef result = NULL;
     OSStatus osStatus;
 
@@ -162,6 +177,7 @@ PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
     }
     CFDataRef rawData = NULL;
     for (CFIndex i = 0; i < CFArrayGetCount(result); i++) {
+        x509cert = nullptr;
         SecCertificateRef cert = (SecCertificateRef) CFArrayGetValueAtIndex(result, i);
         rawData = SecCertificateCopyData(cert);
         if (!rawData) {
@@ -170,9 +186,9 @@ PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
             break;
         }
         const uint8_t* rawDataPtr = CFDataGetBytePtr(rawData);
-        X509Ptr x509cert(d2i_X509(nullptr, &rawDataPtr, CFDataGetLength(rawData)), &X509_free);
+        x509cert = d2i_X509(nullptr, &rawDataPtr, CFDataGetLength(rawData));
         if (x509cert)
-            pems_.emplace_back(std::move(x509cert));
+            pems_.push_back(x509cert);
         CFRelease(rawData);
         rawData = NULL;
     }
@@ -182,22 +198,33 @@ PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
     if (rawData != NULL) {
         CFRelease(rawData);
     }
-#endif /*TARGET_OS_OSX, _WIN32*/
+#endif /*__APPLE__, _WIN32*/
+}
+
+PEMCache::~PEMCache()
+{
+    for (const auto pem : pems_)
+        if (pem)
+            X509_free(pem);
 }
 
 void
 PEMCache::fillX509Store(SSL_CTX* ctx)
 {
     if (logger)
-        logger->d("adding %d decoded certs to X509 store", pems_.size());
-    if (X509_STORE* store = SSL_CTX_get_cert_store(ctx)) {
-        for (const auto& pem : pems_) {
-            if (X509_STORE_add_cert(store, pem.get()) != 1)
-                if (logger)
-                    logger->w("couldn't add local certificate");
-        }
-    } else if (logger)
-        logger->e("couldn't get the context cert store");
+        logger->w("adding %d decoded certs to X509 store", pems_.size());
+    X509_STORE* store = SSL_CTX_get_cert_store(ctx);
+    if (store == nullptr) {
+        if (logger)
+            logger->e("couldn't get the context cert store");
+        return;
+    }
+    for (const auto pem : pems_) {
+        if (X509_STORE_add_cert(store, pem) == 1)
+            continue;
+        if (logger)
+            logger->d("couldn't add local certificate");
+    }
 }
 
 } /*namespace http*/

src/compat/os_cert.h

@@ -24,35 +24,13 @@
 
 #include <openssl/x509.h>
 
-#if (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER > 0x20501000L))
-#define EMBEDDED_ASN1_TIME_PARSE 0
-#else
-#define EMBEDDED_ASN1_TIME_PARSE 1
-#endif
-
-#if EMBEDDED_ASN1_TIME_PARSE
+#ifdef _WIN32
+#include <crypto/x509.h> // to expose x509_store_ctx_st
 #define V_ASN1_UTCTIME         23
 #define V_ASN1_GENERALIZEDTIME 24
-
-extern "C" {
-/*
- * Parse an RFC 5280 format ASN.1 time string.
- *
- * mode must be:
- * 0 if we expect to parse a time as specified in RFC 5280 for an X509 object.
- * V_ASN1_UTCTIME if we wish to parse an RFC5280 format UTC time.
- * V_ASN1_GENERALIZEDTIME if we wish to parse an RFC5280 format Generalized time.
- *
- * Returns:
- * -1 if the string was invalid.
- * V_ASN1_UTCTIME if the string validated as a UTC time string.
- * V_ASN1_GENERALIZEDTIME if the string validated as a Generalized time string.
- *
- * Fills in *tm with the corresponding time if tm is non NULL.
- */
+#define timegm                 _mkgmtime
 int ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode);
-}
-#endif
+#endif /*_WIN32*/
 
 namespace dht {
 namespace http {
@@ -63,16 +41,15 @@ namespace http {
 class PEMCache
 {
     PEMCache(const std::shared_ptr<Logger>& l);
-
-    using X509Ptr = std::unique_ptr<X509, void(*)(X509*)>;
-    std::vector<X509Ptr> pems_;
+    ~PEMCache();
+    std::vector<X509*> pems_;
     std::shared_ptr<Logger> logger;
 
 public:
     static PEMCache& instance(const std::shared_ptr<Logger>& l)
     {
-        static PEMCache instance_(l);
-        return instance_;
+        static PEMCache* instance_ = new PEMCache(l);
+        return *instance_;
     }
 
     void fillX509Store(SSL_CTX* ctx);

src/crypto.cpp

@@ -54,7 +54,7 @@ static std::uniform_int_distribution<uint8_t> rand_byte;
 #define GNUTLS_PKCS_PBES2_AES_256 GNUTLS_PKCS_USE_PBES2_AES_256
 #endif
 
-#define DHT_AES_LEGACY_ENCRYPT 0
+#define DHT_AES_LEGACY_ENCRYPT 1
 #define DHT_AES_LEGACY_DECRYPT 1
 
 namespace dht {
@@ -128,37 +128,37 @@ Blob aesEncrypt(const Blob& data, const std::string& password)
     return encrypted;
 }
 
-Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
+Blob aesDecrypt(const Blob& data, const Blob& key)
 {
     if (not aesKeySizeGood(key.size()))
         throw DecryptError("Wrong key size");
 
-    if (data_length <= GCM_IV_SIZE + GCM_DIGEST_SIZE)
+    if (data.size() <= GCM_IV_SIZE + GCM_DIGEST_SIZE)
         throw DecryptError("Wrong data size");
 
     std::array<uint8_t, GCM_DIGEST_SIZE> digest;
 
     struct gcm_aes_ctx aes;
     gcm_aes_set_key(&aes, key.size(), key.data());
-    gcm_aes_set_iv(&aes, GCM_IV_SIZE, data);
+    gcm_aes_set_iv(&aes, GCM_IV_SIZE, data.data());
 
-    size_t data_sz = data_length - GCM_IV_SIZE - GCM_DIGEST_SIZE;
+    size_t data_sz = data.size() - GCM_IV_SIZE - GCM_DIGEST_SIZE;
     Blob ret(data_sz);
-    gcm_aes_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
+    gcm_aes_decrypt(&aes, data_sz, ret.data(), data.data() + GCM_IV_SIZE);
     gcm_aes_digest(&aes, GCM_DIGEST_SIZE, digest.data());
 
-    if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
+    if (not std::equal(digest.begin(), digest.end(), data.end() - GCM_DIGEST_SIZE)) {
 #if DHT_AES_LEGACY_DECRYPT
-        //gcm_aes_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
+        //gcm_aes_decrypt(&aes, data_sz, ret.data(), data.data() + GCM_IV_SIZE);
         Blob ret_tmp(data_sz);
         struct gcm_aes_ctx aes_d;
         gcm_aes_set_key(&aes_d, key.size(), key.data());
-        gcm_aes_set_iv(&aes_d, GCM_IV_SIZE, data);
+        gcm_aes_set_iv(&aes_d, GCM_IV_SIZE, data.data());
         gcm_aes_update(&aes_d, ret.size(), ret.data());
         gcm_aes_encrypt(&aes_d, ret.size(), ret_tmp.data(), ret.data());
         gcm_aes_digest(&aes_d, GCM_DIGEST_SIZE, digest.data());
 
-        if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE))
+        if (not std::equal(digest.begin(), digest.end(), data.end() - GCM_DIGEST_SIZE))
             throw DecryptError("Can't decrypt data");
 #else
         throw DecryptError("Can't decrypt data");
@@ -168,13 +168,14 @@ Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
     return ret;
 }
 
-Blob aesDecrypt(const uint8_t* data, size_t data_len, const std::string& password)
+Blob aesDecrypt(const Blob& data, const std::string& password)
 {
-    if (data_len <= PASSWORD_SALT_LENGTH)
+    if (data.size() <= PASSWORD_SALT_LENGTH)
         throw DecryptError("Wrong data size");
-    Blob salt {data, data+PASSWORD_SALT_LENGTH};
+    Blob salt {data.begin(), data.begin()+PASSWORD_SALT_LENGTH};
     Blob key = stretchKey(password, salt, 256/8);
-    return aesDecrypt(data+PASSWORD_SALT_LENGTH, data_len - PASSWORD_SALT_LENGTH, key);
+    Blob encrypted {data.begin()+PASSWORD_SALT_LENGTH, data.end()};
+    return aesDecrypt(encrypted, key);
 }
 
 Blob stretchKey(const std::string& password, Blob& salt, size_t key_length)
@@ -291,14 +292,14 @@ PrivateKey::operator=(PrivateKey&& o) noexcept
 }
 
 Blob
-PrivateKey::sign(const uint8_t* data, size_t data_length) const
+PrivateKey::sign(const Blob& data) const
 {
     if (!key)
         throw CryptoException("Can't sign data: no private key set !");
-    if (std::numeric_limits<unsigned>::max() < data_length)
+    if (std::numeric_limits<unsigned>::max() < data.size())
         throw CryptoException("Can't sign data: too large !");
     gnutls_datum_t sig;
-    const gnutls_datum_t dat {(unsigned char*)data, (unsigned)data_length};
+    const gnutls_datum_t dat {(unsigned char*)data.data(), (unsigned)data.size()};
     if (gnutls_privkey_sign_data(key, GNUTLS_DIG_SHA512, 0, &dat, &sig) != GNUTLS_E_SUCCESS)
         throw CryptoException("Can't sign data !");
     Blob ret(sig.data, sig.data+sig.size);
@@ -320,7 +321,7 @@ PrivateKey::decryptBloc(const uint8_t* src, size_t src_size) const
 }
 
 Blob
-PrivateKey::decrypt(const uint8_t* cypher, size_t cypher_len) const
+PrivateKey::decrypt(const Blob& cipher) const
 {
     if (!key)
         throw CryptoException("Can't decrypt data without private key !");
@@ -333,12 +334,12 @@ PrivateKey::decrypt(const uint8_t* cypher, size_t cypher_len) const
         throw CryptoException("Must be an RSA key");
 
     unsigned cypher_block_sz = key_len / 8;
-    if (cypher_len < cypher_block_sz)
+    if (cipher.size() < cypher_block_sz)
         throw DecryptError("Unexpected cipher length");
-    else if (cypher_len == cypher_block_sz)
-        return decryptBloc(cypher, cypher_block_sz);
+    else if (cipher.size() == cypher_block_sz)
+        return decryptBloc(cipher.data(), cypher_block_sz);
 
-    return aesDecrypt(cypher + cypher_block_sz, cypher_len - cypher_block_sz, decryptBloc(cypher, cypher_block_sz));
+    return aesDecrypt(Blob {cipher.begin() + cypher_block_sz, cipher.end()}, decryptBloc(cipher.data(), cypher_block_sz));
 }
 
 Blob
@@ -710,13 +711,13 @@ CertificateRequest::sign(const PrivateKey& key, const std::string& password)
 }
 
 bool
-CertificateRequest::verify() const
+CertificateRequest::verify() const 
 {
     return gnutls_x509_crq_verify(request, 0) >= 0;
 }
 
-Blob
-CertificateRequest::pack() const
+Blob 
+CertificateRequest::pack() const 
 {
     gnutls_datum_t dat {nullptr, 0};
     if (auto err = gnutls_x509_crq_export2(request, GNUTLS_X509_FMT_PEM, &dat))
@@ -727,7 +728,7 @@ CertificateRequest::pack() const
 }
 
 std::string
-CertificateRequest::toString() const
+CertificateRequest::toString() const 
 {
     gnutls_datum_t dat {nullptr, 0};
     if (auto err = gnutls_x509_crq_export2(request, GNUTLS_X509_FMT_PEM, &dat))
@@ -1033,7 +1034,7 @@ Certificate::getPreferredDigest() const
     return getPublicKey().getPreferredDigest();
 }
 
-std::pair<std::string, Blob>
+std::pair<Blob,Blob>
 Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
 {
     gnutls_ocsp_req_t rreq;
@@ -1041,10 +1042,10 @@ Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
     std::unique_ptr<struct gnutls_ocsp_req_int, decltype(&gnutls_ocsp_req_deinit)> req(rreq, &gnutls_ocsp_req_deinit);
-    err = gnutls_ocsp_req_add_cert(req.get(), GNUTLS_DIG_SHA1, issuer, cert);
+    err = gnutls_ocsp_req_add_cert(req.get(), GNUTLS_DIG_SHA512, issuer, cert);
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
-    Blob noncebuf(32);
+    Blob noncebuf(64);
     gnutls_datum_t nonce = { noncebuf.data(), (unsigned)noncebuf.size() };
     err = gnutls_rnd(GNUTLS_RND_NONCE, nonce.data, nonce.size);
     err = gnutls_ocsp_req_set_nonce(req.get(), 0, &nonce);
@@ -1054,9 +1055,9 @@ Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
     err = gnutls_ocsp_req_export(req.get(), &rdata);
     if (err != 0)
         throw CryptoException(gnutls_strerror(err));
-    std::string ret((char*)rdata.data, (char*)rdata.data + rdata.size);
+    Blob ret(rdata.data, rdata.data + rdata.size);
     gnutls_free(rdata.data);
-    return std::make_pair<std::string, Blob>(std::move(ret), std::move(noncebuf));
+    return std::make_pair<Blob,Blob>(std::move(ret), std::move(noncebuf));
 }
 
 // PrivateKey
@@ -1147,8 +1148,8 @@ void
 setRandomSerial(gnutls_x509_crt_t cert)
 {
     random_device rdev;
-    std::uniform_int_distribution<int64_t> dist{1};
-    int64_t cert_serial = dist(rdev);
+    std::uniform_int_distribution<uint64_t> dist{};
+    uint64_t cert_serial = dist(rdev);
     gnutls_x509_crt_set_serial(cert, &cert_serial, sizeof(cert_serial));
 }
 
@@ -1161,11 +1162,13 @@ Certificate::generate(const PrivateKey& key, const std::string& name, const Iden
     Certificate ret {cert};
 
     setValidityPeriod(cert, 10 * 365 * 24 * 60 * 60);
-    if (int err = gnutls_x509_crt_set_key(cert, key.x509_key)) {
-        throw CryptoException(std::string("Error when setting certificate key ") + gnutls_strerror(err));
+    if (gnutls_x509_crt_set_key(cert, key.x509_key) != GNUTLS_E_SUCCESS) {
+        std::cerr << "Error when setting certificate key" << std::endl;
+        return {};
     }
-    if (int err = gnutls_x509_crt_set_version(cert, 3)) {
-        throw CryptoException(std::string("Error when setting certificate version ") + gnutls_strerror(err));
+    if (gnutls_x509_crt_set_version(cert, 3) != GNUTLS_E_SUCCESS) {
+        std::cerr << "Error when setting certificate version" << std::endl;
+        return {};
     }
 
     // TODO: compute the subject key using the recommended RFC method
@@ -1190,15 +1193,18 @@ Certificate::generate(const PrivateKey& key, const std::string& name, const Iden
 
     if (ca.first && ca.second) {
         if (not ca.second->isCA()) {
-            throw CryptoException("Signing certificate must be CA");
+            // Signing certificate must be CA.
+            return {};
         }
-        if (int err = gnutls_x509_crt_privkey_sign(cert, ca.second->cert, ca.first->key, pk.getPreferredDigest(), 0)) {
-            throw CryptoException(std::string("Error when signing certificate ") + gnutls_strerror(err));
+        if (gnutls_x509_crt_privkey_sign(cert, ca.second->cert, ca.first->key, pk.getPreferredDigest(), 0) != GNUTLS_E_SUCCESS) {
+            std::cerr << "Error when signing certificate" << std::endl;
+            return {};
         }
         ret.issuer = ca.second;
     } else {
-        if (int err = gnutls_x509_crt_privkey_sign(cert, cert, key.key, pk.getPreferredDigest(), 0)) {
-            throw CryptoException(std::string("Error when signing certificate ") + gnutls_strerror(err));
+        if (gnutls_x509_crt_privkey_sign(cert, cert, key.key, pk.getPreferredDigest(), 0) != GNUTLS_E_SUCCESS) {
+            std::cerr << "Error when signing certificate" << std::endl;
+            return {};
         }
     }
 
@@ -1240,70 +1246,6 @@ Certificate::getRevocationLists() const
     return ret;
 }
 
-// OcspRequest
-
-OcspRequest::OcspRequest(const uint8_t* dat_ptr, size_t dat_size)
-{
-    int ret = gnutls_ocsp_req_init(&request);
-    if (ret < 0)
-        throw CryptoException(gnutls_strerror(ret));
-    gnutls_datum_t dat = {(unsigned char*)dat_ptr,(unsigned int)dat_size};
-    ret = gnutls_ocsp_req_import(request, &dat);
-    if (ret < 0){
-        gnutls_ocsp_req_deinit(request);
-        throw CryptoException(gnutls_strerror(ret));
-    }
-}
-
-OcspRequest::~OcspRequest()
-{
-    if (request) {
-        gnutls_ocsp_req_deinit(request);
-        request = nullptr;
-    }
-}
-
-std::string
-OcspRequest::toString(const bool compact) const
-{
-    int ret;
-    gnutls_datum_t dat;
-    ret = gnutls_ocsp_req_print(request, compact ? GNUTLS_OCSP_PRINT_COMPACT : GNUTLS_OCSP_PRINT_FULL, &dat);
-
-    std::string str;
-    if (ret == 0) {
-        str = std::string((const char*)dat.data, (size_t)dat.size);
-        gnutls_free(dat.data);
-    } else
-        throw CryptoException(gnutls_strerror(ret));
-    return str;
-}
-
-Blob
-OcspRequest::pack() const
-{
-    gnutls_datum_t dat;
-    int err = gnutls_ocsp_req_export(request, &dat);
-    if (err < 0)
-        throw CryptoException(gnutls_strerror(err));
-    Blob ret {dat.data, dat.data + dat.size};
-    gnutls_free(dat.data);
-    return ret;
-}
-
-Blob
-OcspRequest::getNonce() const
-{
-    gnutls_datum_t dat;
-    unsigned critical;
-    int err = gnutls_ocsp_req_get_nonce(request, &critical, &dat);
-    if (err < 0)
-        throw CryptoException(gnutls_strerror(err));
-    Blob ret {dat.data, dat.data + dat.size};
-    gnutls_free(dat.data);
-    return ret;
-}
-
 // OcspResponse
 
 OcspResponse::OcspResponse(const uint8_t* dat_ptr, size_t dat_size)
@@ -1328,12 +1270,10 @@ Blob
 OcspResponse::pack() const
 {
     gnutls_datum_t dat;
-    int err = gnutls_ocsp_resp_export(response, &dat);
-    if (err < 0)
-        throw CryptoException(gnutls_strerror(err));
-    Blob ret {dat.data, dat.data + dat.size};
-    gnutls_free(dat.data);
-    return ret;
+    int ret = gnutls_ocsp_resp_export(response, &dat);
+    if (ret < 0)
+        throw CryptoException(gnutls_strerror(ret));
+    return {dat.data, dat.data + dat.size};
 }
 
 std::string
@@ -1363,63 +1303,68 @@ OcspResponse::getCertificateStatus() const
     return (gnutls_ocsp_cert_status_t) status;
 }
 
-gnutls_ocsp_cert_status_t
+gnutls_ocsp_verify_reason_t
 OcspResponse::verifyDirect(const Certificate& crt, const Blob& nonce)
 {
-    // Check OCSP response
-    int ret = gnutls_ocsp_resp_get_status(response);
-    if (ret < 0)
-        throw CryptoException(gnutls_strerror(ret));
-    gnutls_ocsp_resp_status_t status = (gnutls_ocsp_resp_status_t)ret;
-    if (status != GNUTLS_OCSP_RESP_SUCCESSFUL)
-        throw CryptoException("OCSP request unsuccessful: " + std::to_string(ret));
-
-    if (not nonce.empty()) {
-        // Ensure no replay attack has been done
-        gnutls_datum_t rnonce;
-        ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
-        if (ret < 0)
-            throw CryptoException(gnutls_strerror(ret));
-        if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
-            gnutls_free(rnonce.data);
-            throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
-        }
-        gnutls_free(rnonce.data);
-    }
-
-    // Verify signature of the Basic OCSP response against the public key in the issuer certificate.
+    // https://www.gnutls.org/manual/html_node/Error-codes.html
+    int ret = -1;
+    // http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-verify-reason-t
     unsigned int verify = 0;
-    ret = gnutls_ocsp_resp_verify_direct(response, crt.issuer->cert, &verify, 0);
-    if (ret < 0)
-        throw CryptoException(gnutls_strerror(ret));
-    if (verify) {
-        if (verify & GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND)
-            throw CryptoException("Signer cert not found");
-        if (verify & GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR)
-            throw CryptoException("Signer cert keyusage error");
-        if (verify & GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER)
-            throw CryptoException("Signer cert is not trusted");
-        if (verify & GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM)
-            throw CryptoException("Insecure algorithm");
-        if (verify & GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE)
-            throw CryptoException("Signature failure");
-        if (verify & GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED)
-            throw CryptoException("Signer cert not yet activated");
-        if (verify & GNUTLS_OCSP_VERIFY_CERT_EXPIRED)
-            throw CryptoException("Signer cert expired");
-        throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
-    }
+    // http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-cert-status-t
+    unsigned int status = 6; // by default assume GNUTLS_OCSP_RESP_UNAUTHORIZED
 
-    // Check whether the OCSP response is about the provided certificate.
+#if GNUTLS_VERSION_NUMBER >= 0x030103
+    /*
+     * This function will check whether the OCSP response is about the provided certificate.
+     *     index: Specifies response number to get. Use (0) to get the first one.
+     */
     if ((ret = gnutls_ocsp_resp_check_crt(response, 0, crt.cert)) < 0)
-        throw CryptoException(gnutls_strerror(ret));
-
-    // Check certificate revocation status
-    unsigned status_ocsp;
-    ret = gnutls_ocsp_resp_get_single(response, 0, NULL, NULL, NULL, NULL, &status_ocsp, NULL, NULL, NULL, NULL);
+        goto end;
+#endif
+    /*
+     * Verify signature of the Basic OCSP Response against the public key in the issuer certificate.
+     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-resp-verify-direct
+     */
+    ret = gnutls_ocsp_resp_verify_direct(response, crt.issuer->cert /*signer*/, &verify, 0);
     if (ret < 0)
+        goto end;
+    ret = gnutls_ocsp_resp_check_crt(response, 0 /*index*/, crt.cert);
+    if (ret < 0)
+        goto end;
+    /*
+     * This function will return the certificate information of the indx'ed response in the
+     * Basic OCSP Response resp. The information returned corresponds to the OCSP SingleResponse
+     * structure except the final singleExtensions.
+     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-resp-get-single
+     */
+    ret = gnutls_ocsp_resp_get_single(response, 0, NULL, NULL, NULL, NULL, &status, NULL, NULL, NULL, NULL);
+    if (ret < 0)
+        goto end;
+    gnutls_datum_t rnonce;
+    /*
+     * This function will return the Basic OCSP Response nonce extension data.
+     */
+    ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
+    if (ret < 0)
+        goto end;
+    // Ensure no replay attack has been done
+    if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
+        ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
+        goto end;
+    }
+end:
+    /*
+     * OCSP validation outcome based on interogative aspects
+     */
+    if (ret != GNUTLS_E_SUCCESS)
         throw CryptoException(gnutls_strerror(ret));
-    return (gnutls_ocsp_cert_status_t)status_ocsp;
+    else if (status != GNUTLS_OCSP_CERT_GOOD)
+        if (status == GNUTLS_OCSP_CERT_REVOKED)
+            throw CryptoException("Certificate was revoked");
+        else
+            throw CryptoException("Certificate is unknown");
+    else
+        return (gnutls_ocsp_verify_reason_t) verify;
 }
 
 // RevocationList

src/dht.cpp

@@ -52,7 +52,12 @@ Dht::updateStatus(sa_family_t af)
         if (other.status == NodeStatus::Disconnected && d.status == NodeStatus::Disconnected)
             onDisconnected();
         else if (other.status == NodeStatus::Connected || d.status == NodeStatus::Connected) {
-            onConnected();
+            // On connected
+            if (bootstrapJob) {
+                bootstrapJob->cancel();
+                bootstrapJob.reset();
+            }
+            bootstrap_period = std::chrono::seconds(10);
         }
     }
     return d.status;
@@ -77,27 +82,11 @@ Dht::Kad::getStatus(time_point now) const
 }
 
 void
-Dht::shutdown(ShutdownCallback cb, bool stop)
+Dht::shutdown(ShutdownCallback cb)
 {
     if (not persistPath.empty())
         saveState(persistPath);
 
-    if (stop) {
-        for (auto dht : {&dht4, &dht6}) {
-            for (auto& sr : dht->searches) {
-                for (const auto& r : sr.second->callbacks)
-                    r.second.done_cb(false, {});
-                sr.second->callbacks.clear();
-                for (const auto& a : sr.second->announce) {
-                    if (a.callback) a.callback(false, {});
-                }
-                sr.second->announce.clear();
-                sr.second->listeners.clear();
-            }
-        }
-        network_engine.clear();
-    }
-
     if (not maintain_storage) {
         if (cb) cb();
         return;
@@ -502,9 +491,9 @@ void Dht::searchSendAnnounceValue(const Sp<Search>& sr) {
                         sr->id.toString().c_str(), sn->node->toString().c_str(), a.value->id);
                 sn->acked[a.value->id] = {
                     network_engine.sendRefreshValue(sn->node, sr->id, a.value->id, sn->token, onDone,
-                    [this, ws, node=sn->node, v=a.value,
-                     onDone,
-                     onExpired,
+                    [this, ws, node=sn->node, v=a.value, 
+                     onDone, 
+                     onExpired, 
                      created = a.permanent ? time_point::max() : a.created,
                      next_refresh_time
                     ](const net::Request& /*req*/, net::DhtProtocolException&& e){
@@ -602,7 +591,7 @@ Dht::searchSynchedNodeListen(const Sp<Search>& sr, SearchNode& n)
     std::weak_ptr<Search> ws = sr;
     for (const auto& l : sr->listeners) {
         const auto& query = l.second.query;
-
+        
         auto r = n.listenStatus.find(query);
         if (n.getListenTime(r, listenExp) > scheduler.time())
             continue;
@@ -736,7 +725,7 @@ Dht::searchStep(Sp<Search> sr)
 
     while (sr->currentlySolicitedNodeCount() < MAX_REQUESTED_SEARCH_NODES and searchSendGetValues(sr));
 
-
+    
     if (sr->getNumberOfConsecutiveBadNodes() >= std::min<size_t>(sr->nodes.size(), SEARCH_MAX_BAD_NODES))
     {
         if (logger_)
@@ -1758,6 +1747,8 @@ fromDhtConfig(const Config& config)
     return netConf;
 }
 
+Dht::Dht() : store(), network_engine(logger_, rd, scheduler, {}) {}
+
 Dht::Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l)
     : DhtInterface(l),
     myid(config.node_id ? config.node_id : InfoHash::getRandom(rd)),
@@ -1992,21 +1983,6 @@ Dht::expire()
     scheduler.add(expire_stuff_time, std::bind(&Dht::expire, this));
 }
 
-void
-Dht::onConnected()
-{
-    if (bootstrapJob) {
-        bootstrapJob->cancel();
-        bootstrapJob.reset();
-    }
-    bootstrap_period = std::chrono::seconds(10);
-    auto callbacks = std::move(onConnectCallbacks_);
-    while (not callbacks.empty()) {
-        callbacks.front()();
-        callbacks.pop();
-    }
-}
-
 void
 Dht::onDisconnected()
 {
@@ -2552,7 +2528,7 @@ Dht::saveState(const std::string& path) const
     state.nodes = exportNodes();
     state.values = exportValues();
     std::ofstream file(path);
-    msgpack::pack(file, state);
+    msgpack::pack(file, state);    
 }
 
 void

src/dht_proxy_client.cpp

@@ -155,10 +155,10 @@ DhtProxyClient::startProxy()
     if (logger_)
         logger_->d("[proxy:client] start proxy with %s", proxyUrl_.c_str());
 
-    nextProxyConfirmationTimer_ = std::make_unique<asio::steady_timer>(httpContext_, std::chrono::steady_clock::now());
+    nextProxyConfirmationTimer_ = std::make_shared<asio::steady_timer>(httpContext_, std::chrono::steady_clock::now());
     nextProxyConfirmationTimer_->async_wait(std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));
 
-    listenerRestartTimer_ = std::make_unique<asio::steady_timer>(httpContext_);
+    listenerRestartTimer_ = std::make_shared<asio::steady_timer>(httpContext_);
 
     loopSignal_();
 }
@@ -242,7 +242,7 @@ DhtProxyClient::cancelAllListeners()
 }
 
 void
-DhtProxyClient::shutdown(ShutdownCallback cb, bool)
+DhtProxyClient::shutdown(ShutdownCallback cb)
 {
     stop();
     if (cb)
@@ -636,8 +636,6 @@ DhtProxyClient::queryProxyInfo(const Sp<InfoState>& infoState, const Sp<http::Re
         logger_->d("[proxy:client] [status] query ipv%i info", family == AF_INET ? 4 : 6);
     try {
         auto request = std::make_shared<http::Request>(httpContext_, resolver, family);
-        if (serverCertificate_)
-            request->set_certificate_authority(serverCertificate_);
         auto reqid = request->id();
         request->set_method(restinio::http_method_get());
         setHeaderFields(*request);
@@ -723,15 +721,6 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
         if (oldStatus == NodeStatus::Disconnected || oldStatus == NodeStatus::Connecting) {
             listenerRestartTimer_->expires_at(std::chrono::steady_clock::now());
             listenerRestartTimer_->async_wait(std::bind(&DhtProxyClient::restartListeners, this, std::placeholders::_1));
-            if (not onConnectCallbacks_.empty()) {
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
-                callbacks_.emplace_back([cbs = std::move(onConnectCallbacks_)]() mutable {
-                    while (not cbs.empty()) {
-                        cbs.front()();
-                        cbs.pop();
-                    }
-                });
-            }
         }
         nextProxyConfirmationTimer_->expires_at(std::chrono::steady_clock::now() + std::chrono::minutes(15));
         nextProxyConfirmationTimer_->async_wait(std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));

src/dht_proxy_server.cpp

@@ -822,7 +822,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request,
             logger_->d("[proxy:server] [subscribe %s] [client %s] [session %s]", infoHash.toString().c_str(), clientId.c_str(), sessionId.c_str());
 
         // Insert new or return existing push listeners of a token
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard<std::mutex> lock(lockPushListeners_);
         auto& pushListener = pushListeners_[pushToken];
         auto& pushListeners = pushListener.listeners[infoHash];
 

src/dhtrunner.cpp

@@ -76,17 +76,19 @@ DhtRunner::~DhtRunner()
 }
 
 void
-DhtRunner::run(in_port_t port, Config& config, Context&& context)
+DhtRunner::run(in_port_t port, const Config& config, Context&& context)
 {
-    config.bind4.setFamily(AF_INET);
-    config.bind4.setPort(port);
-    config.bind6.setFamily(AF_INET6);
-    config.bind6.setPort(port);
-    run(config, std::move(context));
+    SockAddr sin4;
+    sin4.setFamily(AF_INET);
+    sin4.setPort(port);
+    SockAddr sin6;
+    sin6.setFamily(AF_INET6);
+    sin6.setPort(port);
+    run(sin4, sin6, config, std::move(context));
 }
 
 void
-DhtRunner::run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context)
+DhtRunner::run(const char* ip4, const char* ip6, const char* service, const Config& config, Context&& context)
 {
     auto res4 = SockAddr::resolve(ip4, service);
     auto res6 = SockAddr::resolve(ip6, service);
@@ -94,9 +96,44 @@ DhtRunner::run(const char* ip4, const char* ip6, const char* service, Config& co
         res4.emplace_back();
     if (res6.empty())
         res6.emplace_back();
-    config.bind4 = std::move(res4.front());
-    config.bind6 = std::move(res6.front());
-    run(config, std::move(context));
+    run(res4.front(), res6.front(), config, std::move(context));
+}
+
+void
+DhtRunner::run(SockAddr& local4, SockAddr& local6, const Config& config, Context&& context)
+{
+    if (running == State::Idle) {
+        auto state_path = config.dht_config.node_config.persist_path;
+        if (not state_path.empty()) {
+            state_path += "_port.txt";
+            std::ifstream inConfig(state_path);
+            if (inConfig.is_open()) {
+                in_port_t port;
+                if (inConfig >> port) {
+                    if (context.logger)
+                        context.logger->d("[runner %p] Using IPv4 port %hu from saved configuration", this, port);
+                    if (local4.getPort() == 0)
+                        local4.setPort(port);
+                }
+                if (inConfig >> port) {
+                    if (context.logger)
+                        context.logger->d("[runner %p] Using IPv6 port %hu from saved configuration", this, port);
+                    if (local6.getPort() == 0)
+                        local6.setPort(port);
+                }
+            }
+        }
+
+        if (not context.sock)
+            context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
+
+        if (not state_path.empty()) {
+            std::ofstream outConfig(state_path);
+            outConfig << context.sock->getBoundRef(AF_INET).getPort() << std::endl;
+            outConfig << context.sock->getBoundRef(AF_INET6).getPort() << std::endl;
+        }
+        run(config, std::move(context));
+    }
 }
 
 void
@@ -104,51 +141,8 @@ DhtRunner::run(const Config& config, Context&& context)
 {
     std::lock_guard<std::mutex> lck(dht_mtx);
     auto expected = State::Idle;
-    if (not running.compare_exchange_strong(expected, State::Running)) {
-        if (context.logger)
-            context.logger->w("[runner %p] Node is already running. Call join() first before calling run() again.");
+    if (not running.compare_exchange_strong(expected, State::Running))
         return;
-    }
-
-    auto local4 = config.bind4;
-    auto local6 = config.bind6;
-    if (not local4 and not local6) {
-        if (context.logger)
-            context.logger->w("[runner %p] No address to bind specified in the configuration, using default addresses");
-        local4.setFamily(AF_INET);
-        local6.setFamily(AF_INET6);
-    }
-    auto state_path = config.dht_config.node_config.persist_path;
-    if (not state_path.empty() && (local4.getPort() == 0 || local6.getPort() == 0)) {
-        state_path += "_port.txt";
-        std::ifstream inConfig(state_path);
-        if (inConfig.is_open()) {
-            in_port_t port;
-            if (inConfig >> port) {
-                if (local4.getPort() == 0) {
-                    if (context.logger)
-                        context.logger->d("[runner %p] Using IPv4 port %hu from saved configuration", this, port);
-                    local4.setPort(port);
-                }
-            }
-            if (inConfig >> port) {
-                if (local6.getPort() == 0) {
-                    if (context.logger)
-                        context.logger->d("[runner %p] Using IPv6 port %hu from saved configuration", this, port);
-                    local6.setPort(port);
-                }
-            }
-        }
-    }
-
-    if (not context.sock)
-        context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
-
-    if (not state_path.empty()) {
-        std::ofstream outConfig(state_path);
-        outConfig << context.sock->getBoundRef(AF_INET).getPort() << std::endl;
-        outConfig << context.sock->getBoundRef(AF_INET6).getPort() << std::endl;
-    }
 
     if (context.logger) {
         logger_ = context.logger;
@@ -173,13 +167,12 @@ DhtRunner::run(const Config& config, Context&& context)
         return ret;
     });
 
+    auto dht = std::unique_ptr<DhtInterface>(new Dht(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger));
+    dht_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht), config.dht_config));
+
 #ifdef OPENDHT_PROXY_CLIENT
     config_ = config;
-    identityAnnouncedCb_ = context.identityAnnouncedCb;
 #endif
-    auto dht = std::unique_ptr<DhtInterface>(new Dht(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger));
-    dht_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht), config.dht_config, std::move(context.identityAnnouncedCb), context.logger));
-
     enableProxy(not config.proxy_server.empty());
     if (context.logger and dht_via_proxy_) {
         dht_via_proxy_->setLogger(context.logger);
@@ -268,31 +261,29 @@ DhtRunner::run(const Config& config, Context&& context)
 }
 
 void
-DhtRunner::shutdown(ShutdownCallback cb, bool stop) {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+DhtRunner::shutdown(ShutdownCallback cb) {
     auto expected = State::Running;
     if (not running.compare_exchange_strong(expected, State::Stopping)) {
         if (expected == State::Stopping and ongoing_ops) {
+            std::lock_guard<std::mutex> lck(storage_mtx);
             shutdownCallbacks_.emplace_back(std::move(cb));
         }
-        else if (cb) {
-            lck.unlock();
-            cb();
-        }
+        else if (cb) cb();
         return;
     }
     if (logger_)
         logger_->d("[runner %p] state changed to Stopping, %zu ongoing ops", this, ongoing_ops.load());
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     shutdownCallbacks_.emplace_back(std::move(cb));
-    pending_ops.emplace([=](SecureDht&) mutable {
+    pending_ops_prio.emplace([=](SecureDht&) mutable {
         auto onShutdown = [this]{ opEnded(); };
 #ifdef OPENDHT_PROXY_CLIENT
         if (dht_via_proxy_)
-            dht_via_proxy_->shutdown(onShutdown, stop);
+            dht_via_proxy_->shutdown(onShutdown);
 #endif
         if (dht_)
-            dht_->shutdown(onShutdown, stop);
+            dht_->shutdown(onShutdown);
     });
     cv.notify_all();
 }
@@ -321,11 +312,11 @@ DhtRunner::bindOpDoneCallback(DoneCallbackSimple&& cb) {
 
 bool
 DhtRunner::checkShutdown() {
+    if (running != State::Stopping or ongoing_ops)
+        return false;
     decltype(shutdownCallbacks_) cbs;
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
-        if (running != State::Stopping or ongoing_ops)
-            return false;
         cbs = std::move(shutdownCallbacks_);
     }
     for (auto& cb : cbs)
@@ -357,13 +348,9 @@ DhtRunner::join()
 
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
-        if (ongoing_ops and logger_) {
-            logger_->w("[runner %p] stopping with %zu remaining ops", this, ongoing_ops.load());
-        }
         pending_ops = decltype(pending_ops)();
         pending_ops_prio = decltype(pending_ops_prio)();
         ongoing_ops = 0;
-        shutdownCallbacks_.clear();
     }
     {
         std::lock_guard<std::mutex> lck(dht_mtx);
@@ -606,18 +593,6 @@ DhtRunner::getPublicAddressStr(sa_family_t af)
     return ret;
 }
 
-void
-DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_family_t af)
-{
-    std::lock_guard<std::mutex> lck(storage_mtx);
-    ongoing_ops++;
-    pending_ops_prio.emplace([cb = std::move(cb), this, af](SecureDht& dht){
-        cb(dht.getPublicAddress(af));
-        opEnded();
-    });
-    cv.notify_all();
-}
-
 void
 DhtRunner::registerCertificate(std::shared_ptr<crypto::Certificate> cert) {
     std::lock_guard<std::mutex> lck(dht_mtx);
@@ -715,12 +690,11 @@ DhtRunner::loop_()
 void
 DhtRunner::get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f, Where w)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (dcb) dcb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=](SecureDht& dht) mutable {
         dht.get(hash, std::move(vcb), bindOpDoneCallback(std::move(dcb)), std::move(f), std::move(w));
@@ -735,12 +709,11 @@ DhtRunner::get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb,
 }
 void
 DhtRunner::query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb, Query q) {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (done_cb) done_cb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=](SecureDht& dht) mutable {
         dht.query(hash, std::move(cb), bindOpDoneCallback(std::move(done_cb)), std::move(q));
@@ -752,12 +725,11 @@ std::future<size_t>
 DhtRunner::listen(InfoHash hash, ValueCallback vcb, Value::Filter f, Where w)
 {
     auto ret_token = std::make_shared<std::promise<size_t>>();
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         ret_token->set_value(0);
         return ret_token->get_future();
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     pending_ops.emplace([=](SecureDht& dht) mutable {
 #ifdef OPENDHT_PROXY_CLIENT
         auto tokenbGlobal = listener_token_++;
@@ -838,12 +810,11 @@ DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 void
 DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -857,12 +828,11 @@ DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created
 void
 DhtRunner::put(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=, cb = std::move(cb)](SecureDht& dht) mutable {
         dht.put(hash, value, bindOpDoneCallback(std::move(cb)), created, permanent);
@@ -899,12 +869,11 @@ DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 void
 DhtRunner::putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -930,12 +899,11 @@ DhtRunner::putSigned(const std::string& key, Value&& value, DoneCallbackSimple c
 void
 DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (cb) cb(false, {});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([=,
         cb = std::move(cb),
@@ -1021,12 +989,11 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple&& cb)
 void
 DhtRunner::bootstrap(const SockAddr& addr, DoneCallbackSimple&& cb)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         if (cb) cb(false);
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops_prio.emplace([addr, cb = bindOpDoneCallback(std::move(cb))](SecureDht& dht) mutable {
         dht.pingNode(std::move(addr), std::move(cb));
@@ -1037,9 +1004,9 @@ DhtRunner::bootstrap(const SockAddr& addr, DoneCallbackSimple&& cb)
 void
 DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
     if (running != State::Running)
         return;
+    std::unique_lock<std::mutex> lck(storage_mtx);
     pending_ops_prio.emplace([id, address](SecureDht& dht) mutable {
         dht.insertNode(id, address);
     });
@@ -1049,9 +1016,9 @@ DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 void
 DhtRunner::bootstrap(const std::vector<NodeExport>& nodes)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
     if (running != State::Running)
         return;
+    std::lock_guard<std::mutex> lck(storage_mtx);
     pending_ops_prio.emplace([=](SecureDht& dht) {
         for (auto& node : nodes)
             dht.insertNode(node);
@@ -1075,12 +1042,11 @@ DhtRunner::connectivityChanged()
 
 void
 DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb) {
-    std::unique_lock<std::mutex> lck(storage_mtx);
     if (running != State::Running) {
-        lck.unlock();
         cb({});
         return;
     }
+    std::lock_guard<std::mutex> lck(storage_mtx);
     ongoing_ops++;
     pending_ops.emplace([this, hash, cb = std::move(cb)] (SecureDht& dht) {
         dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt){
@@ -1156,7 +1122,7 @@ DhtRunner::enableProxy(bool proxify)
         if (not config_.push_token.empty())
             dht_via_proxy->setPushNotificationToken(config_.push_token);
 #endif
-        dht_via_proxy_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht_via_proxy), config_.dht_config, identityAnnouncedCb_, logger_));
+        dht_via_proxy_ = std::unique_ptr<SecureDht>(new SecureDht(std::move(dht_via_proxy), config_.dht_config));
         // add current listeners
         for (auto& l: listeners_)
             l.second.tokenProxyDht = dht_via_proxy_->listen(l.second.hash, l.second.gcb, l.second.f, l.second.w);

src/http.cpp

@@ -31,14 +31,10 @@
 #include <openssl/ssl.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
 
 #define MAXAGE_SEC (14*24*60*60)
 #define JITTER_SEC (60)
 #define OCSP_MAX_RESPONSE_SIZE (20480)
-#ifdef _WIN32
-#define timegm                 _mkgmtime
-#endif
 
 namespace dht {
 namespace http {
@@ -103,44 +99,22 @@ Url::toString() const
 
 std::atomic_uint Connection::ids_ {1};
 
-std::shared_ptr<asio::ssl::context>
-newTlsClientContext(const std::shared_ptr<dht::Logger>& logger)
-{
-    auto ctx = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-    ctx->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
-
-    if (char* path = getenv("CA_ROOT_FILE")) {
-        if (logger)
-            logger->d("Using CA file: %s", path);
-        ctx->load_verify_file(path);
-    } else if (char* path = getenv("CA_ROOT_PATH")) {
-        if (logger)
-            logger->d("Using CA path: %s", path);
-        ctx->add_verify_path(path);
-    } else {
-#ifdef __ANDROID__
-        if (logger)
-            logger->d("Using CA path: /system/etc/security/cacerts");
-        ctx->add_verify_path("/system/etc/security/cacerts");
-#elif defined(WIN32) || defined(TARGET_OS_OSX)
-        PEMCache::instance(logger).fillX509Store(ctx->native_handle());
-#else
-        if (logger)
-            logger->d("Using default CA path");
-        ctx->set_default_verify_paths();
-#endif
-    }
-    return ctx;
-}
-
 Connection::Connection(asio::io_context& ctx, const bool ssl, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
     if (ssl) {
-        ssl_ctx_ = newTlsClientContext(l);
+        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
+#ifdef __ANDROID__
+        ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
+#elif defined(WIN32) || defined(__APPLE__)
+        PEMCache::instance(l).fillX509Store(ssl_ctx_->native_handle());
+#else
+        ssl_ctx_->set_default_verify_paths();
+#endif
         ssl_socket_ = std::make_unique<ssl_socket_t>(ctx_, ssl_ctx_);
         if (logger_)
-            logger_->d("[connection:%i] start https session with system CA", id_);
+            logger_->d("[connection:%i] start https session", id_);
     }
     else {
         socket_ = std::make_unique<socket_t>(ctx);
@@ -153,20 +127,23 @@ Connection::Connection(asio::io_context& ctx, std::shared_ptr<dht::crypto::Certi
                        const dht::crypto::Identity& identity, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
+    ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+    ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
+#ifdef __ANDROID__
+    ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
+#elif WIN32 || defined(__APPLE__)
+    PEMCache::instance(l).fillX509Store(ssl_ctx_->native_handle());
+#else
+    ssl_ctx_->set_default_verify_paths();
+#endif
     asio::error_code ec;
-    if (server_ca) {
-        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
+    if (server_ca){
         auto ca = server_ca->toString(false/*chain*/);
         ssl_ctx_->add_certificate_authority(asio::const_buffer{ca.data(), ca.size()}, ec);
         if (ec)
             throw std::runtime_error("Error adding certificate authority: " + ec.message());
         else if (logger_)
-            logger_->d("[connection:%i] start https with custom CA %s", id_, server_ca->getUID().c_str());
-    } else {
-        ssl_ctx_ = newTlsClientContext(l);
-        if (logger_)
-            logger_->d("[connection:%i] start https session with system CA", id_);
+            logger_->d("[connection:%i] certficate authority %s", id_, server_ca->getUID().c_str());
     }
     if (identity.first){
         auto key = identity.first->serialize();
@@ -260,7 +237,7 @@ issuer_from_chain(STACK_OF(X509)* fullchain)
 using OscpRequestPtr = std::unique_ptr<OCSP_REQUEST, decltype(&OCSP_REQUEST_free)>;
 struct OscpRequestInfo {
     OscpRequestPtr req {nullptr, &OCSP_REQUEST_free};
-    std::string data;
+    std::vector<uint8_t> data;
     std::string url;
 };
 
@@ -300,7 +277,7 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
 
     auto request = std::make_unique<OscpRequestInfo>();
     request->req = OscpRequestPtr(OCSP_REQUEST_new(), &OCSP_REQUEST_free);
-    request->url = url;
+    request->url = strdup(url);
     X509_email_free(urls);
 
     OCSP_CERTID* id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
@@ -330,7 +307,7 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
             logger->e("Unable to allocte memory");
         return {};
     }
-    request->data = std::string((char*)data, (char*)data+size);
+    request->data = std::vector<uint8_t>(data, data+size);
     free(data);
     return request;
 }
@@ -342,6 +319,9 @@ ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, con
     const uint8_t* p = (const uint8_t*)response.data();
     int status, cert_status=0, crl_reason=0;
     time_t now, rev_t = -1, this_t, next_t;
+    OCSP_RESPONSE *resp;
+    OCSP_BASICRESP *bresp;
+    OCSP_CERTID *cid;
 
     X509* cert = cert_from_chain(fullchain);
     if (cert == nullptr) {
@@ -355,39 +335,32 @@ ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, con
             logger->e("Unable to find issuer for cert");
         return false;
     }
-
-    OCSP_CERTID *cidr;
-    if ((cidr = OCSP_cert_to_id(nullptr, cert, issuer)) == nullptr) {
+    if ((cid = OCSP_cert_to_id(nullptr, cert, issuer)) == nullptr) {
         if (logger)
             logger->e("Unable to get issuer cert/CID");
         return false;
     }
-    std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> cid(cidr, &OCSP_CERTID_free);
 
-    OCSP_RESPONSE *r;
-    if ((r = d2i_OCSP_RESPONSE(nullptr, &p, response.size())) == nullptr) {
+    if ((resp = d2i_OCSP_RESPONSE(nullptr, &p, response.size())) == nullptr) {
         if (logger)
             logger->e("OCSP response unserializable");
         return false;
     }
-    std::unique_ptr<OCSP_RESPONSE, decltype(&OCSP_RESPONSE_free)> resp(r, &OCSP_RESPONSE_free);
 
-    OCSP_BASICRESP *brespr;
-    if ((brespr = OCSP_response_get1_basic(resp.get())) == nullptr) {
+    if ((bresp = OCSP_response_get1_basic(resp)) == nullptr) {
         if (logger)
             logger->e("Failed to load OCSP response");
         return false;
     }
-    std::unique_ptr<OCSP_BASICRESP, decltype(&OCSP_BASICRESP_free)> bresp(brespr, &OCSP_BASICRESP_free);
 
-    if (OCSP_basic_verify(bresp.get(), fullchain, store, OCSP_TRUSTOTHER) != 1) {
+    if (OCSP_basic_verify(bresp, fullchain, store, OCSP_TRUSTOTHER) != 1) {
         if (logger)
             logger->w("OCSP verify failed");
         return false;
     }
     printf("OCSP response signature validated\n");
 
-    status = OCSP_response_status(resp.get());
+    status = OCSP_response_status(resp);
     if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
         if (logger)
             logger->w("OCSP Failure: code %d (%s)", status, OCSP_response_status_str(status));
@@ -395,13 +368,13 @@ ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, con
     }
 
     // Check the nonce if we sent one
-    if (OCSP_check_nonce(info.req.get(), bresp.get()) <= 0) {
+    if (OCSP_check_nonce(info.req.get(), bresp) <= 0) {
         if (logger)
             logger->w("No OCSP nonce, or mismatch");
         return false;
     }
 
-    if (OCSP_resp_find_status(bresp.get(), cid.get(), &cert_status, &crl_reason,
+    if (OCSP_resp_find_status(bresp, cid, &cert_status, &crl_reason,
         &revtime, &thisupd, &nextupd) != 1) {
         if (logger)
             logger->w("OCSP verify failed: no result for cert");
@@ -482,7 +455,7 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
         ssl_socket_->asio_ssl_stream().set_verify_mode(verify_mode);
         if (verify_mode != asio::ssl::verify_none) {
             ssl_socket_->asio_ssl_stream().set_verify_callback([
-                    id = id_, logger = logger_, hostname, checkOcsp = checkOcsp_
+                    id = id_, logger = logger_, hostname
                 ] (bool preverified, asio::ssl::verify_context& ctx) -> bool {
                     X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
                     if (logger) {
@@ -497,26 +470,23 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                     auto verify_ec = X509_STORE_CTX_get_error(ctx.native_handle());
                     if (verify_ec != 0 /*X509_V_OK*/ and logger)
                         logger->e("[http::connection:%i] ssl verification error=%i %d", id, verify_ec, verified);
-                    if (verified and checkOcsp) {
-                        std::unique_ptr<stack_st_X509, void(*)(stack_st_X509*)> chain(
-                            X509_STORE_CTX_get1_chain(ctx.native_handle()),
-                            [](stack_st_X509* c){ sk_X509_pop_free(c, X509_free); });
-                        if (auto ocspInfo = ocspRequestFromCert(chain.get(), logger)) {
+                    if (verified) {
+                        auto chain = X509_STORE_CTX_get1_chain(ctx.native_handle());
+                        if (auto ocspInfo = ocspRequestFromCert(chain, logger)) {
                             if (logger)
                                 logger->w("[http::connection:%i] TLS OCSP server: %s, request size: %zu", id, ocspInfo->url.c_str(), ocspInfo->data.size());
                             bool ocspVerified = false;
                             asio::io_context io_ctx;
                             auto ocspReq = std::make_shared<Request>(io_ctx, ocspInfo->url, [&](const Response& ocspResp){
                                 if (ocspResp.status_code == 200) {
-                                    ocspVerified = ocspValidateResponse(*ocspInfo, chain.get(), ocspResp.body, X509_STORE_CTX_get0_store(ctx.native_handle()), logger);
+                                    ocspVerified = ocspValidateResponse(*ocspInfo, chain, ocspResp.body, ctx.native_handle()->ctx, logger);
                                 } else {
                                     if (logger)
                                         logger->w("[http::connection:%i] TLS OCSP check error", id);
                                 }
                             }, logger);
                             ocspReq->set_method(restinio::http_method_post());
-                            ocspReq->set_header_field(restinio::http_field_t::content_type, "application/ocsp-request");
-                            ocspReq->set_body(ocspInfo->data);
+                            ocspReq->set_body({ocspInfo->data.begin(), ocspInfo->data.end()});
                             ocspReq->send();
                             io_ctx.run();
                             if (not ocspVerified)
@@ -561,63 +531,12 @@ void
 Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, ConnectHandlerCb cb)
 {
     std::lock_guard<std::mutex> lock(mutex_);
-    if (!ssl_socket_ && !socket_) {
-        cb(asio::error::operation_aborted, {});
-        return;
-    }
-    auto& base = ssl_socket_? ssl_socket_->lowest_layer() : *socket_;
-
-    ConnectHandlerCb wcb = [&base, cb=std::move(cb)](const asio::error_code& ec, const asio::ip::tcp::endpoint& endpoint) {
-        if (!ec) {
-            auto socket = base.native_handle();
-            // Once connected, set a keep alive on the TCP socket with 30 seconds delay
-            // This will generate broken pipes as soon as possible.
-            // Note this needs to be done once connected to have a valid native_handle()
-            uint32_t start = 30;
-            uint32_t interval = 30;
-            uint32_t cnt = 1;
-#ifdef _WIN32
-            std::string val = "1";
-            setsockopt(socket, SOL_SOCKET, SO_KEEPALIVE, val.c_str(), sizeof(val));
-
-            // TCP_KEEPIDLE and TCP_KEEPINTVL are available since Win 10 version 1709
-            // TCP_KEEPCNT since Win 10 version 1703
-#ifdef TCP_KEEPIDLE
-            std::string start_str = std::to_string(start);
-            setsockopt(socket, IPPROTO_TCP, TCP_KEEPIDLE,
-                    start_str.c_str(), sizeof(start_str));
-#endif
-#ifdef TCP_KEEPINTVL
-            std::string interval_str = std::to_string(interval);
-            setsockopt(socket, IPPROTO_TCP, TCP_KEEPINTVL,
-                    interval_str.c_str(), sizeof(interval_str));
-#endif
-#ifdef TCP_KEEPCNT
-            std::string cnt_str = std::to_string(cnt);
-            setsockopt(socket, IPPROTO_TCP, TCP_KEEPCNT,
-                    cnt_str.c_str(), sizeof(cnt_str));
-#endif
-#else
-            uint32_t val = 1;
-            setsockopt(socket, SOL_SOCKET, SO_KEEPALIVE, &val, sizeof(uint32_t));
-#ifdef __APPLE__
-            // Apple devices only have one parameter
-            setsockopt(socket, IPPROTO_TCP, TCP_KEEPALIVE, &start, sizeof(uint32_t));
-#else
-            // Linux based systems
-            setsockopt(socket, SOL_TCP, TCP_KEEPIDLE, &start, sizeof(uint32_t));
-            setsockopt(socket, SOL_TCP, TCP_KEEPINTVL, &interval, sizeof(uint32_t));
-            setsockopt(socket, SOL_TCP, TCP_KEEPCNT, &cnt, sizeof(uint32_t));
-#endif
-#endif
-        }
-        if (cb)
-            cb(ec, endpoint);
-    };
     if (ssl_socket_)
-        asio::async_connect(ssl_socket_->lowest_layer(), std::move(endpoints), wrapCallabck(std::move(wcb)));
-    else
-        asio::async_connect(*socket_, std::move(endpoints), wrapCallabck(std::move(wcb)));
+        asio::async_connect(ssl_socket_->lowest_layer(), std::move(endpoints), wrapCallabck(std::move(cb)));
+    else if (socket_)
+        asio::async_connect(*socket_, std::move(endpoints), wrapCallabck(std::move(cb)));
+    else if (cb)
+        cb(asio::error::operation_aborted, {});
 }
 
 void
@@ -1305,11 +1224,9 @@ Request::terminate(const asio::error_code& ec)
         return;
 
     response_.aborted = ec == asio::error::operation_aborted;
-    if (ec == asio::error::basic_errors::broken_pipe)
-        response_.status_code = 0U; // Avoid to give a successful answer (happen with a broken pipe, takes the last status)
 
     if (logger_) {
-        if (ec and ec != asio::error::eof and !response_.aborted)
+        if (ec and ec != asio::error::eof and ec != asio::error::operation_aborted)
             logger_->e("[http:request:%i] end with error: %s", id_, ec.message().c_str());
         else
             logger_->d("[http:request:%i] done with status code %u", id_, response_.status_code);
@@ -1437,7 +1354,7 @@ Request::onHeadersComplete() {
 }
 
 bool startsWith(const std::string& haystack, const std::string& needle) {
-    return needle.length() <= haystack.length()
+    return needle.length() <= haystack.length() 
         && std::equal(needle.begin(), needle.end(), haystack.begin());
 }
 
@@ -1468,7 +1385,7 @@ Request::await()
     std::unique_lock<std::mutex> lock(mtx);
     std::condition_variable cv;
     bool ok {false};
-    add_on_done_callback([&](const Response&){
+    add_on_done_callback([&](const Response& resp){
         std::lock_guard<std::mutex> lk(mtx);
         ok = true;
         cv.notify_all();

src/network_engine.cpp

@@ -82,6 +82,10 @@ RequestAnswer::RequestAnswer(ParsedMessage&& msg)
    nodes6(std::move(msg.nodes6))
 {}
 
+NetworkEngine::NetworkEngine(const Sp<Logger>& log, std::mt19937_64& rand, Scheduler& scheduler, std::unique_ptr<DatagramSocket>&& sock)
+    : myid(zeroes), dht_socket(std::move(sock)), logger_(log), rd(rand), cache(rd), rate_limiter((size_t)-1), scheduler(scheduler)
+{}
+
 NetworkEngine::NetworkEngine(InfoHash& myid, NetworkConfig c,
         std::unique_ptr<DatagramSocket>&& sock,
         const Sp<Logger>& log,
@@ -376,7 +380,7 @@ NetworkEngine::isMartian(const SockAddr& addr)
         const uint8_t* address = (const uint8_t*)&sin6.sin6_addr;
         return address[0] == 0xFF ||
               (address[0] == 0xFE && (address[1] & 0xC0) == 0x80) ||
-               memcmp(address, InfoHash::zero().data(), 16) == 0 ||
+               memcmp(address, zeroes.data(), 16) == 0 ||
                memcmp(address, v4prefix,      12) == 0;
     }
     default:
@@ -456,13 +460,9 @@ NetworkEngine::processMessage(const uint8_t *buf, size_t buflen, SockAddr f)
             pmsg_it->second.last_part = now;
             // check data completion
             if (pmsg_it->second.msg->complete()) {
-                try {
-                    // process the full message
-                    process(std::move(pmsg_it->second.msg), from);
-                    partial_messages.erase(pmsg_it);
-		} catch (...) {
-                    return;
-		}  
+                // process the full message
+                process(std::move(pmsg_it->second.msg), from);
+                partial_messages.erase(pmsg_it);
             } else
                 scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, msg->tid));
         }
@@ -485,11 +485,7 @@ NetworkEngine::processMessage(const uint8_t *buf, size_t buflen, SockAddr f)
     }
 
     if (msg->value_parts.empty()) {
-        try {	    
-            process(std::move(msg), from);
-	} catch(...) {
-            return;
-	}
+        process(std::move(msg), from);
     } else {
         // starting partial message session
         auto k = msg->tid;

src/op_cache.h

@@ -39,10 +39,8 @@ public:
     }
 
     static ValueCallback cacheCallback(ValueCallback&& cb, std::function<void()>&& onCancel) {
-        return [
-            cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb)),
-            onCancel = std::move(onCancel)
-        ](const std::vector<Sp<Value>>& vals, bool expired){
+        auto cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb));
+        return [cache, onCancel](const std::vector<Sp<Value>>& vals, bool expired){
             auto ret = cache->onValue(vals, expired);
             if (not ret)
                 onCancel();
@@ -51,9 +49,10 @@ public:
     }
 
     bool onValue(const std::vector<Sp<Value>>& vals, bool expired, const system_clock::time_point& t = system_clock::time_point::min()) {
-        return expired
-            ? onValuesExpired(vals, t)
-            : onValuesAdded(vals, t);
+        if (expired)
+            return onValuesExpired(vals, t);
+        else
+            return onValuesAdded(vals, t);
     }
 
     bool onValuesAdded(const std::vector<Sp<Value>>& vals, const system_clock::time_point& t = system_clock::time_point::min());
@@ -74,7 +73,6 @@ public:
     std::vector<Sp<Value>> get(const Value::Filter& filter) const;
     Sp<Value> get(Value::Id id) const;
     std::vector<Sp<Value>> getValues() const;
-    size_t size() const { return values.size(); }
 
 private:
     OpValueCache(const OpValueCache&) = delete;
@@ -146,10 +144,6 @@ public:
     }
     time_point getExpiration() const;
 
-    size_t size() const {
-        return cache.size();
-    }
-
     size_t searchToken;
 private:
     constexpr static const std::chrono::seconds EXPIRATION {60};
@@ -181,13 +175,6 @@ public:
     std::vector<Sp<Value>> get(const Value::Filter& filter) const;
     Sp<Value> get(Value::Id id) const;
 
-    std::pair<size_t, size_t> size() const {
-        size_t tot = 0;
-        for (const auto& c : ops)
-            tot += c.second->size();
-        return {ops.size(), tot};
-    }
-
 private:
     SearchCache(const SearchCache&) = delete;
     SearchCache& operator=(const SearchCache&) = delete;

src/search.h

@@ -124,14 +124,6 @@ struct Dht::SearchNode {
         return last_get_reply + Node::NODE_EXPIRE_TIME;
     }
 
-    friend std::ostream& operator<< (std::ostream& s, const SearchNode& node) {
-        s << "getStatus:" << node.getStatus.size()
-            << " listenStatus:" << node.listenStatus.size()
-            << " acked:" << node.acked.size()
-            << " cache:" << (node.listenStatus.empty() ? 0 : node.listenStatus.begin()->second.cache.size()) << std::endl;
-        return s;
-    }
-
     /**
      * Could a particular "get" request be sent to this node now ?
      *
@@ -425,18 +417,6 @@ struct Dht::Search {
         }
     }
 
-    friend std::ostream& operator<< (std::ostream& s, const Search& sr) {
-        auto csize = sr.cache.size();
-        s << "announce:" << sr.announce.size()
-            << " gets:" << sr.callbacks.size()
-            << " listeners:" << sr.listeners.size()
-            << " cache:" << csize.first << ',' << csize.second << std::endl;
-        s << "nodes:" << std::endl;
-        for (const auto& n : sr.nodes)
-            s << *n;
-        return s;
-    }
-
     /**
      * @returns true if the node was not present and added to the search
      */

src/securedht.cpp

@@ -36,8 +36,8 @@ extern "C" {
 
 namespace dht {
 
-SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf, IdentityAnnouncedCb iacb, const std::shared_ptr<Logger>& l)
-: DhtInterface(l), dht_(std::move(dht)), key_(conf.id.first), certificate_(conf.id.second), enableCache_(conf.cert_cache_all)
+SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf)
+: dht_(std::move(dht)), key_(conf.id.first), certificate_(conf.id.second), enableCache_(conf.cert_cache_all)
 {
     if (!dht_) return;
     for (const auto& type : DEFAULT_TYPES)
@@ -52,17 +52,16 @@ SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht, SecureDht::Config conf,
         auto certId = certificate_->getId();
         if (key_ and certId != key_->getPublicKey().getId())
             throw DhtException("SecureDht: provided certificate doesn't match private key.");
-        dht_->addOnConnectedCallback([this, certId, cb=std::move(iacb)]{
-            dht_->put(certId, Value {
-                CERTIFICATE_TYPE,
-                *certificate_,
-                1
-            }, [this, certId, cb=std::move(cb)](bool ok) {
-                if (cb) cb(ok);
+
+        dht_->put(certId, Value {
+            CERTIFICATE_TYPE,
+            *certificate_,
+            1
+        }, [this, certId](bool ok) {
+            if (ok)
                 if (logger_)
-                    logger_->d(certId, "SecureDht: certificate announcement %s", ok ? "succeeded" : "failed");
-            }, {}, true);
-        });
+                    logger_->d(certId, "SecureDht: public key announced successfully");
+        }, {}, true);
     }
 }
 

src/value.cpp

@@ -76,7 +76,10 @@ std::ostream& operator<< (std::ostream& s, const Value& v)
                 s.write((const char*)v.data.data(), v.data.size());
                 s << '"';
             } else if (v.data.size() < 1024) {
-                s << toHex(v.data.data(), v.data.size());
+                s << std::hex;
+                for (auto i : v.data)
+                    s << std::setfill('0') << std::setw(2) << (unsigned)i;
+                s << std::dec;
             } else {
                 s << v.data.size() << " bytes";
             }
@@ -496,10 +499,10 @@ Query::msgpack_unpack(const msgpack::object& o)
 }
 
 template <typename T>
-bool subset(const std::vector<T>& fds, const std::vector<T>& qfds)
+bool subset(std::vector<T> fds, std::vector<T> qfds)
 {
-    for (const auto& fd : fds) {
-        if (std::find_if(qfds.begin(), qfds.end(), [&fd](const T& _vfd) { return fd == _vfd; }) == qfds.end())
+    for (auto& fd : fds) {
+        if (std::find_if(qfds.begin(), qfds.end(), [&fd](T& _vfd) { return fd == _vfd; }) == qfds.end())
             return false;
     }
     return true;

src/value_cache.h

@@ -142,10 +142,6 @@ public:
         }
     }
 
-    size_t size() const {
-        return values.size();
-    }
-
 private:
     // prevent copy
     ValueCache(const ValueCache&) = delete;
@@ -196,10 +192,11 @@ private:
         auto v = values.find(vid);
         if (v == values.end())
             return {};
-        std::vector<Sp<Value>> val {std::move(v->second.data)};
+        const std::vector<Sp<Value>> val {std::move(v->second.data)};
         values.erase(v);
+        auto cb = callback;
         CallbackQueue ret;
-        ret.emplace_back([cb = callback, val = std::move(val)]{
+        ret.emplace_back([cb, val]{
             if (cb) cb(val, true);
         });
         return ret;

tests/cryptotester.cpp

@@ -44,10 +44,6 @@ CryptoTester::testSignatureEncryption() {
     // check signature
     CPPUNIT_ASSERT(public_key.checkSignature(data1, signature1));
     CPPUNIT_ASSERT(public_key.checkSignature(data2, signature2));
-    signature1[7]++;
-    signature2[8]--;
-    CPPUNIT_ASSERT(!public_key.checkSignature(data1, signature1));
-    CPPUNIT_ASSERT(!public_key.checkSignature(data2, signature2));
 
     // encrypt data
     {
@@ -165,14 +161,6 @@ void CryptoTester::testCertificateSerialNumber()
     CPPUNIT_ASSERT(std::equal(SERIAL.begin(), SERIAL.end(), serial.begin(), serial.end()));
 }
 
-void CryptoTester::testOcsp() {
-    auto ca = dht::crypto::generateIdentity("Test CA");
-    auto device = dht::crypto::generateIdentity("Test Device", ca);
-    auto ocspRequest = device.second->generateOcspRequest(ca.second->cert);
-    auto req = dht::crypto::OcspRequest((const uint8_t*)ocspRequest.first.data(), ocspRequest.first.size());
-    CPPUNIT_ASSERT(ocspRequest.second == req.getNonce());
-}
-
 void
 CryptoTester::tearDown() {
 

tests/cryptotester.h

@@ -32,7 +32,6 @@ class CryptoTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testCertificateRevocation);
     CPPUNIT_TEST(testCertificateRequest);
     CPPUNIT_TEST(testCertificateSerialNumber);
-    CPPUNIT_TEST(testOcsp);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -60,10 +59,6 @@ class CryptoTester : public CppUnit::TestFixture {
      * Test certificate serial number extraction
      */
     void testCertificateSerialNumber();
-    /**
-     * Test OCSP
-     */
-    void testOcsp();
 };
 
 }  // namespace test

tests/dhtproxytester.cpp

@@ -46,15 +46,15 @@ DhtProxyTester::setUp() {
     auto serverCAIdentity = dht::crypto::generateEcIdentity("DHT Node CA");
 
     dht::ProxyServerConfig serverConfig;
-    //serverConfig.identity = dht::crypto::generateIdentity("DHT Node", serverCAIdentity);
+    serverConfig.identity = dht::crypto::generateIdentity("DHT Node", serverCAIdentity);
     serverConfig.port = 8080;
-    // serverConfig.pushServer = "127.0.0.1:8090";
+    serverConfig.pushServer = "127.0.0.1:8090";
     serverProxy = std::make_unique<dht::DhtProxyServer>(nodeProxy, serverConfig);
 
-    /*clientConfig.server_ca = serverCAIdentity.second;
+    clientConfig.server_ca = serverCAIdentity.second;
     clientConfig.client_identity = dht::crypto::generateIdentity("DhtProxyTester");
-    clientConfig.push_node_id = "dhtnode";*/
-    clientConfig.proxy_server = "http://127.0.0.1:8080";//"https://127.0.0.1:8080";
+    clientConfig.push_node_id = "dhtnode";
+    clientConfig.proxy_server = "https://127.0.0.1:8080";
 }
 
 void
@@ -71,7 +71,7 @@ DhtProxyTester::tearDown() {
         cv.notify_all();
     });
     std::unique_lock<std::mutex> lk(cv_m);
-    CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&]{ return done; }));
+    CPPUNIT_ASSERT(cv.wait_for(lk, 5s, [&]{ return done; }));
     serverProxy.reset();
     nodeProxy.reset();
 }
@@ -289,47 +289,4 @@ DhtProxyTester::testFuzzy()
         CPPUNIT_ASSERT(value->data == mtu);
 }
 
-void
-DhtProxyTester::testShutdownStop()
-{
-    constexpr size_t N = 40000;
-    constexpr unsigned C = 100;
-
-    // Arrange
-    auto key = dht::InfoHash::get("testShutdownStop");
-    std::vector<std::shared_ptr<dht::Value>> values;
-    std::vector<uint8_t> mtu;
-    mtu.reserve(N);
-    for (size_t i = 0; i < N; i++)
-        mtu.emplace_back((i % 2) ? 'T' : 'M');
-
-    std::atomic_uint callback_count {0};
-
-    // Act
-    for (size_t i = 0; i < C; i++) {
-        auto nodeTest = std::make_shared<dht::DhtRunner>();
-        nodeTest->run(0, clientConfig);
-        nodeTest->put(key, dht::Value(mtu), [&](bool ok) {
-            callback_count++;
-        });
-        nodeTest->get(key, [&](const std::vector<std::shared_ptr<dht::Value>>& vals){
-            values.insert(values.end(), vals.begin(), vals.end());
-            return true;
-        },[&](bool ok){
-            callback_count++;
-        });
-        bool done = false;
-        std::condition_variable cv;
-        std::mutex cv_m;
-        nodeTest->shutdown([&]{
-            std::lock_guard<std::mutex> lk(cv_m);
-            done = true;
-            cv.notify_all();
-        }, true);
-        std::unique_lock<std::mutex> lk(cv_m);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&]{ return done; }));
-    }
-    CPPUNIT_ASSERT_EQUAL(2*C, callback_count.load());
-}
-
 }  // namespace test

tests/dhtproxytester.h

@@ -36,7 +36,6 @@ class DhtProxyTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testResubscribeGetValues);
     CPPUNIT_TEST(testPutGet40KChars);
     CPPUNIT_TEST(testFuzzy);
-    CPPUNIT_TEST(testShutdownStop);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -69,8 +68,6 @@ class DhtProxyTester : public CppUnit::TestFixture {
 
    void testFuzzy();
 
-   void testShutdownStop();
-
  private:
     dht::DhtRunner::Config clientConfig {};
     dht::DhtRunner nodePeer;

tests/dhtrunnertester.cpp

@@ -23,7 +23,6 @@
 #include <mutex>
 #include <condition_variable>
 using namespace std::chrono_literals;
-using namespace std::literals;
 
 namespace test {
 CPPUNIT_TEST_SUITE_REGISTRATION(DhtRunnerTester);
@@ -61,12 +60,6 @@ void
 DhtRunnerTester::testConstructors() {
     CPPUNIT_ASSERT(node1.getBoundPort() == 42222);
     CPPUNIT_ASSERT(node2.getBoundPort() == 42232);
-
-    dht::DhtRunner::Config config {};
-    dht::DhtRunner::Context context {};
-    dht::DhtRunner testNode;
-    testNode.run(config, std::move(context));
-    CPPUNIT_ASSERT(testNode.getBoundPort());
 }
 
 void
@@ -174,76 +167,6 @@ DhtRunnerTester::testListen() {
     node1.cancelListen(d, tokend);
 }
 
-void
-DhtRunnerTester::testIdOps() {
-    std::mutex mutex;
-    std::condition_variable cv;
-    unsigned valueCount(0);
-
-    dht::DhtRunner::Config config2;
-    config2.dht_config.node_config.max_peer_req_per_sec = -1;
-    config2.dht_config.node_config.max_req_per_sec = -1;
-    config2.dht_config.id = dht::crypto::generateIdentity();
-
-    dht::DhtRunner::Context context2;
-    context2.identityAnnouncedCb = [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    };
-
-    node2.join();
-    node2.run(42232, config2, std::move(context2));
-    node2.bootstrap(node1.getBound());
-
-    node1.findCertificate(node2.getId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt){
-        CPPUNIT_ASSERT(crt);
-        std::lock_guard<std::mutex> lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    {
-        std::unique_lock<std::mutex> lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&]{ return valueCount == 2; }));
-    }
-
-    dht::DhtRunner::Context context1;
-    context1.identityAnnouncedCb = [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    };
-
-    config2.dht_config.id = dht::crypto::generateIdentity();
-    node1.join();
-    node1.run(42222, config2, std::move(context1));
-    node1.bootstrap(node2.getBound());
-
-    auto key = dht::InfoHash::get("key");
-    node1.putEncrypted(key, node2.getId(), dht::Value("yo"), [&](bool ok){
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    node2.listen<std::string>(key, [&](std::string&& value){
-        CPPUNIT_ASSERT_EQUAL("yo"s, value);
-        std::lock_guard<std::mutex> lk(mutex);
-        valueCount++;
-        cv.notify_all();
-        return false;
-    });
-
-    {
-        std::unique_lock<std::mutex> lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&]{ return valueCount == 4; }));
-    }
-}
-
 void
 DhtRunnerTester::testListenLotOfBytes() {
     std::mutex mutex;

tests/dhtrunnertester.h

@@ -33,7 +33,6 @@ class DhtRunnerTester : public CppUnit::TestFixture {
     CPPUNIT_TEST(testGetPut);
     CPPUNIT_TEST(testListen);
     CPPUNIT_TEST(testListenLotOfBytes);
-    CPPUNIT_TEST(testIdOps);
     CPPUNIT_TEST_SUITE_END();
 
     dht::DhtRunner node1 {};
@@ -59,10 +58,6 @@ class DhtRunnerTester : public CppUnit::TestFixture {
      * Test listen method
      */
     void testListen();
-    /**
-     * Test methods requiring a node identity
-     */
-    void testIdOps();
     /**
      * Test listen method with lot of datas
      */

tests/infohashtester.cpp

@@ -73,7 +73,7 @@ InfoHashTester::testConstructors() {
 }
 
 void
-InfoHashTester::testComparators() {
+InfoHashTester::testComperators() {
     auto nullHash = dht::InfoHash();
     auto minHash = dht::InfoHash("0000000000000000000000000000000000111110");
     auto maxHash = dht::InfoHash("0111110000000000000000000000000000000000");
@@ -136,14 +136,6 @@ InfoHashTester::testXorCmp() {
     CPPUNIT_ASSERT_EQUAL(maxHash.xorCmp(minHash, nullHash), 1);
 }
 
-void
-InfoHashTester::testHex() {
-    const std::string TEST_HASH_STR("01b20304d5060708090a010203e05060708090ae");
-    dht::InfoHash TEST_HASH(TEST_HASH_STR);
-    CPPUNIT_ASSERT_EQUAL(TEST_HASH_STR, TEST_HASH.toString());
-    CPPUNIT_ASSERT_EQUAL(TEST_HASH_STR, dht::toHex(TEST_HASH.data(), TEST_HASH.size()));
-}
-
 void
 InfoHashTester::tearDown() {
 

tests/infohashtester.h

@@ -28,11 +28,10 @@ namespace test {
 class InfoHashTester : public CppUnit::TestFixture {
     CPPUNIT_TEST_SUITE(InfoHashTester);
     CPPUNIT_TEST(testConstructors);
-    CPPUNIT_TEST(testComparators);
+    CPPUNIT_TEST(testComperators);
     CPPUNIT_TEST(testLowBit);
     CPPUNIT_TEST(testCommonBits);
     CPPUNIT_TEST(testXorCmp);
-    CPPUNIT_TEST(testHex);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -51,7 +50,7 @@ class InfoHashTester : public CppUnit::TestFixture {
     /**
      * Test compare operators
      */
-    void testComparators();
+    void testComperators();
     /**
      * Test lowbit method
      */
@@ -65,10 +64,6 @@ class InfoHashTester : public CppUnit::TestFixture {
      */
     void testXorCmp();
 
-    /**
-     * Test hex conversion
-     */
-    void testHex();
 };
 
 }  // namespace test

tests/threadpooltester.cpp

@@ -59,7 +59,7 @@ ThreadPoolTester::testExecutor()
     auto executor8 = std::make_shared<dht::Executor>(pool, 8);
 
     constexpr unsigned N = 64 * 1024;
-    unsigned count1 {0};
+    std::atomic_uint count1 {0};
     std::atomic_uint count4 {0};
     std::atomic_uint count8 {0};
     for (unsigned i=0; i<N; i++) {
@@ -69,7 +69,7 @@ ThreadPoolTester::testExecutor()
     }
 
     auto start = clock::now();
-    while ((count1 != N ||
+    while ((count1.load() != N ||
             count4.load() != N ||
             count8.load() != N) && clock::now() - start < std::chrono::seconds(20))
     {
@@ -78,28 +78,11 @@ ThreadPoolTester::testExecutor()
     executor1.reset();
     executor4.reset();
     executor8.reset();
-    CPPUNIT_ASSERT_EQUAL(N, count1);
+    CPPUNIT_ASSERT_EQUAL(N, count1.load());
     CPPUNIT_ASSERT_EQUAL(N, count4.load());
     CPPUNIT_ASSERT_EQUAL(N, count8.load());
 }
 
-void
-ThreadPoolTester::testContext()
-{
-    std::atomic_uint count {0};
-    constexpr unsigned N = 64 * 1024;
-
-    {
-        dht::ExecutionContext ctx(dht::ThreadPool::computation());
-        for (unsigned i=0; i<N; i++) {
-            ctx.run([&] { count++; });
-        }
-    }
-
-    CPPUNIT_ASSERT_EQUAL(N, count.load());
-
-}
-
 void
 ThreadPoolTester::tearDown() {
 }

tests/threadpooltester.h

@@ -29,7 +29,6 @@ class ThreadPoolTester : public CppUnit::TestFixture {
     CPPUNIT_TEST_SUITE(ThreadPoolTester);
     CPPUNIT_TEST(testThreadPool);
     CPPUNIT_TEST(testExecutor);
-    CPPUNIT_TEST(testContext);
     CPPUNIT_TEST_SUITE_END();
 
  public:
@@ -44,7 +43,6 @@ class ThreadPoolTester : public CppUnit::TestFixture {
 
     void testThreadPool();
     void testExecutor();
-    void testContext();
 };
 
 }  // namespace test

tools/CMakeLists.txt

@@ -39,14 +39,8 @@ endif ()
 install (TARGETS dhtnode dhtscanner dhtchat RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 
 if (OPENDHT_SYSTEMD)
-    if (NOT DEFINED OPENDHT_SYSTEMD_UNIT_FILE_LOCATION)
-        execute_process(COMMAND ${PKG_CONFIG_EXECUTABLE} systemd --variable=systemdsystemunitdir
-                        OUTPUT_VARIABLE SYSTEMD_UNIT_INSTALL_DIR)
-        message("-- Using Systemd unit installation directory by pkg-config: " ${SYSTEMD_UNIT_INSTALL_DIR})
-    else()
-        message("-- Using Systemd unit installation directory requested: " ${OPENDHT_SYSTEMD_UNIT_FILE_LOCATION})
-        set(SYSTEMD_UNIT_INSTALL_DIR ${OPENDHT_SYSTEMD_UNIT_FILE_LOCATION})
-    endif()
+    execute_process(COMMAND ${PKG_CONFIG_EXECUTABLE} systemd --variable=systemdsystemunitdir
+                    OUTPUT_VARIABLE SYSTEMD_UNIT_INSTALL_DIR)
     string(REGEX REPLACE "[ \t\n]+" "" SYSTEMD_UNIT_INSTALL_DIR "${SYSTEMD_UNIT_INSTALL_DIR}")
     set (systemdunitdir "${SYSTEMD_UNIT_INSTALL_DIR}")
 

tools/systemd/dhtnode.service.in

@@ -1,44 +1,14 @@
 [Unit]
 Description=OpenDHT standalone node
-Documentation=man:dhtnode(1)
 After=network.target
 
 [Service]
-Type=simple
-User=opendht
-Group=opendht
-ExecStart=@bindir@/dhtnode -s $DHT_ARGS
-Restart=on-failure
-RestartSec=2s
-LimitNOFILE=65536
-DynamicUser=yes
 EnvironmentFile=@sysconfdir@/dhtnode.conf
+ExecStart=@bindir@/dhtnode -s $DHT_ARGS
 KillMode=process
-WorkingDirectory=/tmp
-
-# Hardening
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-LockPersonality=yes
-NoNewPrivileges=yes
-PrivateDevices=yes
-PrivateTmp=yes
-PrivateUsers=yes
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectSystem=strict
-ReadOnlyDirectories=/
-ReadWriteDirectories=-/proc/self
-ReadWriteDirectories=-/var/run
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-RestrictNamespaces=yes
-RestrictRealtime=yes
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
+Restart=on-failure
+Type=simple
+DynamicUser=yes
 
 [Install]
 WantedBy=multi-user.target