update to version 2.1.9

Tested on Debian Sid

CMakeLists.txt

@@ -1,10 +1,13 @@
 cmake_minimum_required (VERSION 3.1)
+project (opendht)
+
 include(CMakePackageConfigHelpers)
 include(CMakeDependentOption)
+include(FindPkgConfig)
+include(cmake/CheckAtomic.cmake)
 
-project (opendht)
 set (opendht_VERSION_MAJOR 2)
-set (opendht_VERSION_MINOR 1.6)
+set (opendht_VERSION_MINOR 1.9)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -36,9 +39,6 @@ option (OPENDHT_C "Build C bindings" OFF)
 find_package(Doxygen)
 option (OPENDHT_DOCUMENTATION "Create and install the HTML based API documentation (requires Doxygen)" ${DOXYGEN_FOUND})
 
-# native windows build
-set (MSVC (CMAKE_CXX_COMPILER_ID MATCHES "MSVC"))
-
 # Dependencies
 list (APPEND CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake")
 if (NOT MSVC)
@@ -71,13 +71,12 @@ if (NOT MSVC)
     endif()
 
     if (OPENDHT_HTTP)
+        find_path(ASIO_INCLUDE_DIR asio.hpp REQUIRED)
         find_package(Restinio REQUIRED)
-        if (Restinio_FOUND)
-            find_library(FMT_LIBRARY fmt)
-            add_library(fmt SHARED IMPORTED)
-            find_library(HTTP_PARSER_LIBRARY http_parser)
-            add_library(http_parser SHARED IMPORTED)
-        endif()
+        find_library(FMT_LIBRARY fmt)
+        add_library(fmt SHARED IMPORTED)
+        find_library(HTTP_PARSER_LIBRARY http_parser)
+        add_library(http_parser SHARED IMPORTED)
         if (NOT Jsoncpp_FOUND)
             message(SEND_ERROR "Jsoncpp is required for DHT proxy support")
         endif()
@@ -85,8 +84,9 @@ if (NOT MSVC)
             # https://cmake.org/cmake/help/latest/module/FindOpenSSL.html
             pkg_search_module(OPENSSL REQUIRED openssl)
             if (OPENSSL_FOUND)
-                message(STATUS "Found OpenSSL ${OPENSSL_VERSION}")
-                include_directories(${OPENSSL_INCLUDE_DIRS})
+                message(STATUS "Found OpenSSL ${OPENSSL_VERSION} ${OPENSSL_INCLUDE_DIRS}")
+                include_directories(SYSTEM ${OPENSSL_INCLUDE_DIRS})
+                link_directories (${OPENSSL_LIBRARY_DIRS})
             else ()
                 message(SEND_ERROR "OpenSSL is required for DHT proxy as specified")
             endif()
@@ -98,10 +98,6 @@ if (NOT MSVC)
         set(OPENDHT_PROXY_OPENSSL OFF)
     endif ()
 else ()
-    add_definitions(-D_WINSOCK_DEPRECATED_NO_WARNINGS
-                    -D_CRT_SECURE_NO_WARNINGS
-                    -DWIN32_LEAN_AND_MEAN)
-    
     set (WIN32_DEP_DIR ${PROJECT_SOURCE_DIR}/../)
     include_directories(${WIN32_DEP_DIR}/../msvc/include) # SMP gnutls
     include_directories(${WIN32_DEP_DIR}/argon2/include)
@@ -132,16 +128,17 @@ set (CMAKE_CXX_STANDARD 14)
 set (CMAKE_CXX_STANDARD_REQUIRED on)
 
 if (NOT MSVC)
-    set(CXX_WARNINGS -Wno-return-type -Wall -Wextra
-                     -Wnon-virtual-dtor
-                     -pedantic-errors
-                     -fvisibility=hidden)
-    set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CXX_WARNINGS}")
+    set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-return-type -Wall -Wextra -Wnon-virtual-dtor -pedantic-errors -fvisibility=hidden")
     if (OPENDHT_SANITIZE)
         set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address -fstack-protector-strong")
     endif ()
 else ()
-    set(DISABLE_MSC_WARNINGS "/wd4101 /wd4244 /wd4267 /wd4273 /wd4804 /wd4834")
+    add_definitions(-D_WINSOCK_DEPRECATED_NO_WARNINGS
+                    -D_CRT_SECURE_NO_WARNINGS
+                    -DWIN32_LEAN_AND_MEAN
+                    -DSTATIC_GETOPT
+                    -DGNUTLS_INTERNAL_BUILD)
+    set(DISABLE_MSC_WARNINGS "/wd4101 /wd4244 /wd4267 /wd4273 /wd4804 /wd4834 /wd4996")
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${DISABLE_MSC_WARNINGS}")
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP")
 endif ()
@@ -175,15 +172,15 @@ endif ()
 if (Nettle_INCLUDE_DIRS)
     include_directories (SYSTEM "${Nettle_INCLUDE_DIRS}")
 endif ()
+if (ASIO_INCLUDE_DIR)
+    include_directories (SYSTEM "${ASIO_INCLUDE_DIR}")
+endif ()
 if (Restinio_INCLUDE_DIR)
     include_directories (SYSTEM "${Restinio_INCLUDE_DIR}")
 endif ()
 if (Jsoncpp_INCLUDE_DIRS)
     include_directories (SYSTEM "${Jsoncpp_INCLUDE_DIRS}")
 endif ()
-if (OpenSSL_INCLUDE_DIR)
-    include_directories (SYSTEM "${OpenSSL_INCLUDE_DIR}")
-endif ()
 link_directories (${Nettle_LIBRARY_DIRS})
 link_directories (${Jsoncpp_LIBRARY_DIRS})
 include_directories (
@@ -305,9 +302,11 @@ if (OPENDHT_HTTP)
   list (APPEND opendht_HEADERS
     include/opendht/proxy.h
     include/opendht/http.h
+    src/compat/os_cert.h
   )
   list (APPEND opendht_SOURCES
     src/http.cpp
+    src/compat/os_cert.cpp
   )
 endif ()
 
@@ -329,9 +328,7 @@ if(OPENDHT_ARGON2)
 endif()
 
 if (MSVC)
-    set (MSC_COMPAT_DIR ${PROJECT_SOURCE_DIR}/compat/msvc/)
-    list (APPEND opendht_HEADERS ${MSC_COMPAT_DIR}/unistd.h)
-    #include_directories(${PROJECT_SOURCE_DIR}/compat/msvc/)
+    list (APPEND opendht_HEADERS src/compat/msvc/unistd.h)
 endif ()
 
 # Targets
@@ -368,17 +365,15 @@ if (OPENDHT_STATIC)
             )
             if (OPENDHT_HTTP)
                 add_obj_lib (win32_fmt ${WIN32_DEP_DIR}/fmt/msvc/Release/fmt.lib)
-                #add_obj_lib (win32_asio ${WIN32_DEP_DIR}/asio/asio/msvc/x64/Release/asio.lib)
                 add_obj_lib (win32_http_parser ${WIN32_DEP_DIR}/http_parser/x64/Release/http-parser.lib)
                 add_obj_lib (win32_ssl ${WIN32_DEP_DIR}/openssl/libssl_static.lib)
                 add_obj_lib (win32_crypto ${WIN32_DEP_DIR}/openssl/libcrypto_static.lib)
                 list (APPEND obj_libs
                     $<TARGET_OBJECTS:win32_fmt>
-                    #$<TARGET_OBJECTS:win32_asio>
                     $<TARGET_OBJECTS:win32_http_parser>
                     $<TARGET_OBJECTS:win32_ssl>
                     $<TARGET_OBJECTS:win32_crypto>
-                )       
+                )
             endif ()
         else ()
             list (APPEND win32_Libs
@@ -389,7 +384,6 @@ if (OPENDHT_STATIC)
             list (APPEND win32_Libs
                 ${PROJECT_SOURCE_DIR}/../fmt/msvc/Release/fmt.lib
                 ${PROJECT_SOURCE_DIR}/../http_parser/x64/Release/http-parser.lib
-                ${PROJECT_SOURCE_DIR}/../asio/asio/msvc/x64/Release/asio.lib
                 ${PROJECT_SOURCE_DIR}/../openssl/libssl.lib
                 ${PROJECT_SOURCE_DIR}/../openssl/libcrypto.lib
             )
@@ -399,7 +393,7 @@ if (OPENDHT_STATIC)
             ${opendht_HEADERS}
             ${obj_libs}
         )
-        target_link_libraries(opendht-static PUBLIC ${Win32_STATIC_LIBRARIES} ${Win32_IMPORT_LIBRARIES})    
+        target_link_libraries(opendht-static PUBLIC ${Win32_STATIC_LIBRARIES} ${Win32_IMPORT_LIBRARIES})
         set(CMAKE_STATIC_LINKER_FLAGS "${CMAKE_STATIC_LINKER_FLAGS} /ignore:4006")
         set_target_properties (opendht-static PROPERTIES OUTPUT_NAME "libopendht")
     endif()
@@ -420,11 +414,20 @@ if (OPENDHT_SHARED)
         target_link_libraries(opendht PRIVATE ${argon2_LIBRARIES})
         target_include_directories(opendht SYSTEM PRIVATE ${argon2_INCLUDE_DIRS})
     endif ()
-    target_link_libraries(opendht
-        PUBLIC ${CMAKE_THREAD_LIBS_INIT} ${OPENSSL_LIBRARIES}
-        PRIVATE ${GNUTLS_LIBRARIES} ${Nettle_LIBRARIES}
-                ${Jsoncpp_LIBRARIES}
-                ${FMT_LIBRARY} ${HTTP_PARSER_LIBRARY})
+    if (APPLE)
+        target_link_libraries(opendht
+            PUBLIC ${CMAKE_THREAD_LIBS_INIT} ${OPENSSL_LIBRARIES}
+            PRIVATE ${GNUTLS_LIBRARIES} ${Nettle_LIBRARIES}
+                    ${Jsoncpp_LIBRARIES}
+                    ${FMT_LIBRARY} ${HTTP_PARSER_LIBRARY}
+            SYSTEM "-framework CoreFoundation" "-framework Security")
+    else ()
+        target_link_libraries(opendht
+            PUBLIC ${CMAKE_THREAD_LIBS_INIT} ${OPENSSL_LIBRARIES}
+            PRIVATE ${GNUTLS_LIBRARIES} ${Nettle_LIBRARIES}
+                    ${Jsoncpp_LIBRARIES}
+                    ${FMT_LIBRARY} ${HTTP_PARSER_LIBRARY})
+    endif ()
 
     install (TARGETS opendht DESTINATION ${CMAKE_INSTALL_LIBDIR} EXPORT opendht)
 endif ()

cmake/CheckAtomic.cmake

@@ -0,0 +1,95 @@
+# University of Illinois/NCSA
+# Open Source License
+#
+# Copyright (c) 2003-2017 University of Illinois at Urbana-Champaign.
+# All rights reserved.
+#
+# Developed by:
+#
+#     LLVM Team
+#
+#     University of Illinois at Urbana-Champaign
+#
+#     http://llvm.org
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal with
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+#
+#     * Redistributions of source code must retain the above copyright notice,
+#       this list of conditions and the following disclaimers.
+#
+#     * Redistributions in binary form must reproduce the above copyright notice,
+#       this list of conditions and the following disclaimers in the
+#       documentation and/or other materials provided with the distribution.
+#
+#     * Neither the names of the LLVM Team, University of Illinois at
+#       Urbana-Champaign, nor the names of its contributors may be used to
+#       endorse or promote products derived from this Software without specific
+#       prior written permission.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
+# SOFTWARE.
+
+include(CheckCXXSourceCompiles)
+include(CheckLibraryExists)
+
+# Sometimes linking against libatomic is required for atomic ops, if
+# the platform doesn't support lock-free atomics.
+
+function(check_working_cxx_atomics varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  get_directory_property(compile_options COMPILE_OPTIONS)
+  set(CMAKE_REQUIRED_FLAGS ${compile_options})
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+#include <cstdint>
+int main() {
+  struct Test { int64_t val; };
+  std::atomic<Test> s;
+  s.is_lock_free();
+}" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics)
+
+
+if(NOT DEFINED PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
+  if(CMAKE_COMPILER_IS_GNUCXX)
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif(MSVC)
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE OFF)
+  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif("${CMAKE_CXX_COMPILER_ID}" MATCHES "Intel")
+    set(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE ON)
+  endif()
+endif()
+
+# This isn't necessary on MSVC, so avoid command-line switch annoyance
+# by only running on GCC-like hosts.
+if(PROXYGEN_COMPILER_IS_GCC_COMPATIBLE)
+  # First check if atomics work without the library.
+  check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITHOUT_LIB)
+  # If not, check if the library exists, and atomics work with it.
+  if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB)
+    check_library_exists(atomic __atomic_fetch_add_4 "" HAVE_LIBATOMIC)
+    if(HAVE_LIBATOMIC)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+      check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITH_LIB)
+      if (NOT HAVE_CXX_ATOMICS_WITH_LIB)
+	message(FATAL_ERROR "Host compiler must support std::atomic!")
+      endif()
+      list(APPEND CMAKE_CXX_STANDARD_LIBRARIES -latomic)
+    else()
+      message(FATAL_ERROR "Host compiler appears to require libatomic, but cannot find it.")
+    endif()
+  endif()
+endif()

configure.ac

@@ -1,7 +1,7 @@
 dnl define macros
 m4_define([opendht_major_version], 2)
 m4_define([opendht_minor_version], 1)
-m4_define([opendht_patch_version], 6)
+m4_define([opendht_patch_version], 9)
 m4_define([opendht_version],
 		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
 

include/opendht/crypto.h

@@ -565,7 +565,7 @@ struct OPENDHT_PUBLIC Certificate {
      * Return GnuTLS error code.
      * https://www.gnutls.org/manual/html_node/Error-codes.html
      */
-    std::pair<Blob,Blob> generateOcspRequest(gnutls_x509_crt_t& issuer);
+    std::pair<std::string, Blob> generateOcspRequest(gnutls_x509_crt_t& issuer);
 
     gnutls_x509_crt_t cert {nullptr};
     std::shared_ptr<Certificate> issuer {};

include/opendht/http.h

@@ -290,6 +290,9 @@ public:
 
     void send();
 
+    /** Send and block for response */
+    const Response& await();
+
     /**
      * User action to cancel the Request and call the completion callbacks.
      */

include/opendht/infohash.h

@@ -354,6 +354,22 @@ private:
 
 OPENDHT_PUBLIC extern const HexMap hex_map;
 
+inline std::string
+toHex(const uint8_t* data, size_t size) {
+    std::string ret('\0', size * 2);
+    for (size_t i=0; i<size; i++) {
+        auto b = ret.data()+i*2;
+        const auto& m = hex_map[data[i]];
+        *((uint16_t*)b) = *((uint16_t*)&m);
+    }
+    return ret;
+}
+
+inline std::string
+toHex(const std::vector<uint8_t>& data) {
+    return toHex(data.data(), data.size());
+}
+
 template <size_t N>
 const char*
 Hash<N>::to_c_str() const

src/Makefile.am

@@ -71,8 +71,8 @@ endif
 
 libopendht_la_SOURCES += base64.h base64.cpp
 if PROXY_CLIENT_OR_SERVER
-libopendht_la_SOURCES += http.cpp
-nobase_include_HEADERS += ../include/opendht/proxy.h ../include/opendht/http.h
+libopendht_la_SOURCES += http.cpp compat/os_cert.cpp
+nobase_include_HEADERS += ../include/opendht/proxy.h ../include/opendht/http.h compat/os_cert.h
 endif
 
 if ENABLE_PEER_DISCOVERY

src/compat/os_cert.cpp

@@ -0,0 +1,208 @@
+/*
+ *  Copyright (C) 2020 Savoir-faire Linux Inc.
+ *  Author: Andreas Traczyk <andreas.traczyk@savoirfairelinux.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "os_cert.h"
+
+#include "log_enable.h"
+
+#ifdef _WIN32
+#include <windows.h>
+#include <wincrypt.h>
+#pragma comment(lib, "crypt32.lib")
+#endif
+#include <openssl/ssl.h>
+
+#ifdef TARGET_OS_OSX
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+#endif /*TARGET_OS_OSX*/
+
+#if EMBEDDED_ASN1_TIME_PARSE
+#undef X509_NAME
+#undef OCSP_REQUEST
+#undef OCSP_RESPONSE
+#define GENTIME_LENGTH 15
+#define UTCTIME_LENGTH 13
+#define ATOI2(ar)      ((ar) += 2, ((ar)[-2] - '0') * 10 + ((ar)[-1] - '0'))
+extern "C" {
+// Taken from libressl/src/crypto/asn1/a_time_tm.c
+int
+ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode)
+{
+    size_t i;
+    int type = 0;
+    struct tm ltm;
+    struct tm* lt;
+    const char* p;
+
+    if (bytes == NULL)
+        return (-1);
+
+    /* Constrain to valid lengths. */
+    if (len != UTCTIME_LENGTH && len != GENTIME_LENGTH)
+        return (-1);
+
+    lt = tm;
+    if (lt == NULL) {
+        memset(&ltm, 0, sizeof(ltm));
+        lt = &ltm;
+    }
+
+    /* Timezone is required and must be GMT (Zulu). */
+    if (bytes[len - 1] != 'Z')
+        return (-1);
+
+    /* Make sure everything else is digits. */
+    for (i = 0; i < len - 1; i++) {
+        if (isdigit((unsigned char) bytes[i]))
+            continue;
+        return (-1);
+    }
+
+    /*
+     * Validate and convert the time
+     */
+    p = bytes;
+    switch (len) {
+    case GENTIME_LENGTH:
+        if (mode == V_ASN1_UTCTIME)
+            return (-1);
+        lt->tm_year = (ATOI2(p) * 100) - 1900; /* cc */
+        type = V_ASN1_GENERALIZEDTIME;
+        /* FALLTHROUGH */
+    case UTCTIME_LENGTH:
+        if (type == 0) {
+            if (mode == V_ASN1_GENERALIZEDTIME)
+                return (-1);
+            type = V_ASN1_UTCTIME;
+        }
+        lt->tm_year += ATOI2(p); /* yy */
+        if (type == V_ASN1_UTCTIME) {
+            if (lt->tm_year < 50)
+                lt->tm_year += 100;
+        }
+        lt->tm_mon = ATOI2(p) - 1; /* mm */
+        if (lt->tm_mon < 0 || lt->tm_mon > 11)
+            return (-1);
+        lt->tm_mday = ATOI2(p); /* dd */
+        if (lt->tm_mday < 1 || lt->tm_mday > 31)
+            return (-1);
+        lt->tm_hour = ATOI2(p); /* HH */
+        if (lt->tm_hour < 0 || lt->tm_hour > 23)
+            return (-1);
+        lt->tm_min = ATOI2(p); /* MM */
+        if (lt->tm_min < 0 || lt->tm_min > 59)
+            return (-1);
+        lt->tm_sec = ATOI2(p); /* SS */
+        /* Leap second 60 is not accepted. Reconsider later? */
+        if (lt->tm_sec < 0 || lt->tm_sec > 59)
+            return (-1);
+        break;
+    default:
+        return (-1);
+    }
+
+    return type;
+}
+}
+#endif /* EMBEDDED_ASN1_TIME_PARSE */
+
+namespace dht {
+namespace http {
+
+PEMCache::PEMCache(const std::shared_ptr<Logger>& l)
+ : logger(l)
+{
+#ifdef _WIN32
+    PCCERT_CONTEXT pContext = NULL;
+    HCERTSTORE hSystemStore;
+    hSystemStore = CertOpenSystemStore(NULL, "ROOT");
+    if (!hSystemStore) {
+        if (logger)
+            logger->e("couldn't open the system cert store");
+        return;
+    }
+    while (pContext = CertEnumCertificatesInStore(hSystemStore, pContext)) {
+        const uint8_t* encoded_cert = pContext->pbCertEncoded;
+        X509Ptr x509cert(d2i_X509(nullptr, &encoded_cert, pContext->cbCertEncoded), &X509_free);
+        if (x509cert)
+            pems_.emplace_back(std::move(x509cert));
+    }
+    CertCloseStore(hSystemStore, 0);
+#elif TARGET_OS_OSX
+    CFArrayRef result = NULL;
+    OSStatus osStatus;
+
+    if ((osStatus = SecTrustCopyAnchorCertificates(&result)) != 0) {
+        if (logger) {
+            CFStringRef statusString = SecCopyErrorMessageString(osStatus, NULL);
+            logger->d("Error enumerating certificates: %s",
+                    CFStringGetCStringPtr(statusString, kCFStringEncodingASCII));
+            CFRelease(statusString);
+        }
+        if (result != NULL) {
+            CFRelease(result);
+        }
+        return;
+    }
+    CFDataRef rawData = NULL;
+    for (CFIndex i = 0; i < CFArrayGetCount(result); i++) {
+        SecCertificateRef cert = (SecCertificateRef) CFArrayGetValueAtIndex(result, i);
+        rawData = SecCertificateCopyData(cert);
+        if (!rawData) {
+            if (logger)
+                logger->e("couldn't copy raw certificate data");
+            break;
+        }
+        const uint8_t* rawDataPtr = CFDataGetBytePtr(rawData);
+        X509Ptr x509cert(d2i_X509(nullptr, &rawDataPtr, CFDataGetLength(rawData)), &X509_free);
+        if (x509cert)
+            pems_.emplace_back(std::move(x509cert));
+        CFRelease(rawData);
+        rawData = NULL;
+    }
+    if (result != NULL) {
+        CFRelease(result);
+    }
+    if (rawData != NULL) {
+        CFRelease(rawData);
+    }
+#endif /*TARGET_OS_OSX, _WIN32*/
+}
+
+void
+PEMCache::fillX509Store(SSL_CTX* ctx)
+{
+    if (logger)
+        logger->w("adding %d decoded certs to X509 store", pems_.size());
+    X509_STORE* store = SSL_CTX_get_cert_store(ctx);
+    if (store == nullptr) {
+        if (logger)
+            logger->e("couldn't get the context cert store");
+        return;
+    }
+    for (const auto& pem : pems_) {
+        if (X509_STORE_add_cert(store, pem.get()) == 1)
+            continue;
+        if (logger)
+            logger->d("couldn't add local certificate");
+    }
+}
+
+} /*namespace http*/
+} /*namespace dht*/

src/compat/os_cert.h

@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2020 Savoir-faire Linux Inc.
+ *  Author: Andreas Traczyk <andreas.traczyk@savoirfairelinux.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "log_enable.h"
+
+#include <memory>
+
+#include <openssl/x509.h>
+
+#if (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER > 0x20501000L))
+#define EMBEDDED_ASN1_TIME_PARSE 0
+#else
+#define EMBEDDED_ASN1_TIME_PARSE 1
+#endif
+
+#if EMBEDDED_ASN1_TIME_PARSE
+#define V_ASN1_UTCTIME         23
+#define V_ASN1_GENERALIZEDTIME 24
+
+extern "C" {
+/*
+ * Parse an RFC 5280 format ASN.1 time string.
+ *
+ * mode must be:
+ * 0 if we expect to parse a time as specified in RFC 5280 for an X509 object.
+ * V_ASN1_UTCTIME if we wish to parse an RFC5280 format UTC time.
+ * V_ASN1_GENERALIZEDTIME if we wish to parse an RFC5280 format Generalized time.
+ *
+ * Returns:
+ * -1 if the string was invalid.
+ * V_ASN1_UTCTIME if the string validated as a UTC time string.
+ * V_ASN1_GENERALIZEDTIME if the string validated as a Generalized time string.
+ *
+ * Fills in *tm with the corresponding time if tm is non NULL.
+ */
+int ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode);
+}
+#endif
+
+namespace dht {
+namespace http {
+
+// A singleton class used to cache the decoded certificates
+// loaded from local cert stores that need to be added to the
+// ssl context prior to each request.
+class PEMCache
+{
+    PEMCache(const std::shared_ptr<Logger>& l);
+
+    using X509Ptr = std::unique_ptr<X509, void(*)(X509*)>;
+    std::vector<X509Ptr> pems_;
+    std::shared_ptr<Logger> logger;
+
+public:
+    static PEMCache& instance(const std::shared_ptr<Logger>& l)
+    {
+        static PEMCache instance_(l);
+        return instance_;
+    }
+
+    void fillX509Store(SSL_CTX* ctx);
+};
+}
+} // namespace dht

src/crypto.cpp

@@ -1034,7 +1034,7 @@ Certificate::getPreferredDigest() const
     return getPublicKey().getPreferredDigest();
 }
 
-std::pair<Blob,Blob>
+std::pair<std::string, Blob>
 Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
 {
     gnutls_ocsp_req_t rreq;
@@ -1055,9 +1055,9 @@ Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
     err = gnutls_ocsp_req_export(req.get(), &rdata);
     if (err != 0)
         throw CryptoException(gnutls_strerror(err));
-    Blob ret(rdata.data, rdata.data + rdata.size);
+    std::string ret((char*)rdata.data, (char*)rdata.data + rdata.size);
     gnutls_free(rdata.data);
-    return std::make_pair<Blob,Blob>(std::move(ret), std::move(noncebuf));
+    return std::make_pair<std::string, Blob>(std::move(ret), std::move(noncebuf));
 }
 
 // PrivateKey
@@ -1162,13 +1162,11 @@ Certificate::generate(const PrivateKey& key, const std::string& name, const Iden
     Certificate ret {cert};
 
     setValidityPeriod(cert, 10 * 365 * 24 * 60 * 60);
-    if (gnutls_x509_crt_set_key(cert, key.x509_key) != GNUTLS_E_SUCCESS) {
-        std::cerr << "Error when setting certificate key" << std::endl;
-        return {};
+    if (int err = gnutls_x509_crt_set_key(cert, key.x509_key)) {
+        throw CryptoException(std::string("Error when setting certificate key ") + gnutls_strerror(err));
     }
-    if (gnutls_x509_crt_set_version(cert, 3) != GNUTLS_E_SUCCESS) {
-        std::cerr << "Error when setting certificate version" << std::endl;
-        return {};
+    if (int err = gnutls_x509_crt_set_version(cert, 3)) {
+        throw CryptoException(std::string("Error when setting certificate version ") + gnutls_strerror(err));
     }
 
     // TODO: compute the subject key using the recommended RFC method
@@ -1193,18 +1191,15 @@ Certificate::generate(const PrivateKey& key, const std::string& name, const Iden
 
     if (ca.first && ca.second) {
         if (not ca.second->isCA()) {
-            // Signing certificate must be CA.
-            return {};
+            throw CryptoException("Signing certificate must be CA");
         }
-        if (gnutls_x509_crt_privkey_sign(cert, ca.second->cert, ca.first->key, pk.getPreferredDigest(), 0) != GNUTLS_E_SUCCESS) {
-            std::cerr << "Error when signing certificate" << std::endl;
-            return {};
+        if (int err = gnutls_x509_crt_privkey_sign(cert, ca.second->cert, ca.first->key, pk.getPreferredDigest(), 0)) {
+            throw CryptoException(std::string("Error when signing certificate ") + gnutls_strerror(err));
         }
         ret.issuer = ca.second;
     } else {
-        if (gnutls_x509_crt_privkey_sign(cert, cert, key.key, pk.getPreferredDigest(), 0) != GNUTLS_E_SUCCESS) {
-            std::cerr << "Error when signing certificate" << std::endl;
-            return {};
+        if (int err = gnutls_x509_crt_privkey_sign(cert, cert, key.key, pk.getPreferredDigest(), 0)) {
+            throw CryptoException(std::string("Error when signing certificate ") + gnutls_strerror(err));
         }
     }
 
@@ -1306,65 +1301,47 @@ OcspResponse::getCertificateStatus() const
 gnutls_ocsp_verify_reason_t
 OcspResponse::verifyDirect(const Certificate& crt, const Blob& nonce)
 {
-    // https://www.gnutls.org/manual/html_node/Error-codes.html
-    int ret = -1;
-    // http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-verify-reason-t
-    unsigned int verify = 0;
-    // http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-cert-status-t
-    unsigned int status = 6; // by default assume GNUTLS_OCSP_RESP_UNAUTHORIZED
+    // Check OCSP response
+    int ret = gnutls_ocsp_resp_get_status(response);
+    if (ret < 0)
+        throw CryptoException(gnutls_strerror(ret));
+    gnutls_ocsp_resp_status_t status = (gnutls_ocsp_resp_status_t)ret;
+    if (status != GNUTLS_OCSP_RESP_SUCCESSFUL)
+        throw CryptoException("OCSP request unsuccessful: " + std::to_string(ret));
 
-#if GNUTLS_VERSION_NUMBER >= 0x030103
-    /*
-     * This function will check whether the OCSP response is about the provided certificate.
-     *     index: Specifies response number to get. Use (0) to get the first one.
-     */
+    // Check whether the OCSP response is about the provided certificate.
     if ((ret = gnutls_ocsp_resp_check_crt(response, 0, crt.cert)) < 0)
-        goto end;
-#endif
-    /*
-     * Verify signature of the Basic OCSP Response against the public key in the issuer certificate.
-     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-resp-verify-direct
-     */
-    ret = gnutls_ocsp_resp_verify_direct(response, crt.issuer->cert /*signer*/, &verify, 0);
+        throw CryptoException(gnutls_strerror(ret));
+
+    // Verify signature of the Basic OCSP response against the public key in the issuer certificate.
+    unsigned int verify = 0;
+    ret = gnutls_ocsp_resp_verify_direct(response, crt.issuer->cert, &verify, 0);
     if (ret < 0)
-        goto end;
-    ret = gnutls_ocsp_resp_check_crt(response, 0 /*index*/, crt.cert);
+        throw CryptoException(gnutls_strerror(ret));
+
+    // Check certificate revocation status
+    unsigned status_ocsp;
+    ret = gnutls_ocsp_resp_get_single(response, 0, NULL, NULL, NULL, NULL, &status_ocsp, NULL, NULL, NULL, NULL);
     if (ret < 0)
-        goto end;
-    /*
-     * This function will return the certificate information of the indx'ed response in the
-     * Basic OCSP Response resp. The information returned corresponds to the OCSP SingleResponse
-     * structure except the final singleExtensions.
-     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-resp-get-single
-     */
-    ret = gnutls_ocsp_resp_get_single(response, 0, NULL, NULL, NULL, NULL, &status, NULL, NULL, NULL, NULL);
-    if (ret < 0)
-        goto end;
+        throw CryptoException(gnutls_strerror(ret));
+    gnutls_ocsp_cert_status_t certStatus = (gnutls_ocsp_cert_status_t)ret;
+    if (certStatus == GNUTLS_OCSP_CERT_REVOKED)
+        throw CryptoException("Certificate was revoked");
+    else if (certStatus != GNUTLS_OCSP_CERT_GOOD)
+        throw CryptoException("Certificate is unknown");
+
+    // Ensure no replay attack has been done
     gnutls_datum_t rnonce;
-    /*
-     * This function will return the Basic OCSP Response nonce extension data.
-     */
     ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
     if (ret < 0)
-        goto end;
-    // Ensure no replay attack has been done
-    if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
-        ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
-        goto end;
-    }
-end:
-    /*
-     * OCSP validation outcome based on interogative aspects
-     */
-    if (ret != GNUTLS_E_SUCCESS)
         throw CryptoException(gnutls_strerror(ret));
-    else if (status != GNUTLS_OCSP_CERT_GOOD)
-        if (status == GNUTLS_OCSP_CERT_REVOKED)
-            throw CryptoException("Certificate was revoked");
-        else
-            throw CryptoException("Certificate is unknown");
-    else
-        return (gnutls_ocsp_verify_reason_t) verify;
+    if (rnonce.size != nonce.size() || memcmp(nonce.data(), rnonce.data, nonce.size()) != 0){
+        gnutls_free(rnonce.data);
+        throw CryptoException(gnutls_strerror(GNUTLS_E_OCSP_RESPONSE_ERROR));
+    }
+    gnutls_free(rnonce.data);
+
+    return (gnutls_ocsp_verify_reason_t) verify;
 }
 
 // RevocationList

src/http.cpp

@@ -20,12 +20,26 @@
 #include "log_enable.h"
 #include "crypto.h"
 #include "base64.h"
+#include "compat/os_cert.h"
 
 #include <asio.hpp>
 #include <restinio/impl/tls_socket.hpp>
 #include <http_parser.h>
 #include <json/json.h>
 
+#include <openssl/ocsp.h>
+#include <openssl/ssl.h>
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+
+#define MAXAGE_SEC (14*24*60*60)
+#define JITTER_SEC (60)
+#define OCSP_MAX_RESPONSE_SIZE (20480)
+#ifdef _WIN32
+#define timegm                 _mkgmtime
+#endif
+
 namespace dht {
 namespace http {
 
@@ -89,17 +103,41 @@ Url::toString() const
 
 std::atomic_uint Connection::ids_ {1};
 
+std::shared_ptr<asio::ssl::context>
+newTlsClientContext(const std::shared_ptr<dht::Logger>& logger)
+{
+    auto ctx = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+    ctx->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
+
+    if (char* path = getenv("CA_ROOT_FILE")) {
+        if (logger)
+            logger->d("Using CA file: %s", path);
+        ctx->load_verify_file(path);
+    } else if (char* path = getenv("CA_ROOT_PATH")) {
+        if (logger)
+            logger->d("Using CA path: %s", path);
+        ctx->add_verify_path(path);
+    } else {
+#ifdef __ANDROID__
+        if (logger)
+            logger->d("Using CA path: /system/etc/security/cacerts");
+        ctx->add_verify_path("/system/etc/security/cacerts");
+#elif defined(WIN32) || defined(TARGET_OS_OSX)
+        PEMCache::instance(logger).fillX509Store(ctx->native_handle());
+#else
+        if (logger)
+            logger->d("Using default CA path");
+        ctx->set_default_verify_paths();
+#endif
+    }
+    return ctx;
+}
+
 Connection::Connection(asio::io_context& ctx, const bool ssl, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
     if (ssl) {
-        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
-#ifdef __ANDROID__
-        ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
-#else
-        ssl_ctx_->set_default_verify_paths();
-#endif
+        ssl_ctx_ = newTlsClientContext(l);
         ssl_socket_ = std::make_unique<ssl_socket_t>(ctx_, ssl_ctx_);
         if (logger_)
             logger_->d("[connection:%i] start https session", id_);
@@ -115,21 +153,18 @@ Connection::Connection(asio::io_context& ctx, std::shared_ptr<dht::crypto::Certi
                        const dht::crypto::Identity& identity, std::shared_ptr<dht::Logger> l)
     : id_(Connection::ids_++), ctx_(ctx), istream_(&read_buf_), logger_(l)
 {
-    ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
-    ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
-#ifdef __ANDROID__
-        ssl_ctx_->add_verify_path("/system/etc/security/cacerts");
-#else
-        ssl_ctx_->set_default_verify_paths();
-#endif
     asio::error_code ec;
-    if (server_ca){
+    if (server_ca) {
+        ssl_ctx_ = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
+        ssl_ctx_->set_verify_mode(asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
         auto ca = server_ca->toString(false/*chain*/);
         ssl_ctx_->add_certificate_authority(asio::const_buffer{ca.data(), ca.size()}, ec);
         if (ec)
             throw std::runtime_error("Error adding certificate authority: " + ec.message());
         else if (logger_)
             logger_->d("[connection:%i] certficate authority %s", id_, server_ca->getUID().c_str());
+    } else {
+        ssl_ctx_ = newTlsClientContext(l);
     }
     if (identity.first){
         auto key = identity.first->serialize();
@@ -184,6 +219,253 @@ Connection::is_ssl() const
     return ssl_ctx_ ? true : false;
 }
 
+static time_t
+parse_ocsp_time(ASN1_GENERALIZEDTIME* gt)
+{
+    struct tm tm;
+    time_t rv = -1;
+
+    if (gt == nullptr)
+        return -1;
+    // RFC 6960 specifies that all times in OCSP must be GENERALIZEDTIME
+    if (ASN1_time_parse((const char*)gt->data, gt->length, &tm, V_ASN1_GENERALIZEDTIME) == -1)
+        return -1;
+    if ((rv = timegm(&tm)) == -1)
+        return -1;
+    return rv;
+}
+
+static inline X509*
+cert_from_chain(STACK_OF(X509)* fullchain)
+{
+    return sk_X509_value(fullchain, 0);
+}
+
+static X509*
+issuer_from_chain(STACK_OF(X509)* fullchain)
+{
+    X509 *cert, *issuer;
+    X509_NAME *issuer_name;
+
+    cert = cert_from_chain(fullchain);
+    if ((issuer_name = X509_get_issuer_name(cert)) == nullptr)
+        return nullptr;
+
+    issuer = X509_find_by_subject(fullchain, issuer_name);
+    return issuer;
+}
+
+using OscpRequestPtr = std::unique_ptr<OCSP_REQUEST, decltype(&OCSP_REQUEST_free)>;
+struct OscpRequestInfo {
+    OscpRequestPtr req {nullptr, &OCSP_REQUEST_free};
+    std::string data;
+    std::string url;
+};
+
+static std::unique_ptr<OscpRequestInfo>
+ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& logger, bool nonce = false)
+{
+    if (fullchain == nullptr)
+        return {};
+
+    if (sk_X509_num(fullchain) <= 1) {
+        if (logger)
+            logger->e("Cert does not contain a cert chain");
+        return {};
+    }
+    X509* cert = cert_from_chain(fullchain);
+    if (cert == nullptr) {
+        if (logger)
+            logger->e("No certificate found");
+        return {};
+    }
+    X509* issuer = issuer_from_chain(fullchain);
+    if (issuer == nullptr) {
+        if (logger)
+            logger->e("Unable to find issuer for cert");
+        return {};
+    }
+
+    auto urls = X509_get1_ocsp(cert);
+    if (urls == nullptr || sk_OPENSSL_STRING_num(urls) <= 0) {
+        if (logger)
+            logger->e("Certificate contains no OCSP url");
+        return {};
+    }
+    auto url = sk_OPENSSL_STRING_value(urls, 0);
+    if (url == nullptr)
+        return {};
+
+    auto request = std::make_unique<OscpRequestInfo>();
+    request->req = OscpRequestPtr(OCSP_REQUEST_new(), &OCSP_REQUEST_free);
+    request->url = strdup(url);
+    X509_email_free(urls);
+
+    OCSP_CERTID* id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
+    if (id == nullptr) {
+        if (logger)
+            logger->e("Unable to get certificate id from cert");
+        return {};
+    }
+    if (OCSP_request_add0_id(request->req.get(), id) == nullptr) {
+        if (logger)
+            logger->e("Unable to add certificate id to request");
+        return {};
+    }
+
+    if (nonce)
+        OCSP_request_add1_nonce(request->req.get(), nullptr, -1);
+
+    int size;
+    uint8_t* data {nullptr};
+    if ((size = i2d_OCSP_REQUEST(request->req.get(), &data)) <= 0) {
+        if (logger)
+            logger->e("Unable to encode ocsp request");
+        return {};
+    }
+    if (data == nullptr) {
+        if (logger)
+            logger->e("Unable to allocte memory");
+        return {};
+    }
+    request->data = std::string((char*)data, (char*)data+size);
+    free(data);
+    return request;
+}
+
+bool
+ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, const std::string& response, X509_STORE *store, const std::shared_ptr<Logger>& logger)
+{
+    ASN1_GENERALIZEDTIME *revtime = nullptr, *thisupd = nullptr, *nextupd = nullptr;
+    const uint8_t* p = (const uint8_t*)response.data();
+    int status, cert_status=0, crl_reason=0;
+    time_t now, rev_t = -1, this_t, next_t;
+    OCSP_RESPONSE *resp;
+    OCSP_BASICRESP *bresp;
+    OCSP_CERTID *cid;
+
+    X509* cert = cert_from_chain(fullchain);
+    if (cert == nullptr) {
+        if (logger)
+            logger->e("No certificate found");
+        return false;
+    }
+    X509* issuer = issuer_from_chain(fullchain);
+    if (issuer == nullptr) {
+        if (logger)
+            logger->e("Unable to find issuer for cert");
+        return false;
+    }
+    if ((cid = OCSP_cert_to_id(nullptr, cert, issuer)) == nullptr) {
+        if (logger)
+            logger->e("Unable to get issuer cert/CID");
+        return false;
+    }
+
+    if ((resp = d2i_OCSP_RESPONSE(nullptr, &p, response.size())) == nullptr) {
+        if (logger)
+            logger->e("OCSP response unserializable");
+        return false;
+    }
+
+    if ((bresp = OCSP_response_get1_basic(resp)) == nullptr) {
+        if (logger)
+            logger->e("Failed to load OCSP response");
+        return false;
+    }
+
+    if (OCSP_basic_verify(bresp, fullchain, store, OCSP_TRUSTOTHER) != 1) {
+        if (logger)
+            logger->w("OCSP verify failed");
+        return false;
+    }
+    printf("OCSP response signature validated\n");
+
+    status = OCSP_response_status(resp);
+    if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
+        if (logger)
+            logger->w("OCSP Failure: code %d (%s)", status, OCSP_response_status_str(status));
+        return false;
+    }
+
+    // Check the nonce if we sent one
+    if (OCSP_check_nonce(info.req.get(), bresp) <= 0) {
+        if (logger)
+            logger->w("No OCSP nonce, or mismatch");
+        return false;
+    }
+
+    if (OCSP_resp_find_status(bresp, cid, &cert_status, &crl_reason,
+        &revtime, &thisupd, &nextupd) != 1) {
+        if (logger)
+            logger->w("OCSP verify failed: no result for cert");
+        return false;
+    }
+
+    if (revtime && (rev_t = parse_ocsp_time(revtime)) == -1) {
+        if (logger)
+            logger->w("Unable to parse revocation time in OCSP reply");
+        return false;
+    }
+    // Belt and suspenders, Treat it as revoked if there is either
+    // a revocation time, or status revoked.
+    if (rev_t != -1 || cert_status == V_OCSP_CERTSTATUS_REVOKED) {
+        if (logger)
+            logger->w("Invalid OCSP reply: certificate is revoked");
+        if (rev_t != -1) {
+            if (logger)
+                logger->w("Certificate revoked at: %s", ctime(&rev_t));
+        }
+        return false;
+    }
+    if ((this_t = parse_ocsp_time(thisupd)) == -1) {
+        if (logger)
+            logger->w("unable to parse this update time in OCSP reply");
+        return false;
+    }
+    if ((next_t = parse_ocsp_time(nextupd)) == -1) {
+        if (logger)
+            logger->w("unable to parse next update time in OCSP reply");
+        return false;
+    }
+
+    // Don't allow this update to precede next update
+    if (this_t >= next_t) {
+        if (logger)
+            logger->w("Invalid OCSP reply: this update >= next update");
+        return false;
+    }
+
+    now = time(nullptr);
+    // Check that this update is not more than JITTER seconds in the future.
+    if (this_t > now + JITTER_SEC) {
+        if (logger)
+            logger->e("Invalid OCSP reply: this update is in the future (%s)", ctime(&this_t));
+        return false;
+    }
+
+    // Check that this update is not more than MAXSEC in the past.
+    if (this_t < now - MAXAGE_SEC) {
+        if (logger)
+            logger->e("Invalid OCSP reply: this update is too old (%s)", ctime(&this_t));
+        return false;
+    }
+
+    // Check that next update is still valid
+    if (next_t < now - JITTER_SEC) {
+        if (logger)
+            logger->w("Invalid OCSP reply: reply has expired (%s)", ctime(&next_t));
+        return false;
+    }
+
+    if (logger) {
+        logger->d("OCSP response validated");
+        logger->d("	   This Update: %s", ctime(&this_t));
+        logger->d("	   Next Update: %s", ctime(&next_t));
+    }
+    return true;
+}
+
 void
 Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::verify_mode verify_mode)
 {
@@ -196,18 +478,43 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
             ssl_socket_->asio_ssl_stream().set_verify_callback([
                     id = id_, logger = logger_, hostname
                 ] (bool preverified, asio::ssl::verify_context& ctx) -> bool {
+                    X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
                     if (logger) {
                         char subject_name[1024];
-                        X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
                         X509_NAME_oneline(X509_get_subject_name(cert), subject_name, 1024);
                         logger->d("[connection:%i] verify %s compliance to RFC 2818:\n%s", id, hostname.c_str(), subject_name);
                     }
+
                     // starts from CA and goes down the presented chain
                     auto verifier = asio::ssl::rfc2818_verification(hostname);
                     bool verified = verifier(preverified, ctx);
                     auto verify_ec = X509_STORE_CTX_get_error(ctx.native_handle());
                     if (verify_ec != 0 /*X509_V_OK*/ and logger)
                         logger->e("[http::connection:%i] ssl verification error=%i %d", id, verify_ec, verified);
+                    if (verified) {
+                        auto chain = X509_STORE_CTX_get1_chain(ctx.native_handle());
+                        if (auto ocspInfo = ocspRequestFromCert(chain, logger)) {
+                            if (logger)
+                                logger->w("[http::connection:%i] TLS OCSP server: %s, request size: %zu", id, ocspInfo->url.c_str(), ocspInfo->data.size());
+                            bool ocspVerified = false;
+                            asio::io_context io_ctx;
+                            auto ocspReq = std::make_shared<Request>(io_ctx, ocspInfo->url, [&](const Response& ocspResp){
+                                if (ocspResp.status_code == 200) {
+                                    ocspVerified = ocspValidateResponse(*ocspInfo, chain, ocspResp.body, X509_STORE_CTX_get0_store(ctx.native_handle()), logger);
+                                } else {
+                                    if (logger)
+                                        logger->w("[http::connection:%i] TLS OCSP check error", id);
+                                }
+                            }, logger);
+                            ocspReq->set_method(restinio::http_method_post());
+                            ocspReq->set_header_field(restinio::http_field_t::content_type, "application/ocsp-request");
+                            ocspReq->set_body(ocspInfo->data);
+                            ocspReq->send();
+                            io_ctx.run();
+                            if (not ocspVerified)
+                                return false;
+                        }
+                    }
                     return verified;
                 }
             );
@@ -274,6 +581,8 @@ Connection::async_handshake(HandlerCb cb)
                         this_.logger_->d("[connection:%i] self-signed certificate in handshake: %i", this_.id_, verify_ec);
                     else if (verify_ec != X509_V_OK)
                         this_.logger_->e("[connection:%i] verify handshake error: %i", this_.id_, verify_ec);
+                    else
+                        this_.logger_->w("[connection:%i] verify handshake success", this_.id_);
                 }
             }
             if (cb)
@@ -818,12 +1127,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
             conn_ = std::make_shared<Connection>(ctx_, server_ca_, client_identity_, logger_);
         else
             conn_ = std::make_shared<Connection>(ctx_, true/*ssl*/, logger_);
-#if !defined(LINUX) || defined(__ANDROID__)
-        conn_->set_ssl_verification(get_url().host, asio::ssl::verify_none);
-#else
-        conn_->set_ssl_verification(get_url().host, asio::ssl::verify_peer
-                                                    | asio::ssl::verify_fail_if_no_peer_cert);
-#endif
+        conn_->set_ssl_verification(get_url().host, asio::ssl::verify_peer | asio::ssl::verify_fail_if_no_peer_cert);
     }
     else
         conn_ = std::make_shared<Connection>(ctx_, false/*ssl*/, logger_);
@@ -1096,5 +1400,21 @@ Request::getRelativePath(const Url& origin, const std::string& path)
     return newPath.toString();
 }
 
+const Response&
+Request::await()
+{
+    std::mutex mtx;
+    std::unique_lock<std::mutex> lock(mtx);
+    std::condition_variable cv;
+    bool ok {false};
+    add_on_done_callback([&](const Response& resp){
+        std::lock_guard<std::mutex> lk(mtx);
+        ok = true;
+        cv.notify_all();
+    });
+    cv.wait(lock, [&]{ return ok; });
+    return response_;
+}
+
 } // namespace http
 } // namespace dht

src/op_cache.h

@@ -39,8 +39,10 @@ public:
     }
 
     static ValueCallback cacheCallback(ValueCallback&& cb, std::function<void()>&& onCancel) {
-        auto cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb));
-        return [cache, onCancel](const std::vector<Sp<Value>>& vals, bool expired){
+        return [
+            cache = std::make_shared<OpValueCache>(std::forward<ValueCallback>(cb)),
+            onCancel = std::move(onCancel)
+        ](const std::vector<Sp<Value>>& vals, bool expired){
             auto ret = cache->onValue(vals, expired);
             if (not ret)
                 onCancel();
@@ -49,10 +51,9 @@ public:
     }
 
     bool onValue(const std::vector<Sp<Value>>& vals, bool expired, const system_clock::time_point& t = system_clock::time_point::min()) {
-        if (expired)
-            return onValuesExpired(vals, t);
-        else
-            return onValuesAdded(vals, t);
+        return expired 
+            ? onValuesExpired(vals, t) 
+            : onValuesAdded(vals, t);
     }
 
     bool onValuesAdded(const std::vector<Sp<Value>>& vals, const system_clock::time_point& t = system_clock::time_point::min());

src/value.cpp

@@ -76,10 +76,7 @@ std::ostream& operator<< (std::ostream& s, const Value& v)
                 s.write((const char*)v.data.data(), v.data.size());
                 s << '"';
             } else if (v.data.size() < 1024) {
-                s << std::hex;
-                for (auto i : v.data)
-                    s << std::setfill('0') << std::setw(2) << (unsigned)i;
-                s << std::dec;
+                s << toHex(v.data.data(), v.data.size());
             } else {
                 s << v.data.size() << " bytes";
             }

src/value_cache.h

@@ -192,11 +192,10 @@ private:
         auto v = values.find(vid);
         if (v == values.end())
             return {};
-        const std::vector<Sp<Value>> val {std::move(v->second.data)};
+        std::vector<Sp<Value>> val {std::move(v->second.data)};
         values.erase(v);
-        auto cb = callback;
         CallbackQueue ret;
-        ret.emplace_back([cb, val]{
+        ret.emplace_back([cb = callback, val = std::move(val)]{
             if (cb) cb(val, true);
         });
         return ret;

tools/dhtchat.cpp

@@ -54,7 +54,7 @@ main(int argc, char **argv)
         print_usage();
         return 0;
     }
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_init();
 #endif
 
@@ -76,7 +76,7 @@ main(int argc, char **argv)
 
         const InfoHash myid = dht.getId();
 
-#ifndef WIN32_NATIVE
+#ifndef _MSC_VER
         // using the GNU History API
         using_history();
 #endif
@@ -144,7 +144,7 @@ main(int argc, char **argv)
 
     std::cout << std::endl <<  "Stopping node..." << std::endl;
     dht.join();
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_deinit();
 #endif
     return 0;

tools/dhtscanner.cpp

@@ -77,7 +77,7 @@ step(DhtRunner& dht, std::atomic_uint& done, std::shared_ptr<NodeSet> all_nodes,
 int
 main(int argc, char **argv)
 {
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_init();
 #endif
     auto params = parseArgs(argc, argv);
@@ -123,7 +123,7 @@ main(int argc, char **argv)
     }
 
     dht.join();
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_deinit();
 #endif
     return 0;

tools/perftest.cpp

@@ -132,7 +132,7 @@ benchPingPong(unsigned netSize, unsigned n_parallel) {
 int
 main(int argc, char **argv)
 {
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_init();
 #endif
     auto params = parseArgs(argc, argv);
@@ -173,7 +173,7 @@ main(int argc, char **argv)
     std::cout << print_duration(totalTime/totalOps) << " per rt, "
             << totalOps/std::chrono::duration<double>(totalTime).count() << " ping per s" << std::endl << std::endl;
 
-#ifdef WIN32_NATIVE
+#ifdef _MSC_VER
     gnutls_global_deinit();
 #endif
     return 0;

tools/systemd/dhtnode.service.in

@@ -1,14 +1,44 @@
 [Unit]
 Description=OpenDHT standalone node
+Documentation=man:dhtnode(1)
 After=network.target
 
 [Service]
-EnvironmentFile=@sysconfdir@/dhtnode.conf
-ExecStart=@bindir@/dhtnode -s $DHT_ARGS
-KillMode=process
-Restart=on-failure
 Type=simple
+User=opendht
+Group=opendht
+ExecStart=@bindir@/dhtnode -s $DHT_ARGS
+Restart=on-failure
+RestartSec=2s
+LimitNOFILE=65536
 DynamicUser=yes
+EnvironmentFile=@sysconfdir@/dhtnode.conf
+KillMode=process
+WorkingDirectory=/tmp
+
+# Hardening
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+LockPersonality=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+ReadOnlyDirectories=/
+ReadWriteDirectories=-/proc/self
+ReadWriteDirectories=-/var/run
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
 
 [Install]
 WantedBy=multi-user.target