update to version 2.1.7

Tested on Debian Sid

CMakeLists.txt

@@ -2,10 +2,11 @@ cmake_minimum_required (VERSION 3.1)
 include(CMakePackageConfigHelpers)
 include(CMakeDependentOption)
 include(FindPkgConfig)
+include(cmake/CheckAtomic.cmake)
 
 project (opendht)
 set (opendht_VERSION_MAJOR 2)
-set (opendht_VERSION_MINOR 1.6)
+set (opendht_VERSION_MINOR 1.7)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -82,8 +83,8 @@ if (NOT MSVC)
             # https://cmake.org/cmake/help/latest/module/FindOpenSSL.html
             pkg_search_module(OPENSSL REQUIRED openssl)
             if (OPENSSL_FOUND)
-                message(STATUS "Found OpenSSL ${OPENSSL_VERSION}")
-                include_directories(${OPENSSL_INCLUDE_DIRS})
+                message(STATUS "Found OpenSSL ${OPENSSL_VERSION} ${OPENSSL_INCLUDE_DIRS}")
+                include_directories(SYSTEM ${OPENSSL_INCLUDE_DIRS})
                 link_directories (${OPENSSL_LIBRARY_DIRS})
             else ()
                 message(SEND_ERROR "OpenSSL is required for DHT proxy as specified")

cmake/CheckAtomic.cmake

@@ -0,0 +1,93 @@
+# University of Illinois/NCSA
+# Open Source License
+#
+# Copyright (c) 2003-2017 University of Illinois at Urbana-Champaign.
+# All rights reserved.
+#
+# Developed by:
+#
+#     LLVM Team
+#
+#     University of Illinois at Urbana-Champaign
+#
+#     http://llvm.org
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal with
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+#
+#     * Redistributions of source code must retain the above copyright notice,
+#       this list of conditions and the following disclaimers.
+#
+#     * Redistributions in binary form must reproduce the above copyright notice,
+#       this list of conditions and the following disclaimers in the
+#       documentation and/or other materials provided with the distribution.
+#
+#     * Neither the names of the LLVM Team, University of Illinois at
+#       Urbana-Champaign, nor the names of its contributors may be used to
+#       endorse or promote products derived from this Software without specific
+#       prior written permission.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
+# SOFTWARE.
+
+include(CheckCXXSourceCompiles)
+
+# Sometimes linking against libatomic is required for atomic ops, if
+# the platform doesn't support lock-free atomics.
+
+function(check_working_cxx_atomics varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  get_directory_property(compile_options COMPILE_OPTIONS)
+  set(CMAKE_REQUIRED_FLAGS ${compile_options})
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+int main() {
+  struct Test { int val; };
+  std::atomic<Test> s;
+  s.is_lock_free();
+}" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics)
+
+
+if(NOT DEFINED PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
+  if(CMAKE_COMPILER_IS_GNUCXX)
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif(MSVC)
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE OFF)
+  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Intel")
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  endif()
+endif()
+
+# This isn't necessary on MSVC, so avoid command-line switch annoyance
+# by only running on GCC-like hosts.
+if(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
+  # First check if atomics work without the library.
+  check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITHOUT_LIB)
+  # If not, check if the library exists, and atomics work with it.
+  if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB)
+    check_library_exists(atomic __atomic_fetch_add_4 "" HAVE_LIBATOMIC)
+    if(HAVE_LIBATOMIC)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+      check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITH_LIB)
+      if (NOT HAVE_CXX_ATOMICS_WITH_LIB)
+	message(FATAL_ERROR "Host compiler must support std::atomic!")
+      endif()
+      list(APPEND CMAKE_CXX_STANDARD_LIBRARIES -latomic)
+    else()
+      message(FATAL_ERROR "Host compiler appears to require libatomic, but cannot find it.")
+    endif()
+  endif()
+endif()

configure.ac

@@ -1,7 +1,7 @@
 dnl define macros
 m4_define([opendht_major_version], 2)
 m4_define([opendht_minor_version], 1)
-m4_define([opendht_patch_version], 6)
+m4_define([opendht_patch_version], 7)
 m4_define([opendht_version],
 		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
 

src/compat/os_cert.cpp

@@ -32,7 +32,7 @@
 #include <Security/Security.h>
 #endif /*__APPLE__*/
 
-#ifdef _WIN32
+#if !defined (LIBRESSL_VERSION_NUMBER) || (LIBRESSL_VERSION_NUMBER < 0x20501000L)
 #undef X509_NAME
 #undef OCSP_REQUEST
 #undef OCSP_RESPONSE
@@ -133,22 +133,14 @@ ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode)
 
     return (type);
 }
-#endif /*_WIN32*/
+#endif /*LIBRESSL*/
 
 namespace dht {
 namespace http {
 
-void
-addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
+PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
+ : logger(l)
 {
-    X509_STORE* store = SSL_CTX_get_cert_store(ctx);
-    if (store == nullptr) {
-        if (logger)
-            logger->e("couldn't get the context cert store");
-        return;
-    }
-
-    X509* x509cert;
 #ifdef _WIN32
     PCCERT_CONTEXT pContext = NULL;
     HCERTSTORE hSystemStore;
@@ -159,16 +151,10 @@ addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
         return;
     }
     while (pContext = CertEnumCertificatesInStore(hSystemStore, pContext)) {
-        x509cert = nullptr;
         const uint8_t* encoded_cert = pContext->pbCertEncoded;
-        x509cert = d2i_X509(nullptr, &encoded_cert, pContext->cbCertEncoded);
-        if (x509cert) {
-            if (X509_STORE_add_cert(store, x509cert) == 1) {
-                if (logger)
-                    logger->d("local certificate added");
-            }
-            X509_free(x509cert);
-        }
+        X509Ptr x509cert(d2i_X509(nullptr, &encoded_cert, pContext->cbCertEncoded), &X509_free);
+        if (x509cert)
+            pems_.emplace_back(std::move(x509cert));
     }
     CertCloseStore(hSystemStore, 0);
 #elif __APPLE__
@@ -179,7 +165,7 @@ addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
         if (logger) {
             CFStringRef statusString = SecCopyErrorMessageString(osStatus, NULL);
             logger->d("Error enumerating certificates: %s",
-                      CFStringGetCStringPtr(statusString, kCFStringEncodingASCII));
+                    CFStringGetCStringPtr(statusString, kCFStringEncodingASCII));
             CFRelease(statusString);
         }
         if (result != NULL) {
@@ -189,7 +175,6 @@ addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
     }
     CFDataRef rawData = NULL;
     for (CFIndex i = 0; i < CFArrayGetCount(result); i++) {
-        x509cert = nullptr;
         SecCertificateRef cert = (SecCertificateRef) CFArrayGetValueAtIndex(result, i);
         rawData = SecCertificateCopyData(cert);
         if (!rawData) {
@@ -198,14 +183,9 @@ addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
             break;
         }
         const uint8_t* rawDataPtr = CFDataGetBytePtr(rawData);
-        x509cert = d2i_X509(nullptr, &rawDataPtr, CFDataGetLength(rawData));
-        if (x509cert) {
-            if (X509_STORE_add_cert(store, x509cert) == 1) {
-                if (logger)
-                    logger->d("local certificate added");
-            }
-            X509_free(x509cert);
-        }
+        X509Ptr x509cert(d2i_X509(nullptr, &rawDataPtr, CFDataGetLength(rawData)), &X509_free);
+        if (x509cert)
+            pems_.emplace_back(std::move(x509cert));
         CFRelease(rawData);
         rawData = NULL;
     }
@@ -218,5 +198,24 @@ addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger)
 #endif /*__APPLE__, _WIN32*/
 }
 
+void
+PEMCache::fillX509Store(SSL_CTX* ctx)
+{
+    if (logger)
+        logger->w("adding %d decoded certs to X509 store", pems_.size());
+    X509_STORE* store = SSL_CTX_get_cert_store(ctx);
+    if (store == nullptr) {
+        if (logger)
+            logger->e("couldn't get the context cert store");
+        return;
+    }
+    for (const auto& pem : pems_) {
+        if (X509_STORE_add_cert(store, pem.get()) == 1)
+            continue;
+        if (logger)
+            logger->d("couldn't add local certificate");
+    }
+}
+
 } /*namespace http*/
 } /*namespace dht*/

src/compat/os_cert.h

@@ -25,6 +25,7 @@
 #include <openssl/x509.h>
 
 #ifdef _WIN32
+#include <crypto/x509.h> // to expose x509_store_ctx_st
 #define V_ASN1_UTCTIME         23
 #define V_ASN1_GENERALIZEDTIME 24
 #define timegm                 _mkgmtime
@@ -33,6 +34,26 @@ int ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode);
 
 namespace dht {
 namespace http {
-void addSystemCaCertificates(SSL_CTX* ctx, const std::shared_ptr<Logger>& logger);
+
+// A singleton class used to cache the decoded certificates
+// loaded from local cert stores that need to be added to the
+// ssl context prior to each request.
+class PEMCache
+{
+    PEMCache(const std::shared_ptr<Logger>& l);
+
+    using X509Ptr = std::unique_ptr<X509, void(*)(X509*)>;
+    std::vector<X509Ptr> pems_;
+    std::shared_ptr<Logger> logger;
+
+public:
+    static PEMCache& instance(const std::shared_ptr<Logger>& l)
+    {
+        static PEMCache instance_(l);
+        return instance_;
+    }
+
+    void fillX509Store(SSL_CTX* ctx);
+};
 }
 } // namespace dht

src/http.cpp

@@ -99,19 +99,41 @@ Url::toString() const
 
 std::atomic_uint Connection::ids_ {1};
 
+std::shared_ptr<asio::ssl::context>
+newTlsClientContext(const std::shared_ptr<dht::Logger>& logger)
+{
+    auto ctx = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+    ctx->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
+
+    if (char* path = getenv("CA_ROOT_FILE")) {
+        if (logger)
+            logger->d("Using CA file: %s", path);
+        ctx->load_verify_file(path);
+    } else if (char* path = getenv("CA_ROOT_PATH")) {
+        if (logger)
+            logger->d("Using CA path: %s", path);
+        ctx->add_verify_path(path);
+    } else {
+#ifdef __ANDROID__
+        if (logger)
+            logger->d("Using CA path: /system/etc/security/cacerts");
+        ctx->add_verify_path("/system/etc/security/cacerts");
+#elif defined(WIN32) || defined(__APPLE__)
+        PEMCache::instance(logger).fillX509Store(ctx->native_handle());
+#else
+        if (logger)
+            logger->d("Using default CA path");
+        ctx->set_default_verify_paths();
+#endif
+    }
+    return ctx;
+}
+
 Connection::Connection(asio::io_context& ctx, const bool ssl, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
     if (ssl) {
-        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
-#ifdef __ANDROID__
-        ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
-#elif defined(WIN32) || defined(__APPLE__)
-        addSystemCaCertificates(ssl_ctx_->native_handle(), l);
-#else
-        ssl_ctx_->set_default_verify_paths();
-#endif
+        ssl_ctx_ = newTlsClientContext(l);
         ssl_socket_ = std::make_unique<ssl_socket_t>(ctx_, ssl_ctx_);
         if (logger_)
             logger_->d("[connection:%i] start https session", id_);
@@ -127,23 +149,18 @@ Connection::Connection(asio::io_context& ctx, std::shared_ptr<dht::crypto::Certi
                        const dht::crypto::Identity& identity, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
-    ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-    ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
-#ifdef __ANDROID__
-    ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
-#elif WIN32
-    addSystemCaCertificates(ssl_ctx_->native_handle(), l);
-#else
-    ssl_ctx_->set_default_verify_paths();
-#endif
     asio::error_code ec;
-    if (server_ca){
+    if (server_ca) {
+        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
         auto ca = server_ca->toString(false/*chain*/);
         ssl_ctx_->add_certificate_authority(asio::const_buffer{ca.data(), ca.size()}, ec);
         if (ec)
             throw std::runtime_error("Error adding certificate authority: " + ec.message());
         else if (logger_)
             logger_->d("[connection:%i] certficate authority %s", id_, server_ca->getUID().c_str());
+    } else {
+        ssl_ctx_ = newTlsClientContext(l);
     }
     if (identity.first){
         auto key = identity.first->serialize();
@@ -237,7 +254,7 @@ issuer_from_chain(STACK_OF(X509)* fullchain)
 using OscpRequestPtr = std::unique_ptr<OCSP_REQUEST, decltype(&OCSP_REQUEST_free)>;
 struct OscpRequestInfo {
     OscpRequestPtr req {nullptr, &OCSP_REQUEST_free};
-    std::vector<uint8_t> data;
+    std::string data;
     std::string url;
 };
 
@@ -307,7 +324,7 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
             logger->e("Unable to allocte memory");
         return {};
     }
-    request->data = std::vector<uint8_t>(data, data+size);
+    request->data = std::string((char*)data, (char*)data+size);
     free(data);
     return request;
 }
@@ -486,7 +503,8 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                                 }
                             }, logger);
                             ocspReq->set_method(restinio::http_method_post());
-                            ocspReq->set_body({ocspInfo->data.begin(), ocspInfo->data.end()});
+                            ocspReq->set_header_field(restinio::http_field_t::content_type, "application/ocsp-request");
+                            ocspReq->set_body(ocspInfo->data);
                             ocspReq->send();
                             io_ctx.run();
                             if (not ocspVerified)

src/op_cache.h

@@ -39,8 +39,10 @@ public:
     }
 
     static ValueCallback cacheCallback(ValueCallback&& cb, std::function<void()>&& onCancel) {
-        auto cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb));
-        return [cache, onCancel](const std::vector<Sp<Value>>& vals, bool expired){
+        return [
+            cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb)),
+            onCancel = std::move(onCancel)
+        ](const std::vector<Sp<Value>>& vals, bool expired){
             auto ret = cache->onValue(vals, expired);
             if (not ret)
                 onCancel();
@@ -49,10 +51,9 @@ public:
     }
 
     bool onValue(const std::vector<Sp<Value>>& vals, bool expired, const system_clock::time_point& t = system_clock::time_point::min()) {
-        if (expired)
-            return onValuesExpired(vals, t);
-        else
-            return onValuesAdded(vals, t);
+        return expired 
+            ? onValuesExpired(vals, t) 
+            : onValuesAdded(vals, t);
     }
 
     bool onValuesAdded(const std::vector<Sp<Value>>& vals, const system_clock::time_point& t = system_clock::time_point::min());

src/value_cache.h

@@ -192,11 +192,10 @@ private:
         auto v = values.find(vid);
         if (v == values.end())
             return {};
-        const std::vector<Sp<Value>> val {std::move(v->second.data)};
+        std::vector<Sp<Value>> val {std::move(v->second.data)};
         values.erase(v);
-        auto cb = callback;
         CallbackQueue ret;
-        ret.emplace_back([cb, val]{
+        ret.emplace_back([cb = callback, val = std::move(val)]{
             if (cb) cb(val, true);
         });
         return ret;

tools/systemd/dhtnode.service.in

@@ -1,14 +1,44 @@
 [Unit]
 Description=OpenDHT standalone node
+Documentation=man:dhtnode(1)
 After=network.target
 
 [Service]
-EnvironmentFile=@sysconfdir@/dhtnode.conf
-ExecStart=@bindir@/dhtnode -s $DHT_ARGS
-KillMode=process
-Restart=on-failure
 Type=simple
+User=opendht
+Group=opendht
+ExecStart=@bindir@/dhtnode -s $DHT_ARGS
+Restart=on-failure
+RestartSec=2s
+LimitNOFILE=65536
 DynamicUser=yes
+EnvironmentFile=@sysconfdir@/dhtnode.conf
+KillMode=process
+WorkingDirectory=/tmp
+
+# Hardening
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+LockPersonality=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+ReadOnlyDirectories=/
+ReadWriteDirectories=-/proc/self
+ReadWriteDirectories=-/var/run
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
 
 [Install]
 WantedBy=multi-user.target