proxy client: always resubscribe on connectivity change

Track subscribe/permanent-put expiration with std::chrono::system_clock
(wall clock) instead of steady_clock in both the proxy client and server,
so persisted expirations survive restarts and map directly to epoch time.

- DhtProxyServer::clock is now system_clock; expireTimer/expireNotifyTimer
  use asio::system_timer.
- DhtProxyClient::refreshSubscriberTimer uses asio::system_timer and
  system_clock::now() for subscriber refresh.

.github/workflows/ccpp.yml

@@ -7,7 +7,7 @@ env:
   UBUNTU_FULL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
   UBUNTU_MESON_DEPS: "ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-dev python3-setuptools python3-pip libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
   UBUNTU_MINIMAL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libfmt-dev libgnutls28-dev libcppunit-dev libmsgpack-dev libargon2-dev"
-  DEBIAN12_DEPS: "git libtool pkg-config wget cmake libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
+  DEBIAN13_DEPS: "git libtool pkg-config wget cmake libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-dev libargon2-dev"
 
 on: [push, pull_request]
 
@@ -16,7 +16,7 @@ jobs:
     name: Ubuntu/GCC Meson build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Dependencies
         run: |
@@ -40,7 +40,7 @@ jobs:
       matrix:
         cxx_standard: [17, 20, 23]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Minimal Dependencies
         run: |
@@ -65,12 +65,12 @@ jobs:
       - name: Run Unit tests
         run: ctest --output-on-failure --test-dir build
 
-  build-debian12:
-    name: Debian 12/GCC build
+  build-debian13:
+    name: Debian 13/GCC build
     runs-on: ubuntu-latest
 
     container:
-      image: debian:12
+      image: debian:13
       volumes:
         - .:/workspace
       options: --workdir /workspace
@@ -78,12 +78,12 @@ jobs:
         DEBIAN_FRONTEND: noninteractive
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Dependencies
         run: |
           apt-get update
-          apt-get install -y $DEBIAN12_DEPS
+          apt-get install -y $DEBIAN13_DEPS
 
       - name: Build llhttp dependency
         run: |
@@ -131,7 +131,7 @@ jobs:
       matrix:
         cxx_standard: [17, 20, 23]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Homebrew Dependencies
         run: brew install msgpack-cxx asio gnutls nettle readline fmt jsoncpp argon2 openssl cppunit

.github/workflows/clang-analyzer.yml

@@ -6,7 +6,7 @@ jobs:
     name: Clang Static Analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: deps
         run: |
           sudo apt update && \

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/python-wheels.yml

@@ -16,18 +16,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Run locally with: pipx run cibuildwheel --platform linux python
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.4.0
+        uses: pypa/cibuildwheel@v4.1.1
         with:
           package-dir: python
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: opendht-wheels-${{ matrix.os }}
           path: ./wheelhouse/*.whl
@@ -36,7 +36,7 @@ jobs:
     name: Build wheels on Windows
     runs-on: windows-latest
     env:
-      VCPKG_VERSION: "2025.07.25"
+      VCPKG_VERSION: "2026.06.01"
       VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
       VCPKG_DISABLE_METRICS: "1"
       VCPKG_DEFAULT_TRIPLET: x64-windows-release
@@ -44,11 +44,11 @@ jobs:
       VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache vcpkg installed packages
         id: cache-vcpkg
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -86,7 +86,7 @@ jobs:
           pipx run cibuildwheel python
         shell: pwsh
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: opendht-wheels-win_amd64
           path: ./build/wheelhouse/*.whl
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build_wheels, build_wheels_windows]
     steps:
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
       with:
         pattern: opendht-wheels-*
         path: dist

.github/workflows/release-package.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -47,7 +47,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileDeps
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -89,7 +89,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -129,7 +129,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_LLVM }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileDepsLlvm
@@ -148,7 +148,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -171,7 +171,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LLVM }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileLlvm
@@ -190,7 +190,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -213,7 +213,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DHTNODE }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileDhtnode
@@ -231,7 +231,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -254,7 +254,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE_DEPS }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileDepsAlpine
@@ -273,7 +273,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -296,7 +296,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/DockerfileAlpine
@@ -309,7 +309,7 @@ jobs:
     name: Build Windows MSI Installer
     runs-on: windows-latest
     env:
-      VCPKG_VERSION: "2025.07.25"
+      VCPKG_VERSION: "2026.06.01"
       VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
       VCPKG_DISABLE_METRICS: "1"
       VCPKG_DEFAULT_TRIPLET: x64-windows
@@ -319,12 +319,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
       
       - name: Install WIX using .net tools
         run: |
@@ -334,7 +334,7 @@ jobs:
 
       - name: Cache vcpkg installed packages
         id: cache-vcpkg
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -403,7 +403,7 @@ jobs:
           }
 
       - name: Upload MSI Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-msi
           path: build/${{ steps.cpack_msi.outputs.msi_path }} # Path to the MSI in the build directory
@@ -413,7 +413,7 @@ jobs:
     name: Build Windows dhtnode
     runs-on: windows-latest
     env:
-      VCPKG_VERSION: "2025.07.25"
+      VCPKG_VERSION: "2026.06.01"
       VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
       VCPKG_DISABLE_METRICS: "1"
       VCPKG_DEFAULT_TRIPLET: x64-windows-static-release
@@ -423,16 +423,16 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
       - name: Cache vcpkg static installed packages
         id: cache-vcpkg-static
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -483,7 +483,7 @@ jobs:
           cmake --build build_static --config Release --parallel $([System.Environment]::ProcessorCount)
 
       - name: Upload Static dhtnode Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-dhtnode
           path: |
@@ -499,23 +499,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download Windows MSI artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: opendht-windows-msi
           path: downloaded_artifacts/windows_msi
 
       - name: Download Static dhtnode artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: opendht-windows-dhtnode
           path: downloaded_artifacts/static_dhtnode
 
       - name: Create Release
         id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           draft: true
           files: |

.github/workflows/windows-build.yml

@@ -9,7 +9,7 @@ on:
     branches: [ main, master ]
 
 env:
-  VCPKG_VERSION: "2026.01.16"
+  VCPKG_VERSION: "2026.06.01"
   VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
   VCPKG_DISABLE_METRICS: "1"
   VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
       - name: Generate Cache Key
         id: generate_cache_key
@@ -41,7 +41,7 @@ jobs:
 
       - name: Cache vcpkg installed packages
         id: cache-vcpkg
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -75,10 +75,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
       - name: Generate Cache Key for Static Libs
         id: generate_static_cache_key
@@ -89,7 +89,7 @@ jobs:
 
       - name: Cache vcpkg static installed packages
         id: cache-vcpkg-static
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -125,14 +125,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
       - name: Restore vcpkg installed packages
         id: cache-vcpkg-restore
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload build artifacts
         if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
           path: |
@@ -202,14 +202,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
       - name: Restore vcpkg static installed packages
         id: cache-vcpkg-static-restore
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: |
             ${{ env.VCPKG_INSTALLED_DIR }}
@@ -256,7 +256,7 @@ jobs:
           ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4
 
       - name: Upload static build artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-static-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
           path: |
@@ -275,7 +275,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup MinGW
         uses: msys2/setup-msys2@v2
@@ -375,7 +375,7 @@ jobs:
 
       - name: Upload MinGW artifacts
         if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-mingw-${{ matrix.build_type }}
           path: |

BUILD.md

@@ -67,7 +67,7 @@ sudo dnf install python3-Cython python3-devel redhat-rpm-config
 ### macOS
 
 ```sh
-brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt
+brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt llhttp
 ```
 
 ## Build
@@ -81,7 +81,7 @@ git clone https://github.com/savoirfairelinux/opendht.git
 # Build and install
 cd opendht
 mkdir build && cd build
-cmake -DCMAKE_INSTALL_PREFIX=/usr ..
+cmake ..
 make -j$(nproc)
 sudo make install
 ```
@@ -100,8 +100,7 @@ cmake -DOPENDHT_PYTHON=ON \
       -DOPENDHT_PROXY_SERVER=ON \
       -DOPENDHT_PROXY_SERVER_IDENTITY=ON \
       -DOPENDHT_PROXY_CLIENT=ON \
-      -DOPENDHT_PUSH_NOTIFICATIONS=ON \
-      -DCMAKE_INSTALL_PREFIX=/usr ..
+      -DOPENDHT_PUSH_NOTIFICATIONS=ON ..
 ```
 
 #### Common CMake options

CMakeLists.txt

@@ -1,4 +1,4 @@
-cmake_minimum_required (VERSION 3.21...3.31)
+cmake_minimum_required (VERSION 3.21...4.4)
 if(POLICY CMP0091)
     cmake_policy(SET CMP0091 NEW)
 endif()
@@ -9,8 +9,8 @@ if(POLICY CMP0167)
     cmake_policy(SET CMP0167 NEW)
 endif()
 
-set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 7.6)
+set (opendht_VERSION_MAJOR 4)
+set (opendht_VERSION_MINOR 3.0)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -130,6 +130,7 @@ if (NOT MSVC)
                 message(STATUS "simdutf not found with pkgconfig")
                 if (OPENDHT_DOWNLOAD_DEPS)
                     message(STATUS "Fallback mode specified, downloading simdutf")
+                    set(SIMDUTF_CXX_STANDARD ${CMAKE_CXX_STANDARD} CACHE INTERNAL "C++ standard for simdutf downloader")
                     set(SIMDUTF_TESTS OFF CACHE INTERNAL "Disable tests for simdutf downloader")
                     set(SIMDUTF_TOOLS OFF CACHE INTERNAL "Disable tools for simdutf downloader")
                     FetchContent_Declare(simdutf

c/opendht.cpp

@@ -600,7 +600,7 @@ dht_runner_put_signed(
 void
 dht_runner_put_encrypted(dht_runner* r,
                          const dht_infohash* h,
-                         const dht_infohash* to,
+                         const dht_pkid* to,
                          const dht_value* v,
                          dht_done_cb done_cb,
                          void* cb_user_data,
@@ -608,7 +608,7 @@ dht_runner_put_encrypted(dht_runner* r,
 {
     auto runner = reinterpret_cast<dht::DhtRunner*>(r);
     auto hash = reinterpret_cast<const dht::InfoHash*>(h);
-    auto toHash = reinterpret_cast<const dht::InfoHash*>(to);
+    auto toHash = reinterpret_cast<const dht::PkId*>(to);
     auto value = reinterpret_cast<const ValueSp*>(v);
     runner->putEncrypted(
         *hash,

c/opendht_c.h

@@ -195,7 +195,7 @@ OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
                                             bool permanent);
 OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
                                                const dht_infohash* hash,
-                                               const dht_infohash* to,
+                                               const dht_pkid* to,
                                                const dht_value* value,
                                                dht_done_cb done_cb,
                                                void* cb_user_data,

doc/dhtnode.1

@@ -1,102 +1,193 @@
-.TH DHTNODE 1 2019-06-08
+.TH DHTNODE 1 2026-04-18
 .SH NAME
 .B dhtnode
 - a simple OpenDHT command line node runner.
 .SH SYNOPSIS
 .B dhtnode
 [\fB\-h\fR]
+[\fB\-V\fR]
 [\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
-[\fB\-i\fR [\fB\-\-save\-identity\fR \fIfile\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
 [\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
 [\fB\-n\fR \fInetwork_id\fR]
 [\fB\-p\fR \fIlocal_port\fR]
 [\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
-[\fB\-\-certificate\fR \fIfile\fR]
-[\fB\-\-privkey\fR \fIfile\fR]
-[\fB\-\-privkey\-password\fR \fIpassword\fR]
-[\fB\-\-proxyserver\fR \fIport\fR]
-[\fB\-\-proxyclient\fR \fIserver\fR]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
 .SH DESCRIPTION
-Runs an OpenDHT node, with a CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
 Commands available in the interactive shell are:
 .EX
     h, help    Print this help message.
-    q, quit    Quit the program.
+    x, quit    Quit the program.
     log        Start/stop printing DHT logs.
 
     Node information:
     ll         Print basic information and stats about the current node.
-    ls         Print basic information about current searches.
-    ld         Print basic information about currenty stored values on this node.
-    lr         Print the full current routing table of this node
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.
 
     Operations on the DHT:
-    b ip:port             Ping potential node at given IP address/port.
-    g [key]               Get values at [key].
-    l [key]               Listen for value changes at [key].
-    p [key] [str]         Put string value at [key].
-    s [key] [str]         Put string value at [key], signed with our generated
-                          private key.
-    e [key] [dest] [str]  Put string value at [key], encrypted for [dest] with
-                          its public key (if found).
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
 .EE
 .SH OPTIONS
 .TP
-\fB\-h\fP
-Prints some help.
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
 .TP
-\fB\-v\fP
-Enable the verbose mode (log to stdout/stderr by default)
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
 .TP
-\fB\-l\fP \fIlog_file\fP
-Write log to file instead of stdout/stderr
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
 .TP
-\fB\-L\fP
-Write log to syslog instead of stdout/stderr
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
 .TP
-\fB\-i\fP
-Generate cryptographic identity for the node.
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
 .TP
-\fB\-\-save\-identity\fP \fIfile\fP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
 Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
 .TP
-\fB\-\-certificate\fP \fIfile\fP
-Load identity certificate from given file.
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
 .TP
-\fB\-\-privkey\fP \fIfile\fP
-Load identity private key from given file.
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
 .TP
-\fB\-\-privkey\-password\fP \fIpassword\fP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
 Password to use for private key encryption or decryption (optional).
 .TP
-\fB\-d\fP
-Run the program in daemon mode (will fork in the background).
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
 .TP
-\fB\-s\fP
+\fB\-s\fP, \fB\-\-service\fP
 Run the program in service mode (non\-forking daemon).
 .TP
-\fB\-D\fP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
 Enables multicast automatic local peer discovery.
 .TP
-\fB\-f\fP \fIfile\fP
-Specify a file path to persist/load the node state.
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
 .TP
-\fB\-n\fP \fInetwork_id\fP
-Specify the network id. This let you connect to distinct networks and prevents
-the merge of two different networks (available since OpenDHT v0.6.1).
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
 .TP
-\fB\-p\fP \fIlocal_port\fP
-Use UDP port \fIlocal_port\fP for the program to bind to.
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
 .TP
-\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP]
-The program needs to be given a node to connect to the network. You use this
-option to provide the ip address of that node.
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
 .TP
-\fB\-\-proxyserver\fP \fIlocal_port\fP
-Run a proxy server bound to this DHT node on HTTP port \fIlocal_port\fP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
 .TP
-\fB\-\-proxyclient\fP \fIserver\fP
-Run this DHT node in proxy client mode, and connect to \fIserver\fP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
 .SH AUTHORS
 .TP
 Program written by

include/opendht/callbacks.h

@@ -187,8 +187,6 @@ using ShutdownCallback = std::function<void()>;
 using IdentityAnnouncedCb = std::function<void(bool)>;
 using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;
 
-using CertificateStoreQueryLegacy
-    = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;
 
 using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;

include/opendht/crypto.h

@@ -204,7 +204,13 @@ struct OPENDHT_PUBLIC PrivateKey
      * @param algo : the public key algorithm to use, GNUTLS_PK_RSA or GNUTLS_PK_RSA_OAEP
      */
     static PrivateKey generate(unsigned key_length = 4096, gnutls_pk_algorithm_t algo = GNUTLS_PK_RSA);
-    static PrivateKey generateEC();
+
+    /**
+     * Generate a new EC key pair
+     * @param curve : the elliptic curve to use. If GNUTLS_ECC_CURVE_INVALID is provided, the default curve will be used
+     * (currently GNUTLS_ECC_CURVE_SECP384R1).
+     */
+    static PrivateKey generateEC(gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID);
 
     gnutls_privkey_t key {};
     gnutls_x509_privkey_t x509_key {};
@@ -267,9 +273,15 @@ public:
     /**
      * Sign this revocation list using provided key and certificate.
      * Validity_period sets the duration until next update (default to no next update).
+     * If `number` is non-zero, it is stored verbatim (big-endian) as the CRL Number
+     * extension. Otherwise the number is initialized randomly on the first signature
+     * and incremented on subsequent ones.
      */
-    void sign(const PrivateKey&, const Certificate&, duration validity_period = {});
-    void sign(const Identity& id) { sign(*id.first, *id.second); }
+    void sign(const PrivateKey&, const Certificate&, duration validity_period = {}, uint64_t number = 0);
+    void sign(const Identity& id, duration validity_period = {}, uint64_t number = 0)
+    {
+        sign(*id.first, *id.second, validity_period, number);
+    }
 
     bool isSignedBy(const Certificate& issuer) const;
 

include/opendht/default_types.h

@@ -159,7 +159,13 @@ public:
     {}
 
     static Value::Filter getFilter() { return EncryptedValue::getFilter(); }
+    virtual void unpackValue(const dht::Value& v) override
+    {
+        BaseClass::unpackValue(v);
+        id = v.id;
+    }
 
+    dht::Value::Id id {0}; /// Value ID of the trust request, used for deserialization only.
     std::string service;
     std::string conversationId;
     Blob payload;

include/opendht/dht_proxy_server.h

@@ -76,7 +76,7 @@ public:
 
     asio::io_context& io_context() const;
 
-    using clock = std::chrono::steady_clock;
+    using clock = std::chrono::system_clock;
     using time_point = clock::time_point;
 
     struct PushStats
@@ -405,8 +405,8 @@ private:
         std::string pushToken;
         std::string clientId;
         std::shared_ptr<PushSessionContext> sessionCtx;
-        std::unique_ptr<asio::steady_timer> expireTimer;
-        std::unique_ptr<asio::steady_timer> expireNotifyTimer;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
         Sp<Value> value;
         PushType type;
         std::string topic;
@@ -419,13 +419,13 @@ private:
             p.pack("value");
             p.pack(value);
             p.pack("exp");
-            p.pack(to_time_t(expiration));
+            p.pack(std::chrono::system_clock::to_time_t(expiration));
             if (not clientId.empty()) {
                 p.pack("cid");
                 p.pack(clientId);
             }
             if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                std::lock_guard l(sessionCtx->lock);
                 p.pack("sid");
                 p.pack(sessionCtx->sessionId);
             }
@@ -464,8 +464,8 @@ private:
         std::string clientId;
         std::shared_ptr<PushSessionContext> sessionCtx;
         std::future<size_t> internalToken;
-        std::unique_ptr<asio::steady_timer> expireTimer;
-        std::unique_ptr<asio::steady_timer> expireNotifyTimer;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
         PushType type;
         std::string topic;
 
@@ -476,9 +476,9 @@ private:
             p.pack("cid");
             p.pack(clientId);
             p.pack("exp");
-            p.pack(to_time_t(expiration));
+            p.pack(std::chrono::system_clock::to_time_t(expiration));
             if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                std::lock_guard l(sessionCtx->lock);
                 p.pack("sid");
                 p.pack(sessionCtx->sessionId);
             }

include/opendht/dhtrunner.h

@@ -61,8 +61,7 @@ public:
         std::unique_ptr<net::DatagramSocket> sock;
         std::shared_ptr<PeerDiscovery> peerDiscovery {};
         StatusCallback statusChangedCallback {};
-        CertificateStoreQueryLegacy certificateStore {};
-        CertificateStoreQuery certificateStorePkId {};
+        CertificateStoreQuery certificateStore {};
         IdentityAnnouncedCb identityAnnouncedCb {};
         PublicAddressChangedCb publicAddressChangedCb {};
         std::unique_ptr<std::mt19937_64> rng {};
@@ -286,21 +285,6 @@ public:
     }
     void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);
 
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
-    }
-
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
-    }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       std::shared_ptr<Value> value,
@@ -315,13 +299,11 @@ public:
         putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
     }
 
-    [[deprecated("Use the shared_ptr version instead")]]
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       Value&& value,
                       DoneCallback cb = {},
                       bool permanent = false);
-    [[deprecated("Use the shared_ptr version instead")]]
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       Value&& value,
@@ -338,6 +320,14 @@ public:
     {
         putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
     }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }
 
     /**
      * Insert known nodes to the routing table, without necessarly ping them.
@@ -450,13 +440,9 @@ public:
     void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);
 
     // securedht methods
-
-    [[deprecated("Use PkId version")]] void findCertificate(
-        InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
     void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
 
     void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method);
     void setLocalCertificateStore(CertificateStoreQuery&& query_method);
 
     /**
@@ -499,7 +485,7 @@ public:
      */
     time_point loop()
     {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
         return loop_();
     }
 

include/opendht/http.h

@@ -51,11 +51,11 @@ using ConnectHandlerCb = std::function<void(const asio::error_code& ec, const as
 using ssl_socket_t = restinio::impl::tls_socket_t;
 using socket_t = asio::ip::tcp::socket;
 
-class OPENDHT_PUBLIC Url
+struct OPENDHT_PUBLIC Url
 {
-public:
     Url() = default;
-    Url(std::string_view url);
+    Url(std::string url);
+
     std::string url;
     std::string protocol {"http"};
     std::string_view user;
@@ -149,7 +149,7 @@ public:
     using ResolverCb
         = std::function<void(const asio::error_code& ec, const std::vector<asio::ip::tcp::endpoint>& endpoints)>;
 
-    Resolver(asio::io_context& ctx, const std::string& url, std::shared_ptr<log::Logger> logger = {});
+    Resolver(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
     Resolver(asio::io_context& ctx,
              std::string_view host,
              std::string_view service,
@@ -161,10 +161,6 @@ public:
              std::vector<asio::ip::tcp::endpoint> endpoints,
              const bool ssl = false,
              std::shared_ptr<log::Logger> logger = {});
-    Resolver(asio::io_context& ctx,
-             const std::string& url,
-             std::vector<asio::ip::tcp::endpoint> endpoints,
-             std::shared_ptr<log::Logger> logger = {});
 
     ~Resolver();
 
@@ -216,19 +212,19 @@ public:
 
     // resolves implicitly
     Request(asio::io_context& ctx,
-            const std::string& url,
+            std::string url,
             const Json::Value& json,
             OnJsonCb jsoncb,
             std::shared_ptr<log::Logger> logger = {});
-    Request(asio::io_context& ctx, const std::string& url, OnJsonCb jsoncb, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnJsonCb jsoncb, std::shared_ptr<log::Logger> logger = {});
 
-    Request(asio::io_context& ctx, const std::string& url, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
     Request(asio::io_context& ctx,
             std::string_view host,
             std::string_view service,
             const bool ssl = false,
             std::shared_ptr<log::Logger> logger = {});
-    Request(asio::io_context& ctx, const std::string& url, OnDoneCb onDone, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnDoneCb onDone, std::shared_ptr<log::Logger> logger = {});
 
     // user defined resolver
     Request(asio::io_context& ctx, std::shared_ptr<Resolver> resolver, sa_family_t family = AF_UNSPEC);
@@ -344,8 +340,6 @@ private:
 
     dht::crypto::Identity client_identity_;
     std::shared_ptr<dht::crypto::Certificate> server_ca_;
-    std::string service_;
-    std::string host_;
 
     unsigned int id_;
     static std::atomic_uint ids_;

include/opendht/infohash.h

@@ -269,7 +269,7 @@ public:
     }
 
 private:
-    T data_;
+    alignas(alignof(uint32_t)) T data_;
     static constexpr T fromBytes(const uint8_t*, size_t);
     static constexpr T fromString(std::string_view);
 };

include/opendht/logger.h

@@ -131,7 +131,7 @@ struct OPENDHT_PUBLIC Logger
 
     std::shared_ptr<Logger> createChild(std::string tag)
     {
-        std::lock_guard<std::mutex> lock {children_mutex_};
+        std::lock_guard lock {children_mutex_};
         auto child = std::make_shared<Logger>(*this, std::move(tag));
         children_.push_back(child);
         return child;
@@ -139,7 +139,7 @@ struct OPENDHT_PUBLIC Logger
 
     void setFilter(std::string_view filter)
     {
-        std::lock_guard<std::mutex> lock {children_mutex_};
+        std::lock_guard lock {children_mutex_};
         enable_ = filter.empty() or tag_.find(filter) != std::string_view::npos;
         for (auto it = children_.begin(); it != children_.end();) {
             if (auto c = it->lock()) {

include/opendht/network_engine.h

@@ -489,8 +489,12 @@ private:
     static constexpr size_t MTU {1280};
     static constexpr size_t MAX_PACKET_VALUE_SIZE {600};
     static constexpr size_t MAX_MESSAGE_VALUE_SIZE {56 * 1024};
+    static constexpr size_t RX_MAX_EARLY_BYTES {MAX_MESSAGE_VALUE_SIZE + MAX_VALUE_SIZE + 32};
+    static constexpr size_t RX_MAX_EARLY_PARTS {RX_MAX_EARLY_BYTES / MTU + 2};
 
     void process(std::unique_ptr<ParsedMessage>&&, const SockAddr& from);
+    bool isExpectedReply(const ParsedMessage&, const SockAddr& from);
+    bool tryCompleteMessage(PartialMessage&, const SockAddr& from);
 
     bool rateLimit(const SockAddr& addr);
 
@@ -527,7 +531,8 @@ private:
     {
         return packValueHeader(buf, values.begin(), values.end());
     }
-    void maintainRxBuffer(Tid tid);
+    using PartialMessageKey = std::pair<SockAddr, Tid>;
+    void maintainRxBuffer(const PartialMessageKey& key);
 
     /*************
      *  Answers  *
@@ -573,7 +578,7 @@ private:
 
     // requests handling
     std::map<Tid, Sp<Request>> requests {};
-    std::map<Tid, PartialMessage> partial_messages;
+    std::map<PartialMessageKey, PartialMessage> partial_messages;
 
     MessageStats in_stats {}, out_stats {};
     std::set<SockAddr> blacklist {};

include/opendht/network_utils.h

@@ -58,7 +58,7 @@ public:
 
     inline void setOnReceive(OnReceive&& cb)
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         rx_callback = std::move(cb);
     }
 
@@ -67,12 +67,12 @@ public:
 
     SockAddr getBound(sa_family_t family = AF_UNSPEC) const
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         return getBoundRef(family);
     }
     in_port_t getPort(sa_family_t family = AF_UNSPEC) const
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         return getBoundRef(family).getPort();
     }
 
@@ -102,7 +102,7 @@ protected:
 
     inline void onReceived(PacketList&& packets)
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         if (rx_callback) {
             auto r = rx_callback(std::move(packets));
             if (not r.empty() and toRecycle_.size() < RX_QUEUE_MAX_SIZE)
@@ -134,12 +134,12 @@ public:
 
     bool hasIPv4() const override
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         return s4 != -1;
     }
     bool hasIPv6() const override
     {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
         return s6 != -1;
     }
 

include/opendht/proxy.h

@@ -8,7 +8,7 @@ namespace dht {
 namespace proxy {
 
 constexpr const std::chrono::hours OP_TIMEOUT {24}; // one day
-constexpr const std::chrono::hours OP_MARGIN {2};   // two hours
+constexpr const std::chrono::hours OP_MARGIN {8};   // eight hours
 
 using ListenToken = uint64_t;
 

include/opendht/securedht.h

@@ -113,14 +113,6 @@ public:
      * and put it in the DHT.
      * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
      */
-    void putEncrypted(
-        const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
-    }
     void putEncrypted(const InfoHash& hash,
                       const crypto::PublicKey& to,
                       Sp<Value> val,
@@ -145,19 +137,11 @@ public:
 
     Value decrypt(const Value& v);
 
-    [[deprecated("Use PkId version")]] void findCertificate(
-        const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb);
-    [[deprecated("Use PkId version")]] void findPublicKey(const InfoHash& node,
-                                                          const std::function<void(const Sp<crypto::PublicKey>)>& cb);
-
     void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
     void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);
 
     void registerCertificate(const Sp<crypto::Certificate>& cert);
 
-    [[deprecated("Use PkId version")]] Sp<crypto::Certificate> getCertificate(const InfoHash& node) const;
-    [[deprecated("Use PkId version")]] Sp<crypto::PublicKey> getPublicKey(const InfoHash& node) const;
-
     Sp<crypto::Certificate> getCertificate(const PkId& node) const;
     Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;
 
@@ -166,10 +150,6 @@ public:
      * The search key used is the public key ID, so there may be multiple certificates retured, signed with
      * the same private key.
      */
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-    {
-        localQueryMethodLegacy_ = std::move(query_method);
-    }
     void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
     void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }
 
@@ -347,13 +327,10 @@ private:
 
     // method to query the local certificate store
     CertificateStoreQuery localQueryMethod_ {};
-    CertificateStoreQueryLegacy localQueryMethodLegacy_ {};
 
     // our certificate cache
-    std::map<InfoHash, Sp<crypto::Certificate>> nodesCertificates_ {};
-    std::map<InfoHash, Sp<crypto::PublicKey>> nodesPubKeys_ {};
-    std::map<PkId, Sp<crypto::Certificate>> nodesCertificatesLong_ {};
-    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeysLong_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};
 
     std::atomic_bool forward_all_ {false};
     bool enableCache_ {false};

include/opendht/thread_pool.h

@@ -10,7 +10,9 @@
 #include <future>
 #include <functional>
 
-#include <ciso646> // fix windows compiler bug
+#if __cplusplus < 202002L
+#include <ciso646>
+#endif
 
 namespace dht {
 
@@ -55,10 +57,12 @@ public:
 private:
     std::mutex lock_;
     std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
     std::queue<std::function<void()>> tasks_ {};
     std::vector<std::unique_ptr<std::thread>> threads_;
     unsigned readyThreads_ {0};
     bool running_ {true};
+    bool stopping_ {false};
 
     unsigned minThreads_;
     const unsigned maxThreads_;
@@ -104,7 +108,7 @@ public:
 
     void run(std::function<void()>&& task)
     {
-        std::lock_guard<std::mutex> lock(state_->mtx);
+        std::lock_guard lock(state_->mtx);
         if (state_->shutdown_)
             return;
         state_->pendingTasks++;
@@ -125,7 +129,7 @@ private:
 
         void destroy(bool wait = true)
         {
-            std::unique_lock<std::mutex> lock(mtx);
+            std::unique_lock lock(mtx);
             if (destroyed)
                 return;
             if (wait) {
@@ -141,7 +145,7 @@ private:
         void run(const std::function<void()>& task)
         {
             {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                 pendingTasks--;
                 ongoingTasks++;
             }
@@ -149,7 +153,7 @@ private:
                 return;
             task();
             {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                 ongoingTasks--;
                 cv.notify_all();
             }

include/opendht/utils.h

@@ -85,6 +85,14 @@ using system_clock = std::chrono::system_clock;
 using time_point = clock::time_point;
 using duration = clock::duration;
 
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t,
+                                           time_point steady_now,
+                                           system_clock::time_point system_now);
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t,
+                                                       time_point steady_now,
+                                                       system_clock::time_point system_now);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t);
 OPENDHT_PUBLIC time_point from_time_t(std::time_t t);
 OPENDHT_PUBLIC std::time_t to_time_t(time_point t);
 

include/opendht/value.h

@@ -31,6 +31,7 @@ using namespace std::literals;
 static constexpr auto VALUE_KEY_ID("id");
 static const std::string VALUE_KEY_DAT("dat");
 static const std::string VALUE_KEY_PRIO("p");
+static const std::string VALUE_KEY_PUSHTYPE("pt");
 static const std::string VALUE_KEY_SIGNATURE("sig");
 
 static const std::string VALUE_KEY_SEQ("seq");
@@ -451,6 +452,7 @@ struct OPENDHT_PUBLIC Value
         , signature(std::move(o.signature))
         , cypher(std::move(o.cypher))
         , priority(o.priority)
+        , pushType(std::move(o.pushType))
     {}
 
     template<typename Type>
@@ -574,7 +576,7 @@ struct OPENDHT_PUBLIC Value
     template<typename Packer>
     void msgpack_pack(Packer& pk) const
     {
-        pk.pack_map(2 + (priority ? 1 : 0));
+        pk.pack_map(2 + (priority ? 1 : 0) + (!pushType.empty() ? 1 : 0));
         pk.pack(VALUE_KEY_ID);
         pk.pack(id);
         pk.pack(VALUE_KEY_DAT);
@@ -583,6 +585,10 @@ struct OPENDHT_PUBLIC Value
             pk.pack(VALUE_KEY_PRIO);
             pk.pack(priority);
         }
+        if (!pushType.empty()) {
+            pk.pack(VALUE_KEY_PUSHTYPE);
+            pk.pack(pushType);
+        }
     }
 
     template<typename Packer>
@@ -672,6 +678,13 @@ struct OPENDHT_PUBLIC Value
      */
     unsigned priority {0};
 
+    /**
+     * Push notification type — set by the sender so that the proxy server
+     * can include it in the FCM/APNs payload without decrypting the value.
+     * Example: "audioCall", "videoCall"
+     */
+    std::string pushType {};
+
     inline bool isSignatureChecked() const { return signatureChecked; }
     inline bool isDecrypted() const { return decrypted; }
     bool checkSignature();

meson.build

@@ -5,7 +5,7 @@ project(
     'cython',
     license: 'MIT',
     license_files: 'LICENSE',
-    version: '3.7.6',
+    version: '4.3.0',
     meson_version: '>=1.1.0',
     default_options: ['cpp_std=c++20', 'warning_level=3'],
 )
@@ -15,10 +15,23 @@ nettle = dependency('nettle')
 msgpack = dependency('msgpack-cxx', required: false)
 argon2 = dependency('libargon2')
 fmt = dependency('fmt')
-openssl = dependency('openssl', required: get_option('proxy_client'))
-jsoncpp = dependency('jsoncpp', required: get_option('proxy_client'))
-llhttp = dependency('llhttp', 'libllhttp', required: get_option('proxy_client'))
-simdutf = dependency('simdutf', required: get_option('proxy_client'))
+
+proxy_enabled = get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
+
+openssl = dependency('openssl', required: proxy_enabled)
+jsoncpp = dependency('jsoncpp', required: proxy_enabled)
+llhttp = dependency('llhttp', 'libllhttp', required: proxy_enabled)
+simdutf = dependency('simdutf', required: proxy_enabled)
+
+# restinio is a header-only library that may not ship a pkg-config file
+restinio_dep = dependency('restinio', required: false)
+if not restinio_dep.found()
+    cpp = meson.get_compiler('cpp')
+    if cpp.has_header('restinio/all.hpp', required: proxy_enabled)
+        restinio_dep = declare_dependency()
+    endif
+endif
+
 io_uring = host_machine.system() == 'linux' ? dependency('liburing', required: false) : disabler()
 
 deps = [
@@ -33,6 +46,10 @@ deps = [
     llhttp,
 ]
 
+if restinio_dep.found()
+    deps += restinio_dep
+endif
+
 if host_machine.system() == 'linux' and io_uring.found()
     deps += io_uring
 endif
@@ -79,7 +96,7 @@ if get_option('indexation').enabled()
     opendht_src += 'src/indexation/pht.cpp'
     add_project_arguments('-DOPENDHT_INDEXATION', language: 'cpp')
 endif
-if jsoncpp.found()
+if jsoncpp.found() and simdutf.found()
     opendht_src += ['src/base64.cpp']
     add_project_arguments('-DOPENDHT_JSONCPP', language: 'cpp')
     conf_data.set('jsoncpp_lib', ', jsoncpp')

python/opendht.pyx

@@ -820,13 +820,8 @@ cdef class DhtRunner(_WithID):
                         key._infohash, (<PkId>to)._pkid, val._value,
                         cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
                     )
-                elif isinstance(to, InfoHash):
-                    self.thisptr.get().putEncrypted(
-                        key._infohash, (<InfoHash>to)._infohash, val._value,
-                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
-                    )
                 else:
-                    raise TypeError("'to' must be PublicKey, PkId, or InfoHash")
+                    raise TypeError("'to' must be PublicKey or PkId")
             except:
                 ref.Py_DECREF(cb_obj)
                 raise

python/opendht_cpp.pxd

@@ -282,7 +282,6 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
         void get(InfoHash key, GetCallback get_cb, DoneCallback done_cb, nullptr_t f, Where w)
         void put(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, time_point created, bool permanent)
         void putSigned(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, bool permanent) 
-        void putEncrypted(InfoHash key, InfoHash to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void putEncrypted(InfoHash key, PkId to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void putEncrypted(InfoHash key, shared_ptr[PublicKey] to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void cancelPut(InfoHash key, shared_ptr[Value] val)

python/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [tool.cibuildwheel]
 build = [
-  'cp3{9,10,11,12,13}-manylinux_x86_64',
-  'cp3{10,11,12,13}-manylinux_aarch64',
-  'cp3{11,12,13}-macosx_x86_64',
-  'cp3{11,12,13}-macosx_arm64',
-  'cp3{11,12,13}-win_amd64',
+  'cp3{9,10,11,12,13,14}-manylinux_x86_64',
+  'cp3{10,11,12,13,14}-manylinux_aarch64',
+  'cp3{11,12,13,14}-macosx_x86_64',
+  'cp3{11,12,13,14}-macosx_arm64',
+  'cp3{11,12,13,14}-win_amd64',
 ]
 
 [tool.cibuildwheel.linux]

rust/src/dhtrunner.rs

@@ -226,7 +226,7 @@ impl DhtRunner {
     pub fn put_encrypted<'a>(
         &mut self,
         h: &InfoHash,
-        to: &InfoHash,
+        to: &PkId,
         v: Box<Value>,
         done_cb: &'a mut (dyn FnMut(bool)),
         permanent: bool,

rust/src/ffi.rs

@@ -190,7 +190,7 @@ extern {
                                  cb_user_data: *mut c_void,
                                  permanent: bool);
     pub fn dht_runner_put_encrypted(dht: *mut DhtRunner, h: *const InfoHash,
-                                    to: *const InfoHash, v: *const Value,
+                                    to: *const PkId, v: *const Value,
                                     done_cb: extern fn(bool, *mut c_void),
                                     cb_user_data: *mut c_void,
                                     permanent: bool);

src/base64.cpp

@@ -36,4 +36,19 @@ base64_decode(std::string_view str)
     return buffer;
 }
 
+std::vector<unsigned char>
+base64_default_or_url_decode(std::string_view str)
+{
+    std::vector<unsigned char> buffer(simdutf::maximal_binary_length_from_base64(str.data(), str.size()));
+    simdutf::result r = simdutf::base64_to_binary(str.data(),
+                                                  str.size(),
+                                                  (char*) buffer.data(),
+                                                  simdutf::base64_options::base64_default_or_url);
+    if (r.error) {
+        throw std::invalid_argument(concat("Invalid base64 input: "sv, simdutf::error_to_string(r.error)));
+    } else {
+        buffer.resize(r.count);
+    }
+    return buffer;
+}
 } // namespace dht

src/base64.h

@@ -21,5 +21,12 @@ std::string base64_encode(const std::vector<unsigned char>& str);
  * @return a base64-decoded buffer
  */
 std::vector<unsigned char> base64_decode(std::string_view str);
+/**
+ * Decode a buffer in base64 or url style base64 (including '-' '_' ).
+ *
+ * @param str the input buffer
+ * @return a base64-decoded buffer
+ */
+std::vector<unsigned char> base64_default_or_url_decode(std::string_view str);
 
-} // namespace dht
+} // namespace dht

src/crypto.cpp

@@ -11,6 +11,7 @@ extern "C" {
 #include <nettle/gcm.h>
 #include <nettle/aes.h>
 #include <nettle/hmac.h>
+#include <nettle/version.h>
 #include <gnutls/crypto.h>
 
 #include <argon2.h>
@@ -98,6 +99,46 @@ private:
 #define GCM_DIGEST_SIZE GCM_BLOCK_SIZE
 #endif
 
+static void
+gcmAes128Digest(gcm_aes128_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes128_digest(ctx, digest);
+#else
+    gcm_aes128_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes192Digest(gcm_aes192_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes192_digest(ctx, digest);
+#else
+    gcm_aes192_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes256Digest(gcm_aes256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes256_digest(ctx, digest);
+#else
+    gcm_aes256_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+hmacSha256Digest(hmac_sha256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    hmac_sha256_digest(ctx, digest);
+#else
+    hmac_sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+#endif
+}
+
 Blob
 aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
 {
@@ -115,19 +156,19 @@ aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
         gcm_aes128_set_key(&aes, key.data());
         gcm_aes128_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes128_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes128Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     } else if (key.size() == AES_LENGTHS[1]) {
         struct gcm_aes192_ctx aes;
         gcm_aes192_set_key(&aes, key.data());
         gcm_aes192_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes192_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes192Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     } else if (key.size() == AES_LENGTHS[2]) {
         struct gcm_aes256_ctx aes;
         gcm_aes256_set_key(&aes, key.data());
         gcm_aes256_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes256_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes256Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     }
 
     return ret;
@@ -160,19 +201,19 @@ aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
         gcm_aes128_set_key(&aes, key.data());
         gcm_aes128_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes128_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes128Digest(&aes, digest.data());
     } else if (key.size() == AES_LENGTHS[1]) {
         struct gcm_aes192_ctx aes;
         gcm_aes192_set_key(&aes, key.data());
         gcm_aes192_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes192_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes192Digest(&aes, digest.data());
     } else if (key.size() == AES_LENGTHS[2]) {
         struct gcm_aes256_ctx aes;
         gcm_aes256_set_key(&aes, key.data());
         gcm_aes256_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes256_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes256Digest(&aes, digest.data());
     }
 
     if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
@@ -446,7 +487,7 @@ PrivateKey::getPublicKey() const
 const std::shared_ptr<PublicKey>&
 PrivateKey::getSharedPublicKey() const
 {
-    std::lock_guard<std::mutex> lock(publicKeyMutex_);
+    std::lock_guard lock(publicKeyMutex_);
     if (not publicKey_) {
         auto pk = std::make_shared<PublicKey>();
         if (auto err = gnutls_pubkey_import_privkey(pk->pk, key, GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN, 0))
@@ -530,6 +571,12 @@ PublicKey::toString() const
     }
     if (err != GNUTLS_E_SUCCESS)
         throw CryptoException(std::string("Could not print public key: ") + gnutls_strerror(err));
+    // GnuTLS reports the PEM size including the terminating null byte, which
+    // does not belong to the text and would end up embedded in whatever the
+    // string is copied into, such as the "owner" field of a serialized value.
+    ret.resize(sz);
+    if (not ret.empty() and ret.back() == '\0')
+        ret.pop_back();
     return ret;
 }
 
@@ -959,7 +1006,7 @@ Certificate::getPublicKey() const
 const std::shared_ptr<PublicKey>&
 Certificate::getSharedPublicKey() const
 {
-    std::lock_guard<std::mutex> lock(publicKeyMutex_);
+    std::lock_guard lock(publicKeyMutex_);
     if (not publicKey_) {
         auto pk = std::make_shared<PublicKey>();
         if (auto err = gnutls_pubkey_import_x509(pk->pk, cert, 0))
@@ -1247,14 +1294,16 @@ PrivateKey::generate(unsigned key_length, gnutls_pk_algorithm_t algo)
 }
 
 PrivateKey
-PrivateKey::generateEC()
+PrivateKey::generateEC(gnutls_ecc_curve_t curve)
 {
     gnutls_x509_privkey_t key;
     if (gnutls_x509_privkey_init(&key) != GNUTLS_E_SUCCESS)
         throw CryptoException("Unable to initialize private key.");
     int err = gnutls_x509_privkey_generate(key,
                                            GNUTLS_PK_EC,
-                                           gnutls_sec_param_to_pk_bits(GNUTLS_PK_EC, GNUTLS_SEC_PARAM_ULTRA),
+                                           curve == GNUTLS_ECC_CURVE_INVALID
+                                               ? gnutls_sec_param_to_pk_bits(GNUTLS_PK_EC, GNUTLS_SEC_PARAM_ULTRA)
+                                               : GNUTLS_CURVE_TO_BITS(curve),
                                            0);
     if (err != GNUTLS_E_SUCCESS) {
         gnutls_x509_privkey_deinit(key);
@@ -1355,8 +1404,11 @@ setRandomSerial(gnutls_x509_crt_t cert)
 {
     std::random_device rdev;
     std::uniform_int_distribution<int64_t> dist {1};
-    int64_t cert_serial = dist(rdev);
-    gnutls_x509_crt_set_serial(cert, &cert_serial, sizeof(cert_serial));
+    const auto cert_serial = dist(rdev);
+    std::array<uint8_t, sizeof(cert_serial)> packed_serial;
+    for (size_t i = 0; i < packed_serial.size(); i++)
+        packed_serial[i] = cert_serial >> (8 * (packed_serial.size() - 1 - i));
+    gnutls_x509_crt_set_serial(cert, packed_serial.data(), packed_serial.size());
 }
 
 Certificate
@@ -1832,34 +1884,8 @@ RevocationList::getUpdateTime() const
     return std::chrono::system_clock::from_time_t(t);
 }
 
-enum class Endian : uint32_t { LITTLE = 0, BIG = 1 };
-
-template<typename T>
-T
-endian(T w, Endian endian = Endian::BIG)
-{
-    // this gets optimized out into if (endian == host_endian) return w;
-    union {
-        uint64_t quad;
-        uint32_t islittle;
-    } t;
-    t.quad = 1;
-    if (t.islittle ^ (uint32_t) endian)
-        return w;
-    T r = 0;
-
-    // decent compilers will unroll this (gcc)
-    // or even convert straight into single bswap (clang)
-    for (size_t i = 0; i < sizeof(r); i++) {
-        r <<= 8;
-        r |= w & 0xff;
-        w >>= 8;
-    }
-    return r;
-}
-
 void
-RevocationList::sign(const PrivateKey& key, const Certificate& ca, duration validity)
+RevocationList::sign(const PrivateKey& key, const Certificate& ca, duration validity, uint64_t crlNumber)
 {
     if (auto err = gnutls_x509_crl_set_version(crl, 2))
         throw CryptoException(std::string("Unable to set CRL version: ") + gnutls_strerror(err));
@@ -1869,19 +1895,28 @@ RevocationList::sign(const PrivateKey& key, const Certificate& ca, duration vali
         throw CryptoException(std::string("Unable to set CRL update time: ") + gnutls_strerror(err));
     if (auto err = gnutls_x509_crl_set_next_update(crl, std::chrono::system_clock::to_time_t(next_update)))
         throw CryptoException(std::string("Unable to set CRL next update time: ") + gnutls_strerror(err));
-    uint64_t number {0};
-    size_t number_sz {sizeof(number)};
-    unsigned critical {0};
-    gnutls_x509_crl_get_number(crl, &number, &number_sz, &critical);
+    uint64_t number {crlNumber};
     if (number == 0) {
-        // initialize to a random number
-        number_sz = sizeof(number);
-        std::random_device rdev;
-        std::generate_n((uint8_t*) &number, sizeof(number), std::bind(rand_byte, std::ref(rdev)));
-    } else
-        number = endian(endian(number) + 1);
-    if (auto err = gnutls_x509_crl_set_number(crl, &number, sizeof(number)))
-        throw CryptoException(std::string("Unable to set CRL update time: ") + gnutls_strerror(err));
+        // The CRL Number extension holds a DER integer of variable length, so it must be
+        // read as a big-endian byte string rather than straight into an uint64_t.
+        auto current = getNumber();
+        for (uint8_t byte : current)
+            number = (number << 8) | byte;
+        if (number == 0) {
+            // Initialize to a random number.
+            std::random_device rdev;
+            do {
+                std::generate_n((uint8_t*) &number, sizeof(number), std::bind(rand_byte, std::ref(rdev)));
+            } while (number == 0);
+        } else
+            number++;
+    }
+    // Store the number in network byte order.
+    uint8_t packedNumber[sizeof(number)];
+    for (size_t i = 0; i < sizeof(packedNumber); i++)
+        packedNumber[i] = (uint8_t) ((number >> (8 * (sizeof(packedNumber) - 1 - i))) & 0xff);
+    if (auto err = gnutls_x509_crl_set_number(crl, packedNumber, sizeof(packedNumber)))
+        throw CryptoException(std::string("Unable to set CRL number: ") + gnutls_strerror(err));
     if (auto err = gnutls_x509_crl_sign2(crl, ca.cert, key.x509_key, GNUTLS_DIG_SHA512, 0))
         throw CryptoException(std::string("Unable to sign certificate revocation list: ") + gnutls_strerror(err));
     // to be able to actually use the CRL we need to serialize/deserialize it
@@ -2045,7 +2080,7 @@ hkdf_extract(const Blob& salt, const Blob& ikm)
     hmac_sha256_set_key(&ctx, salt.size(), salt.data());
     hmac_sha256_update(&ctx, ikm.size(), ikm.data());
     Blob prk(SHA256_DIGEST_SIZE);
-    hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, prk.data());
+    hmacSha256Digest(&ctx, prk.data());
     return prk;
 }
 
@@ -2063,7 +2098,7 @@ hkdf_expand(const Blob& prk, const uint8_t* info, size_t info_len, size_t len)
         hmac_sha256_update(&ctx, info_len, info);
         hmac_sha256_update(&ctx, 1, &i);
         T.resize(SHA256_DIGEST_SIZE);
-        hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, T.data());
+        hmacSha256Digest(&ctx, T.data());
         okm.insert(okm.end(), T.begin(), T.end());
         i++;
     }
@@ -2223,7 +2258,7 @@ webPushEncrypt(const Blob& p256dh,
 
     Blob ciphertext(plaintext.size() + GCM_DIGEST_SIZE);
     gcm_aes128_encrypt(&aes, plaintext.size(), ciphertext.data(), plaintext.data());
-    gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ciphertext.data() + plaintext.size());
+    gcmAes128Digest(&aes, ciphertext.data() + plaintext.size());
 
     // 6. Construct Output
     Blob output;

src/dht.cpp

@@ -661,8 +661,9 @@ Dht::searchSynchedNodeListen(const Sp<Search>& sr, SearchNode& n)
                 /* on new values */
                 if (auto sr = ws.lock()) {
                     scheduler.edit(sr->nextSearchStep, scheduler.time());
-                    sr->insertNode(node, scheduler.time(), answer.ntoken);
                     if (auto sn = sr->getNode(node)) {
+                        if (not answer.ntoken.empty())
+                            sn->refreshToken(answer.ntoken);
                         sn->onValues(query, std::move(answer), types, scheduler);
                     }
                 }
@@ -1431,6 +1432,8 @@ Dht::storageStore(const InfoHash& id,
     created = std::min(created, now);
     if (expiration == time_point::min())
         expiration = permanent ? time_point::max() : created + getType(value->type).expiration;
+    else if (not permanent)
+        expiration = std::min(expiration, created + getType(value->type).expiration);
     if (expiration < now)
         return false;
 
@@ -2267,8 +2270,16 @@ Dht::onDisconnected()
 void
 Dht::bootstrap()
 {
-    if (dht4.status != NodeStatus::Disconnected || dht6.status != NodeStatus::Disconnected)
+    if (dht4.status != NodeStatus::Disconnected || dht6.status != NodeStatus::Disconnected) {
+        // The job that led here has already run, and the scheduler does not
+        // clear the handle to a job it has executed. onDisconnected() reads a
+        // set handle as "a bootstrap is already scheduled" and does nothing,
+        // so leaving it set here means the node never tries to rejoin the
+        // network once it has lost it. Clearing it is what says that no
+        // bootstrap is pending any more.
+        bootstrapJob.reset();
         return;
+    }
     if (logger_)
         logger_->debug("[{}] Bootstraping", myid.to_view());
     bootstrap_pending = false;
@@ -2352,6 +2363,9 @@ Dht::confirmNodes()
 std::vector<ValuesExport>
 Dht::exportValues() const
 {
+    const auto& now = scheduler.time();
+    const auto system_now = system_clock::now();
+
     std::vector<ValuesExport> e {};
     e.reserve(store.size());
     for (const auto& h : store) {
@@ -2364,7 +2378,7 @@ Dht::exportValues() const
         pk.pack_array(vals.size());
         for (const auto& v : vals) {
             pk.pack_array(4);
-            pk.pack(v.created.time_since_epoch().count());
+            pk.pack(to_system_time(v.created, now, system_now));
             v.data->msgpack_pack(pk);
             if (const auto& store_addr = v.store_bucket ? v.store_bucket->getAddr() : SockAddr {}) {
                 pk.pack_bin(store_addr.getLength());
@@ -2372,7 +2386,7 @@ Dht::exportValues() const
             } else {
                 pk.pack_bin(0);
             }
-            pk.pack(v.expiration.time_since_epoch().count());
+            pk.pack(to_system_time(v.expiration, now, system_now));
         }
         ve.second = {buffer.data(), buffer.data() + buffer.size()};
         e.push_back(std::move(ve));
@@ -2384,6 +2398,7 @@ void
 Dht::importValues(const std::vector<ValuesExport>& import)
 {
     const auto& now = scheduler.time();
+    const auto system_now = system_clock::now();
 
     unsigned imported = 0, ignored = 0;
     size_t imported_size = 0;
@@ -2408,8 +2423,15 @@ Dht::importValues(const std::vector<ValuesExport>& import)
                 Value tmp_val;
                 SockAddr store_addr;
                 try {
-                    val_time = time_point {
-                        time_point::duration {valel.via.array.ptr[0].as<time_point::duration::rep>()}};
+                    const bool uses_system_time = valel.via.array.ptr[0].type == msgpack::type::EXT;
+                    if (uses_system_time) {
+                        val_time = from_system_time(valel.via.array.ptr[0].as<system_clock::time_point>(),
+                                                    now,
+                                                    system_now);
+                    } else {
+                        val_time = time_point {
+                            time_point::duration {valel.via.array.ptr[0].as<time_point::duration::rep>()}};
+                    }
                     tmp_val.msgpack_unpack(valel.via.array.ptr[1]);
                     if (valel.via.array.size >= 3) {
                         auto addr_blob = valel.via.array.ptr[2].as<Blob>();
@@ -2419,8 +2441,14 @@ Dht::importValues(const std::vector<ValuesExport>& import)
                         }
                     }
                     if (valel.via.array.size >= 4) {
-                        expiration = time_point {
-                            time_point::duration {valel.via.array.ptr[3].as<time_point::duration::rep>()}};
+                        if (uses_system_time) {
+                            expiration = from_system_time(valel.via.array.ptr[3].as<system_clock::time_point>(),
+                                                          now,
+                                                          system_now);
+                        } else {
+                            expiration = time_point {
+                                time_point::duration {valel.via.array.ptr[3].as<time_point::duration::rep>()}};
+                        }
                     }
                 } catch (const std::exception&) {
                     if (logger_)
@@ -2539,6 +2567,7 @@ Dht::onError(Sp<net::Request> req, net::DhtProtocolException e)
                     if (listen.second.req and listen.second.req->pending())
                         n->node->cancelRequest(listen.second.req);
                     listen.second.req = {};
+                    n->node->closeSocket(listen.second.socketId);
                     if (listen.second.refresh) {
                         listen.second.refresh->cancel();
                         listen.second.refresh = {};
@@ -2715,7 +2744,9 @@ Dht::onListenDone(const Sp<Node>& node, net::RequestAnswer& answer, Sp<Search>&
 
     if (not sr->done) {
         const auto& now = scheduler.time();
-        sr->insertNode(node, now, answer.ntoken);
+        if (not answer.ntoken.empty())
+            if (auto sn = sr->getNode(node))
+                sn->refreshToken(answer.ntoken);
         searchSendGetValues(sr);
         scheduler.edit(sr->nextSearchStep, now);
     }

src/dht_proxy_client.cpp

@@ -34,20 +34,20 @@ struct DhtProxyClient::Listener
     Sp<OperationState> opstate;
     std::shared_ptr<http::Request> request;
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
-    std::unique_ptr<asio::steady_timer> refreshSubscriberTimer;
+    std::unique_ptr<asio::system_timer> refreshSubscriberTimer;
 #endif
 };
 
 struct PermanentPut
 {
-    PermanentPut(const Sp<Value>& v, std::unique_ptr<asio::steady_timer>&& j, const Sp<std::atomic_bool>& o)
+    PermanentPut(const Sp<Value>& v, std::unique_ptr<asio::system_timer>&& j, const Sp<std::atomic_bool>& o)
         : value(v)
         , refreshPutTimer(std::move(j))
         , ok(o)
     {}
 
     Sp<Value> value;
-    std::unique_ptr<asio::steady_timer> refreshPutTimer;
+    std::unique_ptr<asio::system_timer> refreshPutTimer;
     Sp<std::atomic_bool> ok;
 };
 
@@ -195,7 +195,7 @@ DhtProxyClient::stop()
     if (not isDestroying_.exchange(true)) {
         std::shared_ptr<http::Resolver> resolver;
         {
-            std::lock_guard<std::mutex> l(resolverLock_);
+            std::lock_guard l(resolverLock_);
             resolver = std::move(resolver_);
         }
         if (resolver)
@@ -204,7 +204,7 @@ DhtProxyClient::stop()
         if (infoState_)
             infoState_->cancel = true;
         {
-            std::lock_guard<std::mutex> lock(requestLock_);
+            std::lock_guard lock(requestLock_);
             for (auto& request : requests_)
                 request.second->cancel();
         }
@@ -219,7 +219,7 @@ DhtProxyClient::stop()
 std::vector<Sp<Value>>
 DhtProxyClient::getLocal(const InfoHash& k, const Value::Filter& filter) const
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto s = searches_.find(k);
     if (s == searches_.end())
         return {};
@@ -229,7 +229,7 @@ DhtProxyClient::getLocal(const InfoHash& k, const Value::Filter& filter) const
 Sp<Value>
 DhtProxyClient::getLocalById(const InfoHash& k, Value::Id id) const
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto s = searches_.find(k);
     if (s == searches_.end())
         return {};
@@ -239,7 +239,7 @@ DhtProxyClient::getLocalById(const InfoHash& k, Value::Id id) const
 void
 DhtProxyClient::cancelAllListeners()
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     if (logger_)
         logger_->debug("[proxy:client] [listeners] [{} searches] cancel all", searches_.size());
     for (auto& s : searches_) {
@@ -266,7 +266,7 @@ DhtProxyClient::shutdown(ShutdownCallback cb, bool)
 NodeStatus
 DhtProxyClient::getStatus(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
     switch (af) {
     case AF_INET:
         return statusIpv4_;
@@ -280,7 +280,7 @@ DhtProxyClient::getStatus(sa_family_t af) const
 bool
 DhtProxyClient::isRunning(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
     switch (af) {
     case AF_INET:
         return statusIpv4_ != NodeStatus::Disconnected;
@@ -297,7 +297,7 @@ DhtProxyClient::periodic(const uint8_t*, size_t, SockAddr, const time_point& /*n
     // Exec all currently stored callbacks
     decltype(callbacks_) callbacks;
     {
-        std::lock_guard<std::mutex> lock(lockCallbacks_);
+        std::lock_guard lock(lockCallbacks_);
         callbacks = std::move(callbacks_);
     }
     for (auto& callback : callbacks)
@@ -357,7 +357,7 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
                 }
                 if (not values.empty() and cb) {
                     {
-                        std::lock_guard<std::mutex> lock(lockCallbacks_);
+                        std::lock_guard lock(lockCallbacks_);
                         callbacks_.emplace_back([opstate, cb, values = std::move(values)]() {
                             if (not opstate->stop.load() and not cb(values)) {
                                 opstate->stop.store(true);
@@ -382,7 +382,7 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
             }
             if (donecb) {
                 {
-                    std::lock_guard<std::mutex> lock(lockCallbacks_);
+                    std::lock_guard lock(lockCallbacks_);
                     callbacks_.emplace_back([donecb, opstate]() {
                         donecb(opstate->ok, {});
                         opstate->stop.store(true);
@@ -391,12 +391,12 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
                 loopSignal_();
             }
             if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                 requests_.erase(reqid);
             }
         });
         {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_[reqid] = request;
         }
         request->send();
@@ -419,12 +419,12 @@ DhtProxyClient::put(const InfoHash& key, Sp<Value> val, DoneCallback cb, time_po
 
     std::shared_ptr<std::atomic_bool> ok;
     if (permanent) {
-        std::lock_guard<std::mutex> lock(searchLock_);
+        std::lock_guard lock(searchLock_);
         ok = std::make_shared<std::atomic_bool>(true);
         auto& search = searches_[key];
         if (val->id) {
             auto id = val->id;
-            auto refreshPutTimer = std::make_unique<asio::steady_timer>(httpContext_,
+            auto refreshPutTimer = std::make_unique<asio::system_timer>(httpContext_,
                                                                         proxy::OP_TIMEOUT - proxy::OP_MARGIN);
             refreshPutTimer->async_wait(
                 std::bind(&DhtProxyClient::handleRefreshPut, this, std::placeholders::_1, key, id));
@@ -443,7 +443,7 @@ DhtProxyClient::put(const InfoHash& key, Sp<Value> val, DoneCallback cb, time_po
             if (ok)
                 *ok = result;
             if (cb) {
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                 callbacks_.emplace_back([cb, result]() { cb(result, {}); });
             }
             loopSignal_();
@@ -464,7 +464,7 @@ DhtProxyClient::handleRefreshPut(const asio::error_code& ec, InfoHash key, Value
     }
     if (logger_)
         logger_->debug("[proxy:client] [put] [refresh {}]", key.to_view());
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto search = searches_.find(key);
     if (search != searches_.end()) {
         auto p = search->second.puts.find(id);
@@ -480,7 +480,7 @@ DhtProxyClient::handleRefreshPut(const asio::error_code& ec, InfoHash key, Value
 std::shared_ptr<http::Request>
 DhtProxyClient::buildRequest(const std::string& target)
 {
-    std::unique_lock<std::mutex> l(resolverLock_);
+    std::unique_lock l(resolverLock_);
     auto resolver = resolver_;
     l.unlock();
     if (not resolver)
@@ -535,12 +535,12 @@ DhtProxyClient::doPut(const InfoHash& key, Sp<Value> val, DoneCallbackSimple cb,
                         auto id = dht::Value(parsedValue).id;
                         val->id = id;
                         if (permanent) {
-                            std::lock_guard<std::mutex> lock(searchLock_);
+                            std::lock_guard lock(searchLock_);
                             auto& search = searches_[key];
                             auto it = search.pendingPuts.find(val);
                             if (it != search.pendingPuts.end()) {
                                 auto sok = std::make_shared<std::atomic_bool>(ok);
-                                auto refreshPutTimer = std::make_unique<asio::steady_timer>(httpContext_,
+                                auto refreshPutTimer = std::make_unique<asio::system_timer>(httpContext_,
                                                                                             proxy::OP_TIMEOUT
                                                                                                 - proxy::OP_MARGIN);
                                 refreshPutTimer->async_wait(
@@ -565,12 +565,12 @@ DhtProxyClient::doPut(const InfoHash& key, Sp<Value> val, DoneCallbackSimple cb,
             if (cb)
                 cb(ok);
             if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                 requests_.erase(reqid);
             }
         });
         {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_[reqid] = request;
         }
         request->send();
@@ -640,7 +640,7 @@ DhtProxyClient::getProxyInfos()
         logger_->debug("[proxy:client] [info] requesting proxy server node information");
     auto infoState = std::make_shared<InfoState>();
     {
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
         if (infoState_)
             infoState_->cancel = true;
         infoState_ = infoState;
@@ -655,7 +655,7 @@ DhtProxyClient::getProxyInfos()
     auto resolver = std::make_shared<http::Resolver>(httpContext_, proxyUrl_, logger_);
     queryProxyInfo(infoState, resolver, AF_INET);
     queryProxyInfo(infoState, resolver, AF_INET6);
-    std::lock_guard<std::mutex> l(resolverLock_);
+    std::lock_guard l(resolverLock_);
     resolver_ = resolver;
 }
 
@@ -701,7 +701,7 @@ DhtProxyClient::queryProxyInfo(const Sp<InfoState>& infoState, const Sp<http::Re
                 }
             }
             if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                 requests_.erase(reqid);
             }
         });
@@ -709,7 +709,7 @@ DhtProxyClient::queryProxyInfo(const Sp<InfoState>& infoState, const Sp<http::Re
         if (infoState->cancel.load())
             return;
         {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_[reqid] = request;
         }
         request->send();
@@ -724,7 +724,7 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
 {
     if (isDestroying_)
         return;
-    std::unique_lock<std::mutex> l(lockCurrentProxyInfos_);
+    std::unique_lock l(lockCurrentProxyInfos_);
     auto oldStatus = std::max(statusIpv4_, statusIpv6_);
     auto& status = family == AF_INET ? statusIpv4_ : statusIpv6_;
     auto& pubAddress = family == AF_INET ? publicAddressV4_ : publicAddressV6_;
@@ -761,7 +761,7 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
                     addresses.emplace_back(publicAddressV4_);
                 if (publicAddressV6_)
                     addresses.emplace_back(publicAddressV6_);
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                 callbacks_.emplace_back(
                     [cb = publicAddressChangedCb_, addresses = std::move(addresses)]() { cb(std::move(addresses)); });
             }
@@ -785,7 +785,7 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
             listenerRestartTimer_->expires_at(std::chrono::steady_clock::now());
             listenerRestartTimer_->async_wait(std::bind(&DhtProxyClient::restartListeners, this, std::placeholders::_1));
             if (not onConnectCallbacks_.empty()) {
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                 callbacks_.emplace_back([cbs = std::move(onConnectCallbacks_)]() mutable {
                     while (not cbs.empty()) {
                         cbs.front()();
@@ -820,7 +820,7 @@ DhtProxyClient::parsePublicAddress(const Json::Value& val)
 std::vector<SockAddr>
 DhtProxyClient::getPublicAddress(sa_family_t family)
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
     std::vector<SockAddr> result;
     if (publicAddressV6_ && family != AF_INET)
         result.emplace_back(publicAddressV6_);
@@ -837,7 +837,7 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
     if (isDestroying_)
         return 0;
 
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto& search = searches_[key];
     auto query = std::make_shared<Query>(Select {}, std::move(where));
     return search.ops
@@ -874,7 +874,7 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
                                                        system_clock::time_point t) {
                 if (opstate->stop)
                     return false;
-                std::lock_guard<std::mutex> lock(searchLock_);
+                std::lock_guard lock(searchLock_);
                 auto s = searches_.find(key);
                 if (s != searches_.end()) {
                     auto l = s->second.listeners.find(token);
@@ -891,8 +891,8 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
                  * (if the proxy crash for any reason)
                  */
                 if (!l->second.refreshSubscriberTimer)
-                    l->second.refreshSubscriberTimer = std::make_unique<asio::steady_timer>(httpContext_);
-                l->second.refreshSubscriberTimer->expires_at(std::chrono::steady_clock::now() + proxy::OP_TIMEOUT
+                    l->second.refreshSubscriberTimer = std::make_unique<asio::system_timer>(httpContext_);
+                l->second.refreshSubscriberTimer->expires_at(std::chrono::system_clock::now() + proxy::OP_TIMEOUT
                                                              - proxy::OP_MARGIN);
                 l->second.refreshSubscriberTimer->async_wait(
                     std::bind(&DhtProxyClient::handleResubscribe, this, std::placeholders::_1, key, token, opstate));
@@ -929,7 +929,7 @@ DhtProxyClient::handleResubscribe(const asio::error_code& ec,
     }
     if (opstate->stop)
         return;
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto s = searches_.find(key);
     if (s != searches_.end()) {
         auto l = s->second.listeners.find(token);
@@ -948,7 +948,7 @@ DhtProxyClient::cancelListen(const InfoHash& key, size_t gtoken)
     if (logger_)
         logger_->debug("[proxy:client] [search {}] cancel listen {}", key.to_view(), gtoken);
 
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     // find the listener in cache
     auto it = searches_.find(key);
     if (it == searches_.end())
@@ -979,7 +979,7 @@ DhtProxyClient::handleExpireListener(const asio::error_code& ec, const InfoHash&
     if (logger_)
         logger_->debug("[proxy:client] [listen {}] expire listener", key.to_view());
 
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     auto search = searches_.find(key);
     if (search == searches_.end())
         return;
@@ -1015,12 +1015,12 @@ DhtProxyClient::handleExpireListener(const asio::error_code& ec, const InfoHash&
                             opFailed();
                     }
                     if (not isDestroying_) {
-                        std::lock_guard<std::mutex> l(requestLock_);
+                        std::lock_guard l(requestLock_);
                         requests_.erase(reqid);
                     }
                 });
                 {
-                    std::lock_guard<std::mutex> l(requestLock_);
+                    std::lock_guard l(requestLock_);
                     requests_[reqid] = request;
                 }
                 request->send();
@@ -1097,7 +1097,7 @@ DhtProxyClient::sendListen(const restinio::http_request_header_t& header,
                     if (cb) {
                         auto expired = json.get("expired", Json::Value(false)).asBool();
                         {
-                            std::lock_guard<std::mutex> lock(lockCallbacks_);
+                            std::lock_guard lock(lockCallbacks_);
                             callbacks_.emplace_back([cb, value, opstate, expired]() {
                                 if (not opstate->stop.load()
                                     and not cb({value}, expired, system_clock::time_point::min()))
@@ -1124,12 +1124,12 @@ DhtProxyClient::sendListen(const restinio::http_request_header_t& header,
                     opFailed();
             }
             if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                 requests_.erase(reqid);
             }
         });
         {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_[reqid] = request;
         }
         request->add_on_status_callback([request, seconds = this->listenKeepIdle()](unsigned status_code) {
@@ -1153,7 +1153,7 @@ DhtProxyClient::opFailed()
     if (logger_)
         logger_->error("[proxy:client] proxy request failed");
     {
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
         statusIpv4_ = NodeStatus::Disconnected;
         statusIpv6_ = NodeStatus::Disconnected;
     }
@@ -1186,15 +1186,15 @@ DhtProxyClient::restartListeners(const asio::error_code& ec)
     if (logger_)
         logger_->d("[proxy:client] [listeners] refresh permanent puts");
 
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     for (auto& search : searches_) {
         const auto& key = search.first;
         for (auto& put : search.second.puts) {
             doPut(key, put.second.value, [ok = put.second.ok](bool result) { *ok = result; }, time_point::max(), true);
             if (!put.second.refreshPutTimer) {
-                put.second.refreshPutTimer = std::make_unique<asio::steady_timer>(httpContext_);
+                put.second.refreshPutTimer = std::make_unique<asio::system_timer>(httpContext_);
             }
-            put.second.refreshPutTimer->expires_at(std::chrono::steady_clock::now() + proxy::OP_TIMEOUT
+            put.second.refreshPutTimer->expires_at(std::chrono::system_clock::now() + proxy::OP_TIMEOUT
                                                    - proxy::OP_MARGIN);
             put.second.refreshPutTimer->async_wait(
                 std::bind(&DhtProxyClient::handleRefreshPut, this, std::placeholders::_1, key, put.first));
@@ -1210,8 +1210,7 @@ DhtProxyClient::restartListeners(const asio::error_code& ec)
         // Connectivity changed, refresh all subscribe
         for (auto& search : searches_)
             for (auto& listener : search.second.listeners)
-                if (!listener.second.opstate->ok)
-                    resubscribe(search.first, listener.first, listener.second);
+                resubscribe(search.first, listener.first, listener.second);
         return;
     }
     if (logger_)
@@ -1249,7 +1248,7 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
     {
         // If a push notification is received, the proxy is up and running
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
         auto oldStatus = std::max(statusIpv4_, statusIpv6_);
         if (oldStatus != NodeStatus::Connected)
             launchConnectedCbs_ = true;
@@ -1264,7 +1263,7 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                 logger_->debug("[proxy:client] [push] ignoring push for other session");
             return PushNotificationResult::IgnoredWrongSession;
         }
-        std::lock_guard<std::mutex> lock(searchLock_);
+        std::lock_guard lock(searchLock_);
         auto timeout = notification.find("timeout");
         if (timeout != notification.cend()) {
             InfoHash key(timeout->second);
@@ -1275,10 +1274,10 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                 auto vid = std::stoull(vidIt->second);
                 auto& put = search.puts.at(vid);
                 if (!put.refreshPutTimer)
-                    put.refreshPutTimer = std::make_unique<asio::steady_timer>(httpContext_,
-                                                                               std::chrono::steady_clock::now());
+                    put.refreshPutTimer = std::make_unique<asio::system_timer>(httpContext_,
+                                                                               std::chrono::system_clock::now());
                 else
-                    put.refreshPutTimer->expires_at(std::chrono::steady_clock::now());
+                    put.refreshPutTimer->expires_at(std::chrono::system_clock::now());
                 put.refreshPutTimer->async_wait(
                     std::bind(&DhtProxyClient::handleRefreshPut, this, std::placeholders::_1, key, vid));
                 ret = PushNotificationResult::PutRefresh;
@@ -1290,12 +1289,12 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                                                : PushNotificationResult::ListenRefresh;
             }
         } else {
-            auto key = InfoHash(notification.at("key"));
             system_clock::time_point sendTime = system_clock::time_point::min();
             try {
                 sendTime = system_clock::time_point(std::chrono::milliseconds(std::stoull(notification.at("t"))));
             } catch (...) {
             }
+            auto key = InfoHash(notification.at("key"));
             auto& search = searches_.at(key);
             auto expired = notification.find("exp");
             for (auto& list : search.listeners) {
@@ -1326,11 +1325,11 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                         ids.emplace_back(std::stoull(substr));
                     }
                     {
-                        std::lock_guard<std::mutex> lockCb(lockCallbacks_);
+                        std::lock_guard lockCb(lockCallbacks_);
                         callbacks_.emplace_back([this, key, token, opstate, ids, sendTime]() {
                             if (opstate->stop)
                                 return;
-                            std::lock_guard<std::mutex> lock(searchLock_);
+                            std::lock_guard lock(searchLock_);
                             auto s = searches_.find(key);
                             if (s == searches_.end())
                                 return;
@@ -1378,9 +1377,9 @@ DhtProxyClient::resubscribe([[maybe_unused]] const InfoHash& key,
     header.method(restinio::http_method_subscribe());
     header.request_target("/key/" + key.toString());
     if (!listener.refreshSubscriberTimer) {
-        listener.refreshSubscriberTimer = std::make_unique<asio::steady_timer>(httpContext_);
+        listener.refreshSubscriberTimer = std::make_unique<asio::system_timer>(httpContext_);
     }
-    listener.refreshSubscriberTimer->expires_at(std::chrono::steady_clock::now() + proxy::OP_TIMEOUT - proxy::OP_MARGIN);
+    listener.refreshSubscriberTimer->expires_at(std::chrono::system_clock::now() + proxy::OP_TIMEOUT - proxy::OP_MARGIN);
     listener.refreshSubscriberTimer->async_wait(
         std::bind(&DhtProxyClient::handleResubscribe, this, std::placeholders::_1, key, token, opstate));
     auto vcb = listener.cb;
@@ -1423,7 +1422,7 @@ DhtProxyClient::setPushNotificationToken([[maybe_unused]] const std::string& tok
 {
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
     {
-        std::unique_lock<std::mutex> l(lockCurrentProxyInfos_);
+        std::unique_lock l(lockCurrentProxyInfos_);
         if (deviceKey_ == token)
             return;
         deviceKey_ = token;
@@ -1432,7 +1431,7 @@ DhtProxyClient::setPushNotificationToken([[maybe_unused]] const std::string& tok
     }
     if (logger_)
         logger_->debug("[proxy:client] [push] token changed, resubscribing");
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
     for (auto& search : searches_) {
         for (auto& listener : search.second.listeners) {
             resubscribe(search.first, listener.first, listener.second);

src/dht_proxy_server.cpp

@@ -126,8 +126,8 @@ DhtProxyServer::ServerStats::toJson() const
     result["putCount"] = static_cast<Json::UInt64>(putCount);
     result["totalPermanentPuts"] = static_cast<Json::UInt64>(totalPermanentPuts);
     result["pushListenersCount"] = static_cast<Json::UInt64>(pushListenersCount);
-    result["serverStartTime"] = static_cast<Json::LargestInt>(to_time_t(serverStartTime));
-    result["lastUpdated"] = static_cast<Json::LargestInt>(to_time_t(lastUpdated));
+    result["serverStartTime"] = static_cast<Json::LargestInt>(std::chrono::system_clock::to_time_t(serverStartTime));
+    result["lastUpdated"] = static_cast<Json::LargestInt>(std::chrono::system_clock::to_time_t(lastUpdated));
     result["androidPush"] = androidPush.toJson();
     result["iosPush"] = iosPush.toJson();
     result["unifiedPush"] = unifiedPush.toJson();
@@ -176,7 +176,7 @@ DhtProxyServer::ConnectionListener::state_changed(const restinio::connection_sta
 void
 DhtProxyServer::onConnectionClosed(restinio::connection_id_t id)
 {
-    std::lock_guard<std::mutex> lock(lockListener_);
+    std::lock_guard lock(lockListener_);
     auto it = listeners_.find(id);
     if (it != listeners_.end()) {
         dht_->cancelListen(it->second.hash, std::move(it->second.token));
@@ -210,7 +210,7 @@ DhtProxyServer::PermanentPut::msgpack_unpack(const msgpack::object& o)
         clientId = cid->as<std::string>();
     }
     if (auto exp = findMapValue(o, "exp"sv)) {
-        expiration = from_time_t(exp->as<time_t>());
+        expiration = std::chrono::system_clock::from_time_t(exp->as<time_t>());
     }
     if (auto token = findMapValue(o, "token"sv)) {
         pushToken = token->as<std::string>();
@@ -240,7 +240,7 @@ DhtProxyServer::Listener::msgpack_unpack(const msgpack::object& o)
         clientId = cid->as<std::string>();
     }
     if (auto exp = findMapValue(o, "exp"sv)) {
-        expiration = from_time_t(exp->as<time_t>());
+        expiration = std::chrono::system_clock::from_time_t(exp->as<time_t>());
     }
     if (auto sid = findMapValue(o, "sid"sv)) {
         if (not sessionCtx)
@@ -381,13 +381,13 @@ DhtProxyServer::saveState(Os& stream)
     msgpack::packer<Os> pk(&stream);
     pk.pack_map(2);
     {
-        std::lock_guard<std::mutex> lock(lockSearchPuts_);
+        std::lock_guard lock(lockSearchPuts_);
         pk.pack("puts");
         pk.pack(puts_);
     }
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
     {
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
         pk.pack("pushListeners");
         pk.pack(pushListeners_);
     }
@@ -408,13 +408,13 @@ DhtProxyServer::loadState(Is& is, size_t size)
             if (oh.get().type != msgpack::type::MAP)
                 continue;
             if (auto puts = findMapValue(oh.get(), "puts"sv)) {
-                std::lock_guard<std::mutex> lock(lockSearchPuts_);
+                std::lock_guard lock(lockSearchPuts_);
                 puts_ = puts->as<decltype(puts_)>();
                 if (logger_)
                     logger_->debug("[proxy:server] Loading {} persistent puts", puts_.size());
                 for (auto& put : puts_) {
                     for (auto& pput : put.second.puts) {
-                        pput.second.expireTimer = std::make_unique<asio::steady_timer>(io_context(),
+                        pput.second.expireTimer = std::make_unique<asio::system_timer>(io_context(),
                                                                                        pput.second.expiration);
                         pput.second.expireTimer->async_wait(std::bind(&DhtProxyServer::handleCancelPermamentPut,
                                                                       this,
@@ -432,12 +432,12 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                 json["to"] = clientId;
                                 json["vid"] = std::to_string(vid);
                                 if (sessionCtx) {
-                                    std::lock_guard<std::mutex> l(sessionCtx->lock);
+                                    std::lock_guard l(sessionCtx->lock);
                                     json["s"] = sessionCtx->sessionId;
                                 }
                                 return json;
                             };
-                            pput.second.expireNotifyTimer = std::make_unique<asio::steady_timer>(io_context(),
+                            pput.second.expireNotifyTimer = std::make_unique<asio::system_timer>(io_context(),
                                                                                                  pput.second.expiration
                                                                                                      - proxy::OP_MARGIN);
                             pput.second.expireNotifyTimer->async_wait(
@@ -450,7 +450,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                           pput.second.topic));
                         }
 #endif
-                        dht_->put(put.first, pput.second.value, DoneCallbackSimple {}, time_point::max(), true);
+                        dht_->put(put.first, pput.second.value, DoneCallbackSimple {}, dht::time_point::max(), true);
                     }
                 }
             } else {
@@ -459,7 +459,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
             }
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
             if (auto pushListeners = findMapValue(oh.get(), "pushListeners"sv)) {
-                std::lock_guard<std::mutex> lock(lockListener_);
+                std::lock_guard lock(lockListener_);
                 pushListeners_ = pushListeners->as<decltype(pushListeners_)>();
                 if (logger_)
                     logger_->debug("[proxy:server] Loading {} push listeners", pushListeners_.size());
@@ -487,7 +487,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                                                                  expired);
                                                });
                             // expire notify
-                            listener.expireNotifyTimer = std::make_unique<asio::steady_timer>(io_context(),
+                            listener.expireNotifyTimer = std::make_unique<asio::system_timer>(io_context(),
                                                                                               listener.expiration
                                                                                                   - proxy::OP_MARGIN);
                             auto jsonProvider = [infoHash = listeners.first.toString(),
@@ -496,7 +496,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                 Json::Value json;
                                 json["timeout"] = infoHash;
                                 json["to"] = clientId;
-                                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                                std::lock_guard l(sessionCtx->lock);
                                 json["s"] = sessionCtx->sessionId;
                                 return json;
                             };
@@ -509,7 +509,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                           listener.type,
                                           listener.topic));
                             // cancel push listen
-                            listener.expireTimer = std::make_unique<asio::steady_timer>(io_context(),
+                            listener.expireTimer = std::make_unique<asio::system_timer>(io_context(),
                                                                                         listener.expiration);
                             listener.expireTimer->async_wait(std::bind(&DhtProxyServer::handleCancelPushListen,
                                                                        this,
@@ -546,7 +546,7 @@ DhtProxyServer::~DhtProxyServer()
         saveState(stateFile);
     }
     if (dht_) {
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
         for (auto& l : listeners_) {
             dht_->cancelListen(l.second.hash, std::move(l.second.token));
             if (l.second.response)
@@ -817,7 +817,7 @@ DhtProxyServer::listen(restinio::request_handle_t request, restinio::router::rou
         auto response = std::make_shared<ResponseByPartsBuilder>(
             initHttpResponse(request->create_response<ResponseByParts>()));
         response->flush();
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
         // save the listener to handle a disconnect
         auto& session = listeners_[request->connection_id()];
         session.hash = infoHash;
@@ -907,6 +907,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
         Json::Value r;
         auto* char_data = reinterpret_cast<const char*>(request->body().data());
         auto reader = std::unique_ptr<Json::CharReader>(jsonReaderBuilder_.newCharReader());
+
         if (!reader->parse(char_data, char_data + request->body().size(), &r, &err)) {
             auto response = initHttpResponse(request->create_response(restinio::status_bad_request()));
             response.set_body(RESP_MSG_JSON_INCORRECT);
@@ -931,7 +932,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
             logger_->debug("[proxy:server] [subscribe {}] [client {}] [session {}]", infoHash, clientId, sessionId);
 
         // Insert new or return existing push listeners of a token
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
         auto& pushListener = pushListeners_[pushToken];
         auto& pushListeners = pushListener.listeners[infoHash];
 
@@ -945,25 +946,25 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
             listIt->clientId = clientId;
             listIt->sessionCtx = std::make_shared<PushSessionContext>(sessionId);
         } else {
-            std::lock_guard<std::mutex> l(listIt->sessionCtx->lock);
+            std::lock_guard l(listIt->sessionCtx->lock);
             listIt->sessionCtx->sessionId = sessionId;
         }
         auto& listener = *listIt;
 
         // Expiration
-        auto timeout = std::chrono::steady_clock::now() + proxy::OP_TIMEOUT;
+        auto timeout = clock::now() + proxy::OP_TIMEOUT;
         listener.expiration = timeout;
         listener.type = type;
         listener.topic = topic;
         if (listener.expireNotifyTimer)
             listener.expireNotifyTimer->expires_at(timeout - proxy::OP_MARGIN);
         else
-            listener.expireNotifyTimer = std::make_unique<asio::steady_timer>(io_context(), timeout - proxy::OP_MARGIN);
+            listener.expireNotifyTimer = std::make_unique<asio::system_timer>(io_context(), timeout - proxy::OP_MARGIN);
         auto jsonProvider = [h = infoHash.toString(), clientId, sessionCtx = listener.sessionCtx]() {
             Json::Value json;
             json["timeout"] = h;
             json["to"] = clientId;
-            std::lock_guard<std::mutex> l(sessionCtx->lock);
+            std::lock_guard l(sessionCtx->lock);
             json["s"] = sessionCtx->sessionId;
             return json;
         };
@@ -975,7 +976,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
                                                          listener.type,
                                                          listener.topic));
         if (!listener.expireTimer)
-            listener.expireTimer = std::make_unique<asio::steady_timer>(io_context(), timeout);
+            listener.expireTimer = std::make_unique<asio::system_timer>(io_context(), timeout);
         else
             listener.expireTimer->expires_at(timeout);
         listener.expireTimer->async_wait(std::bind(&DhtProxyServer::handleCancelPushListen,
@@ -1110,7 +1111,7 @@ DhtProxyServer::handleCancelPushListen(const asio::error_code& ec,
     }
     if (logger_)
         logger_->debug("[proxy:server] [listen:push {}] cancelled for {}", key, clientId);
-    std::lock_guard<std::mutex> lock(lockListener_);
+    std::lock_guard lock(lockListener_);
 
     auto pushListener = pushListeners_.find(pushToken);
     if (pushListener == pushListeners_.end())
@@ -1151,19 +1152,24 @@ DhtProxyServer::handlePushListen(const InfoHash& infoHash,
     json["t"] = Json::Value::Int64(duration_cast<milliseconds>(system_clock::now().time_since_epoch()).count());
 
     {
-        std::lock_guard<std::mutex> l(sessionCtx->lock);
+        std::lock_guard l(sessionCtx->lock);
         json["s"] = sessionCtx->sessionId;
     }
 
     // Build a comma-separated list of ids from the values. This is intended to be used when
     // streaming from the iOS notification extension in order to filter out unwanted values.
     std::string ids;
+    std::string pushTypes;
     for (const auto& value : values) {
-        if (!ids.empty())
+        if (!ids.empty()) {
             ids += ",";
+            pushTypes += ",";
+        }
+        pushTypes += value->pushType;
         ids += std::to_string(value->id);
     }
     json["ids"] = ids;
+    json["pt"] = pushTypes;
 
     // If message is expired copy the value ID to the `exp` field.
     // This is presumably used by the Android notification system.
@@ -1200,14 +1206,7 @@ DhtProxyServer::sendPushNotification(
     try {
         std::shared_ptr<http::Request> request;
         if (type == PushType::UnifiedPush) {
-            http::Url tokenUrl(token);
-            request = std::make_shared<http::Request>(io_context(),
-                                                      concat(tokenUrl.protocol, "://"sv, tokenUrl.host),
-                                                      tokenUrl.service,
-                                                      tokenUrl.protocol.find("https") == 0,
-                                                      logger_);
-            request->set_target(tokenUrl.target);
-            request->set_header_field(restinio::http_field_t::host, std::string(tokenUrl.host));
+            request = std::make_shared<http::Request>(io_context(), token, logger_);
         } else {
             request = std::make_shared<http::Request>(io_context(),
                                                       pushHostPort_.first,
@@ -1226,8 +1225,8 @@ DhtProxyServer::sendPushNotification(
             Blob auth;   ///< Auth secret
             auto delim = topicView.find('|');
             if (delim != std::string_view::npos) {
-                pubKey = base64_decode(topicView.substr(0, delim));
-                auth = base64_decode(topicView.substr(delim + 1));
+                pubKey = base64_default_or_url_decode(topicView.substr(0, delim));
+                auth = base64_default_or_url_decode(topicView.substr(delim + 1));
             }
 
             request->set_header_field(restinio::http_field_t::ttl, "86400");
@@ -1302,12 +1301,12 @@ DhtProxyServer::sendPushNotification(
             if (state == http::Request::State::DONE) {
                 if (logger_ and response.status_code != 200)
                     logger_->error("[proxy:server] [notification] push failed: {}", response.status_code);
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                 requests_.erase(reqid);
             }
         });
         {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_[reqid] = request;
         }
         request->send();
@@ -1330,7 +1329,7 @@ DhtProxyServer::sendPushNotification(
         if (logger_)
             logger_->error("[proxy:server] [notification] error send push: {}", e.what());
         if (reqid) {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
             requests_.erase(reqid);
         }
     }
@@ -1349,7 +1348,7 @@ DhtProxyServer::handleCancelPermamentPut(const asio::error_code& ec, const InfoH
     }
     if (logger_)
         logger_->debug("[proxy:server] [put {}] cancel permament put {}", key, vid);
-    std::lock_guard<std::mutex> lock(lockSearchPuts_);
+    std::lock_guard lock(lockSearchPuts_);
     auto sPuts = puts_.find(key);
     if (sPuts == puts_.end())
         return;
@@ -1406,8 +1405,8 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                     sessionId = pVal["session_id"].asString();
                     topic = pVal["topic"].asString();
                 }
-                std::lock_guard<std::mutex> lock(lockSearchPuts_);
-                auto timeout = std::chrono::steady_clock::now() + proxy::OP_TIMEOUT;
+                std::lock_guard lock(lockSearchPuts_);
+                auto timeout = clock::now() + proxy::OP_TIMEOUT;
                 auto& sPuts = puts_[infoHash];
                 if (value->id == Value::INVALID_ID) {
                     for (auto& pp : sPuts.puts) {
@@ -1423,7 +1422,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                                 if (not pp.second.sessionCtx)
                                     pp.second.sessionCtx = std::make_shared<PushSessionContext>(sessionId);
                                 else {
-                                    std::lock_guard<std::mutex> l(pp.second.sessionCtx->lock);
+                                    std::lock_guard l(pp.second.sessionCtx->lock);
                                     pp.second.sessionCtx->sessionId = sessionId;
                                 }
                             }
@@ -1441,7 +1440,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                 pput.expiration = timeout;
                 if (not pput.expireTimer) {
                     // cancel permanent put
-                    pput.expireTimer = std::make_unique<asio::steady_timer>(io_context(), timeout);
+                    pput.expireTimer = std::make_unique<asio::system_timer>(io_context(), timeout);
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
                     if (not pushToken.empty()) {
                         pput.pushToken = pushToken;
@@ -1458,7 +1457,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                         if (not pput.sessionCtx)
                             pput.sessionCtx = std::make_shared<PushSessionContext>(sessionId);
                         else {
-                            std::lock_guard<std::mutex> l(pput.sessionCtx->lock);
+                            std::lock_guard l(pput.sessionCtx->lock);
                             pput.sessionCtx->sessionId = sessionId;
                         }
                     }
@@ -1475,12 +1474,12 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                         json["timeout"] = infoHash.toString();
                         json["to"] = clientId;
                         json["vid"] = std::to_string(vid);
-                        std::lock_guard<std::mutex> l(sessionCtx->lock);
+                        std::lock_guard l(sessionCtx->lock);
                         json["s"] = sessionCtx->sessionId;
                         return json;
                     };
                     if (!pput.expireNotifyTimer)
-                        pput.expireNotifyTimer = std::make_unique<asio::steady_timer>(io_context(),
+                        pput.expireNotifyTimer = std::make_unique<asio::system_timer>(io_context(),
                                                                                       timeout - proxy::OP_MARGIN);
                     else
                         pput.expireNotifyTimer->expires_at(timeout - proxy::OP_MARGIN);
@@ -1509,7 +1508,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                         response.done();
                     }
                 },
-                time_point::max(),
+                dht::time_point::max(),
                 permanent);
             return restinio::request_handling_status_t::accepted;
         } else {

src/dhtrunner.cpp

@@ -76,7 +76,7 @@ DhtRunner::run(const char* ip4, const char* ip6, const char* service, Config& co
 void
 DhtRunner::run(const Config& config, Context&& context)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     auto expected = State::Idle;
     if (not running.compare_exchange_strong(expected, State::Running)) {
         if (context.logger)
@@ -99,6 +99,11 @@ DhtRunner::run(const Config& config, Context&& context)
         auto state_path = config.dht_config.node_config.persist_path;
         if (not state_path.empty())
             state_path += "_port.txt";
+        // Ports loaded from the persisted state are a best-effort hint to keep a
+        // stable identity across restarts; remember which ones we set so that we
+        // can fall back to random ports if they are already in use (e.g. a fast
+        // restart while the previous instance still holds them).
+        bool triedSavedPort = false;
         if (not state_path.empty() && (local4.getPort() == 0 || local6.getPort() == 0)) {
             std::ifstream inConfig(state_path);
             if (inConfig.is_open()) {
@@ -110,6 +115,7 @@ DhtRunner::run(const Config& config, Context&& context)
                                               fmt::ptr(this),
                                               port);
                         local4.setPort(port);
+                        triedSavedPort = true;
                     }
                 }
                 if (inConfig >> port) {
@@ -119,6 +125,7 @@ DhtRunner::run(const Config& config, Context&& context)
                                               fmt::ptr(this),
                                               port);
                         local6.setPort(port);
+                        triedSavedPort = true;
                     }
                 }
             }
@@ -136,12 +143,25 @@ DhtRunner::run(const Config& config, Context&& context)
 
         if (config.proxy_server.empty()) {
             if (not context.sock) {
-                context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
+                try {
+                    context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
+                } catch (const DhtException&) {
+                    if (not triedSavedPort)
+                        throw;
+                    // The saved ports are unavailable (typically still held by a
+                    // previous instance): fall back to OS-assigned ports.
+                    if (context.logger)
+                        context.logger->w("[runner %p] Saved ports unavailable, falling back to random ports",
+                                          fmt::ptr(this));
+                    local4.setPort(0);
+                    local6.setPort(0);
+                    context.sock.reset(new net::UdpSocket(local4, local6, context.logger));
+                }
             }
             context.sock->setOnReceive([&](net::PacketList&& pkts) {
                 net::PacketList ret;
                 {
-                    std::lock_guard<std::mutex> lck(sock_mtx);
+                    std::lock_guard lck(sock_mtx);
                     rcv.splice(rcv.end(), std::move(pkts));
                     size_t dropped = 0;
                     while (rcv.size() > net::RX_QUEUE_MAX_SIZE) {
@@ -186,9 +206,6 @@ DhtRunner::run(const Config& config, Context&& context)
     if (context.certificateStore) {
         dht_->setLocalCertificateStore(std::move(context.certificateStore));
     }
-    if (context.certificateStorePkId) {
-        dht_->setLocalCertificateStore(std::move(context.certificateStorePkId));
-    }
     if (context.publicAddressChangedCb) {
         dht_->setOnPublicAddressChanged(std::move(context.publicAddressChangedCb));
     }
@@ -197,19 +214,19 @@ DhtRunner::run(const Config& config, Context&& context)
         return;
     dht_thread = std::thread([this]() {
         while (running != State::Idle) {
-            std::unique_lock<std::mutex> lk(dht_mtx);
+            std::unique_lock lk(dht_mtx);
             time_point wakeup = loop_();
 
             auto hasJobToDo = [this]() {
                 if (running == State::Idle)
                     return true;
                 {
-                    std::lock_guard<std::mutex> lck(sock_mtx);
+                    std::lock_guard lck(sock_mtx);
                     if (not rcv.empty())
                         return true;
                 }
                 {
-                    std::lock_guard<std::mutex> lck(storage_mtx);
+                    std::lock_guard lck(storage_mtx);
                     if (not pending_ops_prio.empty())
                         return true;
                     auto s = getStatus();
@@ -284,7 +301,7 @@ DhtRunner::run(const Config& config, Context&& context)
 void
 DhtRunner::shutdown(ShutdownCallback cb, bool stop)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     auto expected = State::Running;
     if (not running.compare_exchange_strong(expected, State::Stopping)) {
         if (expected == State::Stopping and ongoing_ops) {
@@ -344,7 +361,7 @@ DhtRunner::checkShutdown()
 {
     decltype(shutdownCallbacks_) cbs;
     {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
         if (running != State::Stopping or ongoing_ops)
             return false;
         cbs = std::move(shutdownCallbacks_);
@@ -359,7 +376,7 @@ void
 DhtRunner::join()
 {
     {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
         if (running.exchange(State::Idle) == State::Idle)
             return;
         cv.notify_all();
@@ -378,7 +395,7 @@ DhtRunner::join()
         dht_thread.join();
 
     {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
         if (ongoing_ops and logger_) {
             logger_->warn("[runner {:p}] stopping with {:d} remaining ops", fmt::ptr(this), ongoing_ops.load());
         }
@@ -388,7 +405,7 @@ DhtRunner::join()
         shutdownCallbacks_.clear();
     }
     {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
         resetDht();
         status4 = NodeStatus::Disconnected;
         status6 = NodeStatus::Disconnected;
@@ -398,7 +415,7 @@ DhtRunner::join()
 SockAddr
 DhtRunner::getBound(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         if (auto sock = dht_->getSocket())
             return sock->getBound(af);
@@ -408,7 +425,7 @@ DhtRunner::getBound(sa_family_t af) const
 in_port_t
 DhtRunner::getBoundPort(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         if (auto sock = dht_->getSocket())
             return sock->getPort(af);
@@ -418,7 +435,7 @@ DhtRunner::getBoundPort(sa_family_t af) const
 void
 DhtRunner::dumpTables() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     dht_->dumpTables();
 }
 
@@ -443,7 +460,7 @@ DhtRunner::getNodeId() const
 std::pair<size_t, size_t>
 DhtRunner::getStoreSize() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         return {};
     return dht_->getStoreSize();
@@ -452,7 +469,7 @@ DhtRunner::getStoreSize() const
 void
 DhtRunner::setStorageLimit(size_t limit)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         throw std::runtime_error("dht is not running");
     return dht_->setStorageLimit(limit);
@@ -461,7 +478,7 @@ DhtRunner::setStorageLimit(size_t limit)
 size_t
 DhtRunner::getStorageLimit() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         throw std::runtime_error("dht is not running");
     return dht_->getStorageLimit();
@@ -470,7 +487,7 @@ DhtRunner::getStorageLimit() const
 void
 DhtRunner::setLocalStorageLimit(size_t limit)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         throw std::runtime_error("dht is not running");
     return dht_->setLocalStorageLimit(limit);
@@ -479,7 +496,7 @@ DhtRunner::setLocalStorageLimit(size_t limit)
 size_t
 DhtRunner::getLocalStorageLimit() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         throw std::runtime_error("dht is not running");
     return dht_->getLocalStorageLimit();
@@ -488,7 +505,7 @@ DhtRunner::getLocalStorageLimit() const
 std::vector<NodeExport>
 DhtRunner::exportNodes() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         return {};
     return dht_->exportNodes();
@@ -497,7 +514,7 @@ DhtRunner::exportNodes() const
 std::vector<ValuesExport>
 DhtRunner::exportValues() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (!dht_)
         return {};
     return dht_->exportValues();
@@ -506,7 +523,7 @@ DhtRunner::exportValues() const
 void
 DhtRunner::setLogger(const Sp<Logger>& logger)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     logger_ = logger;
     if (dht_)
         dht_->setLogger(logger);
@@ -515,7 +532,7 @@ DhtRunner::setLogger(const Sp<Logger>& logger)
 void
 DhtRunner::setLogFilter(const InfoHash& f)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         dht_->setLogFilter(f);
 }
@@ -523,22 +540,28 @@ DhtRunner::setLogFilter(const InfoHash& f)
 void
 DhtRunner::registerType(const ValueType& type)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     dht_->registerType(type);
 }
 
 void
 DhtRunner::registerInsecureType(const ValueType& type)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     dht_->registerInsecureType(type);
 }
 
 void
 DhtRunner::importValues(const std::vector<ValuesExport>& values)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
-    dht_->importValues(values);
+    {
+        std::lock_guard lck(dht_mtx);
+        dht_->importValues(values);
+    }
+    // Recompute the runner wakeup after import schedules value expirations.
+    std::lock_guard lck(storage_mtx);
+    pending_ops_prio.emplace([](SecureDht&) {});
+    cv.notify_all();
 }
 
 unsigned
@@ -548,7 +571,7 @@ DhtRunner::getNodesStats(sa_family_t af,
                          unsigned* cached_return,
                          unsigned* incoming_return) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     const auto stats = dht_->getNodesStats(af);
     if (good_return)
         *good_return = stats.good_nodes;
@@ -564,7 +587,7 @@ DhtRunner::getNodesStats(sa_family_t af,
 NodeStats
 DhtRunner::getNodesStats(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getNodesStats(af);
 }
 
@@ -572,7 +595,7 @@ NodeInfo
 DhtRunner::getNodeInfo() const
 {
     NodeInfo info {};
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         info = dht_->getNodeInfo();
     info.ongoing_ops = ongoing_ops;
@@ -582,7 +605,7 @@ DhtRunner::getNodeInfo() const
 void
 DhtRunner::getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)> cb)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     ongoing_ops++;
     pending_ops_prio.emplace([cb = std::move(cb), this](SecureDht& dht) {
         auto sinfo = std::make_shared<NodeInfo>();
@@ -597,44 +620,44 @@ DhtRunner::getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)> cb)
 std::vector<unsigned>
 DhtRunner::getNodeMessageStats(bool in) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getNodeMessageStats(in);
 }
 
 std::string
 DhtRunner::getStorageLog() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getStorageLog();
 }
 std::string
 DhtRunner::getStorageLog(const InfoHash& f) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getStorageLog(f);
 }
 std::string
 DhtRunner::getRoutingTablesLog(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getRoutingTablesLog(af);
 }
 std::string
 DhtRunner::getSearchesLog(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getSearchesLog(af);
 }
 std::string
 DhtRunner::getSearchLog(const InfoHash& f, sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     return dht_->getSearchLog(f, af);
 }
 std::vector<SockAddr>
 DhtRunner::getPublicAddress(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         return dht_->getPublicAddress(af);
     return {};
@@ -651,7 +674,7 @@ DhtRunner::getPublicAddressStr(sa_family_t af) const
 void
 DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_family_t af)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     ongoing_ops++;
     pending_ops_prio.emplace([cb = std::move(cb), this, af](SecureDht& dht) {
         cb(dht.getPublicAddress(af));
@@ -663,22 +686,14 @@ DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_
 void
 DhtRunner::registerCertificate(const std::shared_ptr<crypto::Certificate>& cert)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     dht_->registerCertificate(cert);
 }
 
-void
-DhtRunner::setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-{
-    std::lock_guard<std::mutex> lck(dht_mtx);
-    if (dht_)
-        dht_->setLocalCertificateStore(std::forward<CertificateStoreQueryLegacy>(query_method));
-}
-
 void
 DhtRunner::setLocalCertificateStore(CertificateStoreQuery&& query_method)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         dht_->setLocalCertificateStore(std::forward<CertificateStoreQuery>(query_method));
 }
@@ -691,7 +706,7 @@ DhtRunner::loop_()
 
     decltype(pending_ops) ops {};
     {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
         auto s = getStatus();
         ops = (pending_ops_prio.empty()
                && (s == NodeStatus::Connected or s == NodeStatus::Disconnected or running == State::Stopping))
@@ -707,7 +722,7 @@ DhtRunner::loop_()
     decltype(rcv) received {};
     decltype(rcv) received_treated {};
     {
-        std::lock_guard<std::mutex> lck(sock_mtx);
+        std::lock_guard lck(sock_mtx);
         // move to stack
         received = std::move(rcv);
     }
@@ -742,7 +757,7 @@ DhtRunner::loop_()
     }
 
     if (not received_treated.empty()) {
-        std::lock_guard<std::mutex> lck(sock_mtx);
+        std::lock_guard lck(sock_mtx);
         if (rcv_free.size() < net::RX_QUEUE_MAX_SIZE)
             rcv_free.splice(rcv_free.end(), std::move(received_treated));
     }
@@ -766,7 +781,7 @@ DhtRunner::loop_()
 void
 DhtRunner::get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f, Where w)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (dcb)
@@ -788,7 +803,7 @@ DhtRunner::get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb,
 void
 DhtRunner::query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb, Query q)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (done_cb)
@@ -806,7 +821,7 @@ std::future<size_t>
 DhtRunner::listen(InfoHash hash, ValueCallback vcb, Value::Filter f, Where w)
 {
     auto ret_token = std::make_shared<std::promise<size_t>>();
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         ret_token->set_value(0);
@@ -828,7 +843,7 @@ DhtRunner::listen(const std::string& key, GetCallback vcb, Value::Filter f, Wher
 void
 DhtRunner::cancelListen(InfoHash h, size_t token)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     if (running != State::Running)
         return;
     ongoing_ops++;
@@ -842,7 +857,7 @@ DhtRunner::cancelListen(InfoHash h, size_t token)
 void
 DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     if (running != State::Running)
         return;
     ongoing_ops++;
@@ -856,7 +871,7 @@ DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 void
 DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -873,7 +888,7 @@ DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created
 void
 DhtRunner::put(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -896,7 +911,7 @@ DhtRunner::put(const std::string& key, Value&& value, DoneCallbackSimple cb, tim
 void
 DhtRunner::cancelPut(const InfoHash& h, Value::Id id)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops.emplace([=](SecureDht& dht) { dht.cancelPut(h, id); });
     cv.notify_all();
 }
@@ -904,7 +919,7 @@ DhtRunner::cancelPut(const InfoHash& h, Value::Id id)
 void
 DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops.emplace([=](SecureDht& dht) { dht.cancelPut(h, value->id); });
     cv.notify_all();
 }
@@ -912,7 +927,7 @@ DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 void
 DhtRunner::putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -941,7 +956,7 @@ DhtRunner::putSigned(const std::string& key, Value&& value, DoneCallbackSimple c
 void
 DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -955,35 +970,6 @@ DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> va
     cv.notify_all();
 }
 
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
-{
-    std::unique_lock<std::mutex> lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        if (cb)
-            cb(false, {});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([=, cb = std::move(cb), value = std::move(value)](SecureDht& dht) mutable {
-        dht.putEncrypted(hash, to, value, bindOpDoneCallback(std::move(cb)), permanent);
-    });
-    cv.notify_all();
-}
-
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
-}
-
-void
-DhtRunner::putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(InfoHash::get(key), to, std::forward<Value>(value), std::move(cb), permanent);
-}
-
 void
 DhtRunner::putEncrypted(InfoHash hash,
                         const std::shared_ptr<crypto::PublicKey>& to,
@@ -991,7 +977,7 @@ DhtRunner::putEncrypted(InfoHash hash,
                         DoneCallback cb,
                         bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -1015,7 +1001,7 @@ DhtRunner::putEncrypted(
 void
 DhtRunner::bootstrap(const std::string& host, const std::string& service)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops_prio.emplace([host, service](SecureDht& dht) mutable { dht.addBootstrap(host, service); });
     cv.notify_all();
 }
@@ -1023,7 +1009,7 @@ DhtRunner::bootstrap(const std::string& host, const std::string& service)
 void
 DhtRunner::bootstrap(const std::string& hostService)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     auto [h, s] = splitPort(hostService);
     pending_ops_prio.emplace(
         [host = std::string(h), service = std::string(s)](SecureDht& dht) { dht.addBootstrap(host, service); });
@@ -1033,7 +1019,7 @@ DhtRunner::bootstrap(const std::string& hostService)
 void
 DhtRunner::clearBootstrap()
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops_prio.emplace([](SecureDht& dht) mutable { dht.clearBootstrap(); });
     cv.notify_all();
 }
@@ -1045,7 +1031,7 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb)
         cb(false);
         return;
     }
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     ongoing_ops++;
     pending_ops_prio.emplace([cb = bindOpDoneCallback(std::move(cb)), nodes = std::move(nodes)](SecureDht& dht) mutable {
         auto rem = cb ? std::make_shared<std::pair<size_t, bool>>(nodes.size(), false) : nullptr;
@@ -1068,7 +1054,7 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb)
 void
 DhtRunner::bootstrap(SockAddr addr, DoneCallbackSimple cb)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         if (cb)
@@ -1085,7 +1071,7 @@ DhtRunner::bootstrap(SockAddr addr, DoneCallbackSimple cb)
 void
 DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     if (running != State::Running)
         return;
     pending_ops_prio.emplace([id, address](SecureDht& dht) mutable { dht.insertNode(id, address); });
@@ -1095,7 +1081,7 @@ DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 void
 DhtRunner::bootstrap(std::vector<NodeExport> nodes)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     if (running != State::Running)
         return;
     pending_ops_prio.emplace([nodes = std::move(nodes)](SecureDht& dht) {
@@ -1108,7 +1094,7 @@ DhtRunner::bootstrap(std::vector<NodeExport> nodes)
 void
 DhtRunner::connectivityChanged()
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops_prio.emplace([=](SecureDht& dht) {
         dht.connectivityChanged();
 #ifdef OPENDHT_PEER_DISCOVERY
@@ -1119,29 +1105,10 @@ DhtRunner::connectivityChanged()
     cv.notify_all();
 }
 
-void
-DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb)
-{
-    std::unique_lock<std::mutex> lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        cb({});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([this, hash, cb = std::move(cb)](SecureDht& dht) {
-        dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt) {
-            cb(crt);
-            opEnded();
-        });
-    });
-    cv.notify_all();
-}
-
 void
 DhtRunner::findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)> cb)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
     if (running != State::Running) {
         lck.unlock();
         return;
@@ -1167,7 +1134,7 @@ void
 DhtRunner::setProxyServer(const std::string& proxy, const std::string& pushNodeId)
 {
 #ifdef OPENDHT_PROXY_CLIENT
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (config_.proxy_server == proxy and config_.push_node_id == pushNodeId)
         return;
     config_.proxy_server = proxy;
@@ -1194,8 +1161,8 @@ DhtRunner::enableProxy(bool proxify)
             config_.client_identity,
             [this] {
                 if (config_.threaded) {
-                    std::lock_guard<std::mutex> lck(storage_mtx);
-                    pending_ops_prio.emplace([=](SecureDht&) mutable {});
+                    std::lock_guard lck(storage_mtx);
+                    pending_ops_prio.emplace([](SecureDht&) {});
                     cv.notify_all();
                 }
             },
@@ -1207,11 +1174,8 @@ DhtRunner::enableProxy(bool proxify)
             config_.push_platform,
             logger_);
         dht_ = std::make_unique<SecureDht>(std::move(dht_via_proxy), config_.dht_config, identityAnnouncedCb_, logger_);
-        // and use it
-        use_proxy = proxify;
-    } else {
-        use_proxy = proxify;
     }
+    use_proxy = proxify;
 #else
     if (proxify)
         throw std::runtime_error("DHT proxy requested but OpenDHT built without proxy support.");
@@ -1221,7 +1185,7 @@ DhtRunner::enableProxy(bool proxify)
 void
 DhtRunner::forwardAllMessages(bool forward)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
     if (dht_)
         dht_->forwardAllMessages(forward);
 }
@@ -1232,7 +1196,7 @@ DhtRunner::forwardAllMessages(bool forward)
 void
 DhtRunner::setPushNotificationToken(const std::string& token)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
     config_.push_token = token;
     if (dht_)
@@ -1245,7 +1209,7 @@ DhtRunner::setPushNotificationToken(const std::string& token)
 void
 DhtRunner::setPushNotificationTopic(const std::string& topic)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
     config_.push_topic = topic;
     if (dht_)
@@ -1258,7 +1222,7 @@ DhtRunner::setPushNotificationTopic(const std::string& topic)
 void
 DhtRunner::setPushNotificationPlatform(const std::string& platform)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
     config_.push_platform = platform;
     if (dht_)
@@ -1274,7 +1238,7 @@ DhtRunner::pushNotificationReceived([[maybe_unused]] const std::map<std::string,
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
     auto ret_token = std::make_shared<std::promise<PushNotificationResult>>();
     auto future = ret_token->get_future();
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
     pending_ops_prio.emplace([ret_token, this, data](SecureDht&) {
         if (dht_)
             ret_token->set_value(dht_->pushNotificationReceived(data));

src/http.cpp

@@ -42,8 +42,8 @@ constexpr std::string_view ORIGIN_PROTOCOL {"//"sv};
 constexpr const char HTTP_HEADER_DELIM[] = "\r\n\r\n";
 constexpr unsigned MAX_REDIRECTS {5};
 
-Url::Url(std::string_view url_str)
-    : url(url_str)
+Url::Url(std::string url_str)
+    : url(std::move(url_str))
 {
     std::string_view u = url;
     if (u.empty())
@@ -239,7 +239,7 @@ Connection::~Connection()
 void
 Connection::close()
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     asio::error_code ec;
     if (ssl_socket_) {
         if (ssl_socket_->is_open())
@@ -302,13 +302,13 @@ static X509*
 issuer_from_chain(STACK_OF(X509) * fullchain)
 {
     X509 *cert, *issuer;
-    X509_NAME* issuer_name;
+    const X509_NAME* issuer_name;
 
     cert = cert_from_chain(fullchain);
     if ((issuer_name = X509_get_issuer_name(cert)) == nullptr)
         return nullptr;
 
-    issuer = X509_find_by_subject(fullchain, issuer_name);
+    issuer = X509_find_by_subject(fullchain, const_cast<X509_NAME*>(issuer_name));
     return issuer;
 }
 
@@ -490,7 +490,7 @@ ocspValidateResponse(const OscpRequestInfo& info,
 void
 Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::verify_mode verify_mode)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (ssl_socket_) {
         // Set SNI Hostname (many hosts need this to handshake successfully)
         SSL_set_tlsext_host_name(ssl_socket_->asio_ssl_stream().native_handle(), hostname.c_str());
@@ -576,7 +576,7 @@ Connection::input()
 std::string
 Connection::read_bytes(size_t bytes)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (bytes == 0)
         bytes = read_buf_.in_avail();
     std::string content;
@@ -597,7 +597,7 @@ Connection::read_until(const char delim)
 void
 Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, ConnectHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!ssl_socket_ && !socket_) {
         cb(asio::error::operation_aborted, {});
         return;
@@ -629,7 +629,7 @@ Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, Conn
 void
 Connection::async_handshake(HandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (ssl_socket_) {
         std::weak_ptr<Connection> wthis = shared_from_this();
         ssl_socket_
@@ -663,7 +663,7 @@ Connection::async_handshake(HandlerCb cb)
 void
 Connection::async_write(BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!is_open()) {
         if (cb)
             asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -680,7 +680,7 @@ Connection::async_write(BytesHandlerCb cb)
 void
 Connection::async_read_until(const char* delim, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!is_open()) {
         if (cb)
             asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -697,7 +697,7 @@ Connection::async_read_until(const char* delim, BytesHandlerCb cb)
 void
 Connection::async_read_until(char delim, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!is_open()) {
         if (cb)
             asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -714,7 +714,7 @@ Connection::async_read_until(char delim, BytesHandlerCb cb)
 void
 Connection::async_read(size_t bytes, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!is_open()) {
         if (cb)
             asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -731,7 +731,7 @@ Connection::async_read(size_t bytes, BytesHandlerCb cb)
 void
 Connection::async_read_some(size_t bytes, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!is_open()) {
         if (cb)
             asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -751,7 +751,7 @@ Connection::async_read_some(size_t bytes, BytesHandlerCb cb)
 void
 Connection::set_keepalive(uint32_t seconds)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!ssl_socket_ && !socket_)
         return;
 
@@ -830,8 +830,8 @@ Connection::timeout(const std::chrono::seconds& timeout, HandlerCb cb)
 
 // Resolver
 
-Resolver::Resolver(asio::io_context& ctx, const std::string& url, std::shared_ptr<dht::Logger> logger)
-    : url_(url)
+Resolver::Resolver(asio::io_context& ctx, std::string url, std::shared_ptr<dht::Logger> logger)
+    : url_(std::move(url))
     , resolver_(ctx)
     , destroyed_(std::make_shared<bool>(false))
     , logger_(logger)
@@ -871,7 +871,7 @@ Resolver::~Resolver()
 {
     decltype(cbs_) cbs;
     {
-        std::lock_guard<std::mutex> lock(mutex_);
+        std::lock_guard lock(mutex_);
         cbs = std::move(cbs_);
     }
     while (not cbs.empty()) {
@@ -907,7 +907,7 @@ filter(const std::vector<asio::ip::tcp::endpoint>& epts, sa_family_t family)
 void
 Resolver::add_callback(ResolverCb cb, sa_family_t family)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (!completed_)
         cbs_.emplace(family == AF_UNSPEC ? std::move(cb)
                                          : [cb, family](const asio::error_code& ec,
@@ -917,8 +917,16 @@ Resolver::add_callback(ResolverCb cb, sa_family_t family)
                                                else
                                                    cb(ec, filter(endpoints, family));
                                            });
-    else
-        cb(ec_, family == AF_UNSPEC ? endpoints_ : filter(endpoints_, family));
+    else {
+        // Always dispatch the callback on the io_context thread. Invoking it
+        // synchronously would run the caller's continuation (e.g. the whole
+        // connect chain of Request::send) on the calling thread, mutating asio
+        // objects concurrently with the io thread running the io_context.
+        asio::post(resolver_.get_executor(),
+                   [cb = std::move(cb),
+                    ec = ec_,
+                    endpoints = family == AF_UNSPEC ? endpoints_ : filter(endpoints_, family)] { cb(ec, endpoints); });
+    }
 }
 
 void
@@ -946,7 +954,7 @@ Resolver::resolve(std::string_view host, std::string_view service)
                                 }
                                 decltype(cbs_) cbs;
                                 {
-                                    std::lock_guard<std::mutex> lock(mutex_);
+                                    std::lock_guard lock(mutex_);
                                     ec_ = ec;
                                     endpoints_ = std::vector<asio::ip::tcp::endpoint> {endpoints.begin(),
                                                                                        endpoints.end()};
@@ -967,14 +975,14 @@ Resolver::resolve(std::string_view host, std::string_view service)
 std::atomic_uint Request::ids_ {1};
 
 Request::Request(asio::io_context& ctx,
-                 const std::string& url,
+                 std::string url,
                  const Json::Value& json,
                  OnJsonCb jsoncb,
                  std::shared_ptr<dht::Logger> logger)
     : logger_(std::move(logger))
     , id_(Request::ids_++)
     , ctx_(ctx)
-    , resolver_(std::make_shared<Resolver>(ctx, url, logger))
+    , resolver_(std::make_shared<Resolver>(ctx, std::move(url), logger))
 {
     init_default_headers();
     set_header_field(restinio::http_field_t::content_type, std::string(HTTP_HEADER_CONTENT_TYPE_JSON));
@@ -997,11 +1005,11 @@ Request::Request(asio::io_context& ctx,
     });
 }
 
-Request::Request(asio::io_context& ctx, const std::string& url, OnJsonCb jsoncb, std::shared_ptr<dht::Logger> logger)
+Request::Request(asio::io_context& ctx, std::string url, OnJsonCb jsoncb, std::shared_ptr<dht::Logger> logger)
     : logger_(std::move(logger))
     , id_(Request::ids_++)
     , ctx_(ctx)
-    , resolver_(std::make_shared<Resolver>(ctx, url, logger))
+    , resolver_(std::make_shared<Resolver>(ctx, std::move(url), logger))
 {
     init_default_headers();
     set_header_field(restinio::http_field_t::accept, std::string(HTTP_HEADER_CONTENT_TYPE_JSON));
@@ -1022,20 +1030,20 @@ Request::Request(asio::io_context& ctx, const std::string& url, OnJsonCb jsoncb,
     });
 }
 
-Request::Request(asio::io_context& ctx, const std::string& url, std::shared_ptr<dht::Logger> logger)
+Request::Request(asio::io_context& ctx, std::string url, std::shared_ptr<dht::Logger> logger)
     : logger_(logger)
     , id_(Request::ids_++)
     , ctx_(ctx)
-    , resolver_(std::make_shared<Resolver>(ctx, url, logger))
+    , resolver_(std::make_shared<Resolver>(ctx, std::move(url), logger))
 {
     init_default_headers();
 }
 
-Request::Request(asio::io_context& ctx, const std::string& url, OnDoneCb onDone, std::shared_ptr<dht::Logger> logger)
+Request::Request(asio::io_context& ctx, std::string url, OnDoneCb onDone, std::shared_ptr<dht::Logger> logger)
     : logger_(logger)
     , id_(Request::ids_++)
     , ctx_(ctx)
-    , resolver_(std::make_shared<Resolver>(ctx, url, logger))
+    , resolver_(std::make_shared<Resolver>(ctx, std::move(url), logger))
 {
     init_default_headers();
     add_on_done_callback(std::move(onDone));
@@ -1086,7 +1094,6 @@ Request::Request(asio::io_context& ctx,
     , family_(family)
     , resolver_(resolver)
 {
-    set_header_field(restinio::http_field_t::host, concat(get_url().host, ":", get_url().service));
     set_target(Url(target).target);
 }
 
@@ -1390,7 +1397,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
                              if (not sthis)
                                  return;
                              auto& this_ = *sthis;
-                             std::lock_guard<std::mutex> lock(this_.mutex_);
+                             std::lock_guard lock(this_.mutex_);
                              if (ec == asio::error::operation_aborted) {
                                  this_.terminate(ec);
                                  return;
@@ -1443,7 +1450,7 @@ Request::send()
         [wthis](const asio::error_code& ec, std::vector<asio::ip::tcp::endpoint> endpoints) {
             if (auto sthis = wthis.lock()) {
                 auto& this_ = *sthis;
-                std::lock_guard<std::mutex> lock(this_.mutex_);
+                std::lock_guard lock(this_.mutex_);
                 if (ec) {
                     if (this_.logger_)
                         this_.logger_->error("[http:request:{:d}] resolve error: {:s}", this_.id_, ec.message());
@@ -1518,7 +1525,7 @@ Request::terminate(const asio::error_code& ec)
 void
 Request::handle_request(const asio::error_code& ec)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (ec and ec != asio::error::eof) {
         terminate(ec);
         return;
@@ -1542,7 +1549,7 @@ Request::handle_request(const asio::error_code& ec)
 void
 Request::handle_response(const asio::error_code& ec, size_t /* n_bytes */)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
     if (ec && ec != asio::error::eof) {
         terminate(ec);
         return;
@@ -1660,11 +1667,11 @@ const Response&
 Request::await()
 {
     std::mutex mtx;
-    std::unique_lock<std::mutex> lock(mtx);
+    std::unique_lock lock(mtx);
     std::condition_variable cv;
     bool ok {false};
     add_on_done_callback([&](const Response&) {
-        std::lock_guard<std::mutex> lk(mtx);
+        std::lock_guard lk(mtx);
         ok = true;
         cv.notify_all();
     });

src/network_engine.cpp

@@ -40,8 +40,44 @@ struct NetworkEngine::PartialMessage
     time_point start;
     time_point last_part;
     std::unique_ptr<ParsedMessage> msg;
+    std::vector<std::unique_ptr<ParsedMessage>> early_parts;
+    size_t early_bytes {};
+    bool request_quota_consumed {};
 };
 
+bool
+NetworkEngine::isExpectedReply(const ParsedMessage& msg, const SockAddr& from)
+{
+    auto request = requests.find(msg.tid);
+    if (request != requests.end() && request->second->pending() && !request->second->node->id
+        && request->second->node->getAddr() == from)
+        return true;
+
+    auto node = cache.getNode(msg.id, from.getFamily());
+    if (!node || node->getAddr() != from)
+        return false;
+
+    auto pending = node->getRequest(msg.tid);
+    return (pending && pending->pending()) || node->getSocket(msg.tid);
+}
+
+bool
+NetworkEngine::tryCompleteMessage(PartialMessage& partial, const SockAddr& from)
+{
+    try {
+        if (!partial.msg->complete())
+            return false;
+        process(std::move(partial.msg), from);
+    } catch (const std::exception& e) {
+        if (logger_)
+            logger_->warn("Error while processing partial message: {}", e.what());
+    } catch (...) {
+        if (logger_)
+            logger_->warn("Unknown error while processing partial message");
+    }
+    return true;
+}
+
 std::vector<Blob>
 serializeValues(const std::vector<Sp<Value>>& st)
 {
@@ -466,34 +502,58 @@ NetworkEngine::processMessage(const uint8_t* buf, size_t buflen, SockAddr f)
 
     // partial value data
     if (msg->type == MessageType::ValueData) {
-        auto pmsg_it = partial_messages.find(msg->tid);
-        if (pmsg_it == partial_messages.end()) {
-            if (logIncoming_)
-                if (logger_)
-                    logger_->debug("Unable to find partial message");
+        if (msg->fragment_parts.empty()
+            || std::any_of(msg->fragment_parts.begin(), msg->fragment_parts.end(), [](const auto& fragment) {
+                   return fragment.second.second.empty();
+               })) {
             rateLimit(from);
             return;
         }
-        if (!pmsg_it->second.from.equals(from)) {
-            if (logger_)
-                logger_->debug("Received partial message data from unexpected IP address");
-            rateLimit(from);
+        PartialMessageKey key {from, msg->tid};
+        auto pmsg_it = partial_messages.find(key);
+        if (pmsg_it == partial_messages.end()) {
+            if (!rateLimit(from))
+                return;
+            auto inserted = partial_messages.emplace(key, PartialMessage {});
+            pmsg_it = inserted.first;
+            pmsg_it->second.from = from;
+            pmsg_it->second.start = now;
+            pmsg_it->second.last_part = now;
+            pmsg_it->second.request_quota_consumed = true;
+            scheduler.add(now + RX_MAX_PACKET_TIME, std::bind(&NetworkEngine::maintainRxBuffer, this, key));
+        }
+        auto& pmsg = pmsg_it->second;
+        if (!pmsg.msg) {
+            if (pmsg.early_parts.size() >= RX_MAX_EARLY_PARTS) {
+                partial_messages.erase(pmsg_it);
+                return;
+            }
+            size_t fragment_bytes {};
+            for (const auto& [index, fragment] : msg->fragment_parts) {
+                (void) index;
+                if (fragment.second.size() > RX_MAX_EARLY_BYTES - fragment_bytes) {
+                    partial_messages.erase(pmsg_it);
+                    return;
+                }
+                fragment_bytes += fragment.second.size();
+            }
+            if (fragment_bytes > RX_MAX_EARLY_BYTES - pmsg.early_bytes) {
+                partial_messages.erase(pmsg_it);
+                return;
+            }
+            pmsg.early_bytes += fragment_bytes;
+            pmsg.early_parts.emplace_back(std::move(msg));
+            pmsg.last_part = now;
+            scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, key));
             return;
         }
         // append data block
-        if (pmsg_it->second.msg->append(*msg)) {
-            pmsg_it->second.last_part = now;
-            // check data completion
-            if (pmsg_it->second.msg->complete()) {
-                try {
-                    // process the full message
-                    process(std::move(pmsg_it->second.msg), from);
-                } catch (...) {
-                    return;
-                }
+        if (pmsg.msg->append(*msg)) {
+            pmsg.last_part = now;
+            if (tryCompleteMessage(pmsg, from)) {
                 partial_messages.erase(pmsg_it);
             } else
-                scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, msg->tid));
+                scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, key));
         }
         return;
     }
@@ -504,7 +564,32 @@ NetworkEngine::processMessage(const uint8_t* buf, size_t buflen, SockAddr f)
         return;
     }
 
-    if (msg->type > MessageType::Reply) {
+    if (msg->value_parts.empty()) {
+        if (msg->type > MessageType::Reply) {
+            /* Rate limit requests. */
+            if (!rateLimit(from)) {
+                if (logger_)
+                    logger_->warn("Dropping request due to rate limiting");
+                return;
+            }
+        }
+        try {
+            process(std::move(msg), from);
+        } catch (const std::exception& e) {
+            if (logger_)
+                logger_->warn("Error while processing message: {}", e.what());
+        }
+        return;
+    }
+
+    PartialMessageKey partial_key {from, msg->tid};
+    if (msg->type == MessageType::Reply && !isExpectedReply(*msg, from))
+        return;
+
+    const auto partial = partial_messages.find(partial_key);
+    const bool request_quota_consumed = partial != partial_messages.end() && !partial->second.msg
+                                        && partial->second.request_quota_consumed;
+    if (msg->type > MessageType::Reply && !request_quota_consumed) {
         /* Rate limit requests. */
         if (!rateLimit(from)) {
             if (logger_)
@@ -513,26 +598,28 @@ NetworkEngine::processMessage(const uint8_t* buf, size_t buflen, SockAddr f)
         }
     }
 
-    if (msg->value_parts.empty()) {
-        try {
-            process(std::move(msg), from);
-        } catch (...) {
-            return;
-        }
-    } else {
-        // starting partial message session
-        auto k = msg->tid;
-        auto& pmsg = partial_messages[k];
-        if (not pmsg.msg) {
+    // starting partial message session
+    auto inserted = partial_messages.emplace(partial_key, PartialMessage {});
+    auto& pmsg = inserted.first->second;
+    if (not pmsg.msg) {
+        if (inserted.second) {
             pmsg.from = from;
-            pmsg.msg = std::move(msg);
             pmsg.start = now;
-            pmsg.last_part = now;
-            scheduler.add(now + RX_MAX_PACKET_TIME, std::bind(&NetworkEngine::maintainRxBuffer, this, k));
-            scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, k));
-        } else if (logger_)
-            logger_->error("Partial message with given TID {} already exists", k);
-    }
+            scheduler.add(now + RX_MAX_PACKET_TIME, std::bind(&NetworkEngine::maintainRxBuffer, this, partial_key));
+        }
+        pmsg.msg = std::move(msg);
+        pmsg.last_part = now;
+        for (const auto& part : pmsg.early_parts)
+            pmsg.msg->append(*part);
+        pmsg.early_parts.clear();
+        pmsg.early_bytes = 0;
+        if (tryCompleteMessage(pmsg, from)) {
+            partial_messages.erase(inserted.first);
+        } else {
+            scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, partial_key));
+        }
+    } else if (logger_)
+        logger_->error("Partial message from {} with given TID {} already exists", from.toString(), msg->tid);
 }
 
 void
@@ -1611,9 +1698,9 @@ NetworkEngine::sendError(const SockAddr& addr, Tid tid, uint16_t code, const std
 }
 
 void
-NetworkEngine::maintainRxBuffer(Tid tid)
+NetworkEngine::maintainRxBuffer(const PartialMessageKey& key)
 {
-    auto msg = partial_messages.find(tid);
+    auto msg = partial_messages.find(key);
     if (msg != partial_messages.end()) {
         const auto& now = scheduler.time();
         if (msg->second.start + RX_MAX_PACKET_TIME < now || msg->second.last_part + RX_TIMEOUT < now) {

src/network_utils.cpp

@@ -107,14 +107,14 @@ UdpSocket::UdpSocket(in_port_t port, const std::shared_ptr<Logger>& l)
     SockAddr bind6;
     bind6.setFamily(AF_INET6);
     bind6.setPort(port);
-    std::lock_guard<std::mutex> lk(lock);
+    std::lock_guard lk(lock);
     openSockets(bind4, bind6);
 }
 
 UdpSocket::UdpSocket(const SockAddr& bind4, const SockAddr& bind6, const std::shared_ptr<Logger>& l)
     : logger(l)
 {
-    std::lock_guard<std::mutex> lk(lock);
+    std::lock_guard lk(lock);
     openSockets(bind4, bind6);
 }
 
@@ -161,7 +161,7 @@ UdpSocket::sendTo(const SockAddr& dest, const uint8_t* data, size_t size, [[mayb
         if (logger)
             logger->d("Can't send message to %s: %s", dest.toString().c_str(), strerror(err));
         if (err == EPIPE || err == ENOTCONN || err == ECONNRESET) {
-            std::lock_guard<std::mutex> lk(lock);
+            std::lock_guard lk(lock);
             auto bind4 = std::move(bound4), bind6 = std::move(bound6);
             openSockets(bind4, bind6);
             return sendTo(dest, data, size, false);
@@ -286,13 +286,13 @@ UdpSocket::openSockets(const SockAddr& bind4, const SockAddr& bind6)
                         pkt.received = clock::now();
                         onReceived(std::move(pkts));
                     } else if (rc == -1) {
-                        if (logger)
-                            logger->e("Error receiving packet: %s", strerror(errno));
                         int err = errno;
+                        if (logger)
+                            logger->e("Error receiving packet: %s", strerror(err));
                         if (err == EPIPE || err == ENOTCONN || err == ECONNRESET) {
                             if (not running)
                                 break;
-                            std::unique_lock<std::mutex> lk(lock, std::try_to_lock);
+                            std::unique_lock lk(lock, std::try_to_lock);
                             if (lk.owns_lock()) {
                                 if (not running)
                                     break;
@@ -337,7 +337,7 @@ UdpSocket::openSockets(const SockAddr& bind4, const SockAddr& bind6)
             close(stop_readfd);
         if (stopfd != -1)
             close(stopfd);
-        std::unique_lock<std::mutex> lk(lock, std::try_to_lock);
+        std::unique_lock lk(lock, std::try_to_lock);
         if (lk.owns_lock()) {
             s4 = -1;
             s6 = -1;

src/op_cache.cpp

@@ -224,7 +224,7 @@ SearchCache::expire(const time_point& now, const std::function<void(size_t)>& on
     auto ret = nextExpiration_;
     for (auto it = ops.begin(); it != ops.end();) {
         auto expiration = it->second->getExpiration();
-        if (expiration < now) {
+        if (expiration <= now) {
             auto cache = std::move(it->second);
             it = ops.erase(it);
             onCancel(cache->searchToken);

src/parsed_message.h

@@ -59,8 +59,12 @@ unpackTid(const msgpack::object& o)
     switch (o.type) {
     case msgpack::type::POSITIVE_INTEGER:
         return o.as<Tid>();
-    default:
-        return ntohl(*reinterpret_cast<const uint32_t*>(o.as<std::array<char, 4>>().data()));
+    default: {
+        auto arr = o.as<std::array<char, 4>>();
+        uint32_t val;
+        std::memcpy(&val, arr.data(), sizeof(val));
+        return ntohl(val);
+    }
     }
 }
 
@@ -270,14 +274,21 @@ ParsedMessage::msgpack_unpack(const msgpack::object& msg)
 
     if (!parsed.a && !parsed.r && !parsed.e && !parsed.u)
         throw msgpack::type_error();
-    auto& req = parsed.a ? *parsed.a : (parsed.r ? *parsed.r : (parsed.u ? *parsed.u : *parsed.e));
 
     if (parsed.e) {
-        if (parsed.e->type != msgpack::type::ARRAY)
+        if (parsed.e->type != msgpack::type::ARRAY or parsed.e->via.array.size < 1)
             throw msgpack::type_error();
         error_code = parsed.e->via.array.ptr[0].as<uint16_t>();
     }
 
+    /* An error-only message carries no request map. The error array must never
+       be reached through the map view of the msgpack object union, and a
+       request field that is not a map must be rejected rather than
+       reinterpreted. */
+    const msgpack::object* req = parsed.a ? parsed.a : (parsed.r ? parsed.r : parsed.u);
+    if (req and req->type != msgpack::type::MAP)
+        throw msgpack::type_error();
+
     struct ParsedReq
     {
         msgpack::object* values;
@@ -286,8 +297,9 @@ ParsedMessage::msgpack_unpack(const msgpack::object& msg)
         msgpack::object* want;
     } parsedReq {};
 
-    for (unsigned i = 0; i < req.via.map.size; i++) {
-        auto& o = req.via.map.ptr[i];
+    const uint32_t req_size = req ? req->via.map.size : 0;
+    for (unsigned i = 0; i < req_size; i++) {
+        auto& o = req->via.map.ptr[i];
         if (o.key.type != msgpack::type::STR)
             continue;
         auto key = o.key.as<std::string_view>();
@@ -366,6 +378,8 @@ ParsedMessage::msgpack_unpack(const msgpack::object& msg)
     } else if (parsedReq.fields) {
         if (auto rfields = findMapValue(*parsedReq.fields, "f"sv)) {
             auto vfields = rfields->as<std::set<Value::Field>>();
+            if (vfields.empty())
+                throw msgpack::type_error();
             if (auto rvalues = findMapValue(*parsedReq.fields, "v"sv)) {
                 if (rvalues->type != msgpack::type::ARRAY)
                     throw msgpack::type_error();

src/peer_discovery.cpp

@@ -123,7 +123,7 @@ PeerDiscovery::DomainPeerDiscovery::~DomainPeerDiscovery()
 void
 PeerDiscovery::DomainPeerDiscovery::startDiscovery(std::string_view type, ServiceDiscoveredCallback callback)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
     callbackmap_[std::string(type)] = callback;
     if (not drunning_) {
         drunning_ = true;
@@ -137,7 +137,7 @@ PeerDiscovery::DomainPeerDiscovery::startDiscovery(std::string_view type, Servic
 void
 PeerDiscovery::DomainPeerDiscovery::loopListener()
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
     if (not drunning_)
         return;
     sockFd_.async_receive_from(asio::buffer(receiveBuf_),
@@ -163,7 +163,7 @@ PeerDiscovery::DomainPeerDiscovery::loopListener()
                                                    continue;
                                                ServiceDiscoveredCallback cb;
                                                {
-                                                   std::lock_guard<std::mutex> lck(dmtx_);
+                                                   std::lock_guard lck(dmtx_);
                                                    if (drunning_) {
                                                        auto callback = callbackmap_.find(o.key.as<std::string_view>());
                                                        if (callback != callbackmap_.end())
@@ -189,7 +189,7 @@ PeerDiscovery::DomainPeerDiscovery::loopListener()
 void
 PeerDiscovery::DomainPeerDiscovery::query(const asio::ip::udp::endpoint& peer)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
     if (not drunning_)
         return;
 
@@ -209,7 +209,7 @@ PeerDiscovery::DomainPeerDiscovery::query(const asio::ip::udp::endpoint& peer)
 void
 PeerDiscovery::DomainPeerDiscovery::publish(const asio::ip::udp::endpoint& peer)
 {
-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
     if (not lrunning_)
         return;
 
@@ -229,7 +229,7 @@ PeerDiscovery::DomainPeerDiscovery::startPublish(std::string_view type, const ms
     msgpack::sbuffer pack_buf_c(pack_buf.size());
     pack_buf_c.write(pack_buf.data(), pack_buf.size());
 
-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
     messages_[std::string(type)] = std::move(pack_buf_c);
     reloadMessages();
     lrunning_ = true;
@@ -239,7 +239,7 @@ PeerDiscovery::DomainPeerDiscovery::startPublish(std::string_view type, const ms
 bool
 PeerDiscovery::DomainPeerDiscovery::stopDiscovery(std::string_view type)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
     auto it = callbackmap_.find(type);
     if (it != callbackmap_.end()) {
         callbackmap_.erase(it);
@@ -253,7 +253,7 @@ PeerDiscovery::DomainPeerDiscovery::stopDiscovery(std::string_view type)
 bool
 PeerDiscovery::DomainPeerDiscovery::stopPublish(std::string_view type)
 {
-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
     auto it = messages_.find(type);
     if (it != messages_.end()) {
         messages_.erase(it);
@@ -282,11 +282,11 @@ void
 PeerDiscovery::DomainPeerDiscovery::stop()
 {
     {
-        std::lock_guard<std::mutex> lck(dmtx_);
+        std::lock_guard lck(dmtx_);
         stopDiscovery();
     }
     {
-        std::lock_guard<std::mutex> lck(mtx_);
+        std::lock_guard lck(mtx_);
         stopPublish();
     }
 }

src/search.h

@@ -133,6 +133,16 @@ struct Dht::SearchNode
         return last_get_reply + Node::NODE_EXPIRE_TIME;
     }
 
+    /**
+     * Update the token without refreshing last_get_reply,
+     * so that periodic find_node/get requests still occur.
+     */
+    void refreshToken(const Blob& tok)
+    {
+        if (not tok.empty() and tok.size() <= 64)
+            token = tok;
+    }
+
     friend std::ostream& operator<<(std::ostream& s, const SearchNode& node)
     {
         s << "getStatus:" << node.getStatus.size() << " listenStatus:" << node.listenStatus.size()

src/securedht.cpp

@@ -96,37 +96,13 @@ SecureDht::secureType(ValueType&& type)
     return type;
 }
 
-Sp<crypto::Certificate>
-SecureDht::getCertificate(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_;
-    auto it = nodesCertificates_.find(node);
-    if (it == nodesCertificates_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
-Sp<crypto::PublicKey>
-SecureDht::getPublicKey(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeys_.find(node);
-    if (it == nodesPubKeys_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
 Sp<crypto::Certificate>
 SecureDht::getCertificate(const PkId& node) const
 {
     if (node == getLongId())
         return certificate_;
-    auto it = nodesCertificatesLong_.find(node);
-    if (it == nodesCertificatesLong_.end())
+    auto it = nodesCertificates_.find(node);
+    if (it == nodesCertificates_.end())
         return nullptr;
     else
         return it->second;
@@ -137,8 +113,8 @@ SecureDht::getPublicKey(const PkId& node) const
 {
     if (node == getLongId())
         return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeysLong_.find(node);
-    if (it == nodesPubKeysLong_.end())
+    auto it = nodesPubKeys_.find(node);
+    if (it == nodesPubKeys_.end())
         return nullptr;
     else
         return it->second;
@@ -191,85 +167,10 @@ void
 SecureDht::registerCertificate(const Sp<crypto::Certificate>& cert)
 {
     if (cert) {
-        nodesCertificates_[cert->getId()] = cert;
-        nodesCertificatesLong_[cert->getLongId()] = cert;
+        nodesCertificates_[cert->getLongId()] = cert;
     }
 }
 
-void
-SecureDht::findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
-{
-    Sp<crypto::Certificate> b = getCertificate(node);
-    if (b && *b) {
-        if (logger_)
-            logger_->debug("Using certificate from cache for {}", node.toString());
-        if (cb)
-            cb(b);
-        return;
-    }
-    if (localQueryMethodLegacy_) {
-        auto res = localQueryMethodLegacy_(node);
-        if (not res.empty()) {
-            if (logger_)
-                logger_->debug("Registering certificate from local store for {}", node.toString());
-            nodesCertificates_.emplace(node, res.front());
-            nodesCertificatesLong_.emplace(res.front()->getLongId(), res.front());
-            if (cb)
-                cb(res.front());
-            return;
-        }
-    }
-
-    auto found = std::make_shared<bool>(false);
-    dht_->get(
-        node,
-        [cb, node, found, this](const std::vector<Sp<Value>>& vals) {
-            for (const auto& v : vals) {
-                if (auto cert = registerCertificate(node, v->data)) {
-                    *found = true;
-                    if (logger_)
-                        logger_->debug("Found certificate for {}", node.toString());
-                    if (cb)
-                        cb(cert);
-                    return false;
-                }
-            }
-            return !*found;
-        },
-        [cb, found](bool) {
-            if (!*found and cb)
-                cb(nullptr);
-        },
-        Value::TypeFilter(CERTIFICATE_TYPE));
-}
-
-void
-SecureDht::findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb)
-{
-    auto pk = getPublicKey(node);
-    if (pk && *pk) {
-        if (logger_)
-            logger_->debug("Found public key from cache for {}", node.toString());
-        if (cb)
-            cb(pk);
-        return;
-    }
-    findCertificate(node, [=](const Sp<crypto::Certificate>& crt) {
-        if (crt && *crt) {
-            auto pk = crt->getSharedPublicKey();
-            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
-                if (cb)
-                    cb(pk);
-                return;
-            }
-        }
-        if (cb)
-            cb(nullptr);
-    });
-}
-
 void
 SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
 {
@@ -287,8 +188,7 @@ SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<c
         if (not res.empty()) {
             if (logger_)
                 logger_->debug("Registering certificate from local store for {}", node.to_c_str());
-            nodesCertificates_.emplace(res.front()->getId(), res.front());
-            nodesCertificatesLong_.emplace(node, res.front());
+            nodesCertificates_.emplace(node, res.front());
             if (cb)
                 cb(res.front());
             return;
@@ -333,8 +233,7 @@ SecureDht::findPublicKey(const PkId& node, const std::function<void(const Sp<cry
         if (crt && *crt) {
             auto pk = crt->getSharedPublicKey();
             if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
+                nodesPubKeys_[pk->getLongId()] = pk;
                 if (cb)
                     cb(pk);
                 return;
@@ -362,8 +261,7 @@ SecureDht::checkValue(const Sp<Value>& v)
             if (auto decrypted_val = v->decrypt(*key_)) {
                 auto cacheValue = not isDecrypted and decrypted_val->owner;
                 if (cacheValue) {
-                    nodesPubKeys_[decrypted_val->owner->getId()] = decrypted_val->owner;
-                    nodesPubKeysLong_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
+                    nodesPubKeys_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
                 }
                 return decrypted_val;
             }
@@ -377,8 +275,7 @@ SecureDht::checkValue(const Sp<Value>& v)
         auto cacheValue = not v->isSignatureChecked() and enableCache_ and v->owner;
         if (v->checkSignature()) {
             if (cacheValue) {
-                nodesPubKeys_[v->owner->getId()] = v->owner;
-                nodesPubKeysLong_[v->owner->getLongId()] = v->owner;
+                nodesPubKeys_[v->owner->getLongId()] = v->owner;
             }
             return v;
         } else if (logger_)
@@ -492,35 +389,6 @@ SecureDht::putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback,
         Where().id(val->id));
 }
 
-void
-SecureDht::putEncrypted(const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent)
-{
-    if (not key_) {
-        if (callback)
-            callback(false, {});
-        return;
-    }
-    findPublicKey(to,
-                  [this, hash, val = std::move(val), callback = std::move(callback), permanent](
-                      const Sp<crypto::PublicKey>& pk) {
-                      if (!pk || !*pk) {
-                          if (callback)
-                              callback(false, {});
-                          return;
-                      }
-                      if (logger_)
-                          logger_->warn("Encrypting data for PK: {}", pk->getId().toString());
-                      try {
-                          dht_->put(hash, encrypt(*val, *pk), callback, time_point::max(), permanent);
-                      } catch (const std::exception& e) {
-                          if (logger_)
-                              logger_->error("Error putting encrypted data: {}", e.what());
-                          if (callback)
-                              callback(false, {});
-                      }
-                  });
-}
-
 void
 SecureDht::putEncrypted(const InfoHash& hash, const PkId& to, Sp<Value> val, DoneCallback callback, bool permanent)
 {

src/thread_pool.cpp

@@ -6,8 +6,10 @@
 #include <atomic>
 #include <thread>
 #include <iostream>
-#include <ciso646> // fix windows compiler bug
-#include <cmath>   // std::pow
+#include <cmath> // std::pow
+#if __cplusplus < 202002L
+#include <ciso646>
+#endif
 
 namespace dht {
 
@@ -78,6 +80,8 @@ ThreadPool::run(std::function<void()>&& cb)
                             break;
                         task = std::move(tasks_.front());
                         tasks_.pop();
+                        if (tasks_.empty() && stopping_)
+                            stopCv_.notify_one();
                     }
 
                     // run task
@@ -135,7 +139,9 @@ ThreadPool::stop(bool wait)
 {
     std::unique_lock l(lock_);
     if (wait) {
-        cv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = true;
+        stopCv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = false;
     }
     running_ = false;
     tasks_ = {};

src/utils.cpp

@@ -238,28 +238,67 @@ operator==(const SockAddr& a, const SockAddr& b)
     return a.equals(b);
 }
 
+time_point
+from_system_time(system_clock::time_point t, time_point steady_now, system_clock::time_point system_now)
+{
+    if (t == system_clock::time_point::min())
+        return time_point::min();
+    if (t == system_clock::time_point::max())
+        return time_point::max();
+    // Saturate before the cast: the steady clock duration may hold a narrower range than the system one.
+    constexpr auto max_dt = std::chrono::duration_cast<system_clock::duration>(duration::max());
+    constexpr auto min_dt = std::chrono::duration_cast<system_clock::duration>(duration::min());
+    auto system_dt = t - system_now;
+    if (system_dt >= max_dt)
+        return time_point::max();
+    if (system_dt <= min_dt)
+        return time_point::min();
+    auto dt = std::chrono::duration_cast<duration>(system_dt);
+    if (dt > duration(0) and steady_now > time_point::max() - dt)
+        return time_point::max();
+    else if (dt < duration(0) and steady_now < time_point::min() - dt)
+        return time_point::min();
+    return steady_now + dt;
+}
+
+time_point
+from_system_time(system_clock::time_point t)
+{
+    return from_system_time(t, clock::now(), system_clock::now());
+}
+
+system_clock::time_point
+to_system_time(time_point t, time_point steady_now, system_clock::time_point system_now)
+{
+    if (t == time_point::min())
+        return system_clock::time_point::min();
+    if (t == time_point::max())
+        return system_clock::time_point::max();
+    // Cast first: mixing clock durations of different periods would overflow the bound computations below.
+    auto dt = std::chrono::duration_cast<system_clock::duration>(t - steady_now);
+    if (dt > system_clock::duration(0) and system_now >= system_clock::time_point::max() - dt)
+        return system_clock::time_point::max();
+    else if (dt < system_clock::duration(0) and system_now <= system_clock::time_point::min() - dt)
+        return system_clock::time_point::min();
+    return system_now + dt;
+}
+
+system_clock::time_point
+to_system_time(time_point t)
+{
+    return to_system_time(t, clock::now(), system_clock::now());
+}
+
 time_point
 from_time_t(std::time_t t)
 {
-    auto dt = system_clock::from_time_t(t) - system_clock::now();
-    auto now = clock::now();
-    if (dt > system_clock::duration(0) and now > time_point::max() - dt)
-        return time_point::max();
-    else if (dt < system_clock::duration(0) and now < time_point::min() - dt)
-        return time_point::min();
-    return now + dt;
+    return from_system_time(system_clock::from_time_t(t));
 }
 
 std::time_t
 to_time_t(time_point t)
 {
-    auto dt = t - clock::now();
-    auto now = system_clock::now();
-    if (dt > duration(0) and now >= system_clock::time_point::max() - dt)
-        return system_clock::to_time_t(system_clock::time_point::max());
-    else if (dt < duration(0) and now <= system_clock::time_point::min() - dt)
-        return system_clock::to_time_t(system_clock::time_point::min());
-    return system_clock::to_time_t(now + std::chrono::duration_cast<system_clock::duration>(dt));
+    return system_clock::to_time_t(to_system_time(t));
 }
 
 Blob

src/value.cpp

@@ -85,7 +85,7 @@ ValueType::DEFAULT_STORE_POLICY(InfoHash, const std::shared_ptr<Value>& v, const
 size_t
 Value::size() const
 {
-    return cypher.size() + data.size() + signature.size() + user_type.size();
+    return cypher.size() + data.size() + signature.size() + user_type.size() + pushType.size();
 }
 
 void
@@ -104,9 +104,14 @@ Value::msgpack_unpack(const msgpack::object& o)
     } else
         throw msgpack::type_error();
 
+    priority = 0;
+    pushType.clear();
     if (auto rprio = findMapValue(o, VALUE_KEY_PRIO)) {
         priority = rprio->as<unsigned>();
     }
+    if (auto rpt = findMapValue(o, VALUE_KEY_PUSHTYPE)) {
+        pushType = rpt->as<std::string>();
+    }
 }
 
 void
@@ -197,6 +202,9 @@ Value::Value(const Json::Value& json)
     const auto& jprio = json["prio"];
     if (jprio.isIntegral())
         priority = jprio.asUInt();
+    const auto& jpt = json[VALUE_KEY_PUSHTYPE];
+    if (jpt.isString())
+        pushType = jpt.asString();
 }
 
 Json::Value
@@ -223,6 +231,8 @@ Value::toJson() const
     }
     if (priority)
         val["prio"] = priority;
+    if (not pushType.empty())
+        val[VALUE_KEY_PUSHTYPE] = pushType;
     return val;
 }
 
@@ -261,6 +271,7 @@ Value::encrypt(const crypto::PrivateKey& from, const crypto::PublicKey& to)
     sign(from);
     Value nv {id};
     nv.priority = priority;
+    nv.pushType = pushType;
     nv.setCypher(to.encrypt(getToEncrypt()));
     return nv;
 }

tests/test_crypto.cpp

@@ -59,6 +59,24 @@ CryptoTester::testSignatureEncryption()
     }
 }
 
+void
+CryptoTester::testPublicKeyPemIsPlainText()
+{
+    auto key = dht::crypto::PrivateKey::generate();
+    auto pem = key.getPublicKey().toString();
+
+    // The exported key is PEM text: it must not carry the terminating null
+    // byte GnuTLS counts in the exported size, which would otherwise be
+    // embedded in anything the string is serialized into.
+    CPPUNIT_ASSERT(not pem.empty());
+    CPPUNIT_ASSERT_EQUAL(std::string::npos, pem.find('\0'));
+    CPPUNIT_ASSERT_EQUAL('\n', pem.back());
+
+    // The exported text still reads back as the same key.
+    dht::crypto::PublicKey reloaded(dht::Blob(pem.begin(), pem.end()));
+    CPPUNIT_ASSERT_EQUAL(key.getPublicKey().getId(), reloaded.getId());
+}
+
 void
 CryptoTester::testCertificateRevocation()
 {
@@ -95,10 +113,159 @@ CryptoTester::testCertificateRevocation()
     CPPUNIT_ASSERT_MESSAGE(v.toString(), v);
 }
 
+namespace {
+
+/** Read a CRL Number extension blob (big-endian, variable length) as an integer. */
+uint64_t
+crlNumberValue(const dht::Blob& number)
+{
+    uint64_t value {0};
+    for (uint8_t byte : number)
+        value = (value << 8) | byte;
+    return value;
+}
+
+} // namespace
+
+void
+CryptoTester::testRevocationListNumber()
+{
+    auto ca = dht::crypto::generateIdentity("ca");
+    auto device = dht::crypto::generateIdentity("dev", ca);
+
+    dht::crypto::RevocationList crl;
+    CPPUNIT_ASSERT_EQUAL(uint64_t(0), crlNumberValue(crl.getNumber()));
+
+    crl.revoke(*device.second);
+    crl.sign(ca);
+    auto first = crl.getNumber();
+    // An unnumbered list gets a random number on its first signature.
+    CPPUNIT_ASSERT(not first.empty());
+    CPPUNIT_ASSERT(crlNumberValue(first) != 0);
+
+    // Re-signing keeps the same lineage and moves the number forward.
+    crl.sign(ca);
+    auto second = crl.getNumber();
+    CPPUNIT_ASSERT_EQUAL(crlNumberValue(first) + 1, crlNumberValue(second));
+
+    crl.sign(ca);
+    CPPUNIT_ASSERT_EQUAL(crlNumberValue(first) + 2, crlNumberValue(crl.getNumber()));
+
+    // The number is a DER integer, so it is stored with leading zeros stripped.
+    // Incrementing must still work for numbers shorter than 8 bytes.
+    for (uint64_t start : {uint64_t(1), uint64_t(0x7f), uint64_t(0x80), uint64_t(0xffff)}) {
+        dht::crypto::RevocationList small;
+        small.revoke(*device.second);
+        small.sign(ca, {}, start);
+        CPPUNIT_ASSERT_EQUAL(start, crlNumberValue(small.getNumber()));
+        small.sign(ca);
+        CPPUNIT_ASSERT_EQUAL(start + 1, crlNumberValue(small.getNumber()));
+        small.sign(ca);
+        CPPUNIT_ASSERT_EQUAL(start + 2, crlNumberValue(small.getNumber()));
+    }
+}
+
+void
+CryptoTester::testRevocationListExplicitNumber()
+{
+    auto ca = dht::crypto::generateIdentity("ca");
+    auto device = dht::crypto::generateIdentity("dev", ca);
+
+    // Values chosen to cover leading zero bytes, a full-width number and the largest
+    // value that still encodes as a positive 8-byte DER integer.
+    const std::vector<uint64_t> numbers {1,
+                                         42,
+                                         0xff,
+                                         0x100,
+                                         0x0000'0001'0000'0000ull,
+                                         0x0000'02a1'0000'0001ull,
+                                         0x7fff'ffff'ffff'ffffull};
+    for (auto number : numbers) {
+        dht::crypto::RevocationList crl;
+        crl.revoke(*device.second);
+        crl.sign(ca, {}, number);
+        CPPUNIT_ASSERT_EQUAL(number, crlNumberValue(crl.getNumber()));
+        CPPUNIT_ASSERT(crl.isSignedBy(*ca.second));
+        CPPUNIT_ASSERT(crl.isRevoked(*device.second));
+
+        // The number must survive a pack/unpack round-trip.
+        dht::crypto::RevocationList unpacked(crl.getPacked());
+        CPPUNIT_ASSERT_EQUAL(number, crlNumberValue(unpacked.getNumber()));
+    }
+
+    // An explicit number overrides the increment, in both directions.
+    dht::crypto::RevocationList crl;
+    crl.revoke(*device.second);
+    crl.sign(ca, {}, 1000);
+    CPPUNIT_ASSERT_EQUAL(uint64_t(1000), crlNumberValue(crl.getNumber()));
+    crl.sign(ca, {}, 5);
+    CPPUNIT_ASSERT_EQUAL(uint64_t(5), crlNumberValue(crl.getNumber()));
+
+    // Passing 0 falls back to the default behavior: increment the current number.
+    crl.sign(ca, {}, 0);
+    CPPUNIT_ASSERT_EQUAL(uint64_t(6), crlNumberValue(crl.getNumber()));
+}
+
+void
+CryptoTester::testRevocationListPartitionedNumber()
+{
+    // Two devices holding the same authority issue revocation lists independently.
+    // RFC 5280 5.2.3 requires CRL numbers to increase monotonically for a given CRL
+    // scope and issuer; partitioning the low bits by device keeps each sequence
+    // monotonic while making collisions between devices impossible.
+    constexpr unsigned TAG_BITS = 24;
+    constexpr uint64_t TAG_A = 0x0a0b0c;
+    constexpr uint64_t TAG_B = 0x0a0b0d;
+
+    auto ca = dht::crypto::generateIdentity("ca");
+    auto account = dht::crypto::generateIdentity("acc", ca, 4096, true);
+    auto deviceA = dht::crypto::generateIdentity("devA", account);
+    auto deviceB = dht::crypto::generateIdentity("devB", account);
+
+    uint64_t previous {0};
+    dht::crypto::RevocationList crlA;
+    for (unsigned i = 1; i <= 4; i++) {
+        crlA.revoke(*deviceA.second);
+        crlA.sign(account, {}, (uint64_t(i) << TAG_BITS) | TAG_A);
+        auto number = crlNumberValue(crlA.getNumber());
+        CPPUNIT_ASSERT_EQUAL(TAG_A, number & ((uint64_t(1) << TAG_BITS) - 1));
+        CPPUNIT_ASSERT(number > previous);
+        CPPUNIT_ASSERT_EQUAL(uint64_t(0), number >> 63);
+        previous = number;
+    }
+
+    // Both devices branch from the same counter but never mint the same number.
+    dht::crypto::RevocationList branchA;
+    branchA.revoke(*deviceA.second);
+    branchA.sign(account, {}, (uint64_t(9) << TAG_BITS) | TAG_A);
+    dht::crypto::RevocationList branchB;
+    branchB.revoke(*deviceB.second);
+    branchB.sign(account, {}, (uint64_t(9) << TAG_BITS) | TAG_B);
+    CPPUNIT_ASSERT(crlNumberValue(branchA.getNumber()) != crlNumberValue(branchB.getNumber()));
+
+    // Both are valid and revoke only their own target.
+    CPPUNIT_ASSERT(branchA.isSignedBy(*account.second));
+    CPPUNIT_ASSERT(branchB.isSignedBy(*account.second));
+    CPPUNIT_ASSERT(branchA.isRevoked(*deviceA.second));
+    CPPUNIT_ASSERT(not branchA.isRevoked(*deviceB.second));
+    CPPUNIT_ASSERT(branchB.isRevoked(*deviceB.second));
+    CPPUNIT_ASSERT(not branchB.isRevoked(*deviceA.second));
+
+    // A number minted by an older client is fully random, so bit 63 may be set. Masking
+    // it out and taking the counter part still yields a strictly greater number.
+    constexpr uint64_t legacy = 0xdead'beef'0123'4567ull;
+    dht::crypto::RevocationList legacyCrl;
+    legacyCrl.revoke(*deviceA.second);
+    legacyCrl.sign(account, {}, legacy);
+    auto counter = ((crlNumberValue(legacyCrl.getNumber()) & ~(uint64_t(1) << 63)) >> TAG_BITS) + 1;
+    legacyCrl.sign(account, {}, (counter << TAG_BITS) | TAG_A);
+    CPPUNIT_ASSERT(crlNumberValue(legacyCrl.getNumber()) > (legacy & ~(uint64_t(1) << 63)));
+    CPPUNIT_ASSERT_EQUAL(uint64_t(0), crlNumberValue(legacyCrl.getNumber()) >> 63);
+}
+
 void
 CryptoTester::testCertificateRequest()
-{
-    // Generate CA
+{    // Generate CA
     auto ca = dht::crypto::generateIdentity("Test CA");
 
     // Generate signed request
@@ -149,6 +316,25 @@ CryptoTester::testCertificateSerialNumber()
     };
     auto serial = dht::crypto::Certificate(cert_pem).getSerialNumber();
     CPPUNIT_ASSERT(std::equal(SERIAL.begin(), SERIAL.end(), serial.begin(), serial.end()));
+
+    auto key = dht::crypto::PrivateKey::generateEC();
+    for (unsigned i = 0; i < 32; i++) {
+        auto generated = dht::crypto::Certificate::generate(key, "generated", {});
+        auto generatedSerial = generated.getSerialNumber();
+        CPPUNIT_ASSERT(not generatedSerial.empty());
+        CPPUNIT_ASSERT_EQUAL(uint8_t {0}, uint8_t(generatedSerial.front() & 0x80));
+        CPPUNIT_ASSERT(std::any_of(generatedSerial.begin(), generatedSerial.end(), [](uint8_t byte) { return byte != 0; }));
+    }
+}
+
+void
+CryptoTester::testEcKeyCurve()
+{
+    auto key = dht::crypto::PrivateKey::generateEC(GNUTLS_ECC_CURVE_SECP256R1);
+    unsigned int bits = 0;
+    CPPUNIT_ASSERT_EQUAL(static_cast<int>(GNUTLS_PK_EC),
+                         gnutls_x509_privkey_get_pk_algorithm2(key.x509_key, &bits));
+    CPPUNIT_ASSERT_EQUAL(256u, bits);
 }
 
 void

tests/test_crypto.h

@@ -12,9 +12,14 @@ class CryptoTester : public CppUnit::TestFixture
 {
     CPPUNIT_TEST_SUITE(CryptoTester);
     CPPUNIT_TEST(testSignatureEncryption);
+    CPPUNIT_TEST(testPublicKeyPemIsPlainText);
     CPPUNIT_TEST(testCertificateRevocation);
+    CPPUNIT_TEST(testRevocationListNumber);
+    CPPUNIT_TEST(testRevocationListExplicitNumber);
+    CPPUNIT_TEST(testRevocationListPartitionedNumber);
     CPPUNIT_TEST(testCertificateRequest);
     CPPUNIT_TEST(testCertificateSerialNumber);
+    CPPUNIT_TEST(testEcKeyCurve);
     CPPUNIT_TEST(testOcsp);
     CPPUNIT_TEST(testAesEncryption);
     CPPUNIT_TEST(testAesEncryptionWithMultipleKeySizes);
@@ -36,10 +41,26 @@ public:
      * Test data signature, encryption and decryption
      */
     void testSignatureEncryption();
+    /**
+     * Test that an exported public key is text only, with no embedded null byte
+     */
+    void testPublicKeyPemIsPlainText();
     /**
      * Test certificate generation, validation and revocation
      */
     void testCertificateRevocation();
+    /**
+     * Test the default CRL Number behavior: random on first signature, incremented after
+     */
+    void testRevocationListNumber();
+    /**
+     * Test signing a revocation list with a caller-provided CRL Number
+     */
+    void testRevocationListExplicitNumber();
+    /**
+     * Test that issuers sharing an authority can partition the CRL Number space
+     */
+    void testRevocationListPartitionedNumber();
     /**
      * Test certificate requests
      */
@@ -48,6 +69,10 @@ public:
      * Test certificate serial number extraction
      */
     void testCertificateSerialNumber();
+    /**
+     * Test EC private key generation with an explicit curve
+     */
+    void testEcKeyCurve();
     /**
      * Test OCSP
      */

tests/test_dhtproxy.cpp

@@ -57,11 +57,11 @@ DhtProxyTester::tearDown()
     std::condition_variable cv;
     std::mutex cv_m;
     nodeProxy->shutdown([&] {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         done = true;
         cv.notify_all();
     });
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&] { return done; }));
     serverProxy.reset();
     nodeProxy.reset();
@@ -81,11 +81,11 @@ DhtProxyTester::testGetPut()
     auto val_data = val.data;
     {
         nodePeer.put(key, std::move(val), [&](bool) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             done = true;
             cv.notify_all();
         });
-        std::unique_lock<std::mutex> lk(cv_m);
+        std::unique_lock lk(cv_m);
         CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&] { return done; }));
     }
 
@@ -101,7 +101,7 @@ DhtProxyTester::testListen()
 
     std::condition_variable cv;
     std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     auto key = dht::InfoHash::get("GLaDOs");
     bool done = false;
 
@@ -111,7 +111,7 @@ DhtProxyTester::testListen()
     auto firstVal_data = firstVal.data;
     nodePeer.put(key, std::move(firstVal), [&](bool ok) {
         CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         done = true;
         cv.notify_all();
     });
@@ -121,7 +121,7 @@ DhtProxyTester::testListen()
     std::vector<dht::Blob> values;
     auto token = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
         if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             for (const auto& value : v)
                 values.emplace_back(value->data);
             done = true;
@@ -156,7 +156,7 @@ DhtProxyTester::testResubscribeGetValues()
     bool done = false;
     std::condition_variable cv;
     std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     auto key = dht::InfoHash::get("GLaDOs");
 
     // If a peer sent a value, the listen operation from the client
@@ -164,7 +164,7 @@ DhtProxyTester::testResubscribeGetValues()
     dht::Value firstVal {"Hey! It's been a long time. How have you been?"};
     auto firstVal_data = firstVal.data;
     nodePeer.put(key, std::move(firstVal), [&](bool ok) {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         CPPUNIT_ASSERT(ok);
         done = true;
         cv.notify_all();
@@ -186,7 +186,7 @@ DhtProxyTester::testResubscribeGetValues()
     std::vector<std::shared_ptr<dht::Value>> values;
     auto ftoken = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
         if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             values.insert(values.end(), v.begin(), v.end());
             done = true;
             cv.notify_all();
@@ -218,14 +218,14 @@ DhtProxyTester::testPutGet40KChars()
         mtu.emplace_back((i % 2) ? 'T' : 'M');
     std::condition_variable cv;
     std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     bool done_put = false;
     bool done_get = false;
 
     // Act
     dht::Value val {mtu};
     nodePeer.put(key, std::move(val), [&](bool ok) {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         done_put = ok;
         cv.notify_all();
     });
@@ -238,7 +238,7 @@ DhtProxyTester::testPutGet40KChars()
             return true;
         },
         [&](bool ok) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             done_get = ok;
             cv.notify_all();
         });
@@ -316,12 +316,12 @@ DhtProxyTester::testShutdownStop()
         std::mutex cv_m;
         nodeTest->shutdown(
             [&] {
-                std::lock_guard<std::mutex> lk(cv_m);
+                std::lock_guard lk(cv_m);
                 done = true;
                 cv.notify_all();
             },
             true);
-        std::unique_lock<std::mutex> lk(cv_m);
+        std::unique_lock lk(cv_m);
         CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&] { return done; }));
     }
     CPPUNIT_ASSERT_EQUAL(2 * C, callback_count.load());

tests/test_dhtproxy_stress.cpp

@@ -51,11 +51,11 @@ DhtProxyStressTester::tearDown()
     std::condition_variable cv;
     std::mutex cv_m;
     nodeProxy->shutdown([&] {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         done = true;
         cv.notify_all();
     });
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&] { return done; }));
     serverProxy.reset();
     nodeProxy.reset();
@@ -70,7 +70,7 @@ DhtProxyStressTester::testRepeatValues()
 
     std::condition_variable cv;
     std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     auto key = dht::InfoHash::get("GLaDOs");
     bool done = false;
 
@@ -80,7 +80,7 @@ DhtProxyStressTester::testRepeatValues()
     auto firstVal_data = firstVal.data;
     nodePeer.put(key, std::move(firstVal), [&](bool ok) {
         CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
         done = true;
         cv.notify_all();
     });
@@ -90,7 +90,7 @@ DhtProxyStressTester::testRepeatValues()
     std::vector<dht::Blob> values;
     auto token = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
         if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             for (const auto& value : v)
                 values.emplace_back(value->data);
             done = true;
@@ -132,7 +132,7 @@ DhtProxyStressTester::testRepeatValues()
         val->id = id++;
         nodePeer.put(key, val, [&](bool ok) {
             CPPUNIT_ASSERT(ok);
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             done = true;
             cv.notify_all();
         });
@@ -145,7 +145,7 @@ DhtProxyStressTester::testRepeatValues()
             if (not expired) {
                 for (const auto& value : v) {
                     if (value->id == val->id) {
-                        std::lock_guard<std::mutex> lk(cv_m);
+                        std::lock_guard lk(cv_m);
                         done = true;
                         cv.notify_all();
                         break;

tests/test_dhtrunner.cpp

@@ -9,6 +9,8 @@
 #include <future>
 #include <mutex>
 #include <condition_variable>
+#include <fstream>
+#include <cstdio>
 using namespace std::chrono_literals;
 using namespace std::literals;
 
@@ -208,6 +210,42 @@ DhtRunnerTester::testImportValuesPreservesRemoteQuota()
     restored.join();
 }
 
+void
+DhtRunnerTester::testExportValuesUsesSystemTime()
+{
+    auto key = dht::InfoHash::get("export-system-time");
+    const auto created = dht::clock::now();
+    msgpack::sbuffer importBuffer;
+    msgpack::packer<msgpack::sbuffer> pk(&importBuffer);
+    pk.pack_array(1);
+    pk.pack_array(2);
+    pk.pack(created.time_since_epoch().count());
+    dht::Value {std::string("persisted")}.msgpack_pack(pk);
+    node1.importValues({
+        dht::ValuesExport {key, {importBuffer.data(), importBuffer.data() + importBuffer.size()}}
+    });
+
+    auto exported = node1.exportValues();
+    CPPUNIT_ASSERT_EQUAL(size_t(1), exported.size());
+
+    msgpack::unpacked msg;
+    msgpack::unpack(msg, reinterpret_cast<const char*>(exported.front().second.data()), exported.front().second.size());
+    const auto values = msg.get();
+    CPPUNIT_ASSERT(values.type == msgpack::type::ARRAY);
+    CPPUNIT_ASSERT_EQUAL(uint32_t(1), values.via.array.size);
+    const auto& persistedValue = values.via.array.ptr[0];
+    CPPUNIT_ASSERT_EQUAL(uint32_t(4), persistedValue.via.array.size);
+    CPPUNIT_ASSERT(persistedValue.via.array.ptr[0].type == msgpack::type::EXT);
+    CPPUNIT_ASSERT(persistedValue.via.array.ptr[3].type == msgpack::type::EXT);
+
+    const auto persistedCreated = persistedValue.via.array.ptr[0].as<std::chrono::system_clock::time_point>();
+    const auto persistedExpiration = persistedValue.via.array.ptr[3].as<std::chrono::system_clock::time_point>();
+    const auto delta = std::chrono::system_clock::now() - persistedCreated;
+    CPPUNIT_ASSERT(delta >= std::chrono::system_clock::duration::zero());
+    CPPUNIT_ASSERT(delta < 5s);
+    CPPUNIT_ASSERT(persistedExpiration > persistedCreated);
+}
+
 void
 DhtRunnerTester::testImportValuesPreservesStoredExpiration()
 {
@@ -262,6 +300,64 @@ DhtRunnerTester::testImportValuesPreservesStoredExpiration()
     restored.join();
 }
 
+void
+DhtRunnerTester::testImportPermanentValueExpires()
+{
+    static const dht::ValueType SHORT_TYPE {201, "Short perm", 500ms};
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+    dht::DhtRunner restored;
+    restored.run(0, config);
+    restored.registerInsecureType(SHORT_TYPE);
+
+    // Ensure the runner is waiting on a previously computed scheduler deadline.
+    std::promise<void> loopCompleted;
+    auto loopCompletedFuture = loopCompleted.get_future();
+    restored.getNodeInfo([&loopCompleted](auto) { loopCompleted.set_value(); });
+    getFutureValue(std::move(loopCompletedFuture));
+
+    auto key = dht::InfoHash::get("import-permanent-expiration");
+    auto now = dht::clock::now();
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack_array(4);
+    pk.pack(now.time_since_epoch().count());
+    dht::Value {SHORT_TYPE.id, std::string("was-permanent")}.msgpack_pack(pk);
+    pk.pack_bin(0);
+    pk.pack(dht::clock::time_point::max().time_since_epoch().count());
+
+    restored.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    auto containsValue = [&] {
+        for (const auto& [exportedKey, data] : restored.exportValues()) {
+            if (exportedKey != key)
+                continue;
+            msgpack::unpacked msg;
+            msgpack::unpack(msg, reinterpret_cast<const char*>(data.data()), data.size());
+            auto valarr = msg.get();
+            CPPUNIT_ASSERT(valarr.type == msgpack::type::ARRAY);
+            return valarr.via.array.size != 0;
+        }
+        return false;
+    };
+
+    CPPUNIT_ASSERT(containsValue());
+    auto timeout = dht::clock::now() + 2s;
+    while (containsValue() and dht::clock::now() < timeout)
+        std::this_thread::sleep_for(10ms);
+    CPPUNIT_ASSERT(!containsValue());
+
+    restored.shutdown();
+    restored.join();
+}
+
 void
 DhtRunnerTester::testBootstrapSetsConnectingState()
 {
@@ -282,7 +378,7 @@ DhtRunnerTester::testBootstrapSetsConnectingState()
 
     dht::DhtRunner::Context context;
     context.statusChangedCallback = [&](dht::NodeStatus status4, dht::NodeStatus status6) {
-        std::lock_guard<std::mutex> lock(mutex);
+        std::lock_guard lock(mutex);
         sawConnecting = sawConnecting || status4 == dht::NodeStatus::Connecting
                         || status6 == dht::NodeStatus::Connecting;
         cv.notify_all();
@@ -299,8 +395,10 @@ DhtRunnerTester::testBootstrapSetsConnectingState()
 
     clientNode.bootstrap("127.0.0.1", std::to_string(bound.getPort()));
 
-    std::unique_lock<std::mutex> lock(mutex);
-    CPPUNIT_ASSERT(cv.wait_for(lock, 5s, [&] { return sawConnecting; }));
+    {
+        std::unique_lock lock(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lock, 5s, [&] { return sawConnecting; }));
+    }
 
     bootstrapNode.shutdown();
     bootstrapNode.join();
@@ -382,7 +480,7 @@ DhtRunnerTester::testBootstrapMissingNodeThenPutFails()
 
     dht::DhtRunner::Context context;
     context.statusChangedCallback = [&](dht::NodeStatus status4, dht::NodeStatus status6) {
-        std::lock_guard<std::mutex> lock(mutex);
+        std::lock_guard lock(mutex);
         if (status4 == dht::NodeStatus::Connecting || status6 == dht::NodeStatus::Connecting)
             sawConnecting = true;
         if (sawConnecting && status4 == dht::NodeStatus::Disconnected && status6 == dht::NodeStatus::Disconnected)
@@ -400,14 +498,14 @@ DhtRunnerTester::testBootstrapMissingNodeThenPutFails()
 
     clientNode.bootstrap("127.0.0.1", std::to_string(missingPort));
     clientNode.put(dht::InfoHash::get("bootstrap-missing-put"), dht::Value {"value"}, [&](bool ok) {
-        std::lock_guard<std::mutex> lock(mutex);
+        std::lock_guard lock(mutex);
         putReturnedBeforeDisconnect = !sawDisconnectedAfterConnecting;
         putDone.set_value(ok);
         cv.notify_all();
     });
 
     {
-        std::unique_lock<std::mutex> lock(mutex);
+        std::unique_lock lock(mutex);
         CPPUNIT_ASSERT(cv.wait_for(lock, 10s, [&] { return sawConnecting; }));
         CPPUNIT_ASSERT(cv.wait_for(lock, 20s, [&] { return sawDisconnectedAfterConnecting; }));
     }
@@ -419,6 +517,76 @@ DhtRunnerTester::testBootstrapMissingNodeThenPutFails()
     clientNode.join();
 }
 
+void
+DhtRunnerTester::testShutdownCompletesWithPendingPut()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    auto getUnusedPort = [&]() {
+        dht::DhtRunner tmpNode;
+        tmpNode.run(0, config);
+        auto port = tmpNode.getBoundPort();
+        tmpNode.shutdown();
+        tmpNode.join();
+        return port;
+    };
+
+    auto missingPort = getUnusedPort();
+
+    dht::DhtRunner clientNode;
+    clientNode.run(0, config);
+    while (clientNode.getBoundPort() == missingPort)
+        missingPort = getUnusedPort();
+
+    clientNode.bootstrap("127.0.0.1", std::to_string(missingPort));
+    clientNode.put(dht::InfoHash::get("shutdown-pending-put"), dht::Value {"value"}, [](bool) {});
+
+    std::promise<void> shutdownDone;
+    auto shutdownFuture = shutdownDone.get_future();
+    clientNode.shutdown([&]() { shutdownDone.set_value(); });
+
+    CPPUNIT_ASSERT(std::future_status::ready == shutdownFuture.wait_for(5s));
+
+    clientNode.join();
+}
+
+void
+DhtRunnerTester::testSavedPortFallback()
+{
+    // A saved port that is already taken by another process (e.g. fast
+    // application restart while the old instance still holds it) must not
+    // prevent the node from starting: it should fall back to a random port.
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.persist_path = "/tmp/opendht_test_port_fallback";
+    std::string portFile = config.dht_config.node_config.persist_path + "_port.txt";
+
+    // node1 (from setUp) holds a port; save it as our persisted port.
+    auto takenPort = node1.getBoundPort();
+    {
+        std::ofstream out(portFile);
+        out << takenPort << std::endl << takenPort << std::endl;
+    }
+
+    dht::DhtRunner testNode;
+    CPPUNIT_ASSERT_NO_THROW(testNode.run(0, config));
+    CPPUNIT_ASSERT(testNode.getBoundPort());
+    CPPUNIT_ASSERT(testNode.getBoundPort() != takenPort);
+
+    testNode.shutdown();
+    testNode.join();
+    std::remove(portFile.c_str());
+    std::remove((config.dht_config.node_config.persist_path + "_port.txt").c_str());
+}
+
 void
 DhtRunnerTester::testListen()
 {

tests/test_dhtrunner.h

@@ -21,10 +21,14 @@ class DhtRunnerTester : public CppUnit::TestFixture
     CPPUNIT_TEST(testListenLotOfBytes);
     CPPUNIT_TEST(testIdOps);
     CPPUNIT_TEST(testImportValuesPreservesRemoteQuota);
+    CPPUNIT_TEST(testExportValuesUsesSystemTime);
     CPPUNIT_TEST(testImportValuesPreservesStoredExpiration);
+    CPPUNIT_TEST(testImportPermanentValueExpires);
     CPPUNIT_TEST(testBootstrapSetsConnectingState);
     CPPUNIT_TEST(testBootstrapThenPutNoRace);
     CPPUNIT_TEST(testBootstrapMissingNodeThenPutFails);
+    CPPUNIT_TEST(testShutdownCompletesWithPendingPut);
+    CPPUNIT_TEST(testSavedPortFallback);
     CPPUNIT_TEST_SUITE_END();
 
     dht::DhtRunner node1 {};
@@ -64,10 +68,14 @@ public:
      */
     void testIdOps();
     void testImportValuesPreservesRemoteQuota();
+    void testExportValuesUsesSystemTime();
     void testImportValuesPreservesStoredExpiration();
+    void testImportPermanentValueExpires();
     void testBootstrapSetsConnectingState();
     void testBootstrapThenPutNoRace();
     void testBootstrapMissingNodeThenPutFails();
+    void testShutdownCompletesWithPendingPut();
+    void testSavedPortFallback();
     /**
      * Test listen method with lot of datas
      */

tests/test_http.cpp

@@ -8,6 +8,7 @@
 
 #include <iostream>
 #include <string>
+#include <atomic>
 #include <chrono>
 #include <condition_variable>
 
@@ -332,13 +333,43 @@ HttpTester::test_parse_url_just_slash()
     CPPUNIT_ASSERT_EQUAL(std::string("/"), parsed.target);
 }
 
+void
+HttpTester::test_completed_resolver_callback_uses_io_thread()
+{
+    asio::io_context ioContext;
+    const asio::ip::tcp::endpoint endpoint(asio::ip::address_v4::loopback(), 80);
+    dht::http::Resolver resolver(ioContext, {endpoint});
+    const auto callerThread = std::this_thread::get_id();
+    std::thread::id callbackThread;
+    asio::error_code callbackError;
+    std::vector<asio::ip::tcp::endpoint> resolvedEndpoints;
+    std::atomic_bool callbackCalled {false};
+
+    resolver.add_callback([&](const asio::error_code& ec, const auto& endpoints) {
+        callbackError = ec;
+        callbackThread = std::this_thread::get_id();
+        resolvedEndpoints = endpoints;
+        callbackCalled = true;
+    });
+
+    CPPUNIT_ASSERT(!callbackCalled);
+    std::thread ioThread([&] { ioContext.run(); });
+    ioThread.join();
+
+    CPPUNIT_ASSERT(callbackCalled);
+    CPPUNIT_ASSERT(!callbackError);
+    CPPUNIT_ASSERT(callbackThread != callerThread);
+    CPPUNIT_ASSERT_EQUAL(size_t(1), resolvedEndpoints.size());
+    CPPUNIT_ASSERT_EQUAL(endpoint, resolvedEndpoints.front());
+}
+
 void
 HttpTester::test_send_json()
 {
     // Arrange
     std::condition_variable cv;
     std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
     bool done = false;
     unsigned int status = 0;
 
@@ -350,7 +381,7 @@ HttpTester::test_send_json()
                                                         "http://127.0.0.1:8080/key/key",
                                                         json,
                                                         [&](Json::Value value, const dht::http::Response& response) {
-                                                            std::lock_guard<std::mutex> lk(cv_m);
+                                                            std::lock_guard lk(cv_m);
                                                             resp_val = std::move(value);
                                                             status = response.status_code;
                                                             done = true;
@@ -368,7 +399,7 @@ HttpTester::test_send_json()
     request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
         "http://google.ca",
         [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             status = response.status_code;
             done = true;
             cv.notify_all();
@@ -382,7 +413,7 @@ HttpTester::test_send_json()
     request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
         "https://google.ca",
         [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             status = response.status_code;
             done = true;
             cv.notify_all();
@@ -396,7 +427,7 @@ HttpTester::test_send_json()
     request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
         "https://google.ca/sdbjklwGBIP",
         [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
             status = response.status_code;
             done = true;
             cv.notify_all();

tests/test_http.h

@@ -39,6 +39,7 @@ class HttpTester : public CppUnit::TestFixture
     CPPUNIT_TEST(test_parse_url_complex_path_query_fragment);
     CPPUNIT_TEST(test_parse_url_empty);
     CPPUNIT_TEST(test_parse_url_just_slash);
+    CPPUNIT_TEST(test_completed_resolver_callback_uses_io_thread);
     // send
     CPPUNIT_TEST(test_send_json);
     CPPUNIT_TEST_SUITE_END();
@@ -82,6 +83,7 @@ public:
     void test_parse_url_complex_path_query_fragment();
     void test_parse_url_empty();
     void test_parse_url_just_slash();
+    void test_completed_resolver_callback_uses_io_thread();
     /**
      * Test send(json)
      */

tests/test_networkengine.cpp

@@ -214,9 +214,12 @@ makeEngine(std::unique_ptr<TestDatagramSocket>&& socket,
            std::mt19937_64& rd,
            int& onNewNodeCalls)
 {
+    net::NetworkConfig config {};
+    config.max_req_per_sec = -1;
+    config.max_peer_req_per_sec = -1;
     return net::NetworkEngine(
         myid,
-        {},
+        config,
         std::move(socket),
         {},
         rd,
@@ -234,6 +237,21 @@ makeEngine(std::unique_ptr<TestDatagramSocket>&& socket,
         [](Sp<Node>, const InfoHash&, const Blob&, const Value::Id&) { return net::RequestAnswer {}; });
 }
 
+static Sp<Node>
+addPendingGetRequest(net::NetworkEngine& engine, const InfoHash& id, const SockAddr& addr, Tid tid)
+{
+    auto node = engine.insertNode(id, addr);
+    auto request = std::make_shared<net::Request>(
+        MessageType::GetValues,
+        tid,
+        node,
+        Blob {},
+        [](const net::Request&, ParsedMessage&&) {},
+        [](const net::Request&, bool) {});
+    node->requested(request);
+    return node;
+}
+
 void
 NetworkEngineTester::setUp()
 {}
@@ -243,24 +261,130 @@ NetworkEngineTester::tearDown()
 {}
 
 void
-NetworkEngineTester::testIgnoresUnknownPartialData()
+NetworkEngineTester::testCompletesPartialSessionWithDataBeforeHeader()
 {
     Scheduler scheduler;
     std::mt19937_64 rd(0);
     InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
     int onNewNodeCalls = 0;
     auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
 
-    Blob fragment = {1, 2, 3};
-    auto packet = makeValueDataPacketBlob(99, 0, 0, fragment);
+    auto serialized = serializeValue("fragment before header");
     auto from = makeIPv4("127.0.0.2", 5000);
+    addPendingGetRequest(engine, remoteId, from, 99);
+    auto initialOnNewNodeCalls = onNewNodeCalls;
+    auto fragment = makeValueDataPacketBlob(99, 0, 0, serialized);
+    auto header = makeReplyHeaderPacketBlob(remoteId, 99, {serialized.size()});
 
+    engine.processMessage(fragment.data(), fragment.size(), from);
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+    CPPUNIT_ASSERT_EQUAL(initialOnNewNodeCalls, onNewNodeCalls);
+
+    engine.processMessage(header.data(), header.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT(onNewNodeCalls > initialOnNewNodeCalls);
+}
+
+void
+NetworkEngineTester::testBuffersLargeValueBeforeHeader()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(8);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    auto serialized = serializeValue(std::string(57 * 1024, 'l'));
+    auto from = makeIPv4("127.0.0.2", 5008);
+    addPendingGetRequest(engine, remoteId, from, 101);
+    auto initialOnNewNodeCalls = onNewNodeCalls;
+    for (size_t offset = 0; offset < serialized.size(); offset += TEST_MTU) {
+        auto end = std::min(offset + TEST_MTU, serialized.size());
+        Blob data(serialized.begin() + offset, serialized.begin() + end);
+        auto fragment = makeValueDataPacketBlob(101, 0, offset, data);
+        engine.processMessage(fragment.data(), fragment.size(), from);
+    }
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+
+    auto header = makeReplyHeaderPacketBlob(remoteId, 101, {serialized.size()});
+    engine.processMessage(header.data(), header.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT(onNewNodeCalls > initialOnNewNodeCalls);
+}
+
+void
+NetworkEngineTester::testIgnoresEmptyPartialData()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(7);
+    InfoHash myid = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    auto packet = makeValueDataPacketBlob(100, 0, 0, {});
+    auto from = makeIPv4("127.0.0.2", 5007);
     engine.processMessage(packet.data(), packet.size(), from);
 
     CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
     CPPUNIT_ASSERT_EQUAL(0, onNewNodeCalls);
 }
 
+void
+NetworkEngineTester::testRejectsUnsolicitedPartialReply()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(9);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    auto from = makeIPv4("127.0.0.2", 5009);
+    auto header = makeReplyHeaderPacketBlob(remoteId, 102, {TEST_MTU});
+    engine.processMessage(header.data(), header.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getNodeCacheSize());
+}
+
+void
+NetworkEngineTester::testDropsMalformedCompletedPartialMessage()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(10);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    auto from = makeIPv4("127.0.0.2", 5010);
+    addPendingGetRequest(engine, remoteId, from, 103);
+    Blob malformed {0xc1};
+    auto header = makeReplyHeaderPacketBlob(remoteId, 103, {malformed.size()});
+    auto fragment = makeValueDataPacketBlob(103, 0, 0, malformed);
+
+    engine.processMessage(header.data(), header.size(), from);
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+    engine.processMessage(fragment.data(), fragment.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+
+    auto earlyFrom = makeIPv4("127.0.0.2", 5011);
+    addPendingGetRequest(engine, remoteId, earlyFrom, 104);
+    auto earlyHeader = makeReplyHeaderPacketBlob(remoteId, 104, {malformed.size()});
+    auto earlyFragment = makeValueDataPacketBlob(104, 0, 0, malformed);
+
+    engine.processMessage(earlyFragment.data(), earlyFragment.size(), earlyFrom);
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+    engine.processMessage(earlyHeader.data(), earlyHeader.size(), earlyFrom);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+}
+
 void
 NetworkEngineTester::testCompletesPartialSessionFromSameSource()
 {
@@ -274,6 +398,8 @@ NetworkEngineTester::testCompletesPartialSessionFromSameSource()
     std::string data(TEST_MTU * 2 + 64, 'z');
     auto serialized = serializeValue(data);
     auto from = makeIPv4("127.0.0.2", 5001);
+    addPendingGetRequest(engine, remoteId, from, 7);
+    auto initialOnNewNodeCalls = onNewNodeCalls;
     auto header = makeReplyHeaderPacketBlob(remoteId, 7, {serialized.size()});
 
     engine.processMessage(header.data(), header.size(), from);
@@ -287,45 +413,40 @@ NetworkEngineTester::testCompletesPartialSessionFromSameSource()
     }
 
     CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
-    CPPUNIT_ASSERT(onNewNodeCalls > 0);
+    CPPUNIT_ASSERT(onNewNodeCalls > initialOnNewNodeCalls);
 }
 
 void
-NetworkEngineTester::testKeepsSessionForWrongSourceFragment()
+NetworkEngineTester::testSeparatesPartialSessionsBySource()
 {
     Scheduler scheduler;
     std::mt19937_64 rd(2);
     InfoHash myid = InfoHash::getRandom(rd);
-    InfoHash remoteId = InfoHash::getRandom(rd);
+    InfoHash firstRemoteId = InfoHash::getRandom(rd);
+    InfoHash secondRemoteId = InfoHash::getRandom(rd);
     int onNewNodeCalls = 0;
     auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
 
-    std::string data(TEST_MTU + 32, 'w');
-    auto serialized = serializeValue(data);
-    auto goodFrom = makeIPv4("127.0.0.2", 5002);
-    auto badFrom = makeIPv4("127.0.0.3", 5002);
-    auto header = makeReplyHeaderPacketBlob(remoteId, 11, {serialized.size()});
+    auto serialized = serializeValue("same transaction, different peers");
+    auto firstFrom = makeIPv4("127.0.0.2", 5002);
+    auto secondFrom = makeIPv4("127.0.0.3", 5002);
+    addPendingGetRequest(engine, firstRemoteId, firstFrom, 11);
+    addPendingGetRequest(engine, secondRemoteId, secondFrom, 11);
+    auto initialOnNewNodeCalls = onNewNodeCalls;
+    auto firstHeader = makeReplyHeaderPacketBlob(firstRemoteId, 11, {serialized.size()});
+    auto secondHeader = makeReplyHeaderPacketBlob(secondRemoteId, 11, {serialized.size()});
 
-    engine.processMessage(header.data(), header.size(), goodFrom);
+    engine.processMessage(firstHeader.data(), firstHeader.size(), firstFrom);
+    engine.processMessage(secondHeader.data(), secondHeader.size(), secondFrom);
+    CPPUNIT_ASSERT_EQUAL((size_t) 2, engine.getPartialCount());
+
+    auto fragment = makeValueDataPacketBlob(11, 0, 0, serialized);
+    engine.processMessage(fragment.data(), fragment.size(), firstFrom);
     CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
-
-    auto firstEnd = std::min(TEST_MTU, serialized.size());
-    Blob firstFragment(serialized.begin(), serialized.begin() + firstEnd);
-    auto firstPacket = makeValueDataPacketBlob(11, 0, 0, firstFragment);
-    engine.processMessage(firstPacket.data(), firstPacket.size(), badFrom);
-
-    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
-    CPPUNIT_ASSERT_EQUAL(0, onNewNodeCalls);
-
-    engine.processMessage(firstPacket.data(), firstPacket.size(), goodFrom);
-    if (firstEnd < serialized.size()) {
-        Blob tail(serialized.begin() + firstEnd, serialized.end());
-        auto tailPacket = makeValueDataPacketBlob(11, 0, firstEnd, tail);
-        engine.processMessage(tailPacket.data(), tailPacket.size(), goodFrom);
-    }
+    engine.processMessage(fragment.data(), fragment.size(), secondFrom);
 
     CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
-    CPPUNIT_ASSERT(onNewNodeCalls > 0);
+    CPPUNIT_ASSERT(onNewNodeCalls > initialOnNewNodeCalls);
 }
 
 void
@@ -428,8 +549,10 @@ NetworkEngineTester::testListenConfirmationUpdatesSearchNodeToken()
     localDht.onListenDone(node, answer, sr);
 
     CPPUNIT_ASSERT(searchNodePtr->token == answer.ntoken);
-    CPPUNIT_ASSERT(searchNodePtr->last_get_reply == localDht.scheduler.time());
-    CPPUNIT_ASSERT(searchNodePtr->isSynced(localDht.scheduler.time()));
+    /* last_get_reply should NOT be updated by listen confirmation,
+       so that periodic find_node requests still refresh the search table. */
+    CPPUNIT_ASSERT(searchNodePtr->last_get_reply == time_point::min());
+    CPPUNIT_ASSERT(!searchNodePtr->isSynced(localDht.scheduler.time()));
 }
 
 void

tests/test_networkengine.h

@@ -13,9 +13,13 @@ class NetworkEngineTester : public CppUnit::TestFixture
 #ifdef _MSC_VER
     CPPUNIT_TEST(testDisabledOnMsvc);
 #else
-    CPPUNIT_TEST(testIgnoresUnknownPartialData);
+    CPPUNIT_TEST(testCompletesPartialSessionWithDataBeforeHeader);
+    CPPUNIT_TEST(testBuffersLargeValueBeforeHeader);
+    CPPUNIT_TEST(testIgnoresEmptyPartialData);
+    CPPUNIT_TEST(testRejectsUnsolicitedPartialReply);
+    CPPUNIT_TEST(testDropsMalformedCompletedPartialMessage);
     CPPUNIT_TEST(testCompletesPartialSessionFromSameSource);
-    CPPUNIT_TEST(testKeepsSessionForWrongSourceFragment);
+    CPPUNIT_TEST(testSeparatesPartialSessionsBySource);
     CPPUNIT_TEST(testListenConfirmationCarriesToken);
     CPPUNIT_TEST(testListenConfirmationUpdatesSearchNodeToken);
     CPPUNIT_TEST(testListenReopensSocketAfterNodeExpiration);
@@ -30,9 +34,13 @@ public:
 #ifdef _MSC_VER
     void testDisabledOnMsvc();
 #else
-    void testIgnoresUnknownPartialData();
+    void testCompletesPartialSessionWithDataBeforeHeader();
+    void testBuffersLargeValueBeforeHeader();
+    void testIgnoresEmptyPartialData();
+    void testRejectsUnsolicitedPartialReply();
+    void testDropsMalformedCompletedPartialMessage();
     void testCompletesPartialSessionFromSameSource();
-    void testKeepsSessionForWrongSourceFragment();
+    void testSeparatesPartialSessionsBySource();
     void testListenConfirmationCarriesToken();
     void testListenConfirmationUpdatesSearchNodeToken();
     void testListenReopensSocketAfterNodeExpiration();

tests/test_parsedmessage.cpp

@@ -328,6 +328,104 @@ ParsedMessageTester::testParseRejectsInvalidValuesField()
     CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
 }
 
+void
+ParsedMessageTester::testParseRejectsEmptyFieldSelection()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_R);
+    pk.pack_map(1);
+    pk.pack(KEY_REQ_FIELDS);
+    pk.pack_map(2);
+    pk.pack("f");
+    pk.pack_array(0);
+    pk.pack("v");
+    pk.pack_array(0);
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_R);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseRejectsEmptyErrorArray()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_E);
+    pk.pack_array(0);
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_E);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseRejectsNonMapRequest()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(4);
+    pk.pack(KEY_A);
+    pk.pack_array(2);
+    pk.pack(1u);
+    pk.pack(2u);
+    pk.pack(KEY_Q);
+    pk.pack(QUERY_PING);
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_Y);
+    pk.pack("q");
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseErrorOnlyMessageKeepsRequestFieldsEmpty()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    // An error message with no request map: the error array must not be walked
+    // as if it were a sequence of key/value pairs.
+    pk.pack_map(3);
+    pk.pack(KEY_E);
+    pk.pack_array(2);
+    pk.pack(401u);
+    pk.pack("unauthorized");
+    pk.pack(KEY_TID);
+    pk.pack(9u);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_E);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    parsed.msgpack_unpack(msg.get());
+
+    CPPUNIT_ASSERT(parsed.type == MessageType::Error);
+    CPPUNIT_ASSERT_EQUAL((uint16_t) 401, parsed.error_code);
+    CPPUNIT_ASSERT(not parsed.id);
+    CPPUNIT_ASSERT(parsed.token.empty());
+    CPPUNIT_ASSERT(parsed.values.empty());
+    CPPUNIT_ASSERT(parsed.nodes4_raw.empty());
+    CPPUNIT_ASSERT(parsed.nodes6_raw.empty());
+}
+
 void
 ParsedMessageTester::testParseIgnoresIncompleteValueDataEntry()
 {

tests/test_parsedmessage.h

@@ -24,6 +24,10 @@ class ParsedMessageTester : public CppUnit::TestFixture
     CPPUNIT_TEST(testParseRejectsNonMapPacket);
     CPPUNIT_TEST(testParseRejectsInvalidValueDataPayload);
     CPPUNIT_TEST(testParseRejectsInvalidValuesField);
+    CPPUNIT_TEST(testParseRejectsEmptyFieldSelection);
+    CPPUNIT_TEST(testParseRejectsEmptyErrorArray);
+    CPPUNIT_TEST(testParseRejectsNonMapRequest);
+    CPPUNIT_TEST(testParseErrorOnlyMessageKeepsRequestFieldsEmpty);
     CPPUNIT_TEST(testParseIgnoresIncompleteValueDataEntry);
     CPPUNIT_TEST(testCompleteEmpty);
     CPPUNIT_TEST(testCompleteIncomplete);
@@ -53,6 +57,10 @@ public:
     void testParseRejectsNonMapPacket();
     void testParseRejectsInvalidValueDataPayload();
     void testParseRejectsInvalidValuesField();
+    void testParseRejectsEmptyFieldSelection();
+    void testParseRejectsEmptyErrorArray();
+    void testParseRejectsNonMapRequest();
+    void testParseErrorOnlyMessageKeepsRequestFieldsEmpty();
     void testParseIgnoresIncompleteValueDataEntry();
     void testCompleteEmpty();
     void testCompleteIncomplete();

tests/test_peerdiscovery.cpp

@@ -54,7 +54,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
     unsigned countDht {0};
     unsigned countJami {0};
     {
-        std::unique_lock<std::mutex> l(lock);
+        std::unique_lock l(lock);
         dht::PeerDiscovery testDht(MULTICAST_PORT);
         dht::PeerDiscovery testJami(MULTICAST_PORT);
 
@@ -63,7 +63,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
             CPPUNIT_ASSERT_EQUAL(dhtNode.nodeid, v.nodeid);
             CPPUNIT_ASSERT_EQUAL(dhtNode.nid, v.nid);
             {
-                std::lock_guard<std::mutex> l(lock);
+                std::lock_guard l(lock);
                 countDht++;
             }
             cv.notify_all();
@@ -75,7 +75,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
             CPPUNIT_ASSERT_EQUAL(jamiNode.cha, v.cha);
             CPPUNIT_ASSERT_EQUAL(jamiNode.str, v.str);
             {
-                std::lock_guard<std::mutex> l(lock);
+                std::lock_guard l(lock);
                 countJami++;
             }
             cv.notify_all();

tests/test_threadpool.cpp

@@ -80,6 +80,46 @@ ThreadPoolTester::testContext()
     CPPUNIT_ASSERT_EQUAL(N, count.load());
 }
 
+void
+ThreadPoolTester::testJoinNonEmptyTaskQueue()
+{
+    dht::ThreadPool pool(2);
+
+    constexpr unsigned N = 128;
+    std::atomic_uint count {0};
+
+    // Schedule enough work so that the task queue is non-empty when calling
+    // pool.join() below.
+    for (unsigned i = 0; i < N; i++)
+        pool.run([&] {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            count++;
+        });
+
+    std::atomic_bool joined {false};
+    std::condition_variable cv;
+    std::thread joinThread([&] {
+        CPPUNIT_ASSERT(count.load() < N);
+        pool.join();
+        joined = true;
+        cv.notify_one();
+    });
+
+    // After calling join(), all pending tasks should complete, and then all
+    // threads in the pool should join.
+    std::mutex mtx;
+    std::unique_lock lock(mtx);
+    bool poolJoined = cv.wait_for(lock, std::chrono::seconds(10), [&] { return joined.load(); });
+    if (!poolJoined) {
+        // Detach joinThread if we timed out, otherwise the test can crash.
+        joinThread.detach();
+    } else {
+        joinThread.join();
+    }
+    CPPUNIT_ASSERT_EQUAL_MESSAGE("Some tasks were not completed", N, count.load());
+    CPPUNIT_ASSERT_MESSAGE("Thread pool failed to join before timeout", poolJoined);
+}
+
 void
 ThreadPoolTester::tearDown()
 {}

tests/test_threadpool.h

@@ -14,6 +14,7 @@ class ThreadPoolTester : public CppUnit::TestFixture
     CPPUNIT_TEST(testThreadPool);
     CPPUNIT_TEST(testExecutor);
     CPPUNIT_TEST(testContext);
+    CPPUNIT_TEST(testJoinNonEmptyTaskQueue);
     CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -29,6 +30,7 @@ public:
     void testThreadPool();
     void testExecutor();
     void testContext();
+    void testJoinNonEmptyTaskQueue();
 };
 
 } // namespace test

tests/test_value.cpp

@@ -8,6 +8,8 @@
 
 // opendht
 #include "opendht/value.h"
+#include "opendht/crypto.h"
+#include <msgpack.hpp>
 
 namespace test {
 CPPUNIT_TEST_SUITE_REGISTRATION(ValueTester);
@@ -59,4 +61,105 @@ ValueTester::testFilter()
 void
 ValueTester::tearDown()
 {}
+
+void
+ValueTester::testPushTypeMsgpackRoundTrip()
+{
+    dht::Value original {(const uint8_t*) "hello", 5};
+    original.id = 42;
+    original.priority = 3;
+    original.pushType = "audioCall";
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    original.msgpack_pack(pk);
+
+    msgpack::unpacked msg;
+    msgpack::unpack(msg, buffer.data(), buffer.size());
+    dht::Value restored(msg.get());
+
+    CPPUNIT_ASSERT_EQUAL(original.id, restored.id);
+    CPPUNIT_ASSERT_EQUAL(original.priority, restored.priority);
+    CPPUNIT_ASSERT_EQUAL(original.pushType, restored.pushType);
+}
+
+void
+ValueTester::testPushTypeAbsentAfterUnpack()
+{
+    dht::Value withPt {(const uint8_t*) "data", 4};
+    withPt.id = 1;
+    withPt.pushType = "videoCall";
+    withPt.priority = 2;
+
+    msgpack::sbuffer buf1;
+    msgpack::packer<msgpack::sbuffer> pk1(&buf1);
+    withPt.msgpack_pack(pk1);
+
+    msgpack::unpacked msg1;
+    msgpack::unpack(msg1, buf1.data(), buf1.size());
+
+    dht::Value reused;
+    reused.msgpack_unpack(msg1.get());
+    CPPUNIT_ASSERT_EQUAL(std::string("videoCall"), reused.pushType);
+    CPPUNIT_ASSERT_EQUAL(2u, reused.priority);
+
+    dht::Value plain {(const uint8_t*) "data", 4};
+    plain.id = 2;
+
+    msgpack::sbuffer buf2;
+    msgpack::packer<msgpack::sbuffer> pk2(&buf2);
+    plain.msgpack_pack(pk2);
+
+    msgpack::unpacked msg2;
+    msgpack::unpack(msg2, buf2.data(), buf2.size());
+
+    reused.msgpack_unpack(msg2.get());
+    CPPUNIT_ASSERT_EQUAL(std::string(), reused.pushType);
+    CPPUNIT_ASSERT_EQUAL(0u, reused.priority);
+}
+
+void
+ValueTester::testPushTypePreservedAfterEncrypt()
+{
+    auto key = dht::crypto::PrivateKey::generate();
+    const auto& pubkey = key.getPublicKey();
+
+    dht::Value original {(const uint8_t*) "secret", 6};
+    original.id = 99;
+    original.priority = 1;
+    original.pushType = "audioCall";
+
+    auto encrypted = original.encrypt(key, pubkey);
+
+    CPPUNIT_ASSERT_EQUAL(original.pushType, encrypted.pushType);
+    CPPUNIT_ASSERT_EQUAL(original.priority, encrypted.priority);
+    CPPUNIT_ASSERT_EQUAL(original.id, encrypted.id);
+    CPPUNIT_ASSERT(encrypted.isEncrypted());
+}
+
+void
+ValueTester::testPushTypeJsonRoundTrip()
+{
+#ifdef OPENDHT_JSONCPP
+    dht::Value original {(const uint8_t*) "hello", 5};
+    original.id = 42;
+    original.priority = 1;
+    original.pushType = "videoCall";
+
+    dht::Value restored(original.toJson());
+
+    CPPUNIT_ASSERT_EQUAL(original.id, restored.id);
+    CPPUNIT_ASSERT_EQUAL(original.priority, restored.priority);
+    CPPUNIT_ASSERT_EQUAL(original.pushType, restored.pushType);
+
+    // No pushType: the field must stay absent from the JSON and empty after parse.
+    dht::Value plain {(const uint8_t*) "data", 4};
+    plain.id = 7;
+    auto json = plain.toJson();
+    CPPUNIT_ASSERT(!json.isMember("pt"));
+    dht::Value plainRestored(json);
+    CPPUNIT_ASSERT_EQUAL(std::string(), plainRestored.pushType);
+#endif
+}
+
 } // namespace test

tests/test_value.h

@@ -13,6 +13,10 @@ class ValueTester : public CppUnit::TestFixture
     CPPUNIT_TEST_SUITE(ValueTester);
     CPPUNIT_TEST(testConstructors);
     CPPUNIT_TEST(testFilter);
+    CPPUNIT_TEST(testPushTypeMsgpackRoundTrip);
+    CPPUNIT_TEST(testPushTypeAbsentAfterUnpack);
+    CPPUNIT_TEST(testPushTypePreservedAfterEncrypt);
+    CPPUNIT_TEST(testPushTypeJsonRoundTrip);
     CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -32,6 +36,10 @@ public:
      * Test compare operators
      */
     void testFilter();
+    void testPushTypeMsgpackRoundTrip();
+    void testPushTypeAbsentAfterUnpack();
+    void testPushTypePreservedAfterEncrypt();
+    void testPushTypeJsonRoundTrip();
 };
 
 } // namespace test

tools/dhtchat.cpp

@@ -123,7 +123,7 @@ main(int argc, char** argv)
                     iss >> idstr;
                     std::getline(iss, line);
                     dht.putEncrypted(room,
-                                     InfoHash(idstr),
+                                     PkId(idstr),
                                      dht::ImMessage(IdDist()(tools::rd), std::move(line), now),
                                      [](bool ok) {
                                          // dht.cancelPut(room, id);

tools/dhtnode.cpp

@@ -481,7 +481,7 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
             auto value = std::make_shared<dht::Value>(dht::ValueType::USER_DATA.id,
                                                       std::vector<uint8_t> {v.begin(), v.end()});
             value->user_type = "text/plain";
-            node->putEncrypted(id, InfoHash(tostr), std::move(value), [start](bool ok) {
+            node->putEncrypted(id, PkId(tostr), std::move(value), [start](bool ok) {
                 auto end = std::chrono::high_resolution_clock::now();
                 std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took "
                           << print_duration(end - start) << ')' << std::endl;
@@ -649,7 +649,7 @@ main(int argc, char** argv)
     });
 
     // wait for shutdown
-    std::unique_lock<std::mutex> lk(m);
+    std::unique_lock lk(m);
     cv.wait(lk, [&]() { return done; });
 
     node->join();

tools/dhtscanner.cpp

@@ -126,7 +126,7 @@ main(int argc, char** argv)
 
         {
             std::mutex m;
-            std::unique_lock<std::mutex> lk(m);
+            std::unique_lock lk(m);
             cv.wait(lk, [&]() { return done.load() == 0; });
         }
 

tools/perftest.cpp

@@ -68,7 +68,7 @@ benchPingPong(unsigned netSize, unsigned n_parallel)
     unsigned max = PINGPONG_MAX * n_parallel;
 
     auto ping = [&](DhtRunner& node, InfoHash h) {
-        std::lock_guard<std::mutex> lk(m);
+        std::lock_guard lk(m);
         if (i < max) {
             i++;
             node.put(h, Value("hey"));
@@ -93,7 +93,7 @@ benchPingPong(unsigned netSize, unsigned n_parallel)
         ping(pong_node, locs[i].first);
 
     {
-        std::unique_lock<std::mutex> lk(m);
+        std::unique_lock lk(m);
         if (not cv.wait_for(lk, std::chrono::minutes(1), [&]() { return i == max; })) {
             throw std::runtime_error(std::string("Timeout: ") + std::to_string(i));
         }

tools/tools_common.h

@@ -421,7 +421,7 @@ struct ServiceRunner
 {
     bool wait()
     {
-        std::unique_lock<std::mutex> lock(m);
+        std::unique_lock lock(m);
         cv.wait(lock, [&] { return terminate.load(); });
         return !terminate;
     }

vcpkg-configuration.json

@@ -1,7 +1,7 @@
 {
   "default-registry": {
     "kind": "git",
-    "baseline": "66c0373dc7fca549e5803087b9487edfe3aca0a1",
+    "baseline": "f3e10653cc27d62a37a3763cd84b38bca07c6075",
     "repository": "https://github.com/microsoft/vcpkg"
   },
   "registries": [

vcpkg.json

@@ -1,6 +1,6 @@
 {
   "name": "opendht",
-  "version-string": "3.7.6",
+  "version-string": "4.3.0",
   "port-version": 1,
   "description": "OpenDHT: A lightweight C++17 Distributed Hash Table library.",
   "homepage": "https://opendht.net",