update version to 3.1.9

This reverts commit 2dc9f25ff4.

.github/workflows/ccpp.yml

@@ -11,8 +11,10 @@ jobs:
     - name: Dependencies
       run: |
         sudo apt install libncurses5-dev libreadline-dev nettle-dev libasio-dev \
-        libgnutls28-dev libuv1-dev cython3 python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
+        libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
         autotools-dev autoconf libfmt-dev libhttp-parser-dev libmsgpack-dev libargon2-0-dev
+    - name: Cython
+      run: sudo pip3 install Cython
     - name: Configure
       run: |
         ./autogen.sh
@@ -27,9 +29,11 @@ jobs:
     - uses: actions/checkout@v3
     - name: Dependencies
       run: |
-        sudo apt install meson ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev \
-        libgnutls28-dev libuv1-dev cython3 python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
-        libfmt-dev libhttp-parser-dev libmsgpack-dev libargon2-0-dev
+        sudo apt install ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev \
+        libgnutls28-dev libuv1-dev python3-dev python3-setuptools python3-pip \
+        libcppunit-dev libjsoncpp-dev libfmt-dev libhttp-parser-dev libmsgpack-dev libargon2-0-dev
+    - name: Python dependencies
+      run: sudo pip3 install meson Cython
     - name: Configure
       run: meson setup build .
     - name: Build
@@ -48,7 +52,7 @@ jobs:
       run: |
         mkdir build && cd build
         cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Debug \
-                 -DOPENDHT_C=Off -DOPENDHT_TESTS=On -DOPENDHT_PEER_DISCOVERY=Off -DOPENDHT_PYTHON=Off \
+                 -DOPENDHT_C=Off -DBUILD_TESTING=On -DOPENDHT_PEER_DISCOVERY=Off -DOPENDHT_PYTHON=Off \
                  -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=Off -DOPENDHT_PROXY_CLIENT=Off
     - name: Build
       run: cd build && make
@@ -84,7 +88,7 @@ jobs:
         export CPPFLAGS="-I/usr/local/opt/openssl@3/include"
         export PKG_CONFIG_PATH="/usr/local/opt/openssl@3/lib/pkgconfig"
         cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Debug \
-                 -DOPENDHT_C=On -DOPENDHT_TESTS=On -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
+                 -DOPENDHT_C=On -DBUILD_TESTING=On -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
                  -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On -DOPENDHT_PROXY_CLIENT=On -DOPENDHT_PUSH_NOTIFICATIONS=On
 
     - name: Build

.github/workflows/clang-analyzer.yml

@@ -10,7 +10,7 @@ jobs:
       - name: deps
         run: |
           sudo apt install libncurses5-dev libreadline-dev nettle-dev \
-          libgnutls28-dev libuv1-dev cython3 python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
+          libgnutls28-dev libuv1-dev python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
           autotools-dev autoconf libfmt-dev libhttp-parser-dev libmsgpack-dev libargon2-0-dev libasio-dev \
           llvm llvm-dev clang clang-tools && \
           sudo apt remove gcc g++

.vscode/tasks.json

@@ -22,10 +22,10 @@
                 "${workspaceRoot}",
                 "-DCMAKE_EXPORT_COMPILE_COMMANDS=On",
                 "-DCMAKE_BUILD_TYPE=Debug",
+                "-DBUILD_TESTING=On",
                 "-DOPENDHT_SANITIZE=On",
                 "-DOPENDHT_PROXY_CLIENT=On",
                 "-DOPENDHT_PROXY_SERVER=On",
-                "-DOPENDHT_TESTS=On",
                 "-DOPENDHT_C=On"
             ],
             "dependsOn": "builddir"

CMakeLists.txt

@@ -1,10 +1,4 @@
-cmake_minimum_required (VERSION 3.10..3.20)
-if(POLICY CMP0073)
-  cmake_policy(SET CMP0073 NEW)
-endif()
-if(POLICY CMP0074)
-  cmake_policy(SET CMP0074 NEW)
-endif()
+cmake_minimum_required (VERSION 3.16..3.28)
 project (opendht)
 
 include(CMakePackageConfigHelpers)
@@ -15,7 +9,7 @@ include(cmake/CheckAtomic.cmake)
 include(CTest)
 
 set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 1.4)
+set (opendht_VERSION_MINOR 1.9)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")

configure.ac

@@ -1,7 +1,7 @@
 dnl define macros
 m4_define([opendht_major_version], 3)
 m4_define([opendht_minor_version], 1)
-m4_define([opendht_patch_version], 4)
+m4_define([opendht_patch_version], 9)
 m4_define([opendht_version],
 		  [opendht_major_version.opendht_minor_version.opendht_patch_version])
 

docker/DockerfileDeps

@@ -10,12 +10,14 @@ RUN apt-get update && apt-get install -y \
 RUN apt-get update && apt-get install -y \
         build-essential pkg-config cmake git wget \
         libtool autotools-dev autoconf \
-        cython3 python3-dev python3-setuptools python3-build python3-virtualenv \
+        python3-pip python3-dev python3-setuptools python3-build python3-virtualenv \
         libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
         libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
         libssl-dev libfmt-dev libhttp-parser-dev libasio-dev libmsgpack-dev \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 
+RUN pip3 install meson Cython
+
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
     && wget https://github.com/aberaud/restinio/archive/6fd08b65f6f15899dd0de3c801f6a5462b811c64.tar.gz \

docker/DockerfileDepsBionic

@@ -5,12 +5,12 @@ LABEL org.opencontainers.image.source https://github.com/savoirfairelinux/opendh
 RUN echo "APT::Acquire::Retries \"3\";" > /etc/apt/apt.conf.d/80-retries
 RUN apt-get update && apt-get install -y \
         apt-transport-https build-essential pkg-config git wget libncurses5-dev libreadline-dev nettle-dev \
-        libgnutls28-dev libuv1-dev cython3 python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
+        libgnutls28-dev libuv1-dev python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
         libargon2-0-dev \
         autotools-dev autoconf libfmt-dev libhttp-parser-dev libmsgpack-dev libssl-dev python3-pip \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 
-RUN pip3 install --upgrade cmake
+RUN pip3 install --upgrade cmake meson Cython
 
 # libasio-dev (1.10) is too old
 RUN echo "** Building a recent version of asio ***" \

docker/DockerfileDepsFocal

@@ -10,12 +10,14 @@ RUN apt-get update && apt-get install -y \
 RUN apt-get update && apt-get install -y \
         build-essential pkg-config cmake git wget \
         libtool autotools-dev autoconf \
-        cython3 python3-dev python3-setuptools \
+        python3-dev python3-setuptools python3-pip \
         libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
         libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
         libssl-dev libfmt-dev libhttp-parser-dev libasio-dev libmsgpack-dev \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 
+RUN pip3 install meson Cython
+
 RUN echo "*** Downloading RESTinio ***" \
     && mkdir restinio && cd restinio \
     && wget https://github.com/aberaud/restinio/archive/e0a261dd8488246a3cb8bbb3ea781ea5139c3c94.tar.gz \

docker/DockerfileDepsLlvm

@@ -10,13 +10,15 @@ RUN apt-get update && apt-get install -y \
 RUN apt-get update \
     && apt-get install -y llvm llvm-dev lldb clang gdb make cmake pkg-config \
        libtool git wget libncurses5-dev libreadline-dev \
-       nettle-dev libgnutls28-dev libuv1-dev libmsgpack-dev libjsoncpp-dev cython3 python3-dev \
+       nettle-dev libgnutls28-dev libuv1-dev libmsgpack-dev libjsoncpp-dev python3-dev \
        python3-setuptools libcppunit-dev python3-pip python3-build python3-virtualenv \
        autotools-dev autoconf libssl-dev libargon2-dev \
        libfmt-dev libhttp-parser-dev libasio-dev \
     && apt-get remove -y gcc g++ && apt-get autoremove -y \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 
+RUN pip3 install meson Cython
+
 ENV CC cc
 ENV CXX c++
 

include/opendht/crypto.h

@@ -670,94 +670,6 @@ private:
     gnutls_x509_trust_list_t trust {nullptr};
 };
 
-template <class T>
-class OPENDHT_PUBLIC secure_vector
-{
-public:
-    secure_vector() {}
-    secure_vector(secure_vector<T> const&) = default;
-    secure_vector(secure_vector<T> &&) = default;
-    explicit secure_vector(unsigned size): data_(size) {}
-    explicit secure_vector(unsigned size, T _item): data_(size, _item) {}
-    explicit secure_vector(const std::vector<T>& c): data_(c) {}
-    secure_vector(std::vector<T>&& c): data_(std::move(c)) {}
-    ~secure_vector() { clean(); }
-
-    static secure_vector<T> getRandom(size_t size) {
-        secure_vector<T> ret(size);
-        crypto::random_device rdev;
-#ifdef _WIN32
-        std::uniform_int_distribution<int> rand_byte{ 0, std::numeric_limits<uint8_t>::max() };
-#else
-        std::uniform_int_distribution<uint8_t> rand_byte;
-#endif
-        std::generate_n((uint8_t*)ret.data_.data(), ret.size()*sizeof(T), std::bind(rand_byte, std::ref(rdev)));
-        return ret;
-    }
-    secure_vector<T>& operator=(const secure_vector<T>& c) {
-        if (&c == this)
-            return *this;
-        clean();
-        data_ = c.data_;
-        return *this;
-    }
-    secure_vector<T>& operator=(secure_vector<T>&& c) {
-        if (&c == this)
-            return *this;
-        clean();
-        data_ = std::move(c.data_);
-        return *this;
-    }
-    secure_vector<T>& operator=(std::vector<T>&& c) {
-        clean();
-        data_ = std::move(c);
-        return *this;
-    }
-    std::vector<T>& writable() { clean(); return data_; }
-    const std::vector<T>& makeInsecure() const { return data_; }
-    const uint8_t* data() const { return data_.data(); }
-
-    void clean() {
-        clean(data_.begin(), data_.end());
-    }
-
-    void clear() { clean(); data_.clear(); }
-
-    size_t size() const { return data_.size(); }
-    bool empty() const { return data_.empty(); }
-
-    void swap(secure_vector<T>& other) { data_.swap(other.data_); }
-    void resize(size_t s) {
-        if (s == data_.size()) return;
-        if (s < data_.size()) {
-            //shrink
-            clean(data_.begin()+s, data_.end());
-            data_.resize(s);
-        } else {
-            //grow
-            auto data = std::move(data_); // move protected data
-            clear();
-            data_.resize(s);
-            std::copy(data.begin(), data.end(), data_.begin());
-            clean(data.begin(), data.end());
-        }
-    }
-
-private:
-    /**
-     * Securely wipe memory
-     */
-    static void clean(const typename std::vector<T>::iterator& i, const typename std::vector<T>::iterator& j) {
-        volatile uint8_t* b = reinterpret_cast<uint8_t*>(&*i);
-        volatile uint8_t* e = reinterpret_cast<uint8_t*>(&*j);
-        std::fill(b, e, 0);
-    }
-
-    std::vector<T> data_;
-};
-
-using SecureBlob = secure_vector<uint8_t>;
-
 /**
  * Generate an RSA key pair (4096 bits) and a certificate.
  * @param name the name used in the generated certificate
@@ -807,8 +719,11 @@ OPENDHT_PUBLIC inline Blob aesEncrypt(const Blob& data, const Blob& key) {
  * This function uses `stretchKey` to generate an AES key from the password and a random salt.
  * The result is a bundle including the salt that can be decrypted with `aesDecrypt(data, password)`.
  * If needed, the salt or encrypted data can be individually extracted from the bundle with `aesGetSalt` and `aesGetEncrypted`.
+ * @param data: data to encrypt
+ * @param password: password to encrypt the data with
+ * @param salt: optional salt to use for key derivation. If not provided, a random salt will be generated.
  */
-OPENDHT_PUBLIC Blob aesEncrypt(const Blob& data, std::string_view password);
+OPENDHT_PUBLIC Blob aesEncrypt(const Blob& data, std::string_view password, const Blob& salt = {});
 
 /**
  * AES-GCM decryption.

include/opendht/crypto/secure_vector.h

@@ -0,0 +1,114 @@
+/*
+ *  Copyright (C) 2014-2023 Savoir-faire Linux Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+#pragma once
+
+#include <vector>
+#include <random>
+
+namespace dht {
+namespace crypto {
+
+template <class T>
+class secure_vector
+{
+public:
+    secure_vector() {}
+    secure_vector(secure_vector<T> const&) = default;
+    secure_vector(secure_vector<T> &&) = default;
+    explicit secure_vector(unsigned size): data_(size) {}
+    explicit secure_vector(unsigned size, T _item): data_(size, _item) {}
+    explicit secure_vector(const std::vector<T>& c): data_(c) {}
+    secure_vector(std::vector<T>&& c): data_(std::move(c)) {}
+    ~secure_vector() { clean(); }
+
+    static secure_vector<T> getRandom(size_t size) {
+        secure_vector<T> ret(size);
+        std::random_device rdev;
+#ifdef _WIN32
+        std::uniform_int_distribution<int> rand_byte{ 0, std::numeric_limits<uint8_t>::max() };
+#else
+        std::uniform_int_distribution<uint8_t> rand_byte;
+#endif
+        std::generate_n((uint8_t*)ret.data_.data(), ret.size()*sizeof(T), std::bind(rand_byte, std::ref(rdev)));
+        return ret;
+    }
+    secure_vector<T>& operator=(const secure_vector<T>& c) {
+        if (&c == this)
+            return *this;
+        clean();
+        data_ = c.data_;
+        return *this;
+    }
+    secure_vector<T>& operator=(secure_vector<T>&& c) {
+        if (&c == this)
+            return *this;
+        clean();
+        data_ = std::move(c.data_);
+        return *this;
+    }
+    secure_vector<T>& operator=(std::vector<T>&& c) {
+        clean();
+        data_ = std::move(c);
+        return *this;
+    }
+    std::vector<T>& writable() { clean(); return data_; }
+    const std::vector<T>& makeInsecure() const { return data_; }
+    const uint8_t* data() const { return data_.data(); }
+
+    void clean() {
+        clean(data_.begin(), data_.end());
+    }
+
+    void clear() { clean(); data_.clear(); }
+
+    size_t size() const { return data_.size(); }
+    bool empty() const { return data_.empty(); }
+
+    void swap(secure_vector<T>& other) { data_.swap(other.data_); }
+    void resize(size_t s) {
+        if (s == data_.size()) return;
+        if (s < data_.size()) {
+            //shrink
+            clean(data_.begin()+s, data_.end());
+            data_.resize(s);
+        } else {
+            //grow
+            auto data = std::move(data_); // move protected data
+            clear();
+            data_.resize(s);
+            std::copy(data.begin(), data.end(), data_.begin());
+            clean(data.begin(), data.end());
+        }
+    }
+
+private:
+    /**
+     * Securely wipe memory
+     */
+    static void clean(const typename std::vector<T>::iterator& i, const typename std::vector<T>::iterator& j) {
+        volatile uint8_t* b = reinterpret_cast<uint8_t*>(&*i);
+        volatile uint8_t* e = reinterpret_cast<uint8_t*>(&*j);
+        std::fill(b, e, 0);
+    }
+
+    std::vector<T> data_;
+};
+
+using SecureBlob = secure_vector<uint8_t>;
+
+}
+}

include/opendht/dht.h

@@ -65,7 +65,7 @@ public:
      * Initialise the Dht with two open sockets (for IPv4 and IP6)
      * and an ID for the node.
      */
-    Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l = {});
+    Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l = {}, std::unique_ptr<std::mt19937_64>&& rd = {});
 
     virtual ~Dht();
 
@@ -372,7 +372,7 @@ private:
     Dht(const Dht&) = delete;
     Dht& operator=(const Dht&) = delete;
 
-    std::mt19937_64 rd {crypto::getSeededRandomEngine<std::mt19937_64>()};
+    std::mt19937_64 rd;
 
     InfoHash myid {};
 

include/opendht/dhtrunner.h

@@ -79,6 +79,7 @@ public:
         CertificateStoreQuery certificateStore {};
         IdentityAnnouncedCb identityAnnouncedCb {};
         PublicAddressChangedCb publicAddressChangedCb {};
+        std::unique_ptr<std::mt19937_64> rng {};
         Context() {}
     };
 

include/opendht/http.h

@@ -196,6 +196,8 @@ public:
         return logger_;
     }
 
+    void cancel();
+
 private:
     void resolve(const std::string& host, const std::string& service);
 

include/opendht/infohash.h

@@ -323,7 +323,7 @@ Hash<N>
 Hash<N>::getRandom()
 {
     Hash h;
-    crypto::random_device rdev;
+    std::random_device rdev;
     std::uniform_int_distribution<uint32_t> rand_int;
     auto a = reinterpret_cast<uint32_t*>(h.data());
     auto b = reinterpret_cast<uint32_t*>(h.data() + h.size());

include/opendht/rng.h

@@ -27,104 +27,49 @@
 namespace dht {
 namespace crypto {
 
-#ifndef _MSC_VER
-#ifdef _WIN32
-
-/**
- * Hardware random number generator using Intel RDRAND/RDSEED,
- * API-compatible with std::random_device.
+/** 
+ * Generate a seeded random engine.
  */
-class random_device {
-public:
-    using result_type = std::random_device::result_type;
-    using pseudo_engine = std::mt19937_64;
-
-    /**
-     * Current implementation assumption : result_type must be of a size
-     * supported by Intel RDRAND/RDSEED.
-     * result_type is unsigned int so this is currently safe.
-     */
-    static_assert(
-        sizeof(result_type) == 2 ||
-        sizeof(result_type) == 4 ||
-        sizeof(result_type) == 8,
-        "result_type must be 16, 32 or 64 bits");
-
-    random_device();
-
-    result_type operator()();
-
-    static constexpr result_type min() {
-        return std::numeric_limits<result_type>::lowest();
-    }
-
-    static constexpr result_type max() {
-        return std::numeric_limits<result_type>::max();
-    }
-
-    double entropy() const {
-        if (hasRdrand() or hasRdseed())
-            return 1.;
-        return 0.;
-    }
-
-    static bool hasRdrand() {
-        static const bool hasrdrand = _hasRdrand();
-        return hasrdrand;
-    }
-
-    static bool hasRdseed() {
-        static const bool hasrdseed = _hasRdseed();
-        return hasrdseed;
-    }
-
-private:
-    random_device& operator=(random_device&) = delete;
-
-    pseudo_engine gen;
-    std::uniform_int_distribution<result_type> dis {};
-
-    static bool hasIntelCpu();
-    static bool _hasRdrand();
-    static bool _hasRdseed();
-
-    struct CPUIDinfo {
-        unsigned int EAX;
-        unsigned int EBX;
-        unsigned int ECX;
-        unsigned int EDX;
-        CPUIDinfo(const unsigned int func, const unsigned int subfunc);
+template<class T = std::mt19937, std::size_t N = T::state_size+1>
+auto getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type {
+    std::array<typename T::result_type, N> random_data;
+    constexpr auto gen = [](std::random_device& source) -> typename T::result_type {
+        for (unsigned j=0; j<64; j++) {
+            try {
+                return source();
+            } catch (...) {
+                std::this_thread::sleep_for(std::chrono::microseconds(500));
+            }
+        }
+        throw std::runtime_error("Can't generate random number");
     };
-    bool rdrandStep(result_type* r);
-    bool rdrand(result_type* r);
-    bool rdseedStep(result_type* r);
-    bool rdseed(result_type* r);
-};
-
-#else
-
-using random_device = std::random_device;
-
-#endif
-#else
-using random_device = std::random_device;
-#endif
-
-template<class T = std::mt19937, std::size_t N = T::state_size>
-auto getSeededRandomEngine () -> typename std::enable_if<!!N, T>::type {
-    typename T::result_type random_data[N];
-    for (unsigned i=0; i<256; i++) {
+    for (unsigned i=0; i<8; i++) {
         try {
-            random_device source;
-            std::generate(std::begin(random_data), std::end(random_data), std::ref(source));
-            std::seed_seq seeds(std::begin(random_data), std::end(random_data));
-            T seededEngine (seeds);
-            return seededEngine;
+            std::random_device source;
+            for (auto& r : random_data)
+                r = gen(source);
+            std::seed_seq seed(
+                (std::seed_seq::result_type*)random_data.data(),
+                (std::seed_seq::result_type*)(random_data.data() + random_data.size()));
+            return T(seed);
         } catch (...) {
-            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            std::this_thread::sleep_for(std::chrono::microseconds(500));
         }
     }
-    throw std::runtime_error("Can't seed random engine");
+    throw std::runtime_error("Can't seed random seed");
+}
+
+/**
+ * Generate a random engine from another source.
+ */
+template<class T = std::mt19937, std::size_t N = T::state_size+1>
+auto getDerivedRandomEngine(T& source) -> typename std::enable_if<!!N, T>::type {
+    std::array<typename T::result_type, N> random_data;
+    std::generate(random_data.begin(), random_data.end(), std::ref(source));
+    std::seed_seq seed(
+        (std::seed_seq::result_type*)random_data.data(),
+        (std::seed_seq::result_type*)(random_data.data() + random_data.size()));
+    return T(seed);
 }
 
 }} // dht::crypto

meson.build

@@ -1,5 +1,5 @@
-project('opendht', 'c', 'cpp',
-    version: '3.1.4',
+project('opendht', 'c', 'cpp', 'cython',
+    version: '3.1.9',
     default_options: [
         'cpp_std=c++17',
         'warning_level=3'
@@ -44,6 +44,11 @@ opendht_src = [
     'src/op_cache.cpp',
     'src/network_utils.cpp'
 ]
+
+if get_option('indexation').enabled()
+    opendht_src += 'src/indexation/pht.cpp'
+    add_project_arguments('-DOPENDHT_INDEXATION', language : 'cpp')
+endif
 if jsoncpp.found()
     opendht_src += ['src/base64.cpp']
     add_project_arguments('-DOPENDHT_JSONCPP', language : 'cpp')
@@ -62,6 +67,9 @@ if get_option('proxy_server').enabled()
     opendht_src += 'src/dht_proxy_server.cpp'
     add_project_arguments('-DOPENDHT_PROXY_SERVER', language : 'cpp')
 endif
+if get_option('push_notifications').enabled()
+    add_project_arguments('-DOPENDHT_PUSH_NOTIFICATIONS', language : 'cpp')
+endif
 if get_option('peer_discovery').enabled()
     opendht_src += 'src/peer_discovery.cpp'
     add_project_arguments('-DOPENDHT_PEER_DISCOVERY', language : 'cpp')
@@ -74,26 +82,59 @@ opendht = shared_library('opendht',
     install : true)
 
 readline = meson.get_compiler('c').find_library('readline', required: get_option('tools'))
+
+if get_option('c').enabled()
+    opendht_c = shared_library('opendht-c',
+        ['c/opendht.cpp',  'c/opendht_c.h'],
+        include_directories : opendht_interface_inc,
+        link_with : opendht,
+        dependencies : [msgpack, fmt],
+        cpp_args : ['-DOPENDHT_C_BUILD', '-Dopendht_c_EXPORTS'],
+        install : true)
+
+    if get_option('tools').enabled()
+        dhtcnode = executable('dhtcnode', 'tools/dhtcnode.c',
+            include_directories : ['c', opendht_interface_inc],
+            link_with : opendht_c,
+            dependencies : [readline],
+            install : true)
+    endif
+endif
+
+if get_option('python').require(get_option('indexation').enabled(), error_message: 'python requires indexation').allowed()
+    py = import('python').find_installation()
+    dep_py = py.dependency()
+    py.extension_module(
+        'opendht',
+        'python/opendht.pyx',
+        include_directories : opendht_interface_inc,
+        override_options : ['cython_language=cpp'],
+        link_with : [opendht],
+        dependencies : [msgpack, fmt, dep_py],
+        install : true
+    )
+endif
+
 if get_option('tools').enabled()
     dhtnode = executable('dhtnode', 'tools/dhtnode.cpp',
         include_directories : opendht_interface_inc,
         link_with : opendht,
-        dependencies : [readline, msgpack, fmt],
+        dependencies : [readline, msgpack, fmt, openssl],
         install : true)
     dhtchat = executable('dhtchat', 'tools/dhtchat.cpp',
         include_directories : opendht_interface_inc,
         link_with : opendht,
-        dependencies : [readline, msgpack, fmt],
+        dependencies : [readline, msgpack, fmt, openssl],
         install : true)
     dhtscanner = executable('dhtscanner', 'tools/dhtscanner.cpp',
         include_directories : opendht_interface_inc,
         link_with : opendht,
-        dependencies : [readline, msgpack, fmt],
+        dependencies : [readline, msgpack, fmt, openssl],
         install : true)
     if http_parser.found()
         durl = executable('durl', 'tools/durl.cpp',
-        include_directories : opendht_interface_inc,
-        link_with : opendht,
-        dependencies : [msgpack, openssl])
+            include_directories : opendht_interface_inc,
+            link_with : opendht,
+            dependencies : [msgpack, openssl])
     endif
 endif

meson.options

@@ -1,4 +1,8 @@
 option('proxy_client', type : 'feature', value : 'disabled')
 option('proxy_server', type : 'feature', value : 'disabled')
+option('push_notifications', type : 'feature', value : 'disabled')
 option('peer_discovery', type : 'feature', value : 'enabled')
 option('tools', type : 'feature', value : 'enabled')
+option('c', type : 'feature', value : 'enabled')
+option('indexation', type : 'feature', value : 'enabled')
+option('python', type : 'feature', value : 'enabled')

src/Makefile.am

@@ -29,10 +29,6 @@ libopendht_la_SOURCES  = \
         network_utils.cpp \
         thread_pool.cpp
 
-if WIN32
-libopendht_la_SOURCES += rng.cpp
-endif
-
 nobase_include_HEADERS = \
         ../include/opendht.h \
         ../include/opendht/def.h \

src/compat/os_cert.cpp

@@ -17,7 +17,6 @@
  */
 
 #include "os_cert.h"
-
 #include "logger.h"
 
 #ifdef _WIN32
@@ -32,96 +31,6 @@
 #include <Security/Security.h>
 #endif /*TARGET_OS_OSX*/
 
-#if EMBEDDED_ASN1_TIME_PARSE
-#undef X509_NAME
-#undef OCSP_REQUEST
-#undef OCSP_RESPONSE
-#define GENTIME_LENGTH 15
-#define UTCTIME_LENGTH 13
-#define ATOI2(ar)      ((ar) += 2, ((ar)[-2] - '0') * 10 + ((ar)[-1] - '0'))
-extern "C" {
-// Taken from libressl/src/crypto/asn1/a_time_tm.c
-int
-ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode)
-{
-    size_t i;
-    int type = 0;
-    struct tm ltm;
-    struct tm* lt;
-    const char* p;
-
-    if (bytes == NULL)
-        return (-1);
-
-    /* Constrain to valid lengths. */
-    if (len != UTCTIME_LENGTH && len != GENTIME_LENGTH)
-        return (-1);
-
-    lt = tm;
-    if (lt == NULL) {
-        memset(&ltm, 0, sizeof(ltm));
-        lt = &ltm;
-    }
-
-    /* Timezone is required and must be GMT (Zulu). */
-    if (bytes[len - 1] != 'Z')
-        return (-1);
-
-    /* Make sure everything else is digits. */
-    for (i = 0; i < len - 1; i++) {
-        if (isdigit((unsigned char) bytes[i]))
-            continue;
-        return (-1);
-    }
-
-    /*
-     * Validate and convert the time
-     */
-    p = bytes;
-    switch (len) {
-    case GENTIME_LENGTH:
-        if (mode == V_ASN1_UTCTIME)
-            return (-1);
-        lt->tm_year = (ATOI2(p) * 100) - 1900; /* cc */
-        type = V_ASN1_GENERALIZEDTIME;
-        /* FALLTHROUGH */
-    case UTCTIME_LENGTH:
-        if (type == 0) {
-            if (mode == V_ASN1_GENERALIZEDTIME)
-                return (-1);
-            type = V_ASN1_UTCTIME;
-        }
-        lt->tm_year += ATOI2(p); /* yy */
-        if (type == V_ASN1_UTCTIME) {
-            if (lt->tm_year < 50)
-                lt->tm_year += 100;
-        }
-        lt->tm_mon = ATOI2(p) - 1; /* mm */
-        if (lt->tm_mon < 0 || lt->tm_mon > 11)
-            return (-1);
-        lt->tm_mday = ATOI2(p); /* dd */
-        if (lt->tm_mday < 1 || lt->tm_mday > 31)
-            return (-1);
-        lt->tm_hour = ATOI2(p); /* HH */
-        if (lt->tm_hour < 0 || lt->tm_hour > 23)
-            return (-1);
-        lt->tm_min = ATOI2(p); /* MM */
-        if (lt->tm_min < 0 || lt->tm_min > 59)
-            return (-1);
-        lt->tm_sec = ATOI2(p); /* SS */
-        /* Leap second 60 is not accepted. Reconsider later? */
-        if (lt->tm_sec < 0 || lt->tm_sec > 59)
-            return (-1);
-        break;
-    default:
-        return (-1);
-    }
-
-    return type;
-}
-}
-#endif /* EMBEDDED_ASN1_TIME_PARSE */
-
 namespace dht {
 namespace http {
 

src/compat/os_cert.h

@@ -24,36 +24,6 @@
 
 #include <openssl/x509.h>
 
-#if (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER > 0x20501000L))
-#define EMBEDDED_ASN1_TIME_PARSE 0
-#else
-#define EMBEDDED_ASN1_TIME_PARSE 1
-#endif
-
-#if EMBEDDED_ASN1_TIME_PARSE
-#define V_ASN1_UTCTIME         23
-#define V_ASN1_GENERALIZEDTIME 24
-
-extern "C" {
-/*
- * Parse an RFC 5280 format ASN.1 time string.
- *
- * mode must be:
- * 0 if we expect to parse a time as specified in RFC 5280 for an X509 object.
- * V_ASN1_UTCTIME if we wish to parse an RFC5280 format UTC time.
- * V_ASN1_GENERALIZEDTIME if we wish to parse an RFC5280 format Generalized time.
- *
- * Returns:
- * -1 if the string was invalid.
- * V_ASN1_UTCTIME if the string validated as a UTC time string.
- * V_ASN1_GENERALIZEDTIME if the string validated as a Generalized time string.
- *
- * Fills in *tm with the corresponding time if tm is non NULL.
- */
-int ASN1_time_parse(const char* bytes, size_t len, struct tm* tm, int mode);
-}
-#endif
-
 namespace dht {
 namespace http {
 

src/crypto.cpp

@@ -43,8 +43,6 @@ static std::uniform_int_distribution<int> rand_byte{ 0, std::numeric_limits<uint
 static std::uniform_int_distribution<uint8_t> rand_byte;
 #endif
 
-#define DHT_AES_LEGACY_DECRYPT 1
-
 namespace dht {
 namespace crypto {
 
@@ -92,7 +90,7 @@ Blob aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
 
     Blob ret(data_length + GCM_IV_SIZE + GCM_DIGEST_SIZE);
     {
-        crypto::random_device rdev;
+        std::random_device rdev;
         std::generate_n(ret.begin(), GCM_IV_SIZE, std::bind(rand_byte, std::ref(rdev)));
     }
     struct gcm_aes_ctx aes;
@@ -103,11 +101,11 @@ Blob aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
     return ret;
 }
 
-Blob aesEncrypt(const Blob& data, std::string_view password)
+Blob aesEncrypt(const Blob& data, std::string_view password, const Blob& salt)
 {
-    Blob salt;
-    Blob key = stretchKey(password, salt, 256 / 8);
-    return aesBuildEncrypted(aesEncrypt(data, key), salt);
+    Blob salt_actual = salt;
+    Blob key = stretchKey(password, salt_actual, 256 / 8);
+    return aesBuildEncrypted(aesEncrypt(data, key), salt_actual);
 }
 
 Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
@@ -130,21 +128,7 @@ Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
     gcm_aes_digest(&aes, GCM_DIGEST_SIZE, digest.data());
 
     if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
-#if DHT_AES_LEGACY_DECRYPT
-        //gcm_aes_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        Blob ret_tmp(data_sz);
-        struct gcm_aes_ctx aes_d;
-        gcm_aes_set_key(&aes_d, key.size(), key.data());
-        gcm_aes_set_iv(&aes_d, GCM_IV_SIZE, data);
-        gcm_aes_update(&aes_d, ret.size(), ret.data());
-        gcm_aes_encrypt(&aes_d, ret.size(), ret_tmp.data(), ret.data());
-        gcm_aes_digest(&aes_d, GCM_DIGEST_SIZE, digest.data());
-
-        if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE))
-            throw DecryptError("Can't decrypt data");
-#else
         throw DecryptError("Can't decrypt data");
-#endif
     }
 
     return ret;
@@ -191,7 +175,7 @@ Blob stretchKey(std::string_view password, Blob& salt, size_t key_length)
 {
     if (salt.empty()) {
         salt.resize(PASSWORD_SALT_LENGTH);
-        crypto::random_device rdev;
+        std::random_device rdev;
         std::generate_n(salt.begin(), salt.size(), std::bind(rand_byte, std::ref(rdev)));
     }
     Blob res;
@@ -307,7 +291,7 @@ PrivateKey::sign(const uint8_t* data, size_t data_length) const
         throw CryptoException("Can't sign data: no private key set !");
     if (std::numeric_limits<unsigned>::max() < data_length)
         throw CryptoException("Can't sign data: too large !");
-    gnutls_datum_t sig;
+    gnutls_datum_t sig {nullptr, 0};
     const gnutls_datum_t dat {(unsigned char*)data, (unsigned)data_length};
     if (gnutls_privkey_sign_data(key, GNUTLS_DIG_SHA512, 0, &dat, &sig) != GNUTLS_E_SUCCESS)
         throw CryptoException("Can't sign data !");
@@ -320,7 +304,7 @@ Blob
 PrivateKey::decryptBloc(const uint8_t* src, size_t src_size) const
 {
     const gnutls_datum_t dat {(uint8_t*)src, (unsigned)src_size};
-    gnutls_datum_t out;
+    gnutls_datum_t out {nullptr, 0};
     int err = gnutls_privkey_decrypt_data(key, 0, &dat, &out);
     if (err != GNUTLS_E_SUCCESS)
         throw DecryptError(std::string("Can't decrypt data: ") + gnutls_strerror(err));
@@ -498,7 +482,7 @@ void
 PublicKey::encryptBloc(const uint8_t* src, size_t src_size, uint8_t* dst, size_t dst_size) const
 {
     const gnutls_datum_t key_dat {(uint8_t*)src, (unsigned)src_size};
-    gnutls_datum_t encrypted;
+    gnutls_datum_t encrypted {nullptr, 0};
     auto err = gnutls_pubkey_encrypt_data(pk, 0, &key_dat, &encrypted);
     if (err != GNUTLS_E_SUCCESS)
         throw CryptoException(std::string("Can't encrypt data: ") + gnutls_strerror(err));
@@ -539,7 +523,7 @@ PublicKey::encrypt(const uint8_t* data, size_t data_len) const
         throw CryptoException("Key is not long enough for AES128");
     Blob key(aes_key_sz);
     {
-        crypto::random_device rdev;
+        std::random_device rdev;
         std::generate_n(key.begin(), key.size(), std::bind(rand_byte, std::ref(rdev)));
     }
     auto data_encrypted = aesEncrypt(data, data_len, key);
@@ -1001,7 +985,7 @@ Certificate::toString(bool chain) const
 std::string
 Certificate::print() const
 {
-    gnutls_datum_t out;
+    gnutls_datum_t out {nullptr, 0};
     gnutls_x509_crt_print(cert, GNUTLS_CRT_PRINT_FULL, &out);
     std::string ret(out.data, out.data+out.size);
     gnutls_free(out.data);
@@ -1077,7 +1061,7 @@ Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
     err = gnutls_ocsp_req_set_nonce(req.get(), 0, &nonce);
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
-    gnutls_datum_t rdata;
+    gnutls_datum_t rdata {nullptr, 0};
     err = gnutls_ocsp_req_export(req.get(), &rdata);
     if (err != 0)
         throw CryptoException(gnutls_strerror(err));
@@ -1170,7 +1154,7 @@ loadIdentity(const std::string &path,const std::string &privkey_password)
     gnutls_x509_crt_t gnuCert;
     if (gnutls_x509_crt_init(&gnuCert) != GNUTLS_E_SUCCESS)
         throw std::runtime_error("Failed to initialize gnutls certificate struct");
-    gnutls_datum_t crtContent;
+    gnutls_datum_t crtContent {nullptr, 0};
     // Read the certificate file
     gnutls_load_file((path + ".crt").c_str(), &crtContent);
     gnutls_x509_crt_import(gnuCert, &crtContent, GNUTLS_X509_FMT_PEM);
@@ -1193,7 +1177,7 @@ setValidityPeriod(gnutls_x509_crt_t cert, int64_t validity)
 void
 setRandomSerial(gnutls_x509_crt_t cert)
 {
-    random_device rdev;
+    std::random_device rdev;
     std::uniform_int_distribution<int64_t> dist{1};
     int64_t cert_serial = dist(rdev);
     gnutls_x509_crt_set_serial(cert, &cert_serial, sizeof(cert_serial));
@@ -1340,7 +1324,7 @@ std::string
 OcspRequest::toString(const bool compact) const
 {
     int ret;
-    gnutls_datum_t dat;
+    gnutls_datum_t dat {nullptr, 0};
     ret = gnutls_ocsp_req_print(request, compact ? GNUTLS_OCSP_PRINT_COMPACT : GNUTLS_OCSP_PRINT_FULL, &dat);
 
     std::string str;
@@ -1355,7 +1339,7 @@ OcspRequest::toString(const bool compact) const
 Blob
 OcspRequest::pack() const
 {
-    gnutls_datum_t dat;
+    gnutls_datum_t dat {nullptr, 0};
     int err = gnutls_ocsp_req_export(request, &dat);
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
@@ -1367,7 +1351,7 @@ OcspRequest::pack() const
 Blob
 OcspRequest::getNonce() const
 {
-    gnutls_datum_t dat;
+    gnutls_datum_t dat {nullptr, 0};
     unsigned critical;
     int err = gnutls_ocsp_req_get_nonce(request, &critical, &dat);
     if (err < 0)
@@ -1400,7 +1384,7 @@ OcspResponse::~OcspResponse()
 Blob
 OcspResponse::pack() const
 {
-    gnutls_datum_t dat;
+    gnutls_datum_t dat {nullptr, 0};
     int err = gnutls_ocsp_resp_export(response, &dat);
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
@@ -1414,7 +1398,7 @@ OcspResponse::toString(const bool compact) const
 {
     int ret;
     std::string str;
-    gnutls_datum_t dat;
+    gnutls_datum_t dat {nullptr, 0};
     ret = gnutls_ocsp_resp_print(response, compact ? GNUTLS_OCSP_PRINT_COMPACT : GNUTLS_OCSP_PRINT_FULL, &dat);
     if (ret == 0)
         str = std::string((const char*)dat.data, (size_t)dat.size);
@@ -1449,7 +1433,7 @@ OcspResponse::verifyDirect(const Certificate& crt, const Blob& nonce)
 
     if (not nonce.empty()) {
         // Ensure no replay attack has been done
-        gnutls_datum_t rnonce;
+        gnutls_datum_t rnonce {nullptr, 0};
         ret = gnutls_ocsp_resp_get_nonce(response, NULL, &rnonce);
         if (ret < 0)
             throw CryptoException(gnutls_strerror(ret));
@@ -1666,7 +1650,7 @@ RevocationList::sign(const PrivateKey& key, const Certificate& ca, duration vali
     if (number == 0) {
         // initialize to a random number
         number_sz = sizeof(number);
-        random_device rdev;
+        std::random_device rdev;
         std::generate_n((uint8_t*)&number, sizeof(number), std::bind(rand_byte, std::ref(rdev)));
     } else
         number = endian(endian(number) + 1);
@@ -1707,7 +1691,7 @@ RevocationList::getNumber() const
 std::string
 RevocationList::toString() const
 {
-    gnutls_datum_t out;
+    gnutls_datum_t out {nullptr, 0};
     gnutls_x509_crl_print(crl, GNUTLS_CRT_PRINT_FULL, &out);
     std::string ret(out.data, out.data+out.size);
     gnutls_free(out.data);

src/dht.cpp

@@ -1815,8 +1815,9 @@ fromDhtConfig(const Config& config)
     return netConf;
 }
 
-Dht::Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l)
+Dht::Dht(std::unique_ptr<net::DatagramSocket>&& sock, const Config& config, const Sp<Logger>& l, std::unique_ptr<std::mt19937_64>&& rda)
     : DhtInterface(l),
+    rd(rda ? std::move(*rda) : crypto::getSeededRandomEngine<std::mt19937_64>()),
     myid(config.node_id ? config.node_id : InfoHash::getRandom(rd)),
     store(),
     store_quota(),

src/dht_proxy_client.cpp

@@ -26,7 +26,6 @@
 #include <http_parser.h>
 #include <deque>
 
-
 namespace dht {
 
 struct DhtProxyClient::InfoState {
@@ -98,7 +97,7 @@ std::string
 getRandomSessionId(size_t length = 8) {
     static constexpr const char chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;<=>?@[]^_`{|}~";
     std::string str(length, 0);
-    crypto::random_device rdev;
+    std::random_device rdev;
     std::uniform_int_distribution<> dist(0, (sizeof(chars)/sizeof(char)) - 2);
     std::generate_n( str.begin(), length, [&]{ return chars[dist(rdev)]; } );
     return str;
@@ -191,10 +190,12 @@ void
 DhtProxyClient::stop()
 {
     if (not isDestroying_.exchange(true)) {
+        std::shared_ptr<http::Resolver> resolver;
         {
             std::lock_guard<std::mutex> l(resolverLock_);
-            resolver_.reset();
+            resolver = std::move(resolver_);
         }
+        resolver->cancel();
         cancelAllListeners();
         if (infoState_)
             infoState_->cancel = true;

src/dht_proxy_server.cpp

@@ -1061,7 +1061,7 @@ DhtProxyServer::sendPushNotification(const std::string& token, Json::Value&& jso
         std::shared_ptr<http::Request> request;
         http::Url tokenUrl(token);
         if (type == PushType::UnifiedPush)
-            request = std::make_shared<http::Request>(io_context(), tokenUrl.protocol + "://" + tokenUrl.host, logger_);
+            request = std::make_shared<http::Request>(io_context(), tokenUrl.protocol + "://" + tokenUrl.host + (tokenUrl.service.empty() ? "" : (":" + tokenUrl.service)), logger_);
         else
             request = std::make_shared<http::Request>(io_context(), pushHostPort_.first, pushHostPort_.second, pushHostPort_.first.find("https://") == 0, logger_);;
         reqid = request->id();

src/dhtrunner.cpp

@@ -167,7 +167,7 @@ DhtRunner::run(const Config& config, Context&& context)
                 outConfig << context.sock->getBoundRef(AF_INET).getPort() << std::endl;
                 outConfig << context.sock->getBoundRef(AF_INET6).getPort() << std::endl;
             }
-            auto dht = std::make_unique<Dht>(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger);
+            auto dht = std::make_unique<Dht>(std::move(context.sock), SecureDht::getConfig(config.dht_config), context.logger, std::move(context.rng));
             dht_ = std::make_unique<SecureDht>(std::move(dht), config.dht_config, std::move(context.identityAnnouncedCb), context.logger);
         } else {
             enableProxy(true);
@@ -210,7 +210,7 @@ DhtRunner::run(const Config& config, Context&& context)
                     if (not pending_ops_prio.empty())
                         return true;
                     auto s = getStatus();
-                    if (not pending_ops.empty() and (s == NodeStatus::Connected or s == NodeStatus::Disconnected))
+                    if (not pending_ops.empty() and (s == NodeStatus::Connected or s == NodeStatus::Disconnected or running == State::Stopping))
                         return true;
                 }
                 return false;
@@ -284,7 +284,7 @@ DhtRunner::shutdown(ShutdownCallback cb, bool stop) {
         return;
     }
     if (logger_)
-        logger_->d("[runner %p] state changed to Stopping, %zu ongoing ops", fmt::ptr(this), ongoing_ops.load());
+        logger_->debug("[runner {:p}] state changed to Stopping, {:d} ongoing ops", fmt::ptr(this), ongoing_ops.load());
     ongoing_ops++;
     shutdownCallbacks_.emplace_back(std::move(cb));
     pending_ops.emplace([=](SecureDht&) mutable {
@@ -349,7 +349,7 @@ DhtRunner::join()
             if (auto sock = dht_->getSocket())
                 sock->stop();
         if (logger_)
-            logger_->d("[runner %p] state changed to Idle", fmt::ptr(this));
+            logger_->debug("[runner {:p}] state changed to Idle", fmt::ptr(this));
     }
 
     if (dht_thread.joinable())
@@ -358,7 +358,7 @@ DhtRunner::join()
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
         if (ongoing_ops and logger_) {
-            logger_->w("[runner %p] stopping with %zu remaining ops", fmt::ptr(this), ongoing_ops.load());
+            logger_->warn("[runner {:p}] stopping with {:d} remaining ops", fmt::ptr(this), ongoing_ops.load());
         }
         pending_ops = decltype(pending_ops)();
         pending_ops_prio = decltype(pending_ops_prio)();
@@ -630,7 +630,7 @@ DhtRunner::loop_()
     {
         std::lock_guard<std::mutex> lck(storage_mtx);
         auto s = getStatus();
-        ops = (pending_ops_prio.empty() && (s == NodeStatus::Connected or s == NodeStatus::Disconnected)) ?
+        ops = (pending_ops_prio.empty() && (s == NodeStatus::Connected or s == NodeStatus::Disconnected or running == State::Stopping)) ?
                std::move(pending_ops) : std::move(pending_ops_prio);
     }
     while (not ops.empty()) {

src/http.cpp

@@ -144,12 +144,12 @@ Connection::Connection(asio::io_context& ctx, const bool ssl, std::shared_ptr<dh
         ssl_ctx_ = newTlsClientContext(l);
         ssl_socket_ = std::make_unique<ssl_socket_t>(ctx_, ssl_ctx_);
         if (logger_)
-            logger_->d("[connection:%i] start https session with system CA", id_);
+            logger_->debug("[connection:{:d}] start https session with system CA", id_);
     }
     else {
         socket_ = std::make_unique<socket_t>(ctx);
         if (logger_)
-            logger_->d("[connection:%i] start http session", id_);
+            logger_->debug("[connection:{:d}] start http session", id_);
     }
 }
 
@@ -166,11 +166,11 @@ Connection::Connection(asio::io_context& ctx, std::shared_ptr<dht::crypto::Certi
         if (ec)
             throw std::runtime_error("Error adding certificate authority: " + ec.message());
         else if (logger_)
-            logger_->d("[connection:%i] start https with custom CA %s", id_, server_ca->getUID().c_str());
+            logger_->debug("[connection:{:d}] start https with custom CA {:s}", id_, server_ca->getUID());
     } else {
         ssl_ctx_ = newTlsClientContext(l);
         if (logger_)
-            logger_->d("[connection:%i] start https session with system CA", id_);
+            logger_->debug("[connection:{:d}] start https session with system CA", id_);
     }
     if (identity.first){
         auto key = identity.first->serialize();
@@ -185,7 +185,7 @@ Connection::Connection(asio::io_context& ctx, std::shared_ptr<dht::crypto::Certi
         if (ec)
             throw std::runtime_error("Error adding client certificate: " + ec.message());
         else if (logger_)
-            logger_->d("[connection:%i] client certificate %s", id_, identity.second->getUID().c_str());
+            logger_->debug("[connection:{:d}] client certificate {:s}", id_, identity.second->getUID());
     }
     ssl_socket_ = std::make_unique<ssl_socket_t>(ctx_, ssl_ctx_);
 }
@@ -208,7 +208,7 @@ Connection::close()
             socket_->close(ec);
     }
     if (ec and logger_)
-        logger_->e("[connection:%i] error closing: %s", id_, ec.message().c_str());
+        logger_->error("[connection:{:d}] error closing: {:s}", id_, ec.message());
 }
 
 bool
@@ -225,20 +225,25 @@ Connection::is_ssl() const
     return ssl_ctx_ ? true : false;
 }
 
-static time_t
-parse_ocsp_time(ASN1_GENERALIZEDTIME* gt)
-{
-    struct tm tm;
-    time_t rv = -1;
+std::string asn1ToString(ASN1_GENERALIZEDTIME* time) {
+    if (!time) {
+        return "(null)";
+    }
+    BIO* memBio = BIO_new(BIO_s_mem());
+    if (!memBio) {
+        throw std::runtime_error("Failed to create BIO");
+    }
 
-    if (gt == nullptr)
-        return -1;
-    // RFC 6960 specifies that all times in OCSP must be GENERALIZEDTIME
-    if (ASN1_time_parse((const char*)gt->data, gt->length, &tm, V_ASN1_GENERALIZEDTIME) == -1)
-        return -1;
-    if ((rv = timegm(&tm)) == -1)
-        return -1;
-    return rv;
+    if (ASN1_GENERALIZEDTIME_print(memBio, time) <= 0) {
+        BIO_free(memBio);
+        throw std::runtime_error("Failed to print ASN1_GENERALIZEDTIME");
+    }
+
+    char* bioData;
+    long bioLength = BIO_get_mem_data(memBio, &bioData);
+    std::string result(bioData, bioLength);
+    BIO_free(memBio);
+    return result;
 }
 
 static inline X509*
@@ -276,26 +281,26 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
 
     if (sk_X509_num(fullchain) <= 1) {
         if (logger)
-            logger->e("Cert does not contain a cert chain");
+            logger->error("Cert does not contain a cert chain");
         return {};
     }
     X509* cert = cert_from_chain(fullchain);
     if (cert == nullptr) {
         if (logger)
-            logger->e("No certificate found");
+            logger->error("No certificate found");
         return {};
     }
     X509* issuer = issuer_from_chain(fullchain);
     if (issuer == nullptr) {
         if (logger)
-            logger->e("Unable to find issuer for cert");
+            logger->error("Unable to find issuer for cert");
         return {};
     }
 
     auto urls = X509_get1_ocsp(cert);
     if (urls == nullptr || sk_OPENSSL_STRING_num(urls) <= 0) {
         if (logger)
-            logger->e("Certificate contains no OCSP url");
+            logger->error("Certificate contains no OCSP url");
         return {};
     }
     auto url = sk_OPENSSL_STRING_value(urls, 0);
@@ -310,12 +315,12 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
     OCSP_CERTID* id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
     if (id == nullptr) {
         if (logger)
-            logger->e("Unable to get certificate id from cert");
+            logger->error("Unable to get certificate id from cert");
         return {};
     }
     if (OCSP_request_add0_id(request->req.get(), id) == nullptr) {
         if (logger)
-            logger->e("Unable to add certificate id to request");
+            logger->error("Unable to add certificate id to request");
         return {};
     }
 
@@ -326,12 +331,12 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
     uint8_t* data {nullptr};
     if ((size = i2d_OCSP_REQUEST(request->req.get(), &data)) <= 0) {
         if (logger)
-            logger->e("Unable to encode ocsp request");
+            logger->error("Unable to encode ocsp request");
         return {};
     }
     if (data == nullptr) {
         if (logger)
-            logger->e("Unable to allocte memory");
+            logger->error("Unable to allocte memory");
         return {};
     }
     request->data = std::string((char*)data, (char*)data+size);
@@ -342,36 +347,32 @@ ocspRequestFromCert(STACK_OF(X509)* fullchain, const std::shared_ptr<Logger>& lo
 bool
 ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, const std::string& response, X509_STORE *store, const std::shared_ptr<Logger>& logger)
 {
-    ASN1_GENERALIZEDTIME *revtime = nullptr, *thisupd = nullptr, *nextupd = nullptr;
-    const uint8_t* p = (const uint8_t*)response.data();
-    int status, cert_status=0, crl_reason=0;
-    time_t now, rev_t = -1, this_t, next_t;
-
     X509* cert = cert_from_chain(fullchain);
     if (cert == nullptr) {
         if (logger)
-            logger->e("No certificate found");
+            logger->error("ocsp: no certificate found");
         return false;
     }
     X509* issuer = issuer_from_chain(fullchain);
     if (issuer == nullptr) {
         if (logger)
-            logger->e("Unable to find issuer for cert");
+            logger->error("ocsp: unable to find issuer for cert");
         return false;
     }
 
     OCSP_CERTID *cidr;
     if ((cidr = OCSP_cert_to_id(nullptr, cert, issuer)) == nullptr) {
         if (logger)
-            logger->e("Unable to get issuer cert/CID");
+            logger->error("ocsp: unable to get issuer cert/CID");
         return false;
     }
     std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> cid(cidr, &OCSP_CERTID_free);
 
+    const uint8_t* resp_data = (const uint8_t*)response.data();
     OCSP_RESPONSE *r;
-    if ((r = d2i_OCSP_RESPONSE(nullptr, &p, response.size())) == nullptr) {
+    if ((r = d2i_OCSP_RESPONSE(nullptr, &resp_data, response.size())) == nullptr) {
         if (logger)
-            logger->e("OCSP response unserializable");
+            logger->error("OCSP response unserializable");
         return false;
     }
     std::unique_ptr<OCSP_RESPONSE, decltype(&OCSP_RESPONSE_free)> resp(r, &OCSP_RESPONSE_free);
@@ -379,99 +380,59 @@ ocspValidateResponse(const OscpRequestInfo& info, STACK_OF(X509)* fullchain, con
     OCSP_BASICRESP *brespr;
     if ((brespr = OCSP_response_get1_basic(resp.get())) == nullptr) {
         if (logger)
-            logger->e("Failed to load OCSP response");
+            logger->error("Failed to load OCSP response");
         return false;
     }
     std::unique_ptr<OCSP_BASICRESP, decltype(&OCSP_BASICRESP_free)> bresp(brespr, &OCSP_BASICRESP_free);
 
     if (OCSP_basic_verify(bresp.get(), fullchain, store, OCSP_TRUSTOTHER) != 1) {
         if (logger)
-            logger->w("OCSP verify failed");
+            logger->warn("OCSP verify failed");
         return false;
     }
-    printf("OCSP response signature validated\n");
 
-    status = OCSP_response_status(resp.get());
+    int status = OCSP_response_status(resp.get());
     if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
         if (logger)
-            logger->w("OCSP Failure: code %d (%s)", status, OCSP_response_status_str(status));
+            logger->warn("OCSP Failure: code {:d} ({:s})", status, OCSP_response_status_str(status));
         return false;
     }
 
     // Check the nonce if we sent one
     if (OCSP_check_nonce(info.req.get(), bresp.get()) <= 0) {
         if (logger)
-            logger->w("No OCSP nonce, or mismatch");
+            logger->warn("No OCSP nonce, or mismatch");
         return false;
     }
 
+    ASN1_GENERALIZEDTIME *revtime = nullptr, *thisupd = nullptr, *nextupd = nullptr;
+    int cert_status=0, crl_reason=0;
     if (OCSP_resp_find_status(bresp.get(), cid.get(), &cert_status, &crl_reason,
         &revtime, &thisupd, &nextupd) != 1) {
         if (logger)
-            logger->w("OCSP verify failed: no result for cert");
+            logger->warn("OCSP verify failed: no result for cert");
         return false;
     }
 
-    if (revtime && (rev_t = parse_ocsp_time(revtime)) == -1) {
-        if (logger)
-            logger->w("Unable to parse revocation time in OCSP reply");
-        return false;
-    }
     // Belt and suspenders, Treat it as revoked if there is either
     // a revocation time, or status revoked.
-    if (rev_t != -1 || cert_status == V_OCSP_CERTSTATUS_REVOKED) {
-        if (logger)
-            logger->w("Invalid OCSP reply: certificate is revoked");
-        if (rev_t != -1) {
-            if (logger)
-                logger->w("Certificate revoked at: %s", ctime(&rev_t));
+    if (revtime || cert_status == V_OCSP_CERTSTATUS_REVOKED) {
+        if (logger) {
+            logger->warn("OCSP verify failed: certificate revoked since {}", asn1ToString(revtime));
         }
         return false;
     }
-    if ((this_t = parse_ocsp_time(thisupd)) == -1) {
-        if (logger)
-            logger->w("unable to parse this update time in OCSP reply");
-        return false;
-    }
-    if ((next_t = parse_ocsp_time(nextupd)) == -1) {
-        if (logger)
-            logger->w("unable to parse next update time in OCSP reply");
-        return false;
-    }
 
-    // Don't allow this update to precede next update
-    if (this_t >= next_t) {
+    if (OCSP_check_validity(thisupd, nextupd, 1, -1) == 0) {
         if (logger)
-            logger->w("Invalid OCSP reply: this update >= next update");
-        return false;
-    }
-
-    now = time(nullptr);
-    // Check that this update is not more than JITTER seconds in the future.
-    if (this_t > now + JITTER_SEC) {
-        if (logger)
-            logger->e("Invalid OCSP reply: this update is in the future (%s)", ctime(&this_t));
-        return false;
-    }
-
-    // Check that this update is not more than MAXSEC in the past.
-    if (this_t < now - MAXAGE_SEC) {
-        if (logger)
-            logger->e("Invalid OCSP reply: this update is too old (%s)", ctime(&this_t));
-        return false;
-    }
-
-    // Check that next update is still valid
-    if (next_t < now - JITTER_SEC) {
-        if (logger)
-            logger->w("Invalid OCSP reply: reply has expired (%s)", ctime(&next_t));
+            logger->warn("OCSP reply is expired or not yet valid");
         return false;
     }
 
     if (logger) {
-        logger->d("OCSP response validated");
-        logger->d("	   This Update: %s", ctime(&this_t));
-        logger->d("	   Next Update: %s", ctime(&next_t));
+        logger->debug("OCSP response validated");
+        logger->debug("	   This Update: {}", asn1ToString(thisupd));
+        logger->debug("	   Next Update: {}", asn1ToString(nextupd));
     }
     return true;
 }
@@ -492,7 +453,7 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                     if (logger) {
                         char subject_name[1024];
                         X509_NAME_oneline(X509_get_subject_name(cert), subject_name, 1024);
-                        logger->d("[connection:%i] verify %s compliance to RFC 2818:\n%s", id, hostname.c_str(), subject_name);
+                        logger->debug("[connection:{:d}] verify {:s} compliance to RFC 2818:\n{:s}", id, hostname, subject_name);
                     }
 
                     // starts from CA and goes down the presented chain
@@ -500,14 +461,14 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                     bool verified = verifier(preverified, ctx);
                     auto verify_ec = X509_STORE_CTX_get_error(ctx.native_handle());
                     if (verify_ec != 0 /*X509_V_OK*/ and logger)
-                        logger->e("[http::connection:%i] ssl verification error=%i %d", id, verify_ec, verified);
+                        logger->error("[http::connection:{:d}] ssl verification error={:d} %d", id, verify_ec, verified);
                     if (verified and checkOcsp) {
                         std::unique_ptr<stack_st_X509, void(*)(stack_st_X509*)> chain(
                             X509_STORE_CTX_get1_chain(ctx.native_handle()),
                             [](stack_st_X509* c){ sk_X509_pop_free(c, X509_free); });
                         if (auto ocspInfo = ocspRequestFromCert(chain.get(), logger)) {
                             if (logger)
-                                logger->w("[http::connection:%i] TLS OCSP server: %s, request size: %zu", id, ocspInfo->url.c_str(), ocspInfo->data.size());
+                                logger->warn("[http::connection:{:d}] TLS OCSP server: {:s}, request size: {:d}", id, ocspInfo->url, ocspInfo->data.size());
                             bool ocspVerified = false;
                             asio::io_context io_ctx;
                             auto ocspReq = std::make_shared<Request>(io_ctx, ocspInfo->url, [&](const Response& ocspResp){
@@ -515,7 +476,7 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                                     ocspVerified = ocspValidateResponse(*ocspInfo, chain.get(), ocspResp.body, X509_STORE_CTX_get0_store(ctx.native_handle()), logger);
                                 } else {
                                     if (logger)
-                                        logger->w("[http::connection:%i] TLS OCSP check error", id);
+                                        logger->warn("[http::connection:{:d}] TLS OCSP check error", id);
                                 }
                             }, logger);
                             ocspReq->set_method(restinio::http_method_post());
@@ -646,11 +607,11 @@ Connection::async_handshake(HandlerCb cb)
                 if (this_.logger_) {
                     if (verify_ec == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT /*18*/
                         || verify_ec == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN /*19*/)
-                        this_.logger_->d("[connection:%i] self-signed certificate in handshake: %i", this_.id_, verify_ec);
+                        this_.logger_->debug("[connection:{:d}] self-signed certificate in handshake: {:d}", this_.id_, verify_ec);
                     else if (verify_ec != X509_V_OK)
-                        this_.logger_->e("[connection:%i] verify handshake error: %i", this_.id_, verify_ec);
+                        this_.logger_->error("[connection:{:d}] verify handshake error: {:d}", this_.id_, verify_ec);
                     else
-                        this_.logger_->w("[connection:%i] verify handshake success", this_.id_);
+                        this_.logger_->warn("[connection:{:d}] verify handshake success", this_.id_);
                 }
             }
             if (cb)
@@ -749,7 +710,7 @@ Connection::timeout(const std::chrono::seconds& timeout, HandlerCb cb)
             return;
         else if (ec){
             if (logger)
-                logger->e("[connection:%i] timeout error: %s", id, ec.message().c_str());
+                logger->error("[connection:{:d}] timeout error: {:s}", id, ec.message());
         }
         if (cb)
             cb(ec);
@@ -799,6 +760,12 @@ Resolver::~Resolver()
     *destroyed_ = true;
 }
 
+void
+Resolver::cancel()
+{
+    resolver_.cancel();
+}
+
 inline
 std::vector<asio::ip::tcp::endpoint>
 filter(const std::vector<asio::ip::tcp::endpoint>& epts, sa_family_t family)
@@ -840,9 +807,8 @@ Resolver::resolve(const std::string& host, const std::string& service)
         if (ec == asio::error::operation_aborted or *destroyed)
             return;
         if (logger_) {
-            if (ec)
-                logger_->e("[http:client] [resolver] error for %s:%s: %s",
-                           host.c_str(), service.c_str(), ec.message().c_str());
+            logger_->error("[http:client] [resolver] result for {:s}:{:s}: {:s}",
+                        host, service, ec.message());
         }
         decltype(cbs_) cbs;
         {
@@ -884,7 +850,7 @@ Request::Request(asio::io_context& ctx, const std::string& url, const Json::Valu
             Json::CharReaderBuilder rbuilder;
             auto reader = std::unique_ptr<Json::CharReader>(rbuilder.newCharReader());
             if (!reader->parse(response.body.data(), response.body.data() + response.body.size(), &json, &err) and logger_)
-                logger_->e("[http:request:%i] can't parse response to json", id_, err.c_str());
+                logger_->error("[http:request:{:d}] can't parse response to json: {:s}", id_, err);
         }
         if (jsoncb)
             jsoncb(std::move(json), response);
@@ -906,7 +872,7 @@ Request::Request(asio::io_context& ctx, const std::string& url, OnJsonCb jsoncb,
             Json::CharReaderBuilder rbuilder;
             auto reader = std::unique_ptr<Json::CharReader>(rbuilder.newCharReader());
             if (!reader->parse(response.body.data(), response.body.data() + response.body.size(), &json, &err) and logger_)
-                logger_->e("[http:request:%i] can't parse response to json", id_, err.c_str());
+                logger_->error("[http:request:{:d}] can't parse response to json: {:s}", id_, err);
         }
         if (jsoncb)
             jsoncb(std::move(json), response);
@@ -974,6 +940,8 @@ Request::init_default_headers()
 void
 Request::cancel()
 {
+    if (auto r = resolver_)
+        r->cancel();
     if (auto c = conn_)
         c->close();
 }
@@ -1070,7 +1038,7 @@ Request::build()
         break;
     case restinio::http_connection_header_t::upgrade:
         if (logger_)
-            logger_->e("Unsupported connection type 'upgrade', fallback to 'close'");
+            logger_->error("Unsupported connection type 'upgrade', fallback to 'close'");
     // fallthrough
     case restinio::http_connection_header_t::close:
         conn_str = "close"; // default
@@ -1201,7 +1169,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
 {
     if (endpoints.empty()){
         if (logger_)
-            logger_->e("[http:request:%i] connect: no endpoints provided", id_);
+            logger_->error("[http:request:{:d}] connect: no endpoints provided", id_);
         if (cb)
             cb(asio::error::connection_aborted);
         return;
@@ -1210,7 +1178,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
         std::string eps = "";
         for (const auto& endpoint : endpoints)
             eps.append(endpoint.address().to_string() + ":" + std::to_string(endpoint.port()) + " ");
-        logger_->d("[http:request:%i] connect begin: %s", id_, eps.c_str());
+        logger_->debug("[http:request:{:d}] connect begin: {:s}", id_, eps);
     }
     bool isHttps = get_url().protocol == "https";
     if (isHttps) {
@@ -1241,7 +1209,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
         }
         else if (ec) {
             if (this_.logger_)
-                this_.logger_->e("[http:request:%i] connect failed with all endpoints: %s", this_.id_, ec.message().c_str());
+                this_.logger_->error("[http:request:{:d}] connect failed with all endpoints: {:s}", this_.id_, ec.message());
         } else {
             const auto& url = this_.get_url();
             auto port = endpoint.port();
@@ -1257,9 +1225,9 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
                         if (ec == asio::error::operation_aborted)
                             return;
                         if (ec and logger)
-                            logger->e("[http:request:%i] handshake error: %s", id, ec.message().c_str());
+                            logger->error("[http:request:{:d}] handshake error: {:s}", id, ec.message());
                         //else if (logger)
-                        //    logger->d("[http:request:%i] handshake success", id);
+                        //    logger->d("[http:request:{:d}] handshake success", id);
                         if (cb)
                             cb(ec);
                     });
@@ -1287,7 +1255,7 @@ Request::send()
             std::lock_guard<std::mutex> lock(this_.mutex_);
             if (ec){
                 if (this_.logger_)
-                    this_.logger_->e("[http:request:%i] resolve error: %s", this_.id_, ec.message().c_str());
+                    this_.logger_->error("[http:request:{:d}] resolve error: {:s}", this_.id_, ec.message());
                 this_.terminate(asio::error::connection_aborted);
             }
             else if (!this_.conn_ or !this_.conn_->is_open()) {
@@ -1345,9 +1313,9 @@ Request::terminate(const asio::error_code& ec)
 
     if (logger_) {
         if (ec and ec != asio::error::eof and !response_.aborted)
-            logger_->e("[http:request:%i] end with error: %s", id_, ec.message().c_str());
+            logger_->error("[http:request:{:d}] end with error: {:s}", id_, ec.message());
         else
-            logger_->d("[http:request:%i] done with status code %u", id_, response_.status_code);
+            logger_->debug("[http:request:{:d}] done with status code {:d}", id_, response_.status_code);
     }
 
     if (!parser_ or !http_should_keep_alive(parser_.get()))

src/indexation/pht.cpp

@@ -316,7 +316,7 @@ void Pht::updateCanary(Prefix p) {
     dht_->put(p.hash(), std::move(canary_value),
         [=](bool){
             static std::bernoulli_distribution d(0.5);
-            crypto::random_device rd;
+            std::random_device rd;
             if (p.size_ and d(rd))
                 updateCanary(p.getPrefix(-1));
         }

src/rng.cpp

@@ -1,117 +0,0 @@
-/*
- *  Copyright (C) 2014-2023 Savoir-faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include "rng.h"
-
-#include <chrono>
-#include <cstring>
-
-namespace dht {
-namespace crypto {
-
-random_device::random_device() :
-   gen(std::chrono::system_clock::now().time_since_epoch().count() ^ std::chrono::high_resolution_clock::now().count())
-{}
-
-random_device::result_type
-random_device::operator()()
-{
-    result_type prand = dis(gen);
-    result_type hwrand;
-    if (hasRdseed() and rdseed(&hwrand))
-        prand ^= hwrand;
-    else if (hasRdrand() and rdrand(&hwrand))
-        prand ^= hwrand;
-    return prand;
-}
-
-random_device::CPUIDinfo::CPUIDinfo(const unsigned int func, const unsigned int subfunc)
-{
-    __asm__ __volatile__ (
-        "cpuid"
-        : "=a"(EAX), "=b"(EBX), "=c"(ECX), "=d"(EDX)
-        : "a"(func), "c"(subfunc)
-    );
-}
-
-bool
-random_device::hasIntelCpu()
-{
-    CPUIDinfo info (0, 0);
-    return (memcmp((char *) (&info.EBX), "Genu", 4) == 0
-         && memcmp((char *) (&info.EDX), "ineI", 4) == 0
-         && memcmp((char *) (&info.ECX), "ntel", 4) == 0);
-}
-
-bool
-random_device::_hasRdrand()
-{
-    return hasIntelCpu() && (CPUIDinfo {1, 0}.ECX & (1 << 30));
-}
-
-bool
-random_device::_hasRdseed()
-{
-    return hasIntelCpu() && (CPUIDinfo {7, 0}.ECX & (1 << 18));
-}
-
-bool
-random_device::rdrandStep(result_type* r)
-{
-    unsigned char ok;
-    asm volatile ("rdrand %0; setc %1"
-        : "=r" (*r), "=qm" (ok));
-    return ok;
-}
-
-bool
-random_device::rdrand(result_type* r)
-{
-    result_type res;
-    unsigned retries = 8;
-    while (retries--)
-        if (rdrandStep(&res)) {
-            *r = res;
-            return true;
-        }
-    return false;
-}
-
-bool
-random_device::rdseedStep(result_type* r)
-{
-    unsigned char ok;
-    asm volatile ("rdseed %0; setc %1"
-        : "=r" (*r), "=qm" (ok));
-    return ok;
-}
-
-bool
-random_device::rdseed(result_type* r)
-{
-    result_type res;
-    unsigned retries = 256;
-    while (retries--)
-        if (rdseedStep(&res)) {
-            *r = res;
-            return true;
-        }
-    return false;
-}
-
-}}

src/search.h

@@ -854,12 +854,17 @@ Dht::Search::insertNode(const Sp<Node>& snode, time_point now, const Blob& token
             expired = false;
         }
 
-        while (nodes.size() - bad >  SEARCH_NODES) {
+        while (nodes.size() - bad > SEARCH_NODES) {
+            bool removingNode = nodes.back()->node == snode;
             if (not expired and nodes.back()->isBad())
                 bad--;
             nodes.pop_back();
+            if (removingNode)
+                return false;
         }
     }
+    if (n == nodes.end() or not *n)
+        return false;
     if (not token.empty()) {
         (*n)->candidate = false;
         (*n)->last_get_reply = now;

src/securedht.cpp

@@ -337,7 +337,7 @@ SecureDht::putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback,
         return;
     }
     if (val->id == Value::INVALID_ID) {
-        crypto::random_device rdev;
+        std::random_device rdev;
         std::uniform_int_distribution<Value::Id> rand_id;
         val->id = rand_id(rdev);
     }

tools/dhtchat.cpp

@@ -30,7 +30,7 @@ extern "C" {
 
 using namespace dht;
 
-static std::mt19937_64 rd {dht::crypto::random_device{}()};
+static std::mt19937_64 rd {dht::crypto::getSeededRandomEngine<std::mt19937_64>()};
 static std::uniform_int_distribution<dht::Value::Id> rand_id;
 
 const std::string printTime(const std::time_t& now) {

tools/dhtnode.cpp

@@ -449,7 +449,7 @@ void cmd_loop(std::shared_ptr<DhtRunner>& node, dht_params& params
             value->user_type = "text/plain";
             node->putEncrypted(id, InfoHash(tostr), std::move(value), [start](bool ok) {
                 auto end = std::chrono::high_resolution_clock::now();
-                std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took " << print_duration(end-start) << std::endl;
+                std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took " << print_duration(end-start) << ')' << std::endl;
             });
         }
         else if (op == "a") {