build: prepare 4.5.0 release candidate 1

Co-authored-by: Copilot <223556219+Copilot@users.nply.github.com>

.clang-format

@@ -0,0 +1,99 @@
+Language:        Cpp
+AccessModifierOffset: -4
+AlignAfterOpenBracket: Align
+AlignArrayOfStructures: Left
+AlignConsecutiveAssignments: false
+AlignConsecutiveDeclarations: false
+AlignConsecutiveMacros: true
+AlignEscapedNewlines: DontAlign
+AlignOperands:   true
+AlignTrailingComments: true
+AllowAllParametersOfDeclarationOnNextLine: true
+AllowShortBlocksOnASingleLine: false
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: Inline
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLambdasOnASingleLine: Inline
+AllowShortLoopsOnASingleLine: false
+AlwaysBreakAfterReturnType: TopLevelDefinitions
+AlwaysBreakBeforeMultilineStrings: false
+AlwaysBreakTemplateDeclarations: Yes
+BinPackArguments: false
+BinPackParameters: false
+BraceWrapping:
+  AfterClass:      true
+  AfterControlStatement: false
+  AfterEnum:       false
+  AfterFunction:   true
+  AfterNamespace:  false
+  AfterObjCDeclaration: false
+  AfterStruct:     true
+  AfterUnion:      false
+  BeforeCatch:     false
+  BeforeElse:      false
+  IndentBraces:    false
+  SplitEmptyFunction: false
+  SplitEmptyRecord: false
+  SplitEmptyNamespace: false
+BreakBeforeBinaryOperators: All
+BreakBeforeBraces: Custom
+BreakBeforeInheritanceComma: false
+BreakBeforeTernaryOperators: true
+BreakConstructorInitializersBeforeComma: false
+BreakConstructorInitializers: BeforeComma
+BreakAfterJavaFieldAnnotations: false
+BreakStringLiterals: true
+ColumnLimit:    120
+CommentPragmas:  '^ IWYU pragma:'
+CompactNamespaces: false
+ConstructorInitializerAllOnOneLineOrOnePerLine: false
+ConstructorInitializerIndentWidth: 4
+ContinuationIndentWidth: 4
+Cpp11BracedListStyle: true
+DerivePointerAlignment: false
+DisableFormat:   false
+ExperimentalAutoDetectBinPacking: false
+FixNamespaceComments: true
+ForEachMacros:
+  - forever # avoids { wrapped to next line
+  - foreach
+IncludeIsMainRegex: '(Test)?$'
+IndentCaseLabels: false
+IndentWidth:     4
+IndentWrappedFunctionNames: false
+JavaScriptQuotes: Leave
+JavaScriptWrapImports: true
+KeepEmptyLinesAtTheStartOfBlocks: false
+MacroBlockBegin: ""
+MacroBlockEnd:   ""
+MaxEmptyLinesToKeep: 1
+NamespaceIndentation: None
+ObjCBlockIndentWidth: 4
+ObjCSpaceAfterProperty: false
+ObjCSpaceBeforeProtocolList: true
+PenaltyBreakAssignment: 150
+PenaltyBreakBeforeFirstCallParameter: 300
+PenaltyBreakComment: 500
+PenaltyBreakFirstLessLess: 400
+PenaltyBreakString: 600
+PenaltyExcessCharacter: 50
+PenaltyReturnTypeOnItsOwnLine: 300
+PointerAlignment: Left
+ReflowComments:  true
+SortIncludes:    false
+SortUsingDeclarations: false
+SpaceAfterCStyleCast: true
+SpaceAfterTemplateKeyword: false
+SpaceBeforeAssignmentOperators: true
+SpaceBeforeCpp11BracedList: true
+SpaceBeforeParens: ControlStatements
+SpaceInEmptyParentheses: false
+SpacesBeforeTrailingComments: 1
+SpacesInAngles:  false
+SpacesInContainerLiterals: false
+SpacesInCStyleCastParentheses: false
+SpacesInParentheses: false
+SpacesInSquareBrackets: false
+Standard:        c++17
+TabWidth:        4
+UseTab:          Never

.clang-tidy

@@ -0,0 +1 @@
+Checks: '-*,clang-diagnostic-*,performance-*,bugprone-*,llvm-*,clang-analyzer-*,misc-*,-llvm-namespace-comment,-misc-unused-parameters,-misc-non-private-member-variables-in-classes,-llvm-header-guard,-llvm-include-order,-bugprone-suspicious-string-compare'

.devcontainer/devcontainer.json

@@ -0,0 +1,15 @@
+{
+	"name": "C++",
+	"build": {
+		"dockerfile": "../docker/DockerfileDepsLlvm",
+	},
+	"runArgs": [ "--cap-add=SYS_PTRACE", "--security-opt", "seccomp=unconfined"],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-vscode.cpptools"
+			]
+		}
+	},
+	"forwardPorts": [4222],
+}

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.vscode
+.DS_Store
+build
+build-*
+build_*
+install
+vcpkg_installed
+rust/target
+**/__pycache__
+python/dist
+python/*.egg-info

.github/FUNDING.yml

@@ -0,0 +1 @@
+custom: ['https://jami.net/donate/']

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "vcpkg"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/rust"
+    schedule:
+      interval: "weekly"

.github/workflows/ccpp.yml

@@ -0,0 +1,189 @@
+name: C/C++ CI
+
+env:
+  LLHTTP_VERSION: "v9.2.1"
+  RESTINIO_VERSION: "0.7.10"
+  EXPECTED_LITE_URL: "https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp"
+  UBUNTU_FULL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"
+  UBUNTU_MESON_DEPS: "ninja-build libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-dev python3-setuptools python3-pip libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"
+  UBUNTU_MINIMAL_DEPS: "libncurses5-dev libreadline-dev nettle-dev libfmt-dev libgnutls28-dev libcppunit-dev libmsgpack-cxx-dev libargon2-dev"
+  DEBIAN13_DEPS: "git libtool pkg-config wget cmake libncurses5-dev libreadline-dev nettle-dev libasio-dev libgnutls28-dev libuv1-dev python3-pip python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev libfmt-dev libmsgpack-cxx-dev libargon2-dev"
+
+on: [push, pull_request]
+
+jobs:
+  build-ubuntu-meson:
+    name: Ubuntu/GCC Meson build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Dependencies
+        run: |
+          echo "Installing Ubuntu meson dependencies:"
+          sudo apt update
+          sudo apt install -y $UBUNTU_MESON_DEPS
+
+      - name: Install Python dependencies
+        run: sudo pip3 install meson Cython
+
+      - name: Configure with Meson
+        run: meson setup build .
+
+      - name: Build with Ninja
+        run: cd build && ninja
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Test Rust bindings
+        env:
+          LIBRARY_PATH: ${{ github.workspace }}/build
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build
+          RUSTFLAGS: -L native=${{ github.workspace }}/build
+        run: |
+          cargo test --manifest-path rust/Cargo.toml --all-targets
+          cargo test --manifest-path rust/Cargo.toml --all-features --all-targets
+          cargo test --manifest-path rust/Cargo.toml --all-features --doc
+
+  build-ubuntu-minimal:
+    name: Ubuntu/GCC minimal build
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Minimal Dependencies
+        run: |
+          echo "Installing Ubuntu minimal dependencies:"
+          sudo apt-get update
+          sudo apt-get install -y $UBUNTU_MINIMAL_DEPS
+
+      - name: Configure project with CMake
+        run: |
+          mkdir build && cd build
+          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
+                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
+                   -DOPENDHT_C=Off -DBUILD_TESTING=On \
+                   -DOPENDHT_PEER_DISCOVERY=Off -DOPENDHT_PYTHON=Off \
+                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=Off -DOPENDHT_PROXY_CLIENT=Off
+
+      - name: Build
+        run: cd build && make
+
+      - name: Run Unit tests
+        run: ctest --output-on-failure --test-dir build
+
+  build-debian13:
+    name: Debian 13/GCC build
+    runs-on: ubuntu-latest
+
+    container:
+      image: debian:13
+      volumes:
+        - .:/workspace
+      options: --workdir /workspace
+      env:
+        DEBIAN_FRONTEND: noninteractive
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Dependencies
+        run: |
+          apt-get update
+          apt-get install -y $DEBIAN13_DEPS
+
+      - name: Build llhttp dependency
+        run: |
+          mkdir llhttp
+          wget "https://github.com/nodejs/llhttp/archive/refs/tags/release/${LLHTTP_VERSION}.tar.gz" -O llhttp.tar.gz
+          tar -xzf llhttp.tar.gz -C llhttp --strip-components=1
+          cd llhttp && cmake -DCMAKE_INSTALL_PREFIX=/usr . && make -j2 && make install
+          cd ../ && rm -rf llhttp*
+
+      - name: Install expected-lite header
+        run: |
+          mkdir -p /usr/local/include/nonstd
+          wget "${EXPECTED_LITE_URL}" -O /usr/local/include/nonstd/expected.hpp
+
+      - name: Build restinio dependency
+        run: |
+          mkdir restinio && cd restinio
+          wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2"
+          tar -xjf restinio-${RESTINIO_VERSION}.tar.bz2
+          cd restinio-${RESTINIO_VERSION}/dev
+          cmake -DCMAKE_INSTALL_PREFIX=/usr/local \
+                -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+                -DRESTINIO_WITH_SOBJECTIZER=Off \
+                -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+                -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+          make install
+          cd ../../ && rm -rf restinio*
+
+      - name: Configure project with CMake
+        run: |
+          mkdir build && cd build
+          cmake .. -DCMAKE_BUILD_TYPE=Debug \
+                   -DOPENDHT_C=On -DBUILD_TESTING=On \
+                   -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
+                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On \
+                   -DOPENDHT_PROXY_CLIENT=On
+
+      - name: Build
+        run: cd build && make
+
+  build-macos:
+    name: macOS/Clang build
+    runs-on: macos-15
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Homebrew Dependencies
+        run: brew install msgpack-cxx asio gnutls nettle readline fmt jsoncpp argon2 openssl cppunit
+
+      - name: Install expected-lite header
+        run: |
+          sudo mkdir -p /usr/local/include/nonstd
+          sudo wget "${EXPECTED_LITE_URL}" -O /usr/local/include/nonstd/expected.hpp
+
+      - name: Build restinio dependency
+        run: |
+          mkdir restinio && cd restinio
+          wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2"
+          tar -xjf restinio-${RESTINIO_VERSION}.tar.bz2
+          cd restinio-${RESTINIO_VERSION}/dev
+          cmake -DCMAKE_INSTALL_PREFIX=/usr/local \
+                -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+                -DRESTINIO_WITH_SOBJECTIZER=Off \
+                -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+                -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+          make -j2 && sudo make install
+          cd ../../ && rm -rf restinio*
+
+      - name: Configure project with CMake
+        run: |
+          mkdir build && cd build
+          # Set Homebrew OpenSSL paths
+          export PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"
+          export LDFLAGS="-L/usr/local/opt/openssl@3/lib"
+          export CPPFLAGS="-I/usr/local/opt/openssl@3/include"
+          export PKG_CONFIG_PATH="/usr/local/opt/openssl@3/lib/pkgconfig"
+          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
+                   -DOPENDHT_DOWNLOAD_DEPS=ON \
+                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
+                   -DOPENDHT_C=On -DBUILD_TESTING=On \
+                   -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
+                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On \
+                   -DOPENDHT_PROXY_CLIENT=On -DOPENDHT_PUSH_NOTIFICATIONS=On
+
+      - name: Build
+        run: cd build && make

.github/workflows/clang-analyzer.yml

@@ -0,0 +1,44 @@
+name: Clang Static Analysis
+on: [push, pull_request]
+
+jobs:
+  clang-analyzer:
+    name: Clang Static Analysis
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: deps
+        run: |
+          sudo apt update && \
+          sudo apt install libncurses5-dev libreadline-dev nettle-dev \
+          libgnutls28-dev libuv1-dev python3-dev python3-setuptools libcppunit-dev libjsoncpp-dev \
+          libfmt-dev libmsgpack-cxx-dev libargon2-dev libasio-dev \
+          llvm llvm-dev clang clang-tools && \
+          sudo apt remove gcc g++
+
+      - name: expected-lite
+        run: |
+          sudo mkdir /usr/include/nonstd
+          sudo wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+            -O /usr/include/nonstd/expected.hpp
+
+      - name: restinio
+        env:
+          RESTINIO_VERSION: "0.7.10"
+        run: |
+          mkdir restinio && cd restinio
+          wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2"
+          ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2"
+          cd "restinio-${RESTINIO_VERSION}/dev"
+          cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+          make -j2 && sudo make install
+          cd ../../ && rm -rf restinio*
+
+      - name: cmake
+        run: |
+          mkdir build && cd build && \
+          cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug -DOPENDHT_C=On -DOPENDHT_DOWNLOAD_DEPS=ON -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On -DOPENDHT_PROXY_CLIENT=On -DOPENDHT_PUSH_NOTIFICATIONS=On
+      - name: scan-build
+        run: cd build && scan-build --status-bugs make

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: 'ubuntu-latest'
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: c-cpp
+          build-mode: autobuild
+        - language: actions
+          build-mode: none
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/nodejs-package.yml

@@ -0,0 +1,206 @@
+name: Node.js Package
+
+on:
+  push:
+    branches: ['**']
+    paths:
+      - 'nodejs/**'
+      - '.github/workflows/nodejs-package.yml'
+      - 'src/**'
+      - 'include/**'
+      - 'cmake/**'
+      - 'CMakeLists.txt'
+      - 'vcpkg*.json'
+      - 'ports/**'
+      - 'LICENSE'
+  pull_request:
+    paths:
+      - 'nodejs/**'
+      - '.github/workflows/nodejs-package.yml'
+      - 'src/**'
+      - 'include/**'
+      - 'cmake/**'
+      - 'CMakeLists.txt'
+      - 'vcpkg*.json'
+      - 'ports/**'
+      - 'LICENSE'
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    container:
+      image: ${{ matrix.container }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: nodejs
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-26.04
+            target: linux-x64
+            container: ghcr.io/${{ github.repository }}/opendht-deps-noble:latest
+          - os: macos-15
+            target: darwin-arm64
+          - os: macos-15-intel
+            target: darwin-x64
+          - os: windows-2022
+            target: win32-x64
+    env:
+      VCPKG_DISABLE_METRICS: '1'
+      VCPKG_DEFAULT_TRIPLET: x64-windows-release
+      VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: nodejs/package-lock.json
+      - name: Install macOS dependencies
+        if: runner.os == 'macOS'
+        run: brew install cmake ninja pkg-config dylibbundler gnutls nettle argon2 msgpack-cxx fmt jsoncpp simdutf asio llhttp openssl
+      - name: Install restinio
+        if: runner.os == 'macOS'
+        env:
+          RESTINIO_VERSION: '0.7.10'
+        run: |
+          include="$RUNNER_TEMP/opendht-proxy/include"
+          mkdir -p "$include/nonstd"
+          curl -fsSL --retry 3 https://raw.githubusercontent.com/martinmoene/expected-lite/v0.10.0/include/nonstd/expected.hpp -o "$include/nonstd/expected.hpp"
+          curl -fsSL --retry 3 "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" -o "$RUNNER_TEMP/restinio.tar.bz2"
+          tar -xjf "$RUNNER_TEMP/restinio.tar.bz2" -C "$RUNNER_TEMP"
+          cp -R "$RUNNER_TEMP/restinio-${RESTINIO_VERSION}/dev/restinio" "$include/"
+          echo "CMAKE_PREFIX_PATH=$RUNNER_TEMP/opendht-proxy" >> "$GITHUB_ENV"
+      - name: Set up MSVC
+        if: runner.os == 'Windows'
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+      - name: Set up vcpkg
+        if: runner.os == 'Windows'
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+      - name: Cache Windows native dependencies
+        if: runner.os == 'Windows'
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: node-vcpkg-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            node-vcpkg-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+      - run: npm ci --no-audit --no-fund
+      - name: Build Unix addon
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          if [[ "$RUNNER_OS" == 'macOS' ]]; then
+            export MACOSX_DEPLOYMENT_TARGET=15.0
+            openssl_prefix=$(brew --prefix openssl)
+            export PKG_CONFIG_PATH="$openssl_prefix/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+          fi
+          npm run build -- --CDOPENDHT_DOWNLOAD_DEPS=OFF
+      - name: Build Windows addon
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          npm run build -- `
+            "--CDCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            "--CDVCPKG_MANIFEST_DIR=$env:GITHUB_WORKSPACE" `
+            "--CDVCPKG_INSTALLED_DIR=$env:VCPKG_INSTALLED_DIR" `
+            "--CDVCPKG_TARGET_TRIPLET=$env:VCPKG_DEFAULT_TRIPLET" `
+            --CDVCPKG_MANIFEST_NO_DEFAULT_FEATURES=ON `
+            --CDVCPKG_MANIFEST_FEATURES=proxy `
+            --CDCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreadedDLL `
+            --CDOPENDHT_DOWNLOAD_DEPS=OFF
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          "$env:VCPKG_INSTALLED_DIR/$env:VCPKG_DEFAULT_TRIPLET/bin" >> $env:GITHUB_PATH
+          "OPENDHT_LIBRARY_PATH=$env:VCPKG_INSTALLED_DIR/$env:VCPKG_DEFAULT_TRIPLET/bin" >> $env:GITHUB_ENV
+      - run: npm test
+      - run: npm run typecheck
+      - run: npm run bundle
+      - name: Include static simdutf licenses
+        if: runner.os == 'Linux'
+        run: |
+          mkdir -p prebuilds/linux-x64/licenses/simdutf
+          cp /usr/share/doc/simdutf/LICENSE-* prebuilds/linux-x64/licenses/simdutf/
+      - run: npm run test:package
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-node-prebuild-${{ matrix.target }}
+          path: nodejs/prebuilds/
+          if-no-files-found: error
+
+  package:
+    name: Assemble npm archive
+    needs: build
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: opendht-node-prebuild-*
+          path: nodejs/prebuilds
+          merge-multiple: true
+      - name: Set release version
+        if: github.event_name == 'push' && github.ref_type == 'tag'
+        working-directory: nodejs
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          release_version=$(npm version "${RELEASE_TAG#v}" --no-git-tag-version --ignore-scripts --allow-same-version)
+          if [[ "$release_version" != "$RELEASE_TAG" ]]; then
+            printf '::error::Release tag %s is not an exact npm semantic version (normalized to %s).\n' "$RELEASE_TAG" "$release_version" >&2
+            exit 1
+          fi
+      - name: Pack all platforms
+        working-directory: nodejs
+        run: |
+          npm ci --ignore-scripts
+          mkdir -p dist
+          npm pack --pack-destination dist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist/*.tgz
+          if-no-files-found: error
+
+  smoke:
+    name: Install on ${{ matrix.os }} / Node ${{ matrix.node }}
+    needs: package
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04, macos-15, macos-15-intel, windows-2022]
+        node: ['22', '24', '26']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist
+      - name: Test installed archive without a native build toolchain
+        working-directory: nodejs
+        run: npm run test:package -- dist

.github/workflows/python-wheels.yml

@@ -0,0 +1,84 @@
+name: Python Package
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build_wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      # Run locally with: pipx run cibuildwheel --platform linux python
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v4.3.5
+        with:
+          package-dir: python
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-wheels-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
+  
+  build_wheels_windows:
+    name: Build wheels on Windows
+    runs-on: windows-latest
+    env:
+      VCPKG_DISABLE_METRICS: "1"
+      VCPKG_DEFAULT_TRIPLET: x64-windows-release
+      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Build wheels
+        run: |
+          pip install cython delvewheel build
+          cmake -S . -B build `
+            -DCMAKE_BUILD_TYPE=Release `
+            -DVCPKG_TARGET_TRIPLET=${{ env.VCPKG_DEFAULT_TRIPLET }} `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
+            -DBUILD_TESTING=OFF `
+            -DOPENDHT_C=OFF `
+            -DOPENDHT_TOOLS=OFF `
+            -DOPENDHT_PYTHON=ON `
+            -DOPENDHT_DOCUMENTATION=OFF `
+            -DOPENDHT_PROXY_CLIENT=ON `
+            -DOPENDHT_PROXY_SERVER=ON
+          cd build
+          pipx run cibuildwheel python
+        shell: pwsh
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opendht-wheels-win_amd64
+          path: ./build/wheelhouse/*.whl

.github/workflows/release-package.yml

@@ -0,0 +1,686 @@
+name: Release actions
+
+on:
+  push:
+    tags:
+    - 'v*'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME_DEPS: ${{ github.repository }}/opendht-deps
+  IMAGE_NAME_DEPS_NOBLE: ${{ github.repository }}/opendht-deps-noble
+  IMAGE_NAME: ${{ github.repository }}/opendht
+  IMAGE_NAME_NOBLE: ${{ github.repository }}/opendht-noble
+  IMAGE_NAME_DEPS_LLVM: ${{ github.repository }}/opendht-deps-llvm
+  IMAGE_NAME_LLVM: ${{ github.repository }}/opendht-llvm
+  IMAGE_NAME_DHTNODE: ${{ github.repository }}/dhtnode
+  IMAGE_NAME_ALPINE: ${{ github.repository }}/opendht-alpine
+  IMAGE_NAME_ALPINE_DEPS: ${{ github.repository }}/opendht-deps-alpine
+
+jobs:
+  nodejs-package:
+    name: Build and verify Node.js package
+    uses: ./.github/workflows/nodejs-package.yml
+    permissions:
+      contents: read
+      packages: read
+
+  python-wheels:
+    name: Build Python wheels
+    uses: ./.github/workflows/python-wheels.yml
+    permissions:
+      contents: read
+
+  build-and-push-deps-image:
+    name: Dependency Docker image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDeps
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-deps-image-noble:
+    name: Dependency Docker image (Ubuntu 24.04)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_NOBLE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDepsNoble
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image:
+    name: OpenDHT Docker image
+    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-noble:
+    name: OpenDHT Docker image (Ubuntu 24.04)
+    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image-noble
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_NOBLE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileNoble
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-deps-image-llvm:
+    name: Dependency Docker image (LLVM)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_LLVM }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDepsLlvm
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-llvm:
+    name: OpenDHT Docker image (LLVM)
+    runs-on: ubuntu-latest
+    needs: build-and-push-deps-image-llvm
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LLVM }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileLlvm
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-dhtnode:
+    name: dhtnode Docker image
+    runs-on: ubuntu-latest
+    needs: build-and-push-image
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DHTNODE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDhtnode
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-alpine-deps:
+    name: Alpine Deps Docker image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE_DEPS }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileDepsAlpine
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-image-alpine:
+    name: Alpine Docker image
+    runs-on: ubuntu-latest
+    needs: build-and-push-image-alpine-deps
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/DockerfileAlpine
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-windows-msi:
+    name: Build Windows MSI Installer
+    runs-on: windows-latest
+    env:
+      VCPKG_DISABLE_METRICS: "1"
+      VCPKG_DEFAULT_TRIPLET: x64-windows
+      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
+      - name: Set up MSVC developer environment
+        uses: microsoft/setup-msbuild@v3
+      
+      - name: Install WIX using .net tools
+        run: |
+          dotnet tool install --global wix --version 6.0.1
+          wix extension add --global WixToolset.UI.wixext/6.0.1
+        shell: pwsh
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Configure CMake for MSI
+        shell: pwsh
+        run: |
+          mkdir build -ErrorAction SilentlyContinue
+          cmake -B build `
+            -S . `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_TARGET_TRIPLET=x64-windows `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
+            -DVCPKG_MANIFEST_FEATURES=test `
+            -DCMAKE_BUILD_TYPE=Release `
+            -DOPENDHT_C=On `
+            -DOPENDHT_TOOLS=On `
+            -DOPENDHT_PYTHON=Off `
+            -DOPENDHT_DOCUMENTATION=OFF `
+            -DOPENDHT_PEER_DISCOVERY=On `
+            -DOPENDHT_PROXY_SERVER=On `
+            -DOPENDHT_PROXY_CLIENT=On `
+            -DOPENDHT_HTTP=On `
+            -DBUILD_TESTING=Off `
+            -DOPENDHT_CPACK=On `
+            -A x64
+
+      - name: Build with MSVC
+        shell: pwsh
+        run: |
+          cmake --build build --config Release --parallel $([System.Environment]::ProcessorCount)
+          # Copy vcpkg installed libraries to the build directory
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\x64-windows\lib\*.lib" -Destination "build" -Force
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\x64-windows\bin\*.dll" -Destination "build" -Force
+
+      - name: Package MSI with CPack
+        shell: pwsh
+        id: cpack_msi
+        run: |
+          cd build
+          cpack -C Release -G WIX
+          $msiFile = Get-ChildItem -Path . -Recurse -Filter *.msi | Select-Object -First 1
+          if ($msiFile) {
+            $msiOutputPath = "opendht-installer.msi" # Standardized artifact name
+            Copy-Item $msiFile.FullName -Destination $msiOutputPath
+            echo "msi_path=$msiOutputPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+            Write-Host "MSI created at build/$msiOutputPath"
+          } else {
+            Write-Error "MSI file not found after cpack execution!"
+            exit 1
+          }
+
+      - name: Upload MSI Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: opendht-windows-msi
+          path: build/${{ steps.cpack_msi.outputs.msi_path }} # Path to the MSI in the build directory
+          retention-days: 7
+
+  build-windows-dhtnode:
+    name: Build Windows dhtnode
+    runs-on: windows-latest
+    env:
+      VCPKG_DISABLE_METRICS: "1"
+      VCPKG_DEFAULT_TRIPLET: x64-windows-static-release
+      VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
+      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
+      - name: Set up MSVC developer environment
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Configure CMake for Static Build
+        shell: pwsh
+        run: |
+          mkdir build_static -ErrorAction SilentlyContinue
+          cmake -B build_static `
+            -S . `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_TARGET_TRIPLET=x64-windows-static-release `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
+            -DVCPKG_MANIFEST_FEATURES=test `
+            -DCMAKE_BUILD_TYPE=Release `
+            -DBUILD_SHARED_LIBS=OFF `
+            -DOPENDHT_PROXY_CLIENT=ON `
+            -DOPENDHT_PROXY_SERVER=ON `
+            -DOPENDHT_C=ON `
+            -DOPENDHT_TOOLS=ON `
+            -DOPENDHT_DOCUMENTATION=OFF `
+            -DOPENDHT_PYTHON=OFF `
+            -DOPENDHT_PEER_DISCOVERY=ON `
+            -DOPENDHT_HTTP=ON `
+            -A x64
+
+      - name: Build Static dhtnode
+        shell: pwsh
+        run: |
+          cmake --build build_static --config Release --parallel $([System.Environment]::ProcessorCount)
+
+      - name: Upload Static dhtnode Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: opendht-windows-dhtnode
+          path: |
+            build_static/**/*dhtnode.exe
+          retention-days: 7
+
+  create-github-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build-windows-msi, build-windows-dhtnode, nodejs-package]
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Download Windows MSI artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: opendht-windows-msi
+          path: downloaded_artifacts/windows_msi
+
+      - name: Download Static dhtnode artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: opendht-windows-dhtnode
+          path: downloaded_artifacts/static_dhtnode
+
+      - name: Download npm archive
+        uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: downloaded_artifacts/nodejs
+
+      - name: Create Release
+        id: create_release
+        uses: softprops/action-gh-release@v3
+        with:
+          draft: true
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          files: |
+            downloaded_artifacts/windows_msi/*.msi
+            downloaded_artifacts/static_dhtnode/**/*dhtnode.exe
+            downloaded_artifacts/nodejs/*.tgz
+
+  publish-npm:
+    name: Publish opendht to npm
+    needs: create-github-release
+    runs-on: ubuntu-26.04
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
+          package-manager-cache: false
+      - uses: actions/download-artifact@v8
+        with:
+          name: opendht-node-npm
+          path: nodejs/dist
+      - name: Publish verified archive
+        working-directory: nodejs
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          dist_tag=latest
+          if [[ "${RELEASE_TAG#v}" == *-* ]]; then
+            dist_tag=next
+          fi
+          npm publish ./dist/*.tgz --access public --provenance --tag "$dist_tag"
+
+  publish-pypi:
+    name: Publish opendht to PyPI
+    needs: [create-github-release, python-wheels]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: opendht-wheels-*
+          path: dist
+          merge-multiple: true
+      - name: Publish wheels
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-crate:
+    name: Publish opendht to crates.io
+    needs: create-github-release
+    runs-on: ubuntu-latest
+    environment:
+      name: crates-io
+      url: https://crates.io/crates/opendht
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-edit
+      - name: Set crate version from release tag
+        working-directory: rust
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: cargo set-version "${RELEASE_TAG#v}"
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+      - name: Publish crate
+        working-directory: rust
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish --allow-dirty

.github/workflows/windows-build.yml

@@ -0,0 +1,369 @@
+name: Windows Build
+permissions:
+  contents: read
+
+on: 
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+env:
+  VCPKG_DISABLE_METRICS: "1"
+  VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
+  VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite
+
+jobs:
+  prepare-dependencies:
+    name: Prepare Windows Dependencies
+    runs-on: windows-latest
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows
+    strategy:
+      matrix:
+        arch: [x64]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Set up vcpkg and install dependencies
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+          runVcpkgInstall: true
+          runVcpkgFormatString: >-
+            [`install`, `--clean-after-build`, `--x-feature=test`,
+             `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`,
+             `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`]
+
+  prepare-static-dependencies:
+    name: Prepare Windows Static Dependencies
+    runs-on: windows-latest
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows-static-release
+    strategy:
+      matrix:
+        arch: [x64]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Cache vcpkg binary packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Set up vcpkg and install dependencies
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+          runVcpkgInstall: true
+          runVcpkgFormatString: >-
+            [`install`, `--clean-after-build`, `--x-feature=test`,
+             `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`,
+             `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`]
+
+  build-windows:
+    name: Windows MSVC Build
+    runs-on: windows-latest
+    needs: prepare-dependencies
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows
+    
+    strategy:
+      matrix:
+        build_type: [Debug, Release]
+        arch: [x64]
+        cxx_standard: [17, 20, 23]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Restore vcpkg binary packages
+        uses: actions/cache/restore@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+
+      - name: Configure CMake
+        shell: pwsh
+        run: |
+          mkdir build -ErrorAction SilentlyContinue
+          cmake -B build `
+            -S . `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
+            -DVCPKG_MANIFEST_FEATURES=test `
+            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
+            -DBUILD_TESTING=ON `
+            -DOPENDHT_PROXY_CLIENT=ON `
+            -DOPENDHT_PROXY_SERVER=ON `
+            -DOPENDHT_C=ON `
+            -DOPENDHT_TOOLS=ON `
+            -DOPENDHT_PYTHON=OFF `
+            -DOPENDHT_DOCUMENTATION=OFF `
+            -DOPENDHT_PEER_DISCOVERY=ON `
+            -DOPENDHT_HTTP=ON `
+            -A ${{ matrix.arch }}
+
+      - name: Build
+        run: |
+          cmake --build build --config ${{ matrix.build_type }} --parallel 4
+          # Copy vcpkg installed libraries to the build directory
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\${{ matrix.arch }}-windows\lib\*.lib" -Destination "build" -Force
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\${{ matrix.arch }}-windows\bin\*.dll" -Destination "build" -Force
+
+      - name: Test
+        if: matrix.build_type == 'Release'
+        run: |
+          cd build
+          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4
+
+      - name: Upload build artifacts
+        if: matrix.build_type == 'Release'
+        uses: actions/upload-artifact@v7
+        with:
+          name: opendht-windows-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
+          path: |
+            build/**/*.exe
+            build/**/*.dll
+            build/**/*.lib
+          retention-days: 7
+
+  build-windows-static:
+    name: Windows Static MSVC Build
+    runs-on: windows-latest
+    needs: prepare-static-dependencies
+    env:
+      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows-static-release
+    strategy:
+      matrix:
+        build_type: [Release]
+        arch: [x64]
+        cxx_standard: [17, 20, 23]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up vcpkg
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgJsonGlob: vcpkg.json
+          vcpkgConfigurationJsonGlob: vcpkg-configuration.json
+
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
+
+      - name: Restore vcpkg binary packages
+        uses: actions/cache/restore@v6
+        with:
+          path: ${{ github.workspace }}/vcpkg-binary-cache
+          key: ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', 'ports/**') }}-
+            ${{ runner.os }}-vcpkg-binary-${{ env.VCPKG_DEFAULT_TRIPLET }}-
+      
+      - name: Configure CMake for Static Build
+        shell: pwsh
+        run: |
+          mkdir build -ErrorAction SilentlyContinue
+          cmake -B build `
+            -S . `
+            "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows-static-release `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
+            -DVCPKG_MANIFEST_FEATURES=test `
+            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
+            -DBUILD_SHARED_LIBS=OFF `
+            -DBUILD_TESTING=ON `
+            -DOPENDHT_PROXY_CLIENT=ON `
+            -DOPENDHT_PROXY_SERVER=ON `
+            -DOPENDHT_C=ON `
+            -DOPENDHT_TOOLS=ON `
+            -DOPENDHT_PYTHON=OFF `
+            -DOPENDHT_DOCUMENTATION=OFF `
+            -DOPENDHT_PEER_DISCOVERY=ON `
+            -DOPENDHT_HTTP=ON `
+            -A ${{ matrix.arch }}
+
+      - name: Build Static
+        shell: pwsh
+        run: |
+          cmake --build build --config ${{ matrix.build_type }} --parallel 4
+
+      - name: Test Static Build
+        shell: pwsh
+        run: |
+          cd build
+          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4
+
+      - name: Upload static build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: opendht-windows-static-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
+          path: |
+            build/**/*.exe
+            build/**/*.lib
+          retention-days: 7
+
+  build-windows-mingw:
+    name: Windows MinGW Build
+    runs-on: windows-latest
+    
+    strategy:
+      matrix:
+        build_type: [Release]
+        #build_type: [Debug, Release]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup MinGW
+        uses: msys2/setup-msys2@v2
+        with:
+          msystem: MINGW64
+          update: true
+          install: >-
+            mingw-w64-x86_64-gcc
+            mingw-w64-x86_64-cmake
+            mingw-w64-x86_64-make
+            mingw-w64-x86_64-ninja
+            mingw-w64-x86_64-pkg-config
+            mingw-w64-x86_64-cppunit
+            mingw-w64-x86_64-readline
+            mingw-w64-x86_64-ncurses
+            mingw-w64-x86_64-gnutls
+            mingw-w64-x86_64-nettle
+            mingw-w64-x86_64-jsoncpp
+            mingw-w64-x86_64-fmt
+            mingw-w64-x86_64-asio
+            mingw-w64-x86_64-argon2
+            mingw-w64-x86_64-openssl
+            mingw-w64-clang-x86_64-msgpack-cxx
+
+      - name: Prepare dependencies from source (expected-lite, llhttp, restinio)
+        shell: msys2 {0}
+        env:
+          LLHTTP_VERSION: "v9.2.1"
+          RESTINIO_VERSION: "0.7.10"
+          EXPECTED_LITE_URL: "https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp"
+        run: |
+          MSYS2_SYSROOT=$(cygpath -u "$MSYSTEM_PREFIX")
+
+          # Install expected-lite header
+          mkdir -p ${MSYS2_SYSROOT}/include/nonstd
+          curl -L "${EXPECTED_LITE_URL}" -o ${MSYS2_SYSROOT}/include/nonstd/expected.hpp
+
+          # Build and install llhttp
+          mkdir llhttp
+          curl -L "https://github.com/nodejs/llhttp/archive/refs/tags/release/${LLHTTP_VERSION}.tar.gz" -o llhttp.tar.gz
+          tar -xzf llhttp.tar.gz -C llhttp --strip-components=1
+          cd llhttp
+          cmake -G "MinGW Makefiles" \
+                -DCMAKE_INSTALL_PREFIX=${MSYS2_SYSROOT} \
+                -DCMAKE_BUILD_TYPE=Release .
+          cmake --build . --parallel 2
+          cmake --install .
+          cd ..
+          rm -rf llhttp*
+          
+          # Build and install restinio
+          mkdir restinio && cd restinio
+          curl -L "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" -o restinio.tar.bz2
+          tar -xjf restinio.tar.bz2
+          cd restinio-${RESTINIO_VERSION}/dev
+          cmake -G "MinGW Makefiles" \
+                -DCMAKE_INSTALL_PREFIX=${MSYS2_SYSROOT} \
+                -DCMAKE_BUILD_TYPE=Release \
+                -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+                -DRESTINIO_WITH_SOBJECTIZER=Off \
+                -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+                -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+          cmake --install .
+          cd ../../..
+          rm -rf restinio*
+
+          # Copy msgpack-cxx headers
+          mkdir -p ${MSYS2_SYSROOT}/include/msgpack
+          cp -r /clang64/include/msgpack/* ${MSYS2_SYSROOT}/include/msgpack/
+          cp /clang64/include/msgpack.hpp ${MSYS2_SYSROOT}/include/msgpack.hpp
+
+      - name: Build with MinGW
+        shell: msys2 {0}
+        run: |
+          mkdir build_mingw
+          cd build_mingw
+          cmake .. \
+            -G "MinGW Makefiles" \
+            -DHAVE_MSGPACKCXX=ON \
+            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} \
+            -DBUILD_TESTING=ON \
+            -DOPENDHT_PROXY_CLIENT=ON \
+            -DOPENDHT_PROXY_SERVER=ON \
+            -DOPENDHT_C=ON \
+            -DOPENDHT_TOOLS=ON \
+            -DOPENDHT_PYTHON=OFF \
+            -DOPENDHT_DOCUMENTATION=OFF \
+            -DOPENDHT_PEER_DISCOVERY=ON \
+            -DOPENDHT_HTTP=ON
+          cmake --build . --parallel 4
+
+      #- name: Test MinGW Build
+      #  shell: msys2 {0}
+      #  run: |
+      #    cd build_mingw
+      #    ctest --output-on-failure --parallel 4
+
+      - name: Upload MinGW artifacts
+        if: matrix.build_type == 'Release'
+        uses: actions/upload-artifact@v7
+        with:
+          name: opendht-windows-mingw-${{ matrix.build_type }}
+          path: |
+            build_mingw/**/*.exe
+            build_mingw/**/*.dll
+            build_mingw/**/*.a
+          retention-days: 7

.gitignore

@@ -19,25 +19,53 @@
 *.exe
 *.out
 *.app
+**/dhtnode
+**/dhtchat
+**/dhtscanner
 
-# Autotools
-/ac
-Makefile
-Makefile.in
-/aclocal.m4
-/autom4te.cache/
-/config.*
-/configure
-/depcomp
-/install-sh
-/libtool
-/ltmain.sh
-/m4/
-/missing
-/stamp-h?
-.deps/
-.dirstamp
-.libs/
-*.l[ao]
-*~
+# CMake
+CMakeCache.txt
+CMakeFiles/
+cmake_install.cmake
+*ConfigVersion.cmake
 *.pc
+
+# VSCode
+.vscode/*
+
+# Visual Studio
+.vs/
+CMakeSettings.json
+
+# Eclipse CDT
+.cproject
+.project
+language.settings.xml
+
+# Python
+*.pyc
+*.stamp
+python/opendht.cpp
+python/setup.py
+python/dist/
+wheelhouse/
+*.egg-info/
+
+# Doxygen
+doc/Doxyfile
+
+# git backup files
+*.orig
+
+# vim swap files
+*.swp
+*.swo
+
+# build dir
+build
+build_dev
+.DS_Store
+build-*/
+install/
+vcpkg_installed/
+

.travis.yml

@@ -1,44 +0,0 @@
-sudo: false
-
-services:
-  - docker
-
-language: cpp
-
-compiler:
-  - gcc
-  - clang
-
-addons:
-  apt:
-    sources:
-    - ubuntu-toolchain-r-test
-    packages:
-    - gcc-4.9
-    - g++-4.9
-    - libgnutls28-dev
-    - cmake
-
-before_install:
-  - if [ $TRAVIS_OS_NAME == linux ] && [ $CXX == g++ ]; then export CXX=/usr/bin/g++-4.9 && export CC=/usr/bin/gcc-4.9; fi
-  - if [ $TRAVIS_OS_NAME == linux ]; then git clone https://github.com/msgpack/msgpack-c.git; fi
-  - if [ $TRAVIS_OS_NAME == linux ]; then cd msgpack-c && git checkout cpp-1.2.0 && mkdir build && mkdir -p $HOME/usr && cd build; fi
-  - if [ $TRAVIS_OS_NAME == linux ]; then cmake -DCMAKE_INSTALL_PREFIX=$HOME/usr -DMSGPACK_CXX11=ON -DMSGPACK_BUILD_EXAMPLES=OFF .. && make -j && make install && cd ../.. && pwd; fi
-  - if [ $TRAVIS_OS_NAME == osx ]; then brew update && brew install llvm36 && brew install msgpack && brew install gnutls && brew link --force llvm36; fi
-
-before_script:
-  - if [ $TRAVIS_OS_NAME == linux ]; then travis_retry ./autogen.sh && ./configure --prefix=$HOME/usr; fi
-  - if [ $TRAVIS_OS_NAME == osx ]; then travis_retry ./autogen.sh && ./configure; fi
-
-script:
-  - make -j
-
-notifications:
-  email:
-      - adrien.beraud@savoirfairelinux.com
-
-env:
-  - LANG="en_US.UTF-8"
-
-os:
-  - osx

.vscode/launch.json

@@ -0,0 +1,54 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "dhtnode",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/build/tools/dhtnode",
+            "args": ["-v", "-p", "4222"],
+            "cwd": "${workspaceFolder}/build",
+            "environment": [],
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ],
+            "preLaunchTask": "build",
+            "linux": {
+                "MIMode": "gdb",
+                "externalConsole": false,
+              },
+              "osx": {
+                "MIMode": "lldb",
+                "externalConsole": true,
+              },
+        },
+        {
+            "name": "tests",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/build/opendht_unit_tests",
+            "cwd": "${workspaceFolder}/build",
+            "environment": [],
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ],
+            "preLaunchTask": "build",
+            "linux": {
+                "MIMode": "gdb",
+                "externalConsole": false,
+            },
+            "osx": {
+                "MIMode": "lldb",
+                "externalConsole": true,
+            },
+        }
+    ]
+}

.vscode/settings.json

@@ -0,0 +1,10 @@
+{
+    "C_Cpp.default.compileCommands": "${workspaceFolder}/build/compile_commands.json",
+    "C_Cpp.default.cppStandard": "c++17",
+    "C_Cpp.default.cStandard": "c11",
+    "C_Cpp.autoAddFileAssociations": false,
+    "cmake.configureOnOpen": false,
+    "cmake.configureOnEdit": false,
+    "editor.formatOnSave": true,
+    "files.eol": "\n",
+}

.vscode/tasks.json

@@ -0,0 +1,46 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "build",
+            "type": "shell",
+            "options": {
+                "cwd": "${workspaceRoot}/build"
+            },
+            "command": "make",
+            "args": ["-j4"],
+            "dependsOn": "cmake"
+        },
+        {
+            "label": "cmake",
+            "type": "shell",
+            "options": {
+                "cwd": "${workspaceRoot}/build"
+            },
+            "command": "cmake",
+            "args": [
+                "${workspaceRoot}",
+                "-DCMAKE_EXPORT_COMPILE_COMMANDS=On",
+                "-DCMAKE_BUILD_TYPE=Debug",
+                "-DBUILD_TESTING=On",
+                "-DOPENDHT_SANITIZE=On",
+                "-DOPENDHT_PROXY_CLIENT=On",
+                "-DOPENDHT_PROXY_SERVER=On",
+                "-DOPENDHT_C=On"
+            ],
+            "dependsOn": "builddir"
+        },
+        {
+            "label": "builddir",
+            "type": "shell",
+            "options": {
+                "cwd": "${workspaceRoot}"
+            },
+            "command": "mkdir",
+            "args": [
+                "-p",
+                "${workspaceRoot}/build"
+            ]
+        },
+    ]
+}

AGENTS.md

@@ -0,0 +1,74 @@
+# OpenDHT – Agent Instructions
+
+## Build
+
+### Primary: CMake (C++17)
+```sh
+mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON -GNinja
+ninja
+```
+
+### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
+### Alternative: Meson (C++20)
+```sh
+meson setup build . && cd build && ninja
+```
+
+### Run tests
+```sh
+# Full suite
+ctest --output-on-failure --test-dir build
+
+# Single test executable
+./build/test_testName
+```
+
+## dhtnode
+
+The `dhtnode` CLI tool is a simple DHT node implementation using `DhtRunner`.
+
+---
+
+## Commit
+
+After implementing a feature or fixing a bug, commit your changes in clean, atomic commits with descriptive messages with format:
+`topic: short description`
+
+If any test are added or modified, commit them separately before the fix (if any).
+
+---
+
+## Architecture
+
+OpenDHT is a Kademlia-based DHT library. The implementation is layered:
+
+```
+DhtRunner          (public API — thread-safe, manages lifecycle & I/O threads)
+  └── SecureDht    (GnuTLS crypto: signing, encryption, identity)
+        └── Dht    (core DHT logic: routing, storage, find/get/put operations)
+              └── NetworkEngine   (raw UDP sockets, message parsing, IPv4/IPv6)
+```
+
+- **`DhtRunner`** (`include/opendht/dhtrunner.h`, `src/dhtrunner.cpp`) — entry point for all users of the library. Wraps everything in a thread-pool and exposes async callbacks as well as blocking calls.
+- **`Dht`** (`include/opendht/dht.h`, `src/dht.cpp`) — Kademlia protocol: routing table, k-buckets, value replication, expiry.
+- **`SecureDht`** (`include/opendht/securedht.h`, `src/securedht.cpp`) — transparent encryption/signing layer on top of `Dht`. Identity is a GnuTLS certificate.
+- **`NetworkEngine`** (`include/opendht/network_engine.h`, `src/network_engine.cpp`) — UDP socket layer, serializes/deserializes msgpack messages.
+- **`RoutingTable`** (`include/opendht/routing_table.h`, `src/routing_table.cpp`) — Kademlia routing table with bucket splitting.
+- **`Value`** (`include/opendht/value.h`) — the storable unit: binary blob, optional signature, optional encryption; typed via `ValueType`.
+- **`InfoHash`** (`include/opendht/infohash.h`) — 20-byte SHA-1 identifier; alias `Hash<HASH_LEN>`.
+
+Optional components (`DhtProxyServer`, `DhtProxyClient`, `PeerDiscovery`) are compiled in only when the corresponding CMake options are enabled.
+
+---

BUILD.md

@@ -0,0 +1,199 @@
+# Build the library
+
+The build is currently tested on GNU/Linux, macOS, and Windows.
+
+## Unix-like systems (Linux, macOS, MSYS2/MinGW, etc.)
+
+## Install dependencies
+
+### Debian 13
+
+```sh
+# Install dependencies
+sudo apt install pkg-config libncurses5-dev libreadline-dev nettle-dev libgnutls28-dev libargon2-dev libmsgpack-dev libssl-dev libfmt-dev libjsoncpp-dev libhttp-parser-dev libasio-dev libmsgpack-cxx-dev
+
+# Install Python binding dependencies
+sudo apt-get install cython3 python3-dev python3-setuptools python3-build
+```
+
+Optionally, install RESTinio to enable the OpenDHT proxy client and server:
+```sh
+mkdir /usr/include/nonstd
+wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp
+
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
+cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+make && make install
+```
+
+To run openDHT on a different computer from the build computer, the following runtime dependencies are required:
+```sh
+sudo apt install libargon2-1 libjsoncpp26
+```
+
+### Ubuntu 24.04 and Debian 12
+
+```sh
+# Install dependencies
+sudo apt install pkg-config libncurses5-dev libreadline-dev nettle-dev libgnutls28-dev libargon2-0-dev libmsgpack-dev libssl-dev libfmt-dev libjsoncpp-dev libhttp-parser-dev libasio-dev
+
+# Install Python binding dependencies
+sudo apt-get install cython3 python3-dev python3-setuptools python3-build
+```
+
+Optionally, install RESTinio to enable the OpenDHT proxy client and server:
+```sh
+mkdir /usr/include/nonstd
+wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp
+
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
+cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
+make && make install
+```
+
+### Fedora
+
+```sh
+# Install GnuTLS, Readline and msgpack-c
+sudo dnf install readline-devel gnutls-devel msgpack-devel asio-devel libargon2-devel fmt-devel
+# Install python binding dependencies
+sudo dnf install python3-Cython python3-devel redhat-rpm-config
+```
+
+### macOS
+
+```sh
+brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt llhttp
+```
+
+## Build
+
+Using CMake:
+
+```sh
+# Clone the repository
+git clone https://github.com/savoirfairelinux/opendht.git
+
+# Build and install
+cd opendht
+mkdir build && cd build
+cmake ..
+make -j$(nproc)
+sudo make install
+```
+
+#### Example Configurations
+
+Minimal build (libraries only):
+```sh
+cmake -DOPENDHT_TOOLS=OFF ..
+```
+
+Full-featured build with proxy support, Python, and C bindings:
+```sh
+cmake -DOPENDHT_PYTHON=ON \
+      -DOPENDHT_C=ON \
+      -DOPENDHT_PROXY_SERVER=ON \
+      -DOPENDHT_PROXY_SERVER_IDENTITY=ON \
+      -DOPENDHT_PROXY_CLIENT=ON \
+      -DOPENDHT_PUSH_NOTIFICATIONS=ON ..
+```
+
+#### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
+## Node.js Bindings
+
+Node-API bindings wrap the C++ API directly with `node-addon-api`, including
+RSA/EC keys, certificates, identities, and signed/encrypted DHT operations.
+With the native dependencies above, Node.js 22.9+, and CMake installed, run
+`npm ci`, `npm run build`, `npm test`, and `npm run typecheck` from `nodejs/`.
+This creates a separate native build without changing the existing build tree.
+See [the Node.js binding guide](nodejs/README.md) for the API and current limits.
+`npm run package` creates a platform prebuild with bundled native dependencies;
+`npm run test:package` verifies installation outside the source tree. The Node.js
+package CI builds Linux x64, macOS ARM64/x64, and Windows x64 prebuilds and checks
+the assembled npm archive on Node 22, 24, and 26 before release attachment.
+
+## C and Rust Bindings
+
+Enable `OPENDHT_C=ON` to build the C ABI. With `BUILD_TESTING=ON`, CTest runs
+`test_c`; Meson registers the same test as `CBindings` when `c` and `tests` are
+enabled. Rust regression and callback-lifetime tests run with Cargo; see
+[the Rust build guide](rust/BUILD.md) for build and library-path settings.
+
+`dht_infohash` and `dht_pkid` have `uint32_t` alignment, matching the native hash
+types, while retaining their 20-byte and 32-byte sizes. Rebuild consumers against
+the updated header; foreign-language declarations must match this alignment.
+
+C handles returned by constructors, imports, and reference functions are owned
+and require their matching delete/unref function. Data views, string getters,
+query fields, and callback arguments are borrowed: copy them or take a reference
+before returning from the callback. `dht_sockaddr_array_delete` releases both the
+public-address array and its elements.
+
+Operation completion callbacks run once, including failure when pending work is
+discarded on runner teardown. Listener release callbacks run after the native
+registration is destroyed; deleting an operation token alone does not cancel its
+listener. Cancel first, then delete the consumed token. Startup-context release
+callbacks run after all native status/store callback captures are released, also
+on startup failure. Certificate-store callbacks must invoke the supplied emitter
+synchronously with borrowed certificates. Query-result views are callback-scoped.
+
+`dht_runner_loop` drives non-threaded nodes. `dht_runner_join` waits for callbacks
+and allows restart; never call it from a DHT callback. For persisted shutdown,
+wait for the shutdown callback before joining. Push tokens can be polled without
+blocking and must be deleted separately. `dht_push_token_poll` returns `EAGAIN`
+while pending, 0 with the native outcome when ready, and an error code otherwise;
+consume a successful result only once. Native push outcomes are 0 through 3 for
+refresh/value events, 128 through 131 for ignored events, and 132 for errors.
+
+## Windows/MSVC
+
+Building on Windows with MSVC is supported with VCPKG and CMake.
+
+### Build with VCPKG in manifest mode
+
+1. Install [VCPKG](https://github.com/microsoft/vcpkg) 2026.10.16 and required dependencies:
+```ps1
+git clone https://github.com/microsoft/vcpkg.git
+cd vcpkg
+git checkout 9eec002df1cd109f8f104cd966a763daf9751489
+.\bootstrap-vcpkg.bat
+```
+
+2. Use CMake preset for vcpkg:
+```ps1
+cd opendht
+cmake --preset=vcpkg_manifest .
+cmake --build .
+```
+
+### CI
+
+Windows CI uses [lukka/run-vcpkg](https://github.com/lukka/run-vcpkg) to acquire
+and bootstrap the revision pinned by `default-registry.baseline` in
+`vcpkg-configuration.json`. CMake uses the action's `VCPKG_ROOT` and installs
+manifest dependencies on every run. Dependency-preparation jobs warm the binary
+cache before the Windows build matrix starts.
+
+Only ABI-keyed binary package archives are cached, not installed trees. The
+supported [files provider](https://learn.microsoft.com/en-us/vcpkg/reference/binarycaching#files-provider)
+is persisted with `actions/cache`; it does not use the removed `x-gha` provider
+or require package-feed credentials. Cache keys include the target triplet,
+manifests, overlay ports, run ID, and attempt, with restore prefixes for reuse.
+Each run can save newly built archives without overwriting an immutable cache;
+vcpkg validates package ABIs before reuse.

CMakePresets.json

@@ -0,0 +1,250 @@
+{
+  "version": 2,
+  "configurePresets": [
+    {
+      "name": "default",
+      "binaryDir": "${sourceDir}/build",
+      "hidden": true
+    },
+    {
+      "name": "unix-make",
+      "description": "Unix Makefiles",
+      "generator": "Unix Makefiles",
+      "inherits": "default",
+      "cacheVariables": {
+        "CMAKE_EXPORT_COMPILE_COMMANDS": true
+      }
+    },
+    {
+      "name": "unix-make-full",
+      "description": "Unix Makefiles (Full build)",
+      "inherits": "unix-make",
+      "cacheVariables": {
+        "OPENDHT_C": true,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true,
+        "OPENDHT_PUSH_NOTIFICATIONS": true,
+        "OPENDHT_PYTHON": true,
+        "OPENDHT_INDEX": true,
+        "BUILD_TESTING": true,
+        "OPENDHT_EXAMPLES": true
+      }
+    },
+    {
+      "name": "unix-make-release",
+      "description": "Unix Makefiles (Release build)",
+      "inherits": "unix-make-full",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "BUILD_SHARED_LIBS": true,
+        "BUILD_TESTING": false,
+        "OPENDHT_SANITIZE": false,
+        "OPENDHT_EXAMPLES": false
+      }
+    },
+    {
+      "name": "ninja",
+      "generator": "Ninja",
+      "inherits": "default",
+      "cacheVariables": {
+        "CMAKE_EXPORT_COMPILE_COMMANDS": true
+      }
+    },
+    {
+      "name": "ninja-release",
+      "inherits": "ninja",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "BUILD_SHARED_LIBS": true,
+        "BUILD_TESTING": false,
+        "OPENDHT_SANITIZE": false,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_C": true,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true
+      }
+    },
+    {
+      "name": "msvc",
+      "generator": "Visual Studio 17 2022",
+      "inherits": "default",
+      "cacheVariables": {
+        "BUILD_TESTING": true,
+        "VCPKG_MANIFEST_FEATURES": "test",
+        "OPENDHT_PROXY_CLIENT": false,
+        "OPENDHT_PROXY_SERVER": false,
+        "OPENDHT_C": true
+      }
+    },
+    {
+      "name": "vcpkg_manifest",
+      "inherits": "msvc",
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "BUILD_SHARED_LIBS": true,
+        "CMAKE_BUILD_TYPE": "Debug",
+        "VCPKG_MANIFEST_MODE": true
+      }
+    },
+    {
+      "name": "vcpkg_manifest_static",
+      "inherits": "vcpkg_manifest",
+      "cacheVariables": {
+        "BUILD_SHARED_LIBS": false,
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static"
+      }
+    },
+    {
+      "name": "vcpkg_local",
+      "inherits": "msvc",
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "BUILD_SHARED_LIBS": true,
+        "CMAKE_BUILD_TYPE": "Debug",
+        "BUILD_TESTING": true,
+        "VCPKG_MANIFEST_MODE": false
+      }
+    },
+    {
+      "name": "vcpkg_release",
+      "inherits": "vcpkg_manifest",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-release",
+        "VCPKG_OVERLAY_TRIPLETS": "x64-windows-release;x64-windows-rel;x64-windows",
+        "BUILD_TESTING": false,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_C": false
+      }
+    },
+    {
+      "name": "vcpkg_release_full",
+      "inherits": "vcpkg_release",
+      "cacheVariables": {
+        "BUILD_TESTING": false,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true,
+        "OPENDHT_C": true,
+        "OPENDHT_PYTHON": true,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_DOCUMENTATION": false
+      }
+    },
+    {
+      "name": "vcpkg_release_static",
+      "inherits": "vcpkg_manifest_static",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static-release",
+        "BUILD_TESTING": false,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_C": false
+      }
+    },
+    {
+      "name": "vcpkg_release_static_full",
+      "inherits": "vcpkg_manifest_static",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static-release",
+        "BUILD_TESTING": false,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true,
+        "OPENDHT_C": true,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_DOCUMENTATION": false
+      }
+    },
+    {
+      "name": "vcpkg_release_local",
+      "inherits": "vcpkg_local",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-release",
+        "VCPKG_OVERLAY_TRIPLETS": "x64-windows-release;x64-windows-rel;x64-windows",
+        "BUILD_TESTING": false,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_C": false
+      }
+    },
+    {
+      "name": "vcpkg_release_local_full",
+      "inherits": "vcpkg_local",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-release",
+        "VCPKG_OVERLAY_TRIPLETS": "x64-windows-release;x64-windows-rel;x64-windows",
+        "BUILD_TESTING": false,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true,
+        "OPENDHT_CPACK": true
+      }
+    },
+    {
+      "name": "vcpkg_release_static_local",
+      "inherits": "vcpkg_local",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "BUILD_SHARED_LIBS": false,
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static-release",
+        "VCPKG_OVERLAY_TRIPLETS": "x64-windows-static-release;x64-windows-static-rel;x64-windows-static",
+        "BUILD_TESTING": false,
+        "OPENDHT_CPACK": true,
+        "OPENDHT_C": false
+      }
+    },
+    {
+      "name": "vcpkg_release_static_local_full",
+      "inherits": "vcpkg_local",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "BUILD_SHARED_LIBS": false,
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static-release",
+        "VCPKG_OVERLAY_TRIPLETS": "x64-windows-static-release;x64-windows-static-rel;x64-windows-static",
+        "BUILD_TESTING": false,
+        "OPENDHT_PROXY_CLIENT": true,
+        "OPENDHT_PROXY_SERVER": true,
+        "OPENDHT_CPACK": true
+      }
+    }
+  ],
+  "buildPresets": [
+    {
+      "name": "default",
+      "configurePreset": "default",
+      "hidden": true
+    },
+    {
+      "name": "unix-make",
+      "inherits": "default",
+      "configurePreset": "unix-make"
+    },
+    {
+      "name": "ninja",
+      "inherits": "default",
+      "configurePreset": "ninja"
+    },
+    {
+      "name": "msvc",
+      "inherits": "default",
+      "configurePreset": "msvc"
+    },
+    {
+      "name": "vcpkg-dev",
+      "inherits": "default",
+      "configurePreset": "vcpkg_manifest"
+    },
+    {
+      "name": "vcpkg-release-static",
+      "inherits": "default",
+      "configurePreset": "vcpkg_release_static_full",
+      "configuration": "Release"
+    },
+    {
+      "name": "vcpkg-release",
+      "inherits": "default",
+      "configurePreset": "vcpkg_release_full",
+      "configuration": "Release"
+    }
+  ]
+}

COPYING

@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.

LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile.am

@@ -1,25 +0,0 @@
-SUBDIRS = src
-
-if ENABLE_TOOLS
-SUBDIRS += tools
-endif
-
-if USE_CYTHON
-SUBDIRS += python
-endif
-
-if HAVE_DOXYGEN
-SUBDIRS += doc
-endif
-
-ACLOCAL_AMFLAGS = -I m4
-
-DOC_FILES = \
-			README.md \
-			LICENSE
-
-EXTRA_DIST = \
-			$(DOC_FILES)
-
-pkgconfigdir = $(libdir)/pkgconfig
-pkgconfig_DATA = opendht.pc

README.md

@@ -1,23 +1,44 @@
-OpenDHT
-===
-A lightweight C++11 Distributed Hash Table implementation originally based on https://github.com/jech/dht by Juliusz Chroboczek.
+<img src="https://raw.githubusercontent.com/savoirfairelinux/opendht/master/resources/opendht_logo_512.png" width="100" align="right">
+<br>
+<h1 style="margin-top:10px">
+    <a id="user-content-opendht-" class="anchor" href="/savoirfairelinux/opendht/blob/master/README.md#opendht-" aria-hidden="true"></a>OpenDHT
+</h1>
 
- * Light and fast C++11 Kademlia DHT library.
- * Distributed shared key->value data-store
- * Clean and powerfull distributed map API with storage of arbitrary binary values. 
- * Optional public key cryptography layer providing data signature and encryption (using GnuTLS).
- * IPv4 and IPv6 support.
- * Python binding.
+[![PyPI - Version](https://img.shields.io/pypi/v/opendht?style=flat)](https://pypi.org/project/opendht/)
+[![crates.io - Version](https://img.shields.io/crates/v/opendht?style=flat)](https://crates.io/crates/opendht)
+[![npm - Version](https://img.shields.io/npm/v/opendht?style=flat)](https://www.npmjs.com/package/opendht)
+[![Docker Image](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat&logo=docker&logoColor=white)](https://github.com/savoirfairelinux/opendht/pkgs/container/opendht%2Fopendht)
 
-Documentation
--
+A lightweight C++17 Distributed Hash Table implementation.
+
+OpenDHT provides an easy to use distributed in-memory data store.
+Every node in the network can read and write values to the store.
+Values are distributed over the network, with redundancy.
+
+ * Lightweight and scalable, designed for large networks and small devices
+ * High resilience to network disruption
+ * Public key cryptography layer providing optional data signature and encryption (using GnuTLS)
+ * IPv4 and IPv6 support
+ * Clean and powerful **C++17** map API
+ * Bindings for **C, Rust, Node.js & Python 3**
+ * REST API with optional HTTP client+server with push notification support
+
+## Documentation
 See the wiki: <https://github.com/savoirfairelinux/opendht/wiki>
 
-Examples
--
+#### How to run a node
+
+You can help contribute to the public network by running a stable node with a public IP address.
+https://github.com/savoirfairelinux/opendht/wiki/Running-a-node-with-dhtnode
+
+#### How-to build and install
+
+Build instructions: see [BUILD.md](BUILD.md)
+
+## Examples
 ### C++ example
 The `tools` directory includes simple example programs :
-* `dhtnode`, a command line tool, mostly used for debuging, allowing to perform operations supported by the library (get, put etc.) with text values.
+* `dhtnode`, a command line tool, allowing to run a DHT node and perform operations supported by the library (get, put etc.) with text values.
 * `dhtchat`, a very simple IM client working over the dht.
 
 Example program launching a DHT node, connecting to the network and performing some basic operations:
@@ -35,7 +56,7 @@ int main()
 
     // Join the network through any running node,
     // here using a known bootstrap node.
-    node.bootstrap("bootstrap.ring.cx", "4222");
+    node.bootstrap("bootstrap.jami.net", "4222");
 
     // put some data on the dht
     std::vector<uint8_t> some_data(5, 10);
@@ -52,79 +73,96 @@ int main()
         return true; // return false to stop the search
     });
 
-    // here we could wait for some operations to complete
-    // instead of ending now.
-
     // wait for dht threads to end
     node.join();
     return 0;
 }
 ```
+
 ### Python 3 example
+
+Install on Linux, macOS and Windows with:
+```sh
+pip install opendht
+```
+
+Using the simple, blocking API:
 ```python
 import opendht as dht
 
-r = dht.DhtRunner()
-r.run()
+node = dht.DhtRunner()
+node.run()
 
-# Join the network through any running node,
+# Join the DHT network through any running node,
 # here using a known bootstrap node.
-r.bootstrap("bootstrap.ring.cx", "4222")
+node.bootstrap("bootstrap.jami.net", "4222")
 
-r.put(dht.InfoHash.get("unique_key"), dht.Value(b'some binary data'))
+# blocking call (provide callback arguments to make the call non-blocking)
+node.put(dht.InfoHash.get("unique_key"), dht.Value(b'some binary data'))
 
-# blocking call (provide a get_cb and an optional done_cb argument to make the call non-blocking)
-results = r.get(dht.InfoHash.get("unique_key"))
-for r in results:
-    print(r)
+results = node.get(dht.InfoHash.get("unique_key"))
+for value in results:
+    print(value)
 ```
 
-How-to build and install
--
-### Using autotools
+Or using asyncio:
+```python
+import asyncio
+import opendht.aio as dht
 
-```bash
-# clone the repo
-git clone https://github.com/savoirfairelinux/opendht.git
+async def dht_async_demo(key_str: str):
+    # Start a new node using an async context manager.
+    # It is also possible to call run()/await shutdown() manually.
+    async with dht.DhtRunner(
+        bootstrap=(("bootstrap.jami.net", "4222"),)
+    ) as node:
+        # compute key hash
+        key = dht.InfoHash.get(key_str)
 
-# build and install
-cd opendht
-./autogen.sh && ./configure
-make
-sudo make install
-```
-### Using cmake
+        # put data, waiting for completion
+        await node.put(key, dht.Value(b'tata data'))
 
-```bash
-# clone the repo
-git clone https://github.com/savoirfairelinux/opendht.git
+        # get all values at key
+        results = await node.getAll(key)
+        for value in results:
+            print(value)
+        
+        # same operation, but stream values as they come from the network
+        with node.get(key) as results:
+            async for value in results:
+                print(value)
 
-# build and install
-cd opendht
-mkdir build && cd build
-cmake -DOPENDHT_PYTHON=ON ..
-make -j
-sudo make install
+        # listen for change of values at key
+        with node.listen(key) as values:
+            async for value, expired in values:
+                print(value)
+                if value.data == b'tata data':
+                    break
+
+asyncio.run(dht_async_demo("unique_key"))
 ```
 
-How-to build a simple client app
--
-```bash
-g++ main.cpp -std=c++11 -lopendht -lgnutls
-```
-
-Licence
--
-Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
-
-Licenced under the GNU General Public License version 3, though the core routing library (dht.cpp) is licenced under the MIT licence.
-
-This project is independent from another project called OpenDHT (Sean Rhea. Ph.D. Thesis, 2005), now extinct.
-
-Dependencies
--
-- msgpack-c 1.0+, used for data serialization.
-- GnuTLS 3.1+, used for cryptographic operations.
+## Dependencies
+Core dependencies:
+- msgpack-c 1.2+, used for data serialization.
+- GnuTLS 3.3+, used for cryptographic operations.
 - Nettle 2.4+, a GnuTLS dependency for crypto.
-- Build tested with GCC 4.8+ (Linux, Android, Windows with MinGW), Clang/LLVM (Linux, OS X).
+- {fmt} 9.0+, for log formatting.
 
+Optional dependencies for the REST API (DHT proxy client/server):
+- (optional) restinio
+- (optional) llhttp
+- (optional) jsoncpp 1.7.4-3+
+- (optional) simdutf
+
+Build environment:
+- Build tested with GCC 9+ (GNU/Linux, Windows with MinGW), Clang/LLVM (GNU/Linux, Android, macOS, iOS).
+- Build tested with Microsoft Visual Studio 2019, 2022
+
+## License
+Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+
+OpenDHT is released under the MIT License. See [LICENSE](LICENSE) for details.
+
+## Acknowledgements
+This project was originally based on https://github.com/jech/dht by Juliusz Chroboczek.

autogen.sh

@@ -1 +0,0 @@
-autoreconf --install --verbose -Wall

c/opendht_c.h

@@ -0,0 +1,316 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <opendht/def.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stddef.h>
+
+#ifdef _WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+typedef uint16_t sa_family_t;
+typedef uint16_t in_port_t;
+#else
+#include <sys/socket.h>
+#include <netinet/in.h>
+#endif
+
+// Non-owning data view
+struct OPENDHT_C_PUBLIC dht_data_view
+{
+    const uint8_t* data;
+    size_t size;
+};
+typedef struct dht_data_view dht_data_view;
+
+OPENDHT_C_PUBLIC const char* dht_version(void);
+
+// dht::Blob
+struct OPENDHT_C_PUBLIC dht_blob;
+typedef struct dht_blob dht_blob;
+OPENDHT_C_PUBLIC dht_data_view dht_blob_get_data(const dht_blob* data);
+OPENDHT_C_PUBLIC void dht_blob_delete(dht_blob* data);
+
+// dht::InfoHash
+#ifdef __cplusplus
+#define OPENDHT_C_ALIGN_UINT32 alignas(uint32_t)
+#elif defined(_MSC_VER)
+#define OPENDHT_C_ALIGN_UINT32 __declspec(align(4))
+#else
+#define OPENDHT_C_ALIGN_UINT32 _Alignas(uint32_t)
+#endif
+
+struct OPENDHT_C_PUBLIC dht_infohash
+{
+    OPENDHT_C_ALIGN_UINT32 uint8_t d[HASH_LEN];
+};
+typedef struct dht_infohash dht_infohash;
+OPENDHT_C_PUBLIC void dht_infohash_zero(dht_infohash* h);
+OPENDHT_C_PUBLIC void dht_infohash_random(dht_infohash* h);
+OPENDHT_C_PUBLIC void dht_infohash_from_hex(dht_infohash* h, const char* dat);
+OPENDHT_C_PUBLIC void dht_infohash_from_hex_null(dht_infohash* h, const char* dat);
+OPENDHT_C_PUBLIC void dht_infohash_get(dht_infohash* h, const uint8_t* dat, size_t dat_size);
+OPENDHT_C_PUBLIC void dht_infohash_get_from_string(dht_infohash* h, const char* str);
+OPENDHT_C_PUBLIC const char* dht_infohash_print(const dht_infohash* h);
+OPENDHT_C_PUBLIC bool dht_infohash_is_zero(const dht_infohash* h);
+
+// dht::PkId
+struct OPENDHT_C_PUBLIC dht_pkid
+{
+    OPENDHT_C_ALIGN_UINT32 uint8_t d[32];
+};
+typedef struct dht_pkid dht_pkid;
+#undef OPENDHT_C_ALIGN_UINT32
+OPENDHT_C_PUBLIC const char* dht_pkid_print(const dht_pkid* h);
+
+// dht::crypto::PublicKey
+struct OPENDHT_C_PUBLIC dht_publickey;
+typedef struct dht_publickey dht_publickey;
+OPENDHT_C_PUBLIC dht_publickey* dht_publickey_import(const uint8_t* dat, size_t dat_size);
+OPENDHT_C_PUBLIC void dht_publickey_delete(dht_publickey* pk);
+OPENDHT_C_PUBLIC int dht_publickey_export(const dht_publickey* pk, char* out, size_t* out_size);
+OPENDHT_C_PUBLIC dht_blob* dht_publickey_export_blob(const dht_publickey* pk);
+OPENDHT_C_PUBLIC int dht_publickey_unpack(dht_publickey* pk, const uint8_t* data, size_t size);
+OPENDHT_C_PUBLIC dht_infohash dht_publickey_get_id(const dht_publickey* pk);
+OPENDHT_C_PUBLIC dht_pkid dht_publickey_get_long_id(const dht_publickey* pk);
+OPENDHT_C_PUBLIC bool dht_publickey_check_signature(
+    const dht_publickey* pk, const char* data, size_t data_size, const char* signature, size_t signature_size);
+OPENDHT_C_PUBLIC dht_blob* dht_publickey_encrypt(const dht_publickey* pk, const char* data, size_t data_size);
+
+// dht::crypto::PrivateKey
+struct OPENDHT_C_PUBLIC dht_privatekey;
+typedef struct dht_privatekey dht_privatekey;
+OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_generate(unsigned key_length_bits);
+OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_generate_ec(void);
+OPENDHT_C_PUBLIC dht_privatekey* dht_privatekey_import(const uint8_t* dat, size_t dat_size, const char* password);
+OPENDHT_C_PUBLIC int dht_privatekey_export(const dht_privatekey*, char* out, size_t* out_size, const char* password);
+OPENDHT_C_PUBLIC dht_blob* dht_privatekey_export_blob(const dht_privatekey*, const char* password);
+OPENDHT_C_PUBLIC dht_blob* dht_privatekey_sign(const dht_privatekey*, const uint8_t* data, size_t size);
+OPENDHT_C_PUBLIC dht_publickey* dht_privatekey_get_publickey(const dht_privatekey*);
+OPENDHT_C_PUBLIC dht_blob* dht_privatekey_decrypt(const dht_privatekey*, const char* data, size_t data_size);
+OPENDHT_C_PUBLIC void dht_privatekey_delete(dht_privatekey*);
+
+// dht::crypto::Certificate
+struct OPENDHT_C_PUBLIC dht_certificate;
+typedef struct dht_certificate dht_certificate;
+OPENDHT_C_PUBLIC dht_certificate* dht_certificate_import(const uint8_t* dat, size_t dat_size);
+OPENDHT_C_PUBLIC dht_blob* dht_certificate_export(const dht_certificate* certificate);
+OPENDHT_C_PUBLIC dht_certificate* dht_certificate_ref(const dht_certificate* certificate);
+OPENDHT_C_PUBLIC dht_infohash dht_certificate_get_id(const dht_certificate*);
+OPENDHT_C_PUBLIC dht_pkid dht_certificate_get_long_id(const dht_certificate*);
+OPENDHT_C_PUBLIC dht_publickey* dht_certificate_get_publickey(const dht_certificate*);
+OPENDHT_C_PUBLIC void dht_certificate_delete(dht_certificate*);
+
+struct OPENDHT_C_PUBLIC dht_identity
+{
+    dht_privatekey* privatekey;
+    dht_certificate* certificate;
+};
+typedef struct dht_identity dht_identity;
+OPENDHT_C_PUBLIC dht_identity dht_identity_generate(const char* common_name, const dht_identity* ca);
+OPENDHT_C_PUBLIC dht_identity dht_identity_generate_ec(const char* common_name, const dht_identity* ca);
+OPENDHT_C_PUBLIC void dht_identity_delete(dht_identity*);
+
+// dht::Value
+struct OPENDHT_C_PUBLIC dht_value;
+typedef struct dht_value dht_value;
+typedef uint64_t dht_value_id;
+OPENDHT_C_PUBLIC dht_value* dht_value_new(const uint8_t* data, size_t size);
+OPENDHT_C_PUBLIC dht_value* dht_value_with_id_new(const uint8_t* data, size_t size, uint64_t value_id);
+OPENDHT_C_PUBLIC dht_value* dht_value_new_from_string(const char* str);
+OPENDHT_C_PUBLIC dht_value* dht_value_ref(const dht_value*);
+OPENDHT_C_PUBLIC dht_value* dht_value_copy(const dht_value*);
+OPENDHT_C_PUBLIC void dht_value_unref(dht_value*);
+OPENDHT_C_PUBLIC dht_data_view dht_value_get_data(const dht_value* data);
+OPENDHT_C_PUBLIC dht_value_id dht_value_get_id(const dht_value* data);
+OPENDHT_C_PUBLIC dht_publickey* dht_value_get_owner(const dht_value* data);
+OPENDHT_C_PUBLIC dht_infohash dht_value_get_recipient(const dht_value* data);
+OPENDHT_C_PUBLIC const char* dht_value_get_user_type(const dht_value* data);
+OPENDHT_C_PUBLIC void dht_value_set_user_type(dht_value* data, const char* user_type);
+OPENDHT_C_PUBLIC uint16_t dht_value_get_type(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_type(dht_value* value, uint16_t type);
+OPENDHT_C_PUBLIC uint16_t dht_value_get_seq(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_seq(dht_value* value, uint16_t seq);
+OPENDHT_C_PUBLIC unsigned dht_value_get_priority(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_priority(dht_value* value, unsigned priority);
+OPENDHT_C_PUBLIC const char* dht_value_get_push_type(const dht_value* value);
+OPENDHT_C_PUBLIC void dht_value_set_push_type(dht_value* value, const char* push_type);
+
+// callbacks
+typedef bool (*dht_get_cb)(const dht_value* value, void* user_data);
+typedef bool (*dht_value_cb)(const dht_value* value, bool expired, void* user_data);
+typedef void (*dht_done_cb)(bool ok, void* user_data);
+typedef void (*dht_shutdown_cb)(void* user_data);
+typedef void (*dht_status_cb)(int ipv4_status, int ipv6_status, void* user_data);
+typedef void (*dht_certificate_cb)(const dht_certificate* certificate, void* user_data);
+typedef void (*dht_certificate_store_cb)(const dht_pkid* id, dht_certificate_cb emit, void* emit_data, void* user_data);
+
+typedef struct dht_runner_context
+{
+    dht_status_cb status_cb;
+    dht_certificate_store_cb certificate_store_cb;
+    dht_shutdown_cb released_cb;
+    void* user_data;
+} dht_runner_context;
+
+enum dht_query_field {
+    DHT_FIELD_ID = 1,
+    DHT_FIELD_TYPE = 2,
+    DHT_FIELD_SEQ = 4,
+    DHT_FIELD_OWNER = 8,
+    DHT_FIELD_USER_TYPE = 16
+};
+
+typedef struct dht_query_result
+{
+    uint32_t fields;
+    uint64_t id;
+    uint16_t value_type;
+    uint16_t seq;
+    dht_infohash owner;
+    dht_data_view user_type;
+} dht_query_result;
+typedef bool (*dht_query_cb)(const dht_query_result* result, void* user_data);
+
+struct dht_push_token;
+typedef struct dht_push_token dht_push_token;
+
+struct OPENDHT_C_PUBLIC dht_op_token;
+typedef struct dht_op_token dht_op_token;
+OPENDHT_C_PUBLIC void dht_op_token_delete(dht_op_token* token);
+
+// config
+struct OPENDHT_C_PUBLIC dht_node_config
+{
+    dht_infohash node_id;
+    uint32_t network;
+    bool is_bootstrap;
+    bool maintain_storage;
+    const char* persist_path;
+};
+typedef struct dht_node_config dht_node_config;
+
+struct OPENDHT_C_PUBLIC dht_secure_config
+{
+    dht_node_config node_config;
+    dht_identity id;
+};
+typedef struct dht_secure_config dht_secure_config;
+
+struct OPENDHT_C_PUBLIC dht_runner_config
+{
+    dht_secure_config dht_config;
+    bool threaded;
+    const char* proxy_server;
+    const char* push_node_id;
+    const char* push_token;
+    const char* push_topic;
+    const char* push_platform;
+    const char* proxy_user_agent;
+    bool peer_discovery;
+    bool peer_publish;
+    dht_certificate* server_ca;
+    dht_identity client_identity;
+    bool log;
+};
+typedef struct dht_runner_config dht_runner_config;
+OPENDHT_C_PUBLIC void dht_runner_config_default(dht_runner_config* config);
+
+// dht::DhtRunner
+struct OPENDHT_C_PUBLIC dht_runner;
+typedef struct dht_runner dht_runner;
+OPENDHT_C_PUBLIC dht_runner* dht_runner_new(void);
+OPENDHT_C_PUBLIC void dht_runner_delete(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_loop(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_join(dht_runner* runner);
+/* Returns 0 on success, standard error code on failure */
+OPENDHT_C_PUBLIC int dht_runner_run(dht_runner* runner, in_port_t port);
+/* Returns 0 on success, standard error code on failure */
+OPENDHT_C_PUBLIC int dht_runner_run_config(dht_runner* runner, in_port_t port, const dht_runner_config* config);
+OPENDHT_C_PUBLIC int dht_runner_run_bind(dht_runner* runner,
+                                         const char* ipv4,
+                                         const char* ipv6,
+                                         in_port_t port,
+                                         const dht_runner_config* config,
+                                         const dht_runner_context* context);
+OPENDHT_C_PUBLIC int dht_runner_connectivity_changed(dht_runner* runner);
+OPENDHT_C_PUBLIC int dht_runner_register_type(
+    dht_runner* runner, uint16_t id, const char* name, uint64_t expiration_seconds, bool insecure);
+OPENDHT_C_PUBLIC dht_publickey* dht_runner_get_publickey(const dht_runner* runner);
+OPENDHT_C_PUBLIC void dht_runner_find_certificate(
+    dht_runner* runner, const dht_pkid* id, dht_certificate_cb callback, dht_shutdown_cb released_cb, void* user_data);
+OPENDHT_C_PUBLIC int dht_runner_register_certificate(dht_runner* runner, const dht_certificate* certificate);
+OPENDHT_C_PUBLIC void dht_runner_ping(
+    dht_runner* runner, struct sockaddr* addr, socklen_t addr_len, dht_done_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC void dht_runner_bootstrap(dht_runner* runner, const char* host, const char* service);
+OPENDHT_C_PUBLIC void dht_runner_get(
+    dht_runner* runner, const dht_infohash* hash, dht_get_cb cb, dht_done_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC void dht_runner_get_filtered(dht_runner* runner,
+                                              const dht_infohash* hash,
+                                              const char* where,
+                                              dht_get_cb cb,
+                                              dht_done_cb done_cb,
+                                              void* user_data);
+OPENDHT_C_PUBLIC void dht_runner_query(dht_runner* runner,
+                                       const dht_infohash* hash,
+                                       const char* query,
+                                       dht_query_cb cb,
+                                       dht_done_cb done_cb,
+                                       void* user_data);
+OPENDHT_C_PUBLIC dht_op_token* dht_runner_listen(
+    dht_runner* runner, const dht_infohash* hash, dht_value_cb cb, dht_shutdown_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC dht_op_token* dht_runner_listen_filtered(dht_runner* runner,
+                                                          const dht_infohash* hash,
+                                                          const char* where,
+                                                          dht_value_cb cb,
+                                                          dht_shutdown_cb released_cb,
+                                                          void* user_data);
+OPENDHT_C_PUBLIC void dht_runner_cancel_listen(dht_runner* runner, const dht_infohash* hash, dht_op_token* token);
+OPENDHT_C_PUBLIC void dht_runner_put(dht_runner* runner,
+                                     const dht_infohash* hash,
+                                     const dht_value* value,
+                                     dht_done_cb done_cb,
+                                     void* cb_user_data,
+                                     bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
+                                            const dht_infohash* hash,
+                                            const dht_value* value,
+                                            dht_done_cb done_cb,
+                                            void* cb_user_data,
+                                            bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
+                                               const dht_infohash* hash,
+                                               const dht_pkid* to,
+                                               const dht_value* value,
+                                               dht_done_cb done_cb,
+                                               void* cb_user_data,
+                                               bool permanent);
+OPENDHT_C_PUBLIC void dht_runner_cancel_put(dht_runner* runner, const dht_infohash* hash, dht_value_id value_id);
+OPENDHT_C_PUBLIC void dht_runner_shutdown(dht_runner* runner, dht_shutdown_cb done_cb, void* cb_user_data);
+OPENDHT_C_PUBLIC dht_infohash dht_runner_get_node_id(const dht_runner* runner);
+OPENDHT_C_PUBLIC dht_infohash dht_runner_get_id(const dht_runner* runner);
+OPENDHT_C_PUBLIC bool dht_runner_is_running(const dht_runner* runner);
+OPENDHT_C_PUBLIC in_port_t dht_runner_get_bound_port(const dht_runner* runner, sa_family_t af);
+/** Returns null-terminated array that must be freed after use as well as each element */
+OPENDHT_C_PUBLIC struct sockaddr** dht_runner_get_public_address(const dht_runner* runner);
+OPENDHT_C_PUBLIC void dht_sockaddr_array_delete(struct sockaddr** addresses);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_token(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_topic(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC int dht_runner_set_push_notification_platform(dht_runner* runner, const char* value);
+OPENDHT_C_PUBLIC dht_push_token* dht_runner_push_notification_received(dht_runner* runner,
+                                                                       const char* const* keys,
+                                                                       const char* const* values,
+                                                                       size_t count);
+OPENDHT_C_PUBLIC int dht_push_token_poll(dht_push_token* token, int* result);
+OPENDHT_C_PUBLIC void dht_push_token_delete(dht_push_token* token);
+
+#ifdef __cplusplus
+}
+#endif

cmake/CheckAtomic.cmake

@@ -0,0 +1,126 @@
+# atomic builtins are required for threading support.
+
+INCLUDE(CheckCXXSourceCompiles)
+INCLUDE(CheckLibraryExists)
+INCLUDE("${CMAKE_CURRENT_LIST_DIR}/DetermineGCCCompatible.cmake")
+
+# Sometimes linking against libatomic is required for atomic ops, if
+# the platform doesn't support lock-free atomics.
+
+function(check_working_cxx_atomics varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -std=c++11")
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+std::atomic<int> x;
+std::atomic<short> y;
+std::atomic<char> z;
+int main() {
+  ++z;
+  ++y;
+  return ++x;
+}
+" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics)
+
+function(check_working_cxx_atomics64 varname)
+  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
+  set(CMAKE_REQUIRED_FLAGS "-std=c++11 ${CMAKE_REQUIRED_FLAGS}")
+  CHECK_CXX_SOURCE_COMPILES("
+#include <atomic>
+#include <cstdint>
+std::atomic<uint64_t> x (0);
+int main() {
+  uint64_t i = x.load(std::memory_order_relaxed);
+  (void)i;
+  return 0;
+}
+" ${varname})
+  set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
+endfunction(check_working_cxx_atomics64)
+
+
+# Check for (non-64-bit) atomic operations.
+if(MSVC)
+  set(HAVE_CXX_ATOMICS_WITHOUT_LIB True)
+elseif(LLVM_COMPILER_IS_GCC_COMPATIBLE OR CMAKE_CXX_COMPILER_ID MATCHES "XL")
+  # First check if atomics work without the library.
+  check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITHOUT_LIB)
+  # If not, check if the library exists, and atomics work with it.
+  if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB)
+    check_library_exists(atomic __atomic_fetch_add_4 "" HAVE_LIBATOMIC)
+    if(HAVE_LIBATOMIC)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+      check_working_cxx_atomics(HAVE_CXX_ATOMICS_WITH_LIB)
+      if (NOT HAVE_CXX_ATOMICS_WITH_LIB)
+        message(FATAL_ERROR "Host compiler must support std::atomic!")
+      endif()
+    else()
+      #message(FATAL_ERROR "Host compiler appears to require libatomic, but unable to find it.")
+    endif()
+  endif()
+endif()
+
+# Check for 64 bit atomic operations.
+if(MSVC)
+  set(HAVE_CXX_ATOMICS64_WITHOUT_LIB True)
+elseif(LLVM_COMPILER_IS_GCC_COMPATIBLE OR CMAKE_CXX_COMPILER_ID MATCHES "XL")
+  # First check if atomics work without the library.
+  check_working_cxx_atomics64(HAVE_CXX_ATOMICS64_WITHOUT_LIB)
+  # If not, check if the library exists, and atomics work with it.
+  if(NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB)
+    check_library_exists(atomic __atomic_load_8 "" HAVE_CXX_LIBATOMICS64)
+    if(HAVE_CXX_LIBATOMICS64)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "atomic")
+      check_working_cxx_atomics64(HAVE_CXX_ATOMICS64_WITH_LIB)
+      if (NOT HAVE_CXX_ATOMICS64_WITH_LIB)
+        message(FATAL_ERROR "Host compiler must support 64-bit std::atomic!")
+      endif()
+    else()
+      #message(FATAL_ERROR "Host compiler appears to require libatomic for 64-bit operations, but unable to find it.")
+    endif()
+  endif()
+endif()
+
+# Set variable LLVM_ATOMIC_LIB specifying flags for linking against libatomic.
+if(HAVE_CXX_ATOMICS_WITH_LIB OR HAVE_CXX_ATOMICS64_WITH_LIB)
+  # Use options --push-state, --as-needed and --pop-state if linker is known to support them.
+  # Use single option -Wl of compiler driver to avoid incorrect re-ordering of options by CMake.
+  if(LLVM_LINKER_IS_GNULD OR LLVM_LINKER_IS_GOLD OR LLVM_LINKER_IS_LLD OR LLVM_LINKER_IS_MOLD)
+    set(LLVM_ATOMIC_LIB "-Wl,--push-state,--as-needed,-latomic,--pop-state")
+  else()
+    set(LLVM_ATOMIC_LIB "-latomic")
+  endif()
+else()
+  set(LLVM_ATOMIC_LIB)
+endif()
+
+## TODO: This define is only used for the legacy atomic operations in
+## llvm's Atomic.h, which should be replaced.  Other code simply
+## assumes C++11 <atomic> works.
+CHECK_CXX_SOURCE_COMPILES("
+#ifdef _MSC_VER
+#include <windows.h>
+#endif
+int main() {
+#ifdef _MSC_VER
+        volatile LONG val = 1;
+        MemoryBarrier();
+        InterlockedCompareExchange(&val, 0, 1);
+        InterlockedIncrement(&val);
+        InterlockedDecrement(&val);
+#else
+        volatile unsigned long val = 1;
+        __sync_synchronize();
+        __sync_val_compare_and_swap(&val, 1, 0);
+        __sync_add_and_fetch(&val, 1);
+        __sync_sub_and_fetch(&val, 1);
+#endif
+        return 0;
+      }
+" LLVM_HAS_ATOMICS)
+
+if( NOT LLVM_HAS_ATOMICS )
+  message(STATUS "Warning: LLVM will be built thread-unsafe because atomic builtins are missing")
+endif()

cmake/DetermineGCCCompatible.cmake

@@ -0,0 +1,13 @@
+# Determine if the compiler has GCC-compatible command-line syntax.
+
+if(NOT DEFINED LLVM_COMPILER_IS_GCC_COMPATIBLE)
+  if(CMAKE_COMPILER_IS_GNUCXX)
+    set(LLVM_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif( MSVC )
+    set(LLVM_COMPILER_IS_GCC_COMPATIBLE OFF)
+  elseif( "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang" )
+    set(LLVM_COMPILER_IS_GCC_COMPATIBLE ON)
+  elseif( "${CMAKE_CXX_COMPILER_ID}" MATCHES "Intel" )
+    set(LLVM_COMPILER_IS_GCC_COMPATIBLE ON)
+  endif()
+endif()

cmake/FindMsgpack.cmake

@@ -1,48 +0,0 @@
-# - Try to find msgpack
-# Once done this will define
-#  MSGPACK_FOUND - System has msgpack
-#  MSGPACK_INCLUDE_DIRS - The msgpack include directories
-#  MSGPACK_LIBRARIES - The libraries needed to use msgpack
-
-if(NOT MSGPACK_USE_BUNDLED)
-  find_package(PkgConfig)
-  if (PKG_CONFIG_FOUND)
-    pkg_check_modules(PC_MSGPACK QUIET msgpack)
-  endif()
-else()
-  set(PC_MSGPACK_INCLUDEDIR)
-  set(PC_MSGPACK_INCLUDE_DIRS)
-  set(PC_MSGPACK_LIBDIR)
-  set(PC_MSGPACK_LIBRARY_DIRS)
-  set(LIMIT_SEARCH NO_DEFAULT_PATH)
-endif()
-
-set(MSGPACK_DEFINITIONS ${PC_MSGPACK_CFLAGS_OTHER})
-
-find_path(MSGPACK_INCLUDE_DIR msgpack.h
-  HINTS ${PC_MSGPACK_INCLUDEDIR} ${PC_MSGPACK_INCLUDE_DIRS}
-  ${LIMIT_SEARCH})
-
-# If we're asked to use static linkage, add libmsgpack.a as a preferred library name.
-if(MSGPACK_USE_STATIC)
-  list(APPEND MSGPACK_NAMES
-    "${CMAKE_STATIC_LIBRARY_PREFIX}msgpack${CMAKE_STATIC_LIBRARY_SUFFIX}")
-endif()
-
-list(APPEND MSGPACK_NAMES msgpack)
-
-find_library(MSGPACK_LIBRARY NAMES ${MSGPACK_NAMES}
-  HINTS ${PC_MSGPACK_LIBDIR} ${PC_MSGPACK_LIBRARY_DIRS}
-  ${LIMIT_SEARCH})
-
-mark_as_advanced(MSGPACK_INCLUDE_DIR MSGPACK_LIBRARY)
-
-set(MSGPACK_LIBRARIES ${MSGPACK_LIBRARY})
-set(MSGPACK_INCLUDE_DIRS ${MSGPACK_INCLUDE_DIR})
-
-include(FindPackageHandleStandardArgs)
-# handle the QUIETLY and REQUIRED arguments and set MSGPACK_FOUND to TRUE
-# if all listed variables are TRUE
-find_package_handle_standard_args(Msgpack DEFAULT_MSG
-                                  MSGPACK_LIBRARY MSGPACK_INCLUDE_DIR)
-

cmake/FindReadline.cmake

@@ -10,7 +10,7 @@
 #  READLINE_LIBRARIES    - the Readline library plus the libraries it 
 #                          depends on
 
-# Copyright (C) 2009
+# Copyright (c) 2009
 # ASTRON (Netherlands Institute for Radio Astronomy)
 # P.O.Box 2, 7990 AA Dwingeloo, The Netherlands
 #

cmake/FindRestinio.cmake

@@ -0,0 +1,14 @@
+# header-only does not produce a library
+if(NOT Restinio_FOUND)
+    find_path (Restinio_INCLUDE_DIR restinio
+               HINTS
+               "/usr/include"
+               "/usr/local/include"
+               "/opt/local/include")
+    include(FindPackageHandleStandardArgs)
+    find_package_handle_standard_args(Restinio DEFAULT_MSG Restinio_INCLUDE_DIR)
+    if (Restinio_INCLUDE_DIR)
+        set(Restinio_FOUND TRUE)
+        set(Restinio_INCLUDE_DIRS ${Restinio_INCLUDE_DIR})
+    endif()
+endif()

cmake/WindowsUtils.cmake

@@ -0,0 +1,21 @@
+# Windows utility functions and macros
+
+# Determine Windows NT version for compatibility
+# https://stackoverflow.com/a/40217291/9560245
+macro(get_WIN32_WINNT version)
+    if(CMAKE_SYSTEM_VERSION)
+        set(ver ${CMAKE_SYSTEM_VERSION})
+        string(REGEX MATCH "^([0-9]+).([0-9])" ver ${ver})
+        string(REGEX MATCH "^([0-9]+)" verMajor ${ver})
+        # Check for Windows 10, b/c we'll need to convert to hex 'A'.
+        if("${verMajor}" MATCHES "10")
+            set(verMajor "A")
+            string(REGEX REPLACE "^([0-9]+)" ${verMajor} ver ${ver})
+        endif()
+        # Remove all remaining '.' characters.
+        string(REPLACE "." "" ver ${ver})
+        # Prepend each digit with a zero.
+        string(REGEX REPLACE "([0-9A-Z])" "0\\1" ver ${ver})
+        set(${version} "0x${ver}")
+    endif()
+endmacro()

configure.ac

@@ -1,97 +0,0 @@
-AC_INIT(opendht, 0.5)
-AC_CONFIG_AUX_DIR(ac)
-AM_INIT_AUTOMAKE([foreign])
-AC_CONFIG_HEADERS([config.h])
-AC_CONFIG_MACRO_DIR([m4])
-AC_CANONICAL_HOST
-
-AC_ARG_ENABLE([debug], AS_HELP_STRING([--enable-debug], [Build in debug mode, adds stricter warnings, disables optimization]))
-AS_IF([test "x$enable_debug" = "xyes"],
-      [CXXFLAGS="${CXXFLAGS} -g -Wno-return-type -Wall -Wextra -Wnon-virtual-dtor -O0"],
-      [CXXFLAGS="${CXXFLAGS} -O3"])
-
-AC_PROG_CXX
-AM_PROG_AR
-
-dnl Check for Doxygen
-AC_ARG_ENABLE([doc], [AS_HELP_STRING([--disable-doc], [Disable documentation generation (doxygen)])])
-AS_IF([test "x$enable_doc" != "xno"], [
-  AC_CHECK_PROGS([DOXYGEN], [doxygen])
-  AS_IF([test -z "$DOXYGEN"],[AC_MSG_WARN([Doxygen not found - continuing without Doxygen support])])
-])
-AM_CONDITIONAL([HAVE_DOXYGEN], [test -n "$DOXYGEN"])
-
-dnl Check for Python
-AC_ARG_ENABLE([python], [AS_HELP_STRING([--disable-python], [Disble python binding])])
-AS_IF([test "x$enable_python" != "xno"], [
-  AM_PATH_PYTHON([3.3],, [:])
-  AS_IF([test -n "$PYTHON"],[
-    AC_CHECK_PROGS([CYTHON], [cython])
-    AS_IF([test -z "$CYTHON"],[AC_MSG_WARN([Cython not found - continuing without python support])])
-  ])
-])
-AM_CONDITIONAL([USE_CYTHON], [test -n "$CYTHON"])
-
-case "${host_os}" in
-  "")
-    SYS=unknown
-    ;;
-  *android*)
-    SYS=android
-    ;;
-  linux*)
-    SYS=linux
-    ;;
-  darwin*)
-    SYS=darwin
-    ;;
-  mingw32*)
-    SYS=mingw32
-    WIN32=1
-    AC_DEFINE([_POSIX_SOURCE], [1], [IEEE Std 1003.1.])
-    AC_DEFINE([_POSIX_C_SOURCE], [200809L], [IEEE Std 1003.1.])
-    AC_DEFINE([_XOPEN_SOURCE], [700], [POSIX and XPG 7th edition])
-    AC_DEFINE([_XOPEN_SOURCE_EXTENDED], [1], [XPG things and X/Open Unix extensions.])
-    AC_DEFINE([_BSD_SOURCE], [1], [ISO C, POSIX, and 4.3BSD things.])
-    LDFLAGS="${LDFLAGS} -lws2_32"
-    AC_SUBST(WINDOWS_ARCH)
-    AC_SUBST(PROGRAMFILES)
-    ;;
-  *)
-    SYS="${host_os}"
-    ;;
-esac
-
-AM_CONDITIONAL(WIN32, [test "x$SYS" = "xmingw32"])
-AS_IF([test "x$SYS" = "xandroid"],
-      [], [LDFLAGS="${LDFLAGS} -lpthread"])
-
-LT_INIT()
-LT_LANG(C++)
-
-AX_CXX_COMPILE_STDCXX_11([noext],[mandatory])
-
-PKG_PROG_PKG_CONFIG()
-PKG_CHECK_MODULES([nettle], [nettle >= 2.4])
-PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.1])
-PKG_CHECK_MODULES([msgpack], [msgpack >= 1.1])
-
-AC_ARG_ENABLE([tools], AS_HELP_STRING([--disable-tools],[Disable tools (CLI DHT node)]),,build_tools=yes)
-AM_CONDITIONAL(ENABLE_TOOLS, test x$build_tools == xyes)
-
-AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile doc/Makefile])])
-
-dnl Configure setup.py if we build the python module
-AM_COND_IF([USE_CYTHON], [
-    AC_SUBST(CURRENT_SOURCE_DIR, ".")
-    AC_SUBST(CURRENT_BINARY_DIR, ".")
-    AC_SUBST(PROJECT_SOURCE_DIR, "..")
-    AC_SUBST(PROJECT_BINARY_DIR, "../src/.libs")
-    AC_CONFIG_FILES([python/Makefile python/setup.py])
-])
-
-AC_CONFIG_FILES([Makefile
-                 src/Makefile
-                 tools/Makefile
-                 opendht.pc])
-AC_OUTPUT

doc/CMakeLists.txt

@@ -0,0 +1,16 @@
+if (OPENDHT_TOOLS)
+	INSTALL(FILES ${CMAKE_CURRENT_SOURCE_DIR}/dhtnode.1 DESTINATION ${CMAKE_INSTALL_MANDIR}/man1)
+endif ()
+
+if (OPENDHT_DOCUMENTATION)
+    if (NOT DOXYGEN_FOUND)
+         message(FATAL_ERROR "Doxygen is needed to build the documentation.")
+    endif()
+    configure_file (Doxyfile.in Doxyfile @ONLY)
+    add_custom_target(doc ALL
+                      COMMAND ${DOXYGEN_EXECUTABLE} ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile
+                      WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+                      COMMENT "Generating API documentation with Doxygen"
+                      VERBATIM)
+    install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/html DESTINATION ${CMAKE_INSTALL_DOCDIR}/opendht)
+endif()

doc/Doxyfile.in

@@ -353,7 +353,7 @@ DOCSET_PUBLISHER_ID    = com.savoirfairelinux
 # The default value is: Publisher.
 # This tag requires that the tag GENERATE_DOCSET is set to YES.
 
-DOCSET_PUBLISHER_NAME  = Savoir-Faire Linux
+DOCSET_PUBLISHER_NAME  = Savoir-faire Linux
 
 # If the GENERATE_HTMLHELP tag is set to YES then doxygen generates three
 # additional HTML index files: index.hhp, index.hhc, and index.hhk. The

doc/Makefile.am

@@ -1,9 +0,0 @@
-doxyfile.stamp:
-	$(DOXYGEN) Doxyfile
-	echo stamp > doxyfile.stamp
-
-CLEANFILES = doxyfile.stamp
-
-all-local: doxyfile.stamp
-clean-local:
-	rm -rf $(top_srcdir)/doc/man $(top_srcdir)/doc/html

doc/connectivity-loss-by-search-criteria.tex

@@ -0,0 +1,142 @@
+\documentclass[11pt]{article}
+
+\usepackage[utf8x]{inputenc}
+\usepackage[top=2cm,bottom=2cm]{geometry}
+
+\usepackage{forloop}
+\newcounter{counter}
+
+% maths
+\usepackage{amssymb}
+\usepackage{amsmath}
+\usepackage{mathrsfs}
+\usepackage{shadethm}
+\usepackage{amsthm}
+\newshadetheorem{shadeDef}{Definition}[section]
+\newtheorem{remark}{Remark}[section]
+\renewcommand{\P}{\mathbb{P}}
+
+\usepackage{float}
+\usepackage{booktabs}
+
+\setlength{\parindent}{0ex}
+\setlength{\parskip}{0.5em}
+
+\begin{document}
+    \title{Annex 1: Probabilistic analysis of connectivity changes}
+    \author{Adrien Béraud, Simon Désaulniers, Guillaume Roguez}
+    \maketitle
+    \pagestyle{empty}
+    \begin{shadeDef}
+        A node flagged as \emph{``expired''} by a node $n$ is a node which has not responded to any
+        of $n$'s last three requests.
+    \end{shadeDef}
+    \begin{remark}
+        An expired node will not be contacted before 10 minutes from its expiration time.
+    \end{remark}
+
+    Let $N$ the DHT network, $n_0\in N$, a given node and the following probabilistic events:
+    \begin{itemize}
+        \item $A$: $\forall n \in N$ $n$ is unreachable by $n_0$, \emph{i.e.} $n_0$ lost connection
+            with $N$;
+        \item $B$: $S\subset N$, the nodes unreachable by $n_0$ with $k={|S|\over|N|}$;
+        \item $C$: $m \le |N|$ nodes are flagged as ``expired''.
+    \end{itemize}
+
+    We are interested in knowing $\P(A|C)$, \emph{i.e.} the probability of the event where $A$ occurs
+    prior to $C$. From the above, we immediately get
+    $$\left\{
+        \begin{array}{ll}
+            \P(C|A)       & = 1\\
+            \P(A) + \P(B) & = 1
+        \end{array}
+    \right.$$
+    Also, the event $A|C$ can be abstracted as the urn problem of draw without replacement. Then,
+        $$\P(C|B) = \prod_{i=0}^m \left[k|N| - i \over |N|\right] = \prod_{i=0}^m \left[k - { i \over |N| }\right]$$
+    Furthermore, using Bayes' theroem we have
+    \begin{align*}
+        \P(A|C) & = { \P(C|A)\P(A) \over \P(C|A)\P(A) + \P(C|B)\P(B)}\\
+                & = { \P(A) \over \P(A) + \P(C|B)\P(B) }\\
+                & = { \P(A) \over \P(A) + \P(C|B)\left[1 - \P(A)\right] }\\
+        \Rightarrow \forloop{counter}{0}{\value{counter} < 5}{\qquad}\quad  \P(A)  & =
+            \P(A|C)\left[\P(A) + \P(C|B)\left(1 - \P(A)\right) \right] \\
+        \Rightarrow \forloop{counter}{0}{\value{counter} < 2}{\qquad}\;\:\, \P(A)\left[{ 1 \over \P(A|C)} - 1\right] & =
+            \P(C|B)\left(1 - \P(A)\right) \\
+    \end{align*}
+    Finally,
+    \begin{equation}
+        \label{eq:final}
+        \left[{\P(A) \over 1 - \P(A)}\right]\left[{ 1 \over \P(A|C)} - 1\right] =
+            \prod_{i=0}^m \left[k - { i \over |N| }\right]
+    \end{equation}
+
+    From \eqref{eq:final}, we may set a plausible configuration $\{\P(A),\P(A|C),k,|N|\}$ letting us
+    produce results such as in table \ref{tbl:k_1_2}, \ref{tbl:k_2_3} and \ref{tbl:k_3_4}.
+
+    \begin{table}[H]
+        \centering
+        \caption{The values for $m$ assuming $\P(A|C) \ge 0.95,\, k = {1 \over 2}$}
+        \label{tbl:k_1_2}
+        \begin{tabular}{lcccc}
+            \toprule
+            $|N| \diagdown \P(A)$ & ${1 \over 10 }$ & ${1 \over 100 }$ & ${1 \over 1000 }$ & ${1 \over 10000 }$\\
+            \midrule
+            $2^0$               & 1               & 1                & 1                 & 1\\
+            $2^1$               & 1               & 1                & 1                 & 1\\
+            $2^2$               & 2               & 2                & 2                 & 2\\
+            $2^3$               & 4               & 4                & 4                 & 4\\
+            $2^4$               & 5               & 6                & 7                 & 8\\
+            $2^5$               & 5               & 7                & 9                 & 10\\
+            $2^6$               & 6               & 9                & 11                & 13\\
+            $2^7$               & 6               & 9                & 12                & 14\\
+            $2^8$               & 7               & 10               & 13                & 16\\
+            $2^9$               & 7               & 10               & 13                & 16\\
+            $2^{10}$            & 7               & 10               & 13                & 17\\
+            \bottomrule
+        \end{tabular}
+    \end{table}
+    \begin{table}[H]
+        \centering
+        \caption{The values for $m$ assuming $\P(A|C) \ge 0.95,\, k = {2 \over 3}$}
+        \label{tbl:k_2_3}
+        \begin{tabular}{lcccc}
+            \toprule
+            $|N| \diagdown \P(A)$ & ${1 \over 10 }$ & ${1 \over 100 }$ & ${1 \over 1000 }$ & ${1 \over 10000 }$\\
+            \midrule
+            $2^0$               & 1               & 1                & 1                 & 1\\
+            $2^1$               & 2               & 2                & 2                 & 2\\
+            $2^2$               & 3               & 3                & 4                 & 4\\
+            $2^3$               & 5               & 5                & 6                 & 8\\
+            $2^4$               & 6               & 8                & 9                 & 10\\
+            $2^5$               & 8               & 10               & 12                & 14\\
+            $2^6$               & 9               & 13               & 16                & 18\\
+            $2^7$               & 11              & 15               & 18                & 22\\
+            $2^8$               & 11              & 16               & 21                & 25\\
+            $2^9$               & 12              & 17               & 22                & 27\\
+            $2^{10}$            & 12              & 18               & 23                & 28\\
+            \bottomrule
+        \end{tabular}
+    \end{table}
+    \begin{table}[H]
+        \centering
+        \caption{The values for $m$ assuming $\P(A|C) \ge 0.95,\, k = {3 \over 4}$}
+        \label{tbl:k_3_4}
+        \begin{tabular}{lcccc}
+            \toprule
+            $|N| \diagdown \P(A)$ & ${1 \over 10 }$ & ${1 \over 100 }$ & ${1 \over 1000 }$ & ${1 \over 10000 }$\\
+            \midrule
+            $2^0$               & 1               & 1                & 1                 & 1\\
+            $2^1$               & 2               & 2                & 2                 & 2\\
+            $2^2$               & 3               & 3                & 3                 & 3\\
+            $2^3$               & 5               & 6                & 6                 & 6\\
+            $2^4$               & 7               & 9                & 10                & 11\\
+            $2^5$               & 10              & 12               & 14                & 16\\
+            $2^6$               & 12              & 16               & 19                & 22\\
+            $2^7$               & 14              & 19               & 23                & 27\\
+            $2^8$               & 15              & 21               & 27                & 32\\
+            $2^9$               & 16              & 23               & 30                & 36\\
+            $2^{10}$            & 17              & 24               & 31                & 38\\
+            \bottomrule
+        \end{tabular}
+    \end{table}
+\end{document}

doc/dhtnode.1

@@ -0,0 +1,201 @@
+.TH DHTNODE 1 2026-04-18
+.SH NAME
+.B dhtnode
+- a simple OpenDHT command line node runner.
+.SH SYNOPSIS
+.B dhtnode
+[\fB\-h\fR]
+[\fB\-V\fR]
+[\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
+[\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
+[\fB\-n\fR \fInetwork_id\fR]
+[\fB\-p\fR \fIlocal_port\fR]
+[\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
+.SH DESCRIPTION
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Commands available in the interactive shell are:
+.EX
+    h, help    Print this help message.
+    x, quit    Quit the program.
+    log        Start/stop printing DHT logs.
+
+    Node information:
+    ll         Print basic information and stats about the current node.
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.
+
+    Operations on the DHT:
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
+.EE
+.SH OPTIONS
+.TP
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
+.TP
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
+.TP
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
+.TP
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
+.TP
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
+.TP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
+Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
+.TP
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
+.TP
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
+.TP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
+Password to use for private key encryption or decryption (optional).
+.TP
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
+.TP
+\fB\-s\fP, \fB\-\-service\fP
+Run the program in service mode (non\-forking daemon).
+.TP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
+Enables multicast automatic local peer discovery.
+.TP
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
+.TP
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
+.TP
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
+.TP
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
+.TP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
+.TP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
+.SH AUTHORS
+.TP
+Program written by
+.IP \(bu
+.\}
+Adrien Béraud <adrien.beraud@savoirfairelinux.com>
+.TP
+Man page written by
+.IP \(bu
+.\}
+Simon Désaulniers <sim.desaulniers@gmail.com>

docker/Dockerfile

@@ -0,0 +1,20 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps:latest
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake -GNinja .. -DCMAKE_INSTALL_PREFIX=/usr \
+	-DBUILD_TESTING=Off \
+	-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+	-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+	-DOPENDHT_C=On \
+	-DOPENDHT_PEER_DISCOVERY=On \
+	-DOPENDHT_PYTHON=On \
+	-DOPENDHT_TOOLS=On \
+	-DOPENDHT_PROXY_SERVER=On \
+	-DOPENDHT_PROXY_CLIENT=On \
+	-DOPENDHT_SYSTEMD=On \
+	&& ninja && ninja install \
+	&& cd ../.. && rm -rf opendht

docker/DockerfileAlpine

@@ -0,0 +1,39 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps-alpine:latest AS build
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN mkdir /install
+ENV DESTDIR=/install
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+                -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+                -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+                -DBUILD_TESTING=Off \
+                -DOPENDHT_C=On \
+                -DOPENDHT_PEER_DISCOVERY=On \
+                -DOPENDHT_PYTHON=On \
+                -DOPENDHT_TOOLS=On \
+                -DOPENDHT_PROXY_SERVER=On \
+                -DOPENDHT_PROXY_CLIENT=On \
+                -DOPENDHT_SYSTEMD=On \
+	&& make -j8 && make install
+
+FROM alpine:3.24 AS install
+COPY --from=build /install /
+RUN apk add --no-cache \
+        libstdc++ \
+        gnutls \
+        nettle \
+        openssl \
+        argon2-dev \
+        jsoncpp \
+        llhttp \
+        fmt \
+        readline \
+        ncurses
+CMD ["dhtnode", "-b", "bootstrap.jami.net", "-p", "4222", "--proxyserver", "8080"]
+EXPOSE 4222/udp
+EXPOSE 8080/tcp

docker/DockerfileAlpineEdge

@@ -0,0 +1,40 @@
+FROM opendht-alpine-edge-deps:latest AS build
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN mkdir /install
+ENV DESTDIR=/install
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -GNinja -DCMAKE_INSTALL_PREFIX=/usr \
+                -DOPENDHT_DOWNLOAD_DEPS=Off \
+                -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+                -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+                -DOPENDHT_C=On \
+                -DOPENDHT_PEER_DISCOVERY=On \
+                -DOPENDHT_PYTHON=On \
+                -DOPENDHT_TOOLS=On \
+                -DOPENDHT_PROXY_SERVER=On \
+                -DOPENDHT_PROXY_CLIENT=On \
+                -DOPENDHT_SYSTEMD=On \
+	&& ninja && ninja install
+
+FROM alpine:edge AS install
+COPY --from=build /install /
+RUN apk add --no-cache \
+        libstdc++ \
+        gnutls \
+        nettle \
+        openssl \
+        argon2-dev \
+        jsoncpp \
+        llhttp \
+        fmt \
+        simdutf \
+        readline \
+        ncurses
+CMD ["dhtnode", "-b", "bootstrap.jami.net", "-p", "4222", "--proxyserver", "8080"]
+EXPOSE 4222/udp
+EXPOSE 8080/tcp

docker/DockerfileDeps

@@ -0,0 +1,34 @@
+FROM ubuntu:26.04
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apt-get update && apt-get install -y \
+    dialog apt-utils \
+    && apt-get clean \
+    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+RUN apt-get update && apt-get install -y \
+    build-essential pkg-config cmake git wget meson ninja-build \
+    libtool \
+    python3-dev python3-setuptools python3-build python3-virtualenv cython3 \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-cxx-dev \
+    libllhttp-dev libsimdutf-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+    -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio*

docker/DockerfileDepsAlpine

@@ -0,0 +1,28 @@
+FROM alpine:3.24
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apk add --no-cache \
+        build-base cmake ninja git wget \
+        cython python3-dev py3-setuptools \
+        ncurses-dev readline-dev nettle-dev \
+        cppunit-dev gnutls-dev jsoncpp-dev \
+        argon2-dev openssl-dev fmt-dev simdutf-dev \
+        llhttp-dev asio-dev msgpack-cxx-dev \
+    && rm -rf /var/cache/apk/*
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+            -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio*

docker/DockerfileDepsAlpineEdge

@@ -0,0 +1,28 @@
+FROM alpine:edge
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apk add --no-cache \
+        build-base cmake ninja git wget \
+        cython python3-dev py3-setuptools \
+        ncurses-dev readline-dev nettle-dev \
+        cppunit-dev gnutls-dev jsoncpp-dev \
+        argon2-dev openssl-dev fmt-dev simdutf-dev \
+        llhttp-dev asio-dev msgpack-cxx-dev \
+    && rm -rf /var/cache/apk/*
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+            -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -GNinja -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+             -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+             -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && ninja && ninja install \
+    && cd ../../ && rm -rf restinio*

docker/DockerfileDepsFocal

@@ -0,0 +1,48 @@
+FROM ubuntu:20.04
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apt-get update && apt-get install -y \
+    dialog apt-utils \
+    && apt-get clean \
+    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+RUN apt-get update && apt-get install -y \
+    build-essential pkg-config cmake git wget \
+    libtool \
+    python3-dev python3-setuptools python3-pip \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+RUN pip3 install meson Cython
+
+ARG SIMDUTF_VERSION=8.0.0
+RUN mkdir simdutf \
+    && wget -q "https://github.com/simdutf/simdutf/archive/refs/tags/v${SIMDUTF_VERSION}.tar.gz" -O simdutf.tar.gz \
+    && tar -xzf simdutf.tar.gz -C simdutf --strip-components=1 \
+    && cmake -S simdutf -B simdutf/build -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DBUILD_SHARED_LIBS=OFF -DSIMDUTF_TESTS=OFF -DSIMDUTF_TOOLS=OFF \
+    && cmake --build simdutf/build --parallel 2 \
+    && cmake --install simdutf/build \
+    && install -D simdutf/LICENSE-MIT /usr/share/doc/simdutf/LICENSE-MIT \
+    && install -D simdutf/LICENSE-APACHE /usr/share/doc/simdutf/LICENSE-APACHE \
+    && rm -rf simdutf simdutf.tar.gz
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+    -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio*

docker/DockerfileDepsLlvm

@@ -0,0 +1,39 @@
+FROM ubuntu:26.04
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apt-get update && apt-get install -y \
+    dialog apt-utils \
+    && apt-get clean \
+    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+RUN apt-get update \
+    && apt-get install -y llvm llvm-dev lldb clang gdb make cmake meson pkg-config \
+    libtool git wget libncurses5-dev libreadline-dev \
+    nettle-dev libgnutls28-dev libuv1-dev libmsgpack-cxx-dev libjsoncpp-dev python3-dev \
+    python3-setuptools libcppunit-dev python3-pip python3-build python3-virtualenv \
+    libssl-dev libargon2-dev libllhttp-dev libsimdutf-dev \
+    libfmt-dev libasio-dev \
+    && apt-get remove -y gcc g++ && apt-get autoremove -y \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+RUN pip3 install Cython --break-system-packages
+
+ENV CC=cc
+ENV CXX=c++
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+    -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio*

docker/DockerfileDepsNoble

@@ -0,0 +1,56 @@
+FROM ubuntu:24.04
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+RUN apt-get update && apt-get install -y \
+    dialog apt-utils \
+    && apt-get clean \
+    && echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+RUN apt-get update && apt-get install -y \
+    build-essential pkg-config cmake git wget meson ninja-build patchelf \
+    libtool \
+    python3-dev python3-setuptools python3-build python3-virtualenv cython3 \
+    libncurses5-dev libreadline-dev nettle-dev libcppunit-dev \
+    libgnutls28-dev libuv1-dev libjsoncpp-dev libargon2-dev \
+    libssl-dev libfmt-dev libasio-dev libmsgpack-cxx-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+ARG LLHTTP_VERSION=9.2.1
+RUN mkdir llhttp \
+    && wget -q "https://github.com/nodejs/llhttp/archive/refs/tags/release/v${LLHTTP_VERSION}.tar.gz" -O llhttp.tar.gz \
+    && tar -xzf llhttp.tar.gz -C llhttp --strip-components=1 \
+    && cmake -S llhttp -B llhttp/build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr \
+    && cmake --build llhttp/build --parallel 2 \
+    && cmake --install llhttp/build \
+    && rm -rf llhttp llhttp.tar.gz
+
+ARG SIMDUTF_VERSION=8.0.0
+RUN mkdir simdutf \
+    && wget -q "https://github.com/simdutf/simdutf/archive/refs/tags/v${SIMDUTF_VERSION}.tar.gz" -O simdutf.tar.gz \
+    && tar -xzf simdutf.tar.gz -C simdutf --strip-components=1 \
+    && cmake -S simdutf -B simdutf/build -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DBUILD_SHARED_LIBS=OFF -DSIMDUTF_TESTS=OFF -DSIMDUTF_TOOLS=OFF \
+    && cmake --build simdutf/build --parallel 2 \
+    && cmake --install simdutf/build \
+    && install -D simdutf/LICENSE-MIT /usr/share/doc/simdutf/LICENSE-MIT \
+    && install -D simdutf/LICENSE-APACHE /usr/share/doc/simdutf/LICENSE-APACHE \
+    && rm -rf simdutf simdutf.tar.gz
+
+RUN mkdir /usr/include/nonstd \
+    && wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp \
+    -O /usr/include/nonstd/expected.hpp
+
+ARG RESTINIO_VERSION=0.7.10
+RUN echo "*** Downloading RESTinio ***" \
+    && mkdir restinio && cd restinio \
+    && wget "https://github.com/Stiffstream/restinio/releases/download/v${RESTINIO_VERSION}/restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && ls -l && tar -xjf "restinio-${RESTINIO_VERSION}.tar.bz2" \
+    && cd "restinio-${RESTINIO_VERSION}/dev" \
+    && cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off \
+    -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system \
+    -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system . \
+    && make -j2 && make install \
+    && cd ../../ && rm -rf restinio* \
+    && ldconfig

docker/DockerfileDhtnode

@@ -0,0 +1,4 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht:latest
+CMD ["dhtnode", "-b", "bootstrap.jami.net", "-p", "4222", "--proxyserver", "8080"]
+EXPOSE 4222/udp
+EXPOSE 8080/tcp

docker/DockerfileFocal

@@ -0,0 +1,19 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps-focal:latest
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+				-DBUILD_TESTING=Off \
+				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+				-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+				-DOPENDHT_C=On \
+				-DOPENDHT_PEER_DISCOVERY=On \
+				-DOPENDHT_PYTHON=On \
+				-DOPENDHT_TOOLS=On \
+				-DOPENDHT_PROXY_SERVER=On \
+				-DOPENDHT_PROXY_CLIENT=On \
+	&& make -j8 && make install \
+	&& cd ../.. && rm -rf opendht

docker/DockerfileLlvm

@@ -0,0 +1,19 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps-llvm:latest
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+				-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+				-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+				-DOPENDHT_C=On \
+				-DOPENDHT_PEER_DISCOVERY=On \
+				-DOPENDHT_PYTHON=On \
+				-DOPENDHT_TOOLS=On \
+				-DOPENDHT_PROXY_SERVER=On \
+				-DOPENDHT_PROXY_CLIENT=On \
+				-DOPENDHT_SYSTEMD=On \
+	&& make -j8 && make install \
+	&& cd ../.. && rm -rf opendht

docker/DockerfileNoble

@@ -0,0 +1,20 @@
+FROM ghcr.io/savoirfairelinux/opendht/opendht-deps-noble:latest
+LABEL maintainer="Adrien Béraud <adrien.beraud@savoirfairelinux.com>"
+LABEL org.opencontainers.image.source=https://github.com/savoirfairelinux/opendht
+
+COPY . opendht
+
+RUN cd opendht && mkdir build && cd build \
+	&& cmake .. -DCMAKE_INSTALL_PREFIX=/usr \
+	-DBUILD_TESTING=Off \
+	-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=On \
+	-DCMAKE_BUILD_TYPE=RelWithDebInfo \
+	-DOPENDHT_C=On \
+	-DOPENDHT_PEER_DISCOVERY=On \
+	-DOPENDHT_PYTHON=On \
+	-DOPENDHT_TOOLS=On \
+	-DOPENDHT_PROXY_SERVER=On \
+	-DOPENDHT_PROXY_CLIENT=On \
+	-DOPENDHT_SYSTEMD=On \
+	&& make -j8 && make install \
+	&& cd ../.. && rm -rf opendht

include/opendht.h

@@ -1,38 +1,6 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
-#include "opendht/dht.h"
-#include "opendht/value.h"
-#include "opendht/infohash.h"
-#include "opendht/securedht.h"
 #include "opendht/dhtrunner.h"
 #include "opendht/default_types.h"

include/opendht/callbacks.h

@@ -0,0 +1,211 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "infohash.h"
+#include "value.h"
+
+#include <vector>
+#include <memory>
+#include <functional>
+#include <string>
+
+#ifdef OPENDHT_JSONCPP
+#include <json/json.h>
+#endif
+
+namespace dht {
+
+struct Node;
+
+/**
+ * Current status of a DHT node.
+ */
+enum class NodeStatus {
+    Disconnected, // 0 nodes
+    Connecting,   // bootstrap pending or 1+ nodes
+    Connected     // 1+ good nodes
+};
+
+inline constexpr std::string_view
+statusToStr(NodeStatus status)
+{
+    return status == NodeStatus::Connected ? "connected"sv
+                                           : (status == NodeStatus::Connecting ? "connecting"sv : "disconnected"sv);
+}
+
+struct OPENDHT_PUBLIC NodeStats
+{
+    unsigned good_nodes {0}, dubious_nodes {0}, cached_nodes {0}, incoming_nodes {0};
+    unsigned table_depth {0};
+    unsigned searches {0};
+    unsigned node_cache_size {0};
+    unsigned getKnownNodes() const { return good_nodes + dubious_nodes; }
+    unsigned long getNetworkSizeEstimation() const { return 8 * std::exp2(table_depth); }
+    std::string toString() const;
+
+#ifdef OPENDHT_JSONCPP
+    /**
+     * Build a json object from a NodeStats
+     */
+    Json::Value toJson() const;
+    NodeStats() {};
+    explicit NodeStats(const Json::Value& v);
+#endif
+
+    MSGPACK_DEFINE_MAP(good_nodes, dubious_nodes, cached_nodes, incoming_nodes, table_depth, searches, node_cache_size)
+};
+
+struct OPENDHT_PUBLIC NodeInfo
+{
+    InfoHash id;
+    InfoHash node_id;
+    NodeStats ipv4 {};
+    NodeStats ipv6 {};
+    size_t ongoing_ops {0};
+    size_t storage_values {0};
+    size_t storage_size {0};
+    size_t local_storage_values {0};
+    size_t local_storage_size {0};
+    in_port_t bound4 {0};
+    in_port_t bound6 {0};
+
+#ifdef OPENDHT_JSONCPP
+    /**
+     * Build a json object from a NodeStats
+     */
+    Json::Value toJson() const;
+    NodeInfo() {};
+    explicit NodeInfo(const Json::Value& v);
+#endif
+
+    MSGPACK_DEFINE_MAP(id,
+                       node_id,
+                       ipv4,
+                       ipv6,
+                       ongoing_ops,
+                       storage_values,
+                       storage_size,
+                       local_storage_values,
+                       local_storage_size,
+                       bound4,
+                       bound6)
+};
+
+/**
+ * Dht configuration.
+ */
+struct OPENDHT_PUBLIC Config
+{
+    /** DHT node ID */
+    InfoHash node_id {};
+
+    /**
+     * DHT network ID. A node will only talk with other nodes having
+     * the same network ID.
+     * Network ID 0 (default) represents the main public network.
+     */
+    NetId network {0};
+
+    /** For testing purposes only, enables bootstrap mode */
+    bool is_bootstrap {false};
+
+    /** Makes the DHT responsible to maintain its stored values. Consumes more ressources. */
+    bool maintain_storage {false};
+
+    /** If set, the dht will load its state from this file on start and save its state in this file on shutdown */
+    std::string persist_path {};
+
+    /** If non-0, overrides the default global rate-limit. -1 means no limit. */
+    ssize_t max_req_per_sec {0};
+
+    /** If non-0, overrides the default per-IP address rate-limit. -1 means no limit. */
+    ssize_t max_peer_req_per_sec {0};
+
+    /* If non-0, overrides the default maximum number of searches. -1 means no limit.  */
+    ssize_t max_searches {0};
+
+    /* If non-0, overrides the default maximum store size for remote values. -1 means no limit.  */
+    ssize_t max_store_size {0};
+
+    /* If non-0, overrides the default maximum store size for locally stored values. -1 means no limit.  */
+    ssize_t max_local_store_size {0};
+
+    /* If non-0, overrides the default maximum store key count. -1 means no limit.  */
+    ssize_t max_store_keys {0};
+
+    /**
+     * Use appropriate bahavior for a public IP, stable node:
+     *   - No connectivity change triggered when a search fails
+     *   - Larger listen refresh time
+     */
+    bool public_stable {false};
+
+    /* Client mode, node will not be used by other nodes to store data. */
+    bool client_mode {false};
+};
+
+/**
+ * SecureDht configuration.
+ */
+struct OPENDHT_PUBLIC SecureDhtConfig
+{
+    Config node_config {};
+    crypto::Identity id {};
+
+    /**
+     * Cache all encountered public keys and certificates,
+     * for use by the certificate store, putEncrypted and putSigned
+     */
+    bool cert_cache_all {false};
+};
+
+enum class OPENDHT_PUBLIC PushNotificationResult : uint8_t {
+    /* success codes */
+    PutRefresh,
+    ListenRefresh,
+    Values,
+    ValuesExpired,
+    /* ignored/error codes */
+    IgnoredWrongSession = 0x80,
+    IgnoredNoOp,
+    IgnoredStopped,
+    IgnoredDisabled,
+    Error
+};
+
+static constexpr size_t STORAGE_LIMIT_DEFAULT {1024 * 1024 * 64};
+static constexpr size_t STORAGE_LIMIT_UNLIMITED {(size_t) -1};
+
+using ValuesExport = std::pair<InfoHash, Blob>;
+
+using QueryCallback = std::function<bool(const std::vector<std::shared_ptr<FieldValueIndex>>& fields)>;
+using GetCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>& values)>;
+using ValueCallback = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired)>;
+using GetCallbackSimple = std::function<bool(std::shared_ptr<Value> value)>;
+using ShutdownCallback = std::function<void()>;
+using IdentityAnnouncedCb = std::function<void(bool)>;
+using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;
+
+using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;
+
+using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;
+using DoneCallbackSimple = std::function<void(bool success)>;
+
+typedef bool (*GetCallbackRaw)(std::shared_ptr<Value>, void* user_data);
+typedef bool (*ValueCallbackRaw)(std::shared_ptr<Value>, bool expired, void* user_data);
+typedef void (*DoneCallbackRaw)(bool, std::vector<std::shared_ptr<Node>>*, void* user_data);
+typedef void (*ShutdownCallbackRaw)(void* user_data);
+typedef void (*DoneCallbackSimpleRaw)(bool, void* user_data);
+typedef bool (*FilterRaw)(const Value&, void* user_data);
+
+OPENDHT_PUBLIC GetCallbackSimple bindGetCb(GetCallbackRaw raw_cb, void* user_data);
+OPENDHT_PUBLIC GetCallback bindGetCb(GetCallbackSimple cb);
+OPENDHT_PUBLIC ValueCallback bindValueCb(ValueCallbackRaw raw_cb, void* user_data);
+OPENDHT_PUBLIC ShutdownCallback bindShutdownCb(ShutdownCallbackRaw shutdown_cb_raw, void* user_data);
+OPENDHT_PUBLIC DoneCallback bindDoneCb(DoneCallbackSimple donecb);
+OPENDHT_PUBLIC DoneCallback bindDoneCb(DoneCallbackRaw raw_cb, void* user_data);
+OPENDHT_PUBLIC DoneCallbackSimple bindDoneCbSimple(DoneCallbackSimpleRaw raw_cb, void* user_data);
+OPENDHT_PUBLIC Value::Filter bindFilterRaw(FilterRaw raw_filter, void* user_data);
+
+} // namespace dht

include/opendht/crypto.h

@@ -1,113 +1,147 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
 #include "infohash.h"
+#include "utils.h"
+#include "rng.h"
 
 extern "C" {
 #include <gnutls/gnutls.h>
 #include <gnutls/abstract.h>
 #include <gnutls/x509.h>
+#include <gnutls/ocsp.h>
 }
 
 #include <vector>
 #include <memory>
+#include <atomic>
+#include <mutex>
+#include <string_view>
 
-typedef std::vector<uint8_t> Blob;
+#ifdef _WIN32
+#include <iso646.h>
+#endif
 
 namespace dht {
+
+/**
+ * Contains all crypto primitives
+ */
 namespace crypto {
 
+class OPENDHT_PUBLIC CryptoException : public std::runtime_error
+{
+public:
+    explicit CryptoException(const std::string& str)
+        : std::runtime_error(str) {};
+    explicit CryptoException(const char* str)
+        : std::runtime_error(str) {};
+    CryptoException(const CryptoException& e) noexcept = default;
+    CryptoException& operator=(const CryptoException&) noexcept = default;
+};
+
+/**
+ * Exception thrown when a decryption error happened.
+ */
+class OPENDHT_PUBLIC DecryptError : public CryptoException
+{
+public:
+    explicit DecryptError(const std::string& str)
+        : CryptoException(str) {};
+    explicit DecryptError(const char* str)
+        : CryptoException(str) {};
+    DecryptError(const DecryptError& e) noexcept = default;
+    DecryptError& operator=(const DecryptError&) noexcept = default;
+};
+
 struct PrivateKey;
 struct Certificate;
+class RevocationList;
 
-typedef std::pair<std::shared_ptr<PrivateKey>, std::shared_ptr<Certificate>> Identity;
-
-class CryptoException : public std::runtime_error {
-    public:
-        CryptoException(const std::string& str) : std::runtime_error(str) {};
-};
-
-/**
- * Exception thrown when an expected decryption failed.
- */
-class DecryptError : public CryptoException {
-    public:
-        DecryptError(const std::string& str = "") : CryptoException(str) {};
-};
-
-/**
- * Generate an RSA key pair (2048 bits) and a certificate.
- * @param name the name used in the generated certificate
- * @param ca if set, the certificate authority that will sign the generated certificate.
- *           If not set, the generated certificate will be a self-signed CA.
- * @param key_length stength of the generated provste key (bits).
- */
-Identity generateIdentity(const std::string& name = "dhtnode", Identity ca = {}, unsigned key_length = 4096);
+using Identity = std::pair<std::shared_ptr<PrivateKey>, std::shared_ptr<Certificate>>;
 
 /**
  * A public key.
  */
-struct PublicKey
+struct OPENDHT_PUBLIC PublicKey
 {
-    PublicKey() {}
-    PublicKey(gnutls_pubkey_t k) : pk(k) {}
-    PublicKey(const Blob& pk);
-    PublicKey(PublicKey&& o) noexcept : pk(o.pk) { o.pk = nullptr; };
+    PublicKey();
+
+    /**
+     * Takes ownership of an existing gnutls_pubkey.
+     */
+    PublicKey(gnutls_pubkey_t k)
+        : pk(k)
+    {}
+
+    /** Import public key from serialized data */
+    PublicKey(const uint8_t* dat, size_t dat_size);
+    PublicKey(const Blob& pk)
+        : PublicKey(pk.data(), pk.size())
+    {}
+    PublicKey(std::string_view pk)
+        : PublicKey((const uint8_t*) pk.data(), pk.size())
+    {}
+    PublicKey(PublicKey&& o) noexcept
+        : pk(o.pk)
+    {
+        o.pk = nullptr;
+    }
 
     ~PublicKey();
-    operator bool() const { return pk; }
+    explicit operator bool() const { return pk; }
+    bool operator==(const PublicKey& o) const { return pk == o.pk || getLongId() == o.getLongId(); }
+    bool operator!=(const PublicKey& o) const { return !(*this == o); }
 
     PublicKey& operator=(PublicKey&& o) noexcept;
 
-    InfoHash getId() const;
-    bool checkSignature(const Blob& data, const Blob& signature) const;
-    Blob encrypt(const Blob&) const;
+    /**
+     * Get public key fingerprint
+     */
+    const InfoHash& getId() const;
 
+    /**
+     * Get public key long fingerprint
+     */
+    const PkId& getLongId() const;
+
+    bool checkSignature(const uint8_t* data, size_t data_len, const uint8_t* signature, size_t signature_len) const;
+    inline bool checkSignature(const Blob& data, const Blob& signature) const
+    {
+        return checkSignature(data.data(), data.size(), signature.data(), signature.size());
+    }
+
+    Blob encrypt(const uint8_t* data, size_t data_len) const;
+    inline Blob encrypt(const Blob& data) const { return encrypt(data.data(), data.size()); }
+    inline Blob encrypt(std::string_view data) const { return encrypt((const uint8_t*) data.data(), data.size()); }
     void pack(Blob& b) const;
+    int pack(uint8_t* out, size_t* out_len) const;
     void unpack(const uint8_t* dat, size_t dat_size);
 
-    template <typename Packer>
+    std::string toString() const;
+
+    template<typename Packer>
     void msgpack_pack(Packer& p) const
     {
         Blob b;
         pack(b);
         p.pack_bin(b.size());
-        p.pack_bin_body((const char*)b.data(), b.size());
+        p.pack_bin_body((const char*) b.data(), b.size());
     }
 
-    void msgpack_unpack(msgpack::object o);
+    void msgpack_unpack(const msgpack::object& o);
+
+    gnutls_digest_algorithm_t getPreferredDigest() const;
+
+    gnutls_pubkey_t pk {nullptr};
 
-    gnutls_pubkey_t pk {};
 private:
+    mutable InfoHash cachedId_ {};
+    mutable PkId cachedLongId_ {};
+    mutable std::atomic_bool idCached_ {false};
+    mutable std::atomic_bool longIdCached_ {false};
+
     PublicKey(const PublicKey&) = delete;
     PublicKey& operator=(const PublicKey&) = delete;
     void encryptBloc(const uint8_t* src, size_t src_size, uint8_t* dst, size_t dst_size) const;
@@ -116,76 +150,316 @@ private:
 /**
  * A private key, including the corresponding public key.
  */
-struct PrivateKey
+struct OPENDHT_PUBLIC PrivateKey
 {
     PrivateKey();
-    //PrivateKey(gnutls_privkey_t k) : key(k) {}
+    // PrivateKey(gnutls_privkey_t k) : key(k) {}
+
+    /**
+     * Takes ownership of an existing gnutls_x509_privkey.
+     */
     PrivateKey(gnutls_x509_privkey_t k);
+
     PrivateKey(PrivateKey&& o) noexcept;
     PrivateKey& operator=(PrivateKey&& o) noexcept;
 
-    PrivateKey(const Blob& import, const std::string& password = {});
+    PrivateKey(const uint8_t* src, size_t src_size, const char* password = nullptr);
+    PrivateKey(const Blob& src, const std::string& password = {})
+        : PrivateKey(src.data(), src.size(), password.c_str())
+    {}
+    PrivateKey(std::string_view src, const std::string& password = {})
+        : PrivateKey((const uint8_t*) src.data(), src.size(), password.c_str())
+    {}
+
     ~PrivateKey();
-    operator bool() const { return key; }
-    PublicKey getPublicKey() const;
+    explicit operator bool() const { return key; }
+
+    const PublicKey& getPublicKey() const;
+    const std::shared_ptr<PublicKey>& getSharedPublicKey() const;
+
+    int serialize(uint8_t* out, size_t* out_len, const std::string& password = {}) const;
     Blob serialize(const std::string& password = {}) const;
 
     /**
      * Sign the provided binary object.
-     * @returns the signed data.
+     * @returns the signature data.
      */
-    Blob sign(const Blob&) const;
+    Blob sign(const uint8_t* data, size_t data_len) const;
+    inline Blob sign(std::string_view dat) const { return sign((const uint8_t*) dat.data(), dat.size()); }
+    inline Blob sign(const Blob& dat) const { return sign(dat.data(), dat.size()); }
 
     /**
      * Try to decrypt the provided cypher text.
      * In case of failure a CryptoException is thrown.
      * @returns the decrypted data.
      */
-    Blob decrypt(const Blob& cypher) const;
+    Blob decrypt(const uint8_t* cypher, size_t cypher_len) const;
+    Blob decrypt(const Blob& cypher) const { return decrypt(cypher.data(), cypher.size()); }
 
     /**
      * Generate a new RSA key pair
      * @param key_length : size of the modulus in bits
      *      Minimim value: 2048
      *      Recommended values: 4096, 8192
+     * @param algo : the public key algorithm to use, GNUTLS_PK_RSA or GNUTLS_PK_RSA_OAEP
      */
-    static PrivateKey generate(unsigned key_length = 4096);
+    static PrivateKey generate(unsigned key_length = 4096, gnutls_pk_algorithm_t algo = GNUTLS_PK_RSA);
+
+    /**
+     * Generate a new EC key pair
+     * @param curve : the elliptic curve to use. If GNUTLS_ECC_CURVE_INVALID is provided, the default curve will be used
+     * (currently GNUTLS_ECC_CURVE_SECP384R1).
+     */
+    static PrivateKey generateEC(gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID);
 
     gnutls_privkey_t key {};
     gnutls_x509_privkey_t x509_key {};
+
 private:
     PrivateKey(const PrivateKey&) = delete;
     PrivateKey& operator=(const PrivateKey&) = delete;
     Blob decryptBloc(const uint8_t* src, size_t src_size) const;
 
-    friend dht::crypto::Identity dht::crypto::generateIdentity(const std::string&, dht::crypto::Identity, unsigned key_length);
+    mutable std::mutex publicKeyMutex_;
+    mutable std::shared_ptr<PublicKey> publicKey_ {};
 };
 
-struct Certificate {
-    Certificate() {}
+class OPENDHT_PUBLIC RevocationList
+{
+    using clock = std::chrono::system_clock;
+    using time_point = clock::time_point;
+    using duration = clock::duration;
+
+public:
+    RevocationList();
+    RevocationList(const Blob& b);
+    RevocationList(RevocationList&& o) noexcept
+        : crl(o.crl)
+    {
+        o.crl = nullptr;
+    }
+    ~RevocationList();
+
+    RevocationList& operator=(RevocationList&& o)
+    {
+        crl = o.crl;
+        o.crl = nullptr;
+        return *this;
+    }
+
+    void pack(Blob& b) const;
+    void unpack(const uint8_t* dat, size_t dat_size);
+    Blob getPacked() const
+    {
+        Blob b;
+        pack(b);
+        return b;
+    }
+
+    template<typename Packer>
+    void msgpack_pack(Packer& p) const
+    {
+        Blob b = getPacked();
+        p.pack_bin(b.size());
+        p.pack_bin_body((const char*) b.data(), b.size());
+    }
+
+    void msgpack_unpack(const msgpack::object& o);
+
+    void revoke(const Certificate& crt, time_point t = time_point::min());
+
+    bool isRevoked(const Certificate& crt) const;
+
+    /**
+     * Sign this revocation list using provided key and certificate.
+     * Validity_period sets the duration until next update (default to no next update).
+     * If `number` is non-zero, it is stored verbatim (big-endian) as the CRL Number
+     * extension. Otherwise the number is initialized randomly on the first signature
+     * and incremented on subsequent ones.
+     */
+    void sign(const PrivateKey&, const Certificate&, duration validity_period = {}, uint64_t number = 0);
+    void sign(const Identity& id, duration validity_period = {}, uint64_t number = 0)
+    {
+        sign(*id.first, *id.second, validity_period, number);
+    }
+
+    bool isSignedBy(const Certificate& issuer) const;
+
+    std::string toString() const;
+
+    /**
+     * Read the CRL number extension field.
+     */
+    Blob getNumber() const;
+
+    /** Read CRL issuer Common Name (CN) */
+    std::string getIssuerName() const;
+
+    /** Read CRL issuer User ID (UID) */
+    std::string getIssuerUID() const;
+
+    time_point getUpdateTime() const;
+    time_point getNextUpdateTime() const;
+
+    gnutls_x509_crl_t get() { return crl; }
+    gnutls_x509_crl_t getCopy() const
+    {
+        if (not crl)
+            return nullptr;
+        auto copy = RevocationList(getPacked());
+        gnutls_x509_crl_t ret = copy.crl;
+        copy.crl = nullptr;
+        return ret;
+    }
+
+private:
+    gnutls_x509_crl_t crl {};
+    RevocationList(const RevocationList&) = delete;
+    RevocationList& operator=(const RevocationList&) = delete;
+};
+
+enum class NameType { UNKNOWN = 0, RFC822, DNS, URI, IP };
+
+class OPENDHT_PUBLIC CertificateRequest
+{
+public:
+    CertificateRequest();
+    CertificateRequest(const uint8_t* data, size_t size);
+    CertificateRequest(std::string_view src)
+        : CertificateRequest((const uint8_t*) src.data(), src.size())
+    {}
+    CertificateRequest(const Blob& data)
+        : CertificateRequest(data.data(), data.size())
+    {}
+
+    CertificateRequest(CertificateRequest&& o) noexcept
+        : request(std::move(o.request))
+    {
+        o.request = nullptr;
+    }
+    CertificateRequest& operator=(CertificateRequest&& o) noexcept;
+
+    ~CertificateRequest();
+
+    void setName(const std::string& name);
+    void setUID(const std::string& name);
+    void setAltName(NameType type, const std::string& name);
+
+    std::string getName() const;
+    std::string getUID() const;
+
+    void sign(const PrivateKey& key, const std::string& password = {});
+
+    bool verify() const;
+
+    Blob pack() const;
+    std::string toString() const;
+
+    gnutls_x509_crq_t get() const { return request; }
+
+private:
+    CertificateRequest(const CertificateRequest& o) = delete;
+    CertificateRequest& operator=(const CertificateRequest& o) = delete;
+    gnutls_x509_crq_t request {nullptr};
+};
+
+class OPENDHT_PUBLIC OcspRequest
+{
+public:
+    OcspRequest(gnutls_ocsp_req_t r)
+        : request(r)
+    {}
+    OcspRequest(const uint8_t* dat_ptr, size_t dat_size);
+    OcspRequest(std::string_view dat)
+        : OcspRequest((const uint8_t*) dat.data(), dat.size())
+    {}
+    ~OcspRequest();
+
+    /*
+     * Get OCSP Request in readable format.
+     */
+    std::string toString(const bool compact = true) const;
+
+    Blob pack() const;
+    Blob getNonce() const;
+
+private:
+    gnutls_ocsp_req_t request;
+};
+
+class OPENDHT_PUBLIC OcspResponse
+{
+public:
+    OcspResponse(const uint8_t* dat_ptr, size_t dat_size);
+    OcspResponse(std::string_view response)
+        : OcspResponse((const uint8_t*) response.data(), response.size())
+    {}
+    ~OcspResponse();
+
+    Blob pack() const;
+    /*
+     * Get OCSP Response in readable format.
+     */
+    std::string toString(const bool compact = true) const;
+
+    /*
+     * Get OCSP response certificate status.
+     * Return certificate status.
+     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-cert-status-t
+     */
+    gnutls_ocsp_cert_status_t getCertificateStatus() const;
+
+    /*
+     * Verify OCSP response and return OCSP status.
+     * Throws CryptoException in case of error in the response.
+     * http://www.gnu.org/software/gnutls/reference/gnutls-ocsp.html#gnutls-ocsp-verify-reason-t
+     */
+    gnutls_ocsp_cert_status_t verifyDirect(const Certificate& crt, const Blob& nonce);
+
+private:
+    gnutls_ocsp_resp_t response;
+};
+
+struct OPENDHT_PUBLIC Certificate
+{
+    Certificate() noexcept {}
 
     /**
      * Take ownership of existing gnutls structure
      */
-    Certificate(gnutls_x509_crt_t crt) : cert(crt) {}
+    Certificate(gnutls_x509_crt_t crt) noexcept
+        : cert(crt)
+    {}
 
-    Certificate(Certificate&& o) noexcept : cert(o.cert), issuer(std::move(o.issuer)) { o.cert = nullptr; };
+    Certificate(Certificate&& o) noexcept
+        : cert(o.cert)
+        , issuer(std::move(o.issuer))
+        , publicKey_(std::move(o.publicKey_))
+    {
+        o.cert = nullptr;
+    };
 
     /**
      * Import certificate (PEM or DER) or certificate chain (PEM),
      * ordered from subject to issuer
      */
     Certificate(const Blob& crt);
-    Certificate(const uint8_t* dat, size_t dat_size) {
+    Certificate(const uint8_t* dat, size_t dat_size)
+        : cert(nullptr)
+    {
         unpack(dat, dat_size);
     }
+    Certificate(std::string_view pem)
+        : Certificate((const uint8_t*) pem.data(), pem.size())
+    {}
 
     /**
      * Import certificate chain (PEM or DER),
      * ordered from subject to issuer
      */
     template<typename Iterator>
-    Certificate(const Iterator& begin, const Iterator& end) {
+    Certificate(const Iterator& begin, const Iterator& end)
+    {
         unpack(begin, end);
     }
 
@@ -194,7 +468,8 @@ struct Certificate {
      * ordered from subject to issuer
      */
     template<typename Iterator>
-    Certificate(const std::vector<std::pair<Iterator, Iterator>>& certs) {
+    Certificate(const std::vector<std::pair<Iterator, Iterator>>& certs)
+    {
         unpack(certs);
     }
 
@@ -203,12 +478,21 @@ struct Certificate {
 
     void pack(Blob& b) const;
     void unpack(const uint8_t* dat, size_t dat_size);
-    Blob getPacked() const {
+    Blob getPacked() const
+    {
         Blob b;
         pack(b);
         return b;
     }
 
+    /**
+     * Import certificate chain (PEM or DER).
+     * Certificates are not checked during import.
+     *
+     * Iterator is the type of an iterator or pointer to
+     * gnutls_x509_crt_t or Blob instances to import, that should be
+     * ordered from subject to issuer.
+     */
     template<typename Iterator>
     void unpack(const Iterator& begin, const Iterator& end)
     {
@@ -225,10 +509,16 @@ struct Certificate {
         *this = first ? std::move(*first) : Certificate();
     }
 
-
     /**
-     * Import certificate chain (PEM or DER),
-     * ordered from subject to issuer
+     * Import certificate chain (PEM or DER).
+     * Certificates are not checked during import.
+     *
+     * Iterator is the type of an iterator or pointer to the bytes of
+     * the certificates to import.
+     *
+     * @param certs list of (begin, end) iterator pairs, pointing to the
+     *              PEM or DER certificate data to import, that should be
+     *              ordered from subject to issuer.
      */
     template<typename Iterator>
     void unpack(const std::vector<std::pair<Iterator, Iterator>>& certs)
@@ -238,7 +528,7 @@ struct Certificate {
         for (auto li = certs.rbegin(); li != certs.rend(); ++li) {
             Certificate tmp_crt;
             gnutls_x509_crt_init(&tmp_crt.cert);
-            const gnutls_datum_t crt_dt {(uint8_t*)&(*li->first), (unsigned)(li->second-li->first)};
+            const gnutls_datum_t crt_dt {(uint8_t*) &(*li->first), (unsigned) (li->second - li->first)};
             int err = gnutls_x509_crt_import(tmp_crt.cert, &crt_dt, GNUTLS_X509_FMT_PEM);
             if (err != GNUTLS_E_SUCCESS)
                 err = gnutls_x509_crt_import(tmp_crt.cert, &crt_dt, GNUTLS_X509_FMT_DER);
@@ -250,22 +540,30 @@ struct Certificate {
         *this = tmp_issuer ? std::move(*tmp_issuer) : Certificate();
     }
 
-    template <typename Packer>
+    template<typename Packer>
     void msgpack_pack(Packer& p) const
     {
         Blob b;
         pack(b);
         p.pack_bin(b.size());
-        p.pack_bin_body((const char*)b.data(), b.size());
+        p.pack_bin_body((const char*) b.data(), b.size());
     }
 
-    void msgpack_unpack(msgpack::object o);
+    void msgpack_unpack(const msgpack::object& o);
 
-    operator bool() const { return cert; }
-    PublicKey getPublicKey() const;
+    explicit operator bool() const { return cert; }
+    const PublicKey& getPublicKey() const;
+    const std::shared_ptr<PublicKey>& getSharedPublicKey() const;
 
     /** Same as getPublicKey().getId() */
-    InfoHash getId() const;
+    const InfoHash& getId() const;
+    /** Same as getPublicKey().getLongId() */
+    const PkId& getLongId() const;
+
+    Blob getSerialNumber() const;
+
+    /** Read certificate full DN as described in RFC4514 */
+    std::string getDN() const;
 
     /** Read certificate Common Name (CN) */
     std::string getName() const;
@@ -273,19 +571,24 @@ struct Certificate {
     /** Read certificate User ID (UID) */
     std::string getUID() const;
 
+    /** Read certificate issuer DN as described in RFC4514 */
+    std::string getIssuerDN() const;
+
     /** Read certificate issuer Common Name (CN) */
     std::string getIssuerName() const;
 
     /** Read certificate issuer User ID (UID) */
     std::string getIssuerUID() const;
 
-    enum class NameType { UNKNOWN = 0, RFC822, DNS, URI, IP };
-
     /** Read certificate alternative names */
     std::vector<std::pair<NameType, std::string>> getAltNames() const;
 
+    std::chrono::system_clock::time_point getActivation() const;
+    std::chrono::system_clock::time_point getExpiration() const;
+
     /**
-     * Returns true if the certificate is marked as a Certificate Authority.
+     * Returns true if the certificate is marked as a Certificate Authority
+     * and has necessary key usage flags to sign certificates.
      */
     bool isCA() const;
 
@@ -295,24 +598,279 @@ struct Certificate {
      */
     std::string toString(bool chain = true) const;
 
-    gnutls_x509_crt_t cert {};
+    std::string print() const;
+
+    /**
+     * As a CA, revoke a certificate, adding it to
+     * the attached Certificate Revocation List (CRL)
+     */
+    void revoke(const PrivateKey&, const Certificate&);
+
+    /**
+     * Get the list of certificates revoked as as CA.
+     */
+    std::vector<std::shared_ptr<RevocationList>> getRevocationLists() const;
+
+    /**
+     * Attach existing revocation list.
+     */
+    void addRevocationList(RevocationList&&);
+    void addRevocationList(std::shared_ptr<RevocationList>);
+
+    static Certificate generate(const PrivateKey& key,
+                                const std::string& name = "dhtnode",
+                                const Identity& ca = {},
+                                bool is_ca = false,
+                                int64_t validity = 0);
+    static Certificate generate(const CertificateRequest& request, const Identity& ca, int64_t validity = 0);
+
+    gnutls_x509_crt_t getCopy() const
+    {
+        if (not cert)
+            return nullptr;
+        auto copy = Certificate(getPacked());
+        gnutls_x509_crt_t ret = copy.cert;
+        copy.cert = nullptr;
+        return ret;
+    }
+
+    std::vector<gnutls_x509_crt_t> getChain(bool copy = false) const
+    {
+        if (not cert)
+            return {};
+        std::vector<gnutls_x509_crt_t> crts;
+        for (auto c = this; c; c = c->issuer.get())
+            crts.emplace_back(copy ? c->getCopy() : c->cert);
+        return crts;
+    }
+
+    std::pair<std::vector<gnutls_x509_crt_t>, std::vector<gnutls_x509_crl_t>> getChainWithRevocations(
+        bool copy = false) const
+    {
+        if (not cert)
+            return {};
+        std::vector<gnutls_x509_crt_t> crts;
+        std::vector<gnutls_x509_crl_t> crls;
+        for (auto c = this; c; c = c->issuer.get()) {
+            crts.emplace_back(copy ? c->getCopy() : c->cert);
+            crls.reserve(crls.size() + c->revocation_lists.size());
+            for (const auto& crl : c->revocation_lists)
+                crls.emplace_back(copy ? crl->getCopy() : crl->get());
+        }
+        return {crts, crls};
+    }
+
+    gnutls_digest_algorithm_t getPreferredDigest() const;
+
+    /*
+     * Generate OCSP request.
+     * Return GnuTLS error code.
+     * https://www.gnutls.org/manual/html_node/Error-codes.html
+     */
+    std::pair<std::string, Blob> generateOcspRequest(gnutls_x509_crt_t& issuer);
+
+    /**
+     * Change certificate's expiration
+     */
+    void setValidity(const Identity& ca, int64_t validity);
+    void setValidity(const PrivateKey& key, int64_t validity);
+
+    gnutls_x509_crt_t cert {nullptr};
     std::shared_ptr<Certificate> issuer {};
+    std::shared_ptr<OcspResponse> ocspResponse;
+
 private:
     Certificate(const Certificate&) = delete;
     Certificate& operator=(const Certificate&) = delete;
+    mutable InfoHash cachedId_ {};
+    mutable PkId cachedLongId_ {};
+    mutable std::atomic_bool idCached_ {false};
+    mutable std::atomic_bool longIdCached_ {false};
 
-    friend dht::crypto::Identity dht::crypto::generateIdentity(const std::string&, dht::crypto::Identity, unsigned key_length);
+    struct crlNumberCmp
+    {
+        bool operator()(const std::shared_ptr<RevocationList>& lhs, const std::shared_ptr<RevocationList>& rhs) const
+        {
+            return lhs->getNumber() < rhs->getNumber();
+        }
+    };
+
+    std::set<std::shared_ptr<RevocationList>, crlNumberCmp> revocation_lists;
+
+    mutable std::mutex publicKeyMutex_;
+    mutable std::shared_ptr<PublicKey> publicKey_ {};
+};
+
+struct OPENDHT_PUBLIC TrustList
+{
+    struct VerifyResult
+    {
+        int ret;
+        unsigned result;
+        bool hasError() const { return ret < 0; }
+        bool isValid() const { return !hasError() and !(result & GNUTLS_CERT_INVALID); }
+        explicit operator bool() const { return isValid(); }
+        OPENDHT_PUBLIC std::string toString() const;
+        OPENDHT_PUBLIC friend std::ostream& operator<<(std::ostream& s, const VerifyResult& h);
+    };
+
+    TrustList();
+    TrustList(TrustList&& o) noexcept
+        : trust(std::move(o.trust))
+    {
+        o.trust = nullptr;
+    }
+    TrustList& operator=(TrustList&& o) noexcept;
+    ~TrustList();
+    void add(const Certificate& crt);
+    void add(const RevocationList& crl);
+    void remove(const Certificate& crt, bool parents = true);
+    VerifyResult verify(const Certificate& crt) const;
+
+private:
+    TrustList(const TrustList& o) = delete;
+    TrustList& operator=(const TrustList& o) = delete;
+    gnutls_x509_trust_list_t trust {nullptr};
 };
 
 /**
- * AES-GCM encryption. Key must be 128, 192 or 126 bits long (16, 24 or 32 bytes).
+ * Generate an RSA key pair (4096 bits) and a certificate.
+ * @param name the name used in the generated certificate
+ * @param ca if set, the certificate authority that will sign the generated certificate.
+ *           If not set, the generated certificate will be a self-signed CA.
+ * @param key_length stength of the generated private key (bits).
  */
-Blob aesEncrypt(const Blob& data, const Blob& key);
+OPENDHT_PUBLIC Identity generateIdentity(const std::string& name, const Identity& ca, unsigned key_length, bool is_ca);
+OPENDHT_PUBLIC Identity generateIdentity(const std::string& name = "dhtnode",
+                                         const Identity& ca = {},
+                                         unsigned key_length = 4096);
+
+OPENDHT_PUBLIC Identity generateEcIdentity(const std::string& name, const Identity& ca, bool is_ca);
+OPENDHT_PUBLIC Identity generateEcIdentity(const std::string& name = "dhtnode", const Identity& ca = {});
+
+OPENDHT_PUBLIC void saveIdentity(const Identity& id, const std::string& path, const std::string& privkey_password = {});
+OPENDHT_PUBLIC Identity loadIdentity(const std::string& path, const std::string& privkey_password = {});
+
+/**
+ * Performs SHA512, SHA256 or SHA1, depending on hash_length.
+ * Attempts to choose an hash function with
+ * output size of at least hash_length bytes, Current implementation
+ * will use SHA1 for hash_length up to 20 bytes,
+ * will use SHA256 for hash_length up to 32 bytes,
+ * will use SHA512 for hash_length of 33 bytes and more.
+ */
+OPENDHT_PUBLIC Blob hash(const Blob& data, size_t hash_length = 512 / 8);
+
+OPENDHT_PUBLIC void hash(const uint8_t* data, size_t data_length, uint8_t* hash, size_t hash_length);
+
+/**
+ * Generates an encryption key from a text password,
+ * making the key longer to bruteforce.
+ * The generated key also depends on a unique salt value of any size,
+ * that can be transmitted in clear, and will be generated if
+ * not provided (32 bytes).
+ */
+OPENDHT_PUBLIC Blob stretchKey(std::string_view password, Blob& salt, size_t key_length = 512 / 8);
+
+/**
+ * AES-GCM encryption. Key must be 128, 192 or 256 bits long (16, 24 or 32 bytes).
+ */
+OPENDHT_PUBLIC Blob aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key);
+OPENDHT_PUBLIC inline Blob
+aesEncrypt(const Blob& data, const Blob& key)
+{
+    return aesEncrypt(data.data(), data.size(), key);
+}
+/**
+ * AES-GCM encryption with argon2 key derivation.
+ * This function uses `stretchKey` to generate an AES key from the password and a random salt.
+ * The result is a bundle including the salt that can be decrypted with `aesDecrypt(data, password)`.
+ * If needed, the salt or encrypted data can be individually extracted from the bundle with `aesGetSalt` and
+ * `aesGetEncrypted`.
+ * @param data: data to encrypt
+ * @param password: password to encrypt the data with
+ * @param salt: optional salt to use for key derivation. If not provided, a random salt will be generated.
+ */
+OPENDHT_PUBLIC Blob aesEncrypt(const Blob& data, std::string_view password, const Blob& salt = {});
 
 /**
  * AES-GCM decryption.
  */
-Blob aesDecrypt(const Blob& data, const Blob& key);
+OPENDHT_PUBLIC Blob aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key);
+OPENDHT_PUBLIC inline Blob
+aesDecrypt(const Blob& data, const Blob& key)
+{
+    return aesDecrypt(data.data(), data.size(), key);
+}
+OPENDHT_PUBLIC inline Blob
+aesDecrypt(std::string_view data, const Blob& key)
+{
+    return aesDecrypt((uint8_t*) data.data(), data.size(), key);
+}
 
+OPENDHT_PUBLIC Blob aesDecrypt(const uint8_t* data, size_t data_length, std::string_view password);
+OPENDHT_PUBLIC inline Blob
+aesDecrypt(const Blob& data, std::string_view password)
+{
+    return aesDecrypt(data.data(), data.size(), password);
 }
+OPENDHT_PUBLIC inline Blob
+aesDecrypt(std::string_view data, std::string_view password)
+{
+    return aesDecrypt((uint8_t*) data.data(), data.size(), password);
 }
+
+/**
+ * Get raw AES key from password and salt stored with the encrypted data.
+ */
+OPENDHT_PUBLIC Blob aesGetKey(const uint8_t* data, size_t data_length, std::string_view password);
+OPENDHT_PUBLIC Blob inline aesGetKey(const Blob& data, std::string_view password)
+{
+    return aesGetKey(data.data(), data.size(), password);
+}
+/** Get the salt part of data password-encrypted with `aesEncrypt(data, password)` */
+OPENDHT_PUBLIC Blob aesGetSalt(const uint8_t* data, size_t data_length);
+OPENDHT_PUBLIC Blob inline aesGetSalt(const Blob& data)
+{
+    return aesGetSalt(data.data(), data.size());
+}
+/** Get the encrypted data (ciphertext) part of data password-encrypted with `aesEncrypt(data, password)` */
+OPENDHT_PUBLIC std::string_view aesGetEncrypted(const uint8_t* data, size_t data_length);
+OPENDHT_PUBLIC std::string_view inline aesGetEncrypted(const Blob& data)
+{
+    return aesGetEncrypted(data.data(), data.size());
+}
+
+/** Build an encrypted bundle that can be decrypted with aesDecrypt(data, password).
+ *  @param encryptedData: result of `aesEncrypt(data, key)` or `aesGetEncrypted`
+ *  @param salt: should match the encryption key and password so that `stretchKey(password, salk) == key`.
+ *  Can be obtained from an existing bundle with `aesGetSalt`.
+ **/
+OPENDHT_PUBLIC Blob aesBuildEncrypted(const uint8_t* encryptedData, size_t data_length, const Blob& salt);
+OPENDHT_PUBLIC Blob inline aesBuildEncrypted(const Blob& encryptedData, const Blob& salt)
+{
+    return aesBuildEncrypted(encryptedData.data(), encryptedData.size(), salt);
+}
+OPENDHT_PUBLIC Blob inline aesBuildEncrypted(std::string_view encryptedData, const Blob& salt)
+{
+    return aesBuildEncrypted((const uint8_t*) encryptedData.data(), encryptedData.size(), salt);
+}
+
+/**
+ * Encrypts a payload for WebPush (RFC 8291).
+ * @param p256dh: The user's P-256 public key (uncompressed, 65 bytes).
+ * @param auth: The user's authentication secret (16 bytes).
+ * @param payload: The data to encrypt.
+ * @param privKey: (Optional) The sender's private key (for testing).
+ * @param salt: (Optional) The salt to use (for testing).
+ * @return The encrypted body (including salt, record size, keyid).
+ */
+OPENDHT_PUBLIC Blob webPushEncrypt(const Blob& p256dh,
+                                   const Blob& auth,
+                                   const uint8_t* payload,
+                                   size_t payload_length,
+                                   const PrivateKey& privKey = {},
+                                   const Blob& salt = {});
+
+} // namespace crypto
+} // namespace dht

include/opendht/crypto/secure_vector.h

@@ -0,0 +1,121 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <vector>
+#include <random>
+
+namespace dht {
+namespace crypto {
+
+template<class T>
+class secure_vector
+{
+public:
+    secure_vector() {}
+    secure_vector(secure_vector<T> const&) = default;
+    secure_vector(secure_vector<T>&&) = default;
+    explicit secure_vector(unsigned size)
+        : data_(size)
+    {}
+    explicit secure_vector(unsigned size, T _item)
+        : data_(size, _item)
+    {}
+    explicit secure_vector(const std::vector<T>& c)
+        : data_(c)
+    {}
+    secure_vector(std::vector<T>&& c)
+        : data_(std::move(c))
+    {}
+    ~secure_vector() { clean(); }
+
+    static secure_vector<T> getRandom(size_t size)
+    {
+        secure_vector<T> ret(size);
+        std::random_device rdev;
+#ifdef _WIN32
+        std::uniform_int_distribution<int> rand_byte {0, std::numeric_limits<uint8_t>::max()};
+#else
+        std::uniform_int_distribution<uint8_t> rand_byte;
+#endif
+        std::generate_n((uint8_t*) ret.data_.data(), ret.size() * sizeof(T), std::bind(rand_byte, std::ref(rdev)));
+        return ret;
+    }
+    secure_vector<T>& operator=(const secure_vector<T>& c)
+    {
+        if (&c == this)
+            return *this;
+        clean();
+        data_ = c.data_;
+        return *this;
+    }
+    secure_vector<T>& operator=(secure_vector<T>&& c)
+    {
+        if (&c == this)
+            return *this;
+        clean();
+        data_ = std::move(c.data_);
+        return *this;
+    }
+    secure_vector<T>& operator=(std::vector<T>&& c)
+    {
+        clean();
+        data_ = std::move(c);
+        return *this;
+    }
+    std::vector<T>& writable()
+    {
+        clean();
+        return data_;
+    }
+    const std::vector<T>& makeInsecure() const { return data_; }
+    const uint8_t* data() const { return data_.data(); }
+
+    void clean() { clean(data_.begin(), data_.end()); }
+
+    void clear()
+    {
+        clean();
+        data_.clear();
+    }
+
+    size_t size() const { return data_.size(); }
+    bool empty() const { return data_.empty(); }
+
+    void swap(secure_vector<T>& other) { data_.swap(other.data_); }
+    void resize(size_t s)
+    {
+        if (s == data_.size())
+            return;
+        if (s < data_.size()) {
+            // shrink
+            clean(data_.begin() + s, data_.end());
+            data_.resize(s);
+        } else {
+            // grow
+            auto data = std::move(data_); // move protected data
+            clear();
+            data_.resize(s);
+            std::copy(data.begin(), data.end(), data_.begin());
+            clean(data.begin(), data.end());
+        }
+    }
+
+private:
+    /**
+     * Securely wipe memory
+     */
+    static void clean(const typename std::vector<T>::iterator& i, const typename std::vector<T>::iterator& j)
+    {
+        volatile uint8_t* b = reinterpret_cast<uint8_t*>(&*i);
+        volatile uint8_t* e = reinterpret_cast<uint8_t*>(&*j);
+        std::fill(b, e, 0);
+    }
+
+    std::vector<T> data_;
+};
+
+using SecureBlob = secure_vector<uint8_t>;
+
+} // namespace crypto
+} // namespace dht

include/opendht/def.h

@@ -0,0 +1,44 @@
+#pragma once
+
+// Generic helper definitions for shared library support
+#if defined _WIN32 || defined __CYGWIN__
+  #define OPENDHT_IMPORT __declspec(dllimport)
+  #define OPENDHT_EXPORT __declspec(dllexport)
+  #define OPENDHT_HIDDEN
+#else
+  #define OPENDHT_IMPORT __attribute__ ((visibility ("default")))
+  #define OPENDHT_EXPORT __attribute__ ((visibility ("default")))
+  #define OPENDHT_HIDDEN __attribute__ ((visibility ("hidden")))
+#endif
+
+// Now we use the generic helper definitions above to define OPENDHT_PUBLIC and OPENDHT_LOCAL.
+// OPENDHT_PUBLIC is used for the public API symbols. It either DLL imports or DLL exports (or does nothing for static build)
+// OPENDHT_LOCAL is used for non-api symbols.
+
+#ifdef opendht_EXPORTS // defined if OpenDHT is compiled as a shared library
+  #ifdef OPENDHT_BUILD // defined if we are building the OpenDHT shared library (instead of using it)
+    #define OPENDHT_PUBLIC OPENDHT_EXPORT
+  #else
+    #define OPENDHT_PUBLIC OPENDHT_IMPORT
+  #endif // OPENDHT_BUILD
+  #define OPENDHT_LOCAL OPENDHT_HIDDEN
+#else // opendht_EXPORTS is not defined: this means OpenDHT is a static lib.
+  #define OPENDHT_PUBLIC
+  #define OPENDHT_LOCAL
+#endif // opendht_EXPORTS
+
+
+#ifdef opendht_c_EXPORTS // defined if OpenDHT is compiled as a shared library
+  #ifdef OPENDHT_C_BUILD // defined if we are building the OpenDHT shared library (instead of using it)
+    #define OPENDHT_C_PUBLIC OPENDHT_EXPORT
+  #else
+    #define OPENDHT_C_PUBLIC OPENDHT_IMPORT
+  #endif // OPENDHT_BUILD
+  #define OPENDHT_C_LOCAL OPENDHT_HIDDEN
+#else // opendht_EXPORTS is not defined: this means OpenDHT is a static lib.
+  #define OPENDHT_C_PUBLIC
+  #define OPENDHT_C_LOCAL
+#endif // opendht_EXPORTS
+
+// bytes
+#define HASH_LEN 20u

include/opendht/default_types.h

@@ -1,259 +1,280 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
 #include "value.h"
+#include "sockaddr.h"
+
+namespace dht {
+enum class ImStatus : uint8_t { NONE = 0, TYPING, RECEIVED, READ };
+}
+MSGPACK_ADD_ENUM(dht::ImStatus)
 
 namespace dht {
 
-struct DhtMessage : public Value::Serializable<DhtMessage>
+class OPENDHT_PUBLIC DhtMessage : public Value::Serializable<DhtMessage>
 {
-    DhtMessage(std::string s = {}, Blob msg = {}) : service(s), data(msg) {}
-
-    std::string getService() const {
-        return service;
-    }
-
+public:
     static const ValueType TYPE;
-    virtual const ValueType& getType() const override {
-        return TYPE;
-    }
+
+    DhtMessage(const std::string& s = {}, const Blob& msg = {})
+        : service(s)
+        , data(msg)
+    {}
+
+    std::string getService() const { return service; }
+
     static Value::Filter getFilter() { return {}; }
 
-    static bool storePolicy(InfoHash, std::shared_ptr<Value>&, InfoHash, const sockaddr*, socklen_t);
+    static bool storePolicy(InfoHash key, std::shared_ptr<Value>& value, const InfoHash& from, const SockAddr&);
 
-    static Value::Filter ServiceFilter(std::string s);
+    static Value::Filter ServiceFilter(const std::string& s);
 
     /** print value for debugging */
-    friend std::ostream& operator<< (std::ostream&, const DhtMessage&);
+    friend std::ostream& operator<<(std::ostream&, const DhtMessage&);
 
-public:
     std::string service;
     Blob data;
-    MSGPACK_DEFINE(service, data);
+    MSGPACK_DEFINE(service, data)
 };
 
-template <typename Type>
-struct SignedValue : public Value::Serializable<Type>
+template<typename T>
+class SignedValue : public Value::Serializable<T>
 {
-    virtual void unpackValue(const Value& v) override {
-        from = v.owner.getId();
-        Value::Serializable<Type>::unpackValue(v);
-    }
-    static Value::Filter getFilter() {
-        return [](const Value& v){ return v.isSigned(); };
-    }
+private:
+    using BaseClass = Value::Serializable<T>;
+
 public:
+    virtual void unpackValue(const Value& v) override
+    {
+        if (v.owner) {
+            owner = v.owner;
+            from = v.owner->getId();
+        } else {
+            throw std::runtime_error("Value has no owner");
+        }
+        BaseClass::unpackValue(v);
+    }
+
+    static Value::Filter getFilter()
+    {
+        return [](const Value& v) {
+            return v.isSigned();
+        };
+    }
+
+    Sp<crypto::PublicKey> owner;
     dht::InfoHash from;
 };
 
-template <typename Type>
-struct EncryptedValue : public SignedValue<Type>
+template<typename T>
+class EncryptedValue : public SignedValue<T>
 {
-    virtual void unpackValue(const Value& v) override {
-        to = v.recipient;
-        SignedValue<Type>::unpackValue(v);
-    }
-    static Value::Filter getFilter() {
-        return Value::Filter::chain(
-            SignedValue<Type>::getFilter(),
-            [](const Value& v){ return v.recipient != InfoHash(); }
-        );
-    }
+public:
+    using BaseClass = SignedValue<T>;
 
 public:
+    virtual void unpackValue(const Value& v) override
+    {
+        if (!v.recipient) {
+            throw std::runtime_error("Value has no recipient");
+        }
+        to = v.recipient;
+        BaseClass::unpackValue(v);
+    }
+
+    static Value::Filter getFilter()
+    {
+        return Value::Filter::chain(BaseClass::getFilter(),
+                                    [](const Value& v) { return static_cast<bool>(v.recipient); });
+    }
+
     dht::InfoHash to;
 };
 
-struct ImMessage : public SignedValue<ImMessage>
+class OPENDHT_PUBLIC ImMessage : public SignedValue<ImMessage>
 {
+private:
+    using BaseClass = SignedValue<ImMessage>;
+
+public:
+    static const ValueType TYPE;
+
     ImMessage() {}
     ImMessage(dht::Value::Id id, std::string&& m, long d = 0)
-      : id(id), msg(std::move(m)), date(d) {}
+        : id(id)
+        , msg(std::move(m))
+        , date(d)
+    {}
+    ImMessage(dht::Value::Id id, std::string&& dt, std::string&& m, long d = 0)
+        : id(id)
+        , msg(std::move(m))
+        , datatype(std::move(dt))
+        , date(d)
+    {}
+    ImMessage(dht::Value::Id id, std::string&& dt, std::string&& m, std::map<std::string, std::string>&& md, long d = 0)
+        : id(id)
+        , msg(std::move(m))
+        , datatype(std::move(dt))
+        , metadatas(std::move(md))
+        , date(d)
+    {}
 
-    static const ValueType TYPE;
-    virtual const ValueType& getType() const override {
-        return TYPE;
-    }
-    static Value::Filter getFilter() {
-        return SignedValue::getFilter();
-    }
-    virtual void unpackValue(const Value& v) override {
+    virtual void unpackValue(const Value& v) override
+    {
         to = v.recipient;
         SignedValue::unpackValue(v);
     }
 
+    static Value::Filter getFilter() { return SignedValue::getFilter(); }
+
     dht::InfoHash to;
-    dht::Value::Id id;
+    dht::Value::Id id {0};
     std::string msg;
-    long date;
-    MSGPACK_DEFINE_MAP(id, msg, date);
+    std::string datatype;
+    std::map<std::string, std::string> metadatas;
+    long date {0};
+    ImStatus status {ImStatus::NONE};
+
+    MSGPACK_DEFINE_MAP(id, msg, date, status, datatype, metadatas)
 };
 
-struct TrustRequest : public EncryptedValue<TrustRequest>
+class OPENDHT_PUBLIC TrustRequest : public EncryptedValue<TrustRequest>
 {
+private:
+    using BaseClass = EncryptedValue<TrustRequest>;
+
+public:
+    static const ValueType TYPE;
+
     TrustRequest() {}
-    TrustRequest(std::string s) : service(s) {}
-    TrustRequest(std::string s, const Blob& d) : service(s), payload(d) {}
+    TrustRequest(std::string s, std::string ci = {})
+        : service(s)
+        , conversationId(ci)
+    {}
+    TrustRequest(std::string s, std::string ci, const Blob& d)
+        : service(s)
+        , conversationId(ci)
+        , payload(d)
+    {}
 
-    static const ValueType TYPE;
-    virtual const ValueType& getType() const override {
-        return TYPE;
-    }
-    static Value::Filter getFilter() {
-        return EncryptedValue::getFilter();
+    static Value::Filter getFilter() { return EncryptedValue::getFilter(); }
+    virtual void unpackValue(const dht::Value& v) override
+    {
+        BaseClass::unpackValue(v);
+        id = v.id;
     }
 
+    dht::Value::Id id {0}; /// Value ID of the trust request, used for deserialization only.
     std::string service;
+    std::string conversationId;
     Blob payload;
-    MSGPACK_DEFINE(service, payload);
+    bool confirm {false};
+    MSGPACK_DEFINE_MAP(service, conversationId, payload, confirm)
 };
 
-struct IceCandidates : public EncryptedValue<IceCandidates>
+class OPENDHT_PUBLIC IceCandidates : public EncryptedValue<IceCandidates>
 {
-    IceCandidates() {}
-    IceCandidates(Value::Id msg_id, Blob ice) : id(msg_id), ice_data(ice) {}
+private:
+    using BaseClass = EncryptedValue<IceCandidates>;
 
+public:
     static const ValueType TYPE;
-    virtual const ValueType& getType() const override {
-        return TYPE;
-    }
-    static Value::Filter getFilter() {
-        return EncryptedValue::getFilter();
-    }
 
-    template <typename Packer>
+    IceCandidates() {}
+    IceCandidates(Value::Id msg_id, Blob ice)
+        : id(msg_id)
+        , ice_data(ice)
+    {}
+
+    static Value::Filter getFilter() { return EncryptedValue::getFilter(); }
+
+    template<typename Packer>
     void msgpack_pack(Packer& pk) const
     {
         pk.pack_array(2);
         pk.pack(id);
-#if 0
+#if 1
         pk.pack_bin(ice_data.size());
-        pk.pack_bin_body((const char*)ice_data.data(), ice_data.size());
+        pk.pack_bin_body((const char*) ice_data.data(), ice_data.size());
 #else
         // hack for backward compatibility with old opendht compiled with msgpack 1.0
-        // remove when enough people have moved to new versions 
+        // remove when enough people have moved to new versions
         pk.pack_array(ice_data.size());
         for (uint8_t b : ice_data)
             pk.pack(b);
 #endif
     }
 
-    void msgpack_unpack(msgpack::object o)
+    virtual void msgpack_unpack(const msgpack::object& o)
     {
-        if (o.type != msgpack::type::ARRAY) throw msgpack::type_error();
-        if (o.via.array.size < 2) throw msgpack::type_error();
+        if (o.type != msgpack::type::ARRAY)
+            throw msgpack::type_error();
+        if (o.via.array.size < 2)
+            throw msgpack::type_error();
         id = o.via.array.ptr[0].as<Value::Id>();
         ice_data = unpackBlob(o.via.array.ptr[1]);
     }
 
-    Value::Id id;
+    Value::Id id {0};
     Blob ice_data;
 };
 
-
 /* "Peer" announcement
  */
-struct IpServiceAnnouncement : public Value::Serializable<IpServiceAnnouncement>
+class OPENDHT_PUBLIC IpServiceAnnouncement : public Value::Serializable<IpServiceAnnouncement>
 {
-    IpServiceAnnouncement(in_port_t p = 0) {
-        ss.ss_family = 0;
-        setPort(p);
+private:
+    using BaseClass = Value::Serializable<IpServiceAnnouncement>;
+
+public:
+    static const ValueType TYPE;
+
+    IpServiceAnnouncement(sa_family_t family = AF_UNSPEC, in_port_t p = 0)
+    {
+        addr.setFamily(family);
+        addr.setPort(p);
     }
 
-    IpServiceAnnouncement(const sockaddr* sa, socklen_t sa_len) {
-        if (sa)
-            std::copy_n((const uint8_t*)sa, sa_len, (uint8_t*)&ss);
-    }
+    IpServiceAnnouncement(const SockAddr& sa)
+        : addr(sa)
+    {}
 
-    IpServiceAnnouncement(const Blob& b) {
-        msgpack_unpack(unpackMsg(b).get());
-    }
+    IpServiceAnnouncement(const Blob& b) { msgpack_unpack(unpackMsg(b).get()); }
 
-    template <typename Packer>
+    template<typename Packer>
     void msgpack_pack(Packer& pk) const
     {
-        pk.pack_array(2);
-        pk.pack(getPort());
-        if (ss.ss_family == AF_INET) {
-            pk.pack_bin(sizeof(in_addr));
-            pk.pack_bin_body((const char*)&reinterpret_cast<const sockaddr_in*>(&ss)->sin_addr, sizeof(in_addr));
-        } else if (ss.ss_family == AF_INET6) {
-            pk.pack_bin(sizeof(in6_addr));
-            pk.pack_bin_body((const char*)&reinterpret_cast<const sockaddr_in6*>(&ss)->sin6_addr, sizeof(in6_addr));
-        }
+        pk.pack_bin(addr.getLength());
+        pk.pack_bin_body((const char*) addr.get(), addr.getLength());
     }
 
-    void msgpack_unpack(msgpack::object o)
+    virtual void msgpack_unpack(const msgpack::object& o)
     {
-        if (o.type != msgpack::type::ARRAY) throw msgpack::type_error();
-        if (o.via.array.size < 2) throw msgpack::type_error();
-        setPort(o.via.array.ptr[0].as<in_port_t>());
-        auto ip_dat = o.via.array.ptr[1].as<Blob>();
-        if (ip_dat.size() == sizeof(in_addr))
-            std::copy(ip_dat.begin(), ip_dat.end(), (char*)&reinterpret_cast<sockaddr_in*>(&ss)->sin_addr);
-        else if (ip_dat.size() == sizeof(in6_addr))
-            std::copy(ip_dat.begin(), ip_dat.end(), (char*)&reinterpret_cast<sockaddr_in6*>(&ss)->sin6_addr);
+        if (o.type == msgpack::type::BIN)
+            addr = {(sockaddr*) o.via.bin.ptr, (socklen_t) o.via.bin.size};
         else
             throw msgpack::type_error();
     }
 
-    in_port_t getPort() const {
-        return ntohs(reinterpret_cast<const sockaddr_in*>(&ss)->sin_port);
-    }
-    void setPort(in_port_t p) {
-        reinterpret_cast<sockaddr_in*>(&ss)->sin_port = htons(p);
-    }
+    in_port_t getPort() const { return addr.getPort(); }
+    void setPort(in_port_t p) { addr.setPort(p); }
 
-    sockaddr_storage getPeerAddr() const {
-        return ss;
-    }
+    const SockAddr& getPeerAddr() const { return addr; }
 
-    static const ValueType TYPE;
-    virtual const ValueType& getType() const {
-        return TYPE;
-    }
+    virtual const ValueType& getType() const { return TYPE; }
 
-    static bool storePolicy(InfoHash, std::shared_ptr<Value>&, InfoHash, const sockaddr*, socklen_t);
+    static bool storePolicy(InfoHash, std::shared_ptr<Value>&, const InfoHash&, const SockAddr&);
 
     /** print value for debugging */
-    friend std::ostream& operator<< (std::ostream&, const IpServiceAnnouncement&);
+    friend std::ostream& operator<<(std::ostream&, const IpServiceAnnouncement&);
 
 private:
-    sockaddr_storage ss;
+    SockAddr addr;
 };
 
+OPENDHT_PUBLIC extern const std::array<std::reference_wrapper<const ValueType>, 5> DEFAULT_TYPES;
 
-extern const std::array<std::reference_wrapper<const ValueType>, 5> DEFAULT_TYPES;
+OPENDHT_PUBLIC extern const std::array<std::reference_wrapper<const ValueType>, 1> DEFAULT_INSECURE_TYPES;
 
-extern const std::array<std::reference_wrapper<const ValueType>, 1> DEFAULT_INSECURE_TYPES;
-
-}
+} // namespace dht

include/opendht/dht_interface.h

@@ -0,0 +1,269 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "infohash.h"
+#include "logger.h"
+#include "node_export.h"
+
+#include <queue>
+
+namespace dht {
+
+namespace net {
+class DatagramSocket;
+}
+
+class OPENDHT_PUBLIC DhtInterface
+{
+public:
+    DhtInterface() = default;
+    DhtInterface(const std::shared_ptr<Logger>& l)
+        : logger_(l)
+    {}
+    virtual ~DhtInterface() = default;
+
+    // [[deprecated]]
+    using Status = NodeStatus;
+    // [[deprecated]]
+    using NodeExport = dht::NodeExport;
+
+    /**
+     * Get the current status of the node for the given family.
+     */
+    virtual NodeStatus updateStatus(sa_family_t af) { return getStatus(af); }
+    virtual NodeStatus getStatus(sa_family_t af) const = 0;
+    virtual NodeStatus getStatus() const = 0;
+
+    void addOnConnectedCallback(std::function<void()> cb) { onConnectCallbacks_.emplace(std::move(cb)); }
+    virtual void setOnPublicAddressChanged(PublicAddressChangedCb) {}
+
+    virtual net::DatagramSocket* getSocket() const { return {}; }
+
+    /**
+     * Get the ID of the DHT node.
+     */
+    virtual const InfoHash& getNodeId() const = 0;
+
+    /**
+     * Performs final operations before quitting.
+     * stop: if true, cancel ongoing operations and call their 'done'
+     *       callbacks synchronously.
+     */
+    virtual void shutdown(ShutdownCallback cb, bool stop = false) = 0;
+
+    /**
+     * Returns true if the node is running (have access to an open socket).
+     *
+     *  af: address family. If non-zero, will return true if the node
+     *     is running for the provided family.
+     */
+    virtual bool isRunning(sa_family_t af = 0) const = 0;
+
+    virtual void registerType(const ValueType& type) = 0;
+
+    virtual const ValueType& getType(ValueType::Id type_id) const = 0;
+
+    virtual void addBootstrap(const std::string& /*host*/, const std::string& /*service*/) {};
+    virtual void clearBootstrap() {};
+
+    /**
+     * Insert a node in the main routing table.
+     * The node is not pinged, so this should be
+     * used to bootstrap efficiently from previously known nodes.
+     */
+    virtual void insertNode(const InfoHash& id, const SockAddr&) = 0;
+    virtual void insertNode(const NodeExport& n) = 0;
+
+    virtual void pingNode(SockAddr, DoneCallbackSimple&& cb = {}) = 0;
+
+    virtual time_point periodic(const uint8_t* buf, size_t buflen, SockAddr, const time_point& now) = 0;
+    virtual time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now)
+        = 0;
+
+    /**
+     * Get a value by searching on all available protocols (IPv4, IPv6),
+     * and call the provided get callback when values are found at key.
+     * The operation will start as soon as the node is connected to the network.
+     * @param cb a function called when new values are found on the network.
+     *         It should return false to stop the operation.
+     * @param donecb a function called when the operation is complete.
+                  cb and donecb won't be called again afterward.
+     * @param f a filter function used to prefilter values.
+     */
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallbackSimple donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallbackSimple cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+    virtual void get(
+        const InfoHash& key, GetCallbackSimple cb, DoneCallbackSimple donecb, Value::Filter&& f = {}, Where&& w = {})
+        = 0;
+
+    /**
+      * Similar to Dht::get, but sends a Query to filter data remotely.
+      * @param key the key for which to query data for.
+      * @param cb a function called when new values are found on the network.
+      *         It should return false to stop the operation.
+      * @param done_cb a function called when the operation is complete.
+                      cb and done_cb won't be called again afterward.
+      * @param q a query used to filter values on the remotes before they send a
+      *        response.
+      */
+    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallback done_cb = {}, Query&& q = {}) = 0;
+    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) = 0;
+
+    /**
+     * Get locally stored data for the given hash.
+     */
+    virtual std::vector<Sp<Value>> getLocal(const InfoHash& key, const Value::Filter& f = {}) const = 0;
+
+    /**
+     * Get locally stored data for the given key and value id.
+     */
+    virtual Sp<Value> getLocalById(const InfoHash& key, Value::Id vid) const = 0;
+
+    /**
+     * Announce a value on all available protocols (IPv4, IPv6).
+     *
+     * The operation will start as soon as the node is connected to the network.
+     * The done callback will be called once, when the first announce succeeds, or fails.
+     */
+    virtual void put(const InfoHash& key,
+                     Sp<Value>,
+                     DoneCallback cb = nullptr,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
+    virtual void put(const InfoHash& key,
+                     const Sp<Value>& v,
+                     DoneCallbackSimple cb,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
+    virtual void put(const InfoHash& key,
+                     Value&& v,
+                     DoneCallback cb = nullptr,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
+    virtual void put(const InfoHash& key,
+                     Value&& v,
+                     DoneCallbackSimple cb,
+                     time_point created = time_point::max(),
+                     bool permanent = false)
+        = 0;
+
+    /**
+     * Get data currently being put at the given hash.
+     */
+    virtual std::vector<Sp<Value>> getPut(const InfoHash&) const = 0;
+
+    /**
+     * Get data currently being put at the given hash with the given id.
+     */
+    virtual Sp<Value> getPut(const InfoHash&, const Value::Id&) const = 0;
+
+    /**
+     * Stop any put/announce operation at the given location,
+     * for the value with the given id.
+     */
+    virtual bool cancelPut(const InfoHash&, const Value::Id&) = 0;
+
+    /**
+     * Listen on the network for any changes involving a specified hash.
+     * The node will register to receive updates from relevent nodes when
+     * new values are added or removed.
+     *
+     * @return a token to cancel the listener later.
+     */
+    virtual size_t listen(const InfoHash&, GetCallback, Value::Filter = {}, Where w = {}) = 0;
+    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) = 0;
+    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter = {}, Where w = {}) = 0;
+
+    virtual bool cancelListen(const InfoHash&, size_t token) = 0;
+
+    /**
+     * Inform the DHT of lower-layer connectivity changes.
+     * This will cause the DHT to assume a public IP address change.
+     * The DHT will recontact neighbor nodes, re-register for listen ops etc.
+     */
+    virtual void connectivityChanged(sa_family_t) = 0;
+    virtual void connectivityChanged() = 0;
+
+    /**
+     * Get the list of good nodes for local storage saving purposes
+     * The list is ordered to minimize the back-to-work delay.
+     */
+    virtual std::vector<NodeExport> exportNodes() const = 0;
+
+    virtual std::vector<ValuesExport> exportValues() const = 0;
+    virtual void importValues(const std::vector<ValuesExport>&) = 0;
+
+    virtual NodeStats getNodesStats(sa_family_t af) const = 0;
+
+    virtual std::string getStorageLog() const = 0;
+    virtual std::string getStorageLog(const InfoHash&) const = 0;
+
+    virtual std::string getRoutingTablesLog(sa_family_t) const = 0;
+    virtual std::string getSearchesLog(sa_family_t) const = 0;
+    virtual std::string getSearchLog(const InfoHash&, sa_family_t af = AF_UNSPEC) const = 0;
+
+    virtual void dumpTables() const = 0;
+    virtual std::vector<unsigned> getNodeMessageStats(bool in = false) = 0;
+
+    /**
+     * Set the in-memory storage limit in bytes for remote values
+     */
+    virtual void setStorageLimit(size_t limit = 0) = 0;
+    virtual size_t getStorageLimit() const = 0;
+
+    /**
+     * Set the in-memory storage limit in bytes for locally stored values
+     */
+    virtual void setLocalStorageLimit(size_t limit = 0) = 0;
+    virtual size_t getLocalStorageLimit() const = 0;
+
+    /**
+     * Returns the total memory usage of stored values and the number
+     * of stored values.
+     */
+    virtual std::pair<size_t, size_t> getStoreSize() const = 0;
+
+    virtual std::pair<size_t, size_t> getLocalStoreSize() const = 0;
+
+    virtual std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) = 0;
+
+    virtual void setLogger(const std::shared_ptr<Logger>& l) { logger_ = l; }
+
+    /**
+     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
+     */
+    virtual void setLogFilter(const InfoHash& f)
+    {
+        if (logger_)
+            logger_->setFilter(f);
+    }
+
+    virtual void setPushNotificationToken(const std::string&) {};
+
+    virtual void setPushNotificationTopic(const std::string&) {};
+    virtual void setPushNotificationPlatform(const std::string&) {};
+
+    /**
+     * Call linked callback with a push notification
+     * @param notification to process
+     */
+    virtual PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& data) = 0;
+
+protected:
+    std::shared_ptr<Logger> logger_ {};
+    std::queue<std::function<void()>> onConnectCallbacks_ {};
+};
+
+} // namespace dht

include/opendht/dht_proxy_client.h

@@ -0,0 +1,481 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <functional>
+#include <mutex>
+
+#include "callbacks.h"
+#include "def.h"
+#include "dht_interface.h"
+#include "proxy.h"
+#include "http.h"
+
+#include <restinio/all.hpp>
+#include <json/json.h>
+
+#include <chrono>
+#include <vector>
+#include <functional>
+
+namespace Json {
+class Value;
+}
+
+namespace http {
+class Resolver;
+class Request;
+} // namespace http
+
+namespace dht {
+
+class OPENDHT_PUBLIC DhtProxyClient final : public DhtInterface
+{
+public:
+    DhtProxyClient();
+
+    explicit DhtProxyClient(std::shared_ptr<crypto::Certificate> serverCA,
+                            crypto::Identity clientIdentity,
+                            std::function<void()> loopSignal,
+                            const std::string& serverHost,
+                            const std::string& userAgent = "",
+                            const std::string& pushClientId = "",
+                            const std::string& pushToken = "",
+                            const std::string& pushTopic = "",
+                            const std::string& pushPlatform = "",
+                            std::shared_ptr<Logger> logger = {});
+
+    void setHeaderFields(http::Request& request);
+
+    virtual void setPushNotificationToken(const std::string& token) override;
+
+    virtual void setPushNotificationTopic(const std::string& topic) override
+    {
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+        notificationTopic_ = topic;
+#else
+        (void) topic;
+#endif
+    }
+
+    virtual void setPushNotificationPlatform(const std::string& platform) override
+    {
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+        platform_ = platform;
+#else
+        (void) platform;
+#endif
+    }
+
+    virtual ~DhtProxyClient();
+
+    /**
+     * Get the ID of the node.
+     */
+    inline const InfoHash& getNodeId() const override { return myid; }
+    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { publicAddressChangedCb_ = std::move(cb); }
+
+    /**
+     * Get the current status of the node for the given family.
+     */
+    NodeStatus getStatus(sa_family_t af) const override;
+    NodeStatus getStatus() const override { return std::max(getStatus(AF_INET), getStatus(AF_INET6)); }
+
+    /**
+     * Performs final operations before quitting.
+     */
+    void shutdown(ShutdownCallback cb, bool) override;
+
+    /**
+     * Returns true if the node is running (have access to an open socket).
+     *
+     *  af: address family. If non-zero, will return true if the node
+     *      is running for the provided family.
+     */
+    bool isRunning(sa_family_t af = 0) const override;
+
+    /**
+     * Get a value by asking the proxy and call the provided get callback when
+     * values are found at key.
+     * The operation will start as soon as the node is connected to the network.
+     * @param cb a function called when new values are found on the network.
+     *           It should return false to stop the operation.
+     * @param donecb a function called when the operation is complete.
+                     cb and donecb won't be called again afterward.
+     * @param f a filter function used to prefilter values.
+     */
+    virtual void get(
+        const InfoHash& key, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& f = {}, Where&& w = {}) override;
+    virtual void get(const InfoHash& key,
+                     GetCallback cb,
+                     DoneCallbackSimple donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
+        get(key, cb, bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallback donecb = {},
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
+        get(key, bindGetCb(cb), std::move(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+    virtual void get(const InfoHash& key,
+                     GetCallbackSimple cb,
+                     DoneCallbackSimple donecb,
+                     Value::Filter&& f = {},
+                     Where&& w = {}) override
+    {
+        get(key, bindGetCb(cb), bindDoneCb(std::move(donecb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+
+    /**
+     * Announce a value on all available protocols (IPv4, IPv6).
+     *
+     * The operation will start as soon as the node is connected to the network.
+     * The done callback will be called once, when the first announce succeeds, or fails.
+     * NOTE: For now, created parameter is ignored.
+     */
+    void put(const InfoHash& key,
+             Sp<Value>,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override;
+    void put(const InfoHash& key,
+             const Sp<Value>& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        put(key, v, bindDoneCb(std::move(cb)), created, permanent);
+    }
+
+    void put(const InfoHash& key,
+             Value&& v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        put(key, std::make_shared<Value>(std::move(v)), std::move(cb), created, permanent);
+    }
+    void put(const InfoHash& key,
+             Value&& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        put(key, std::forward<Value>(v), bindDoneCb(std::move(cb)), created, permanent);
+    }
+
+    /**
+     * @param  af the socket family
+     * @return node stats from the proxy
+     */
+    NodeStats getNodesStats(sa_family_t af) const override;
+
+    /**
+     * @param  family the socket family
+     * @return public address
+     */
+    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override;
+
+    /**
+     * Listen on the network for any changes involving a specified hash.
+     * The node will register to receive updates from relevent nodes when
+     * new values are added or removed.
+     *
+     * @return a token to cancel the listener later.
+     */
+    virtual size_t listen(const InfoHash&, ValueCallback, Value::Filter = {}, Where = {}) override;
+
+    virtual size_t listen(const InfoHash& key, GetCallback cb, Value::Filter f = {}, Where w = {}) override
+    {
+        return listen(
+            key,
+            [cb = std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired) {
+                if (not expired)
+                    return cb(vals);
+                return true;
+            },
+            std::forward<Value::Filter>(f),
+            std::forward<Where>(w));
+    }
+    virtual size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) override
+    {
+        return listen(key, bindGetCb(std::move(cb)), std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+    /*
+     * This function relies on the cache implementation.
+     * It means that there are no true cancel here, it keeps the caching in higher priority.
+     */
+    virtual bool cancelListen(const InfoHash& key, size_t token) override;
+
+    /**
+     * Call linked callback with a push notification
+     * @param notification to process
+     */
+    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& notification) override;
+
+    time_point periodic(const uint8_t*, size_t, SockAddr, const time_point& now) override;
+    time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override
+    {
+        return periodic(buf, buflen, SockAddr(from, fromlen), now);
+    }
+
+    /**
+     * Similar to Dht::get, but sends a Query to filter data remotely.
+     * @param key the key for which to query data for.
+     * @param cb a function called when new values are found on the network.
+     *           It should return false to stop the operation.
+     * @param done_cb a function called when the operation is complete.
+               cb and done_cb won't be called again afterward.
+     * @param q a query used to filter values on the remotes before they send a
+     *          response.
+     */
+    virtual void query(const InfoHash& /*key*/,
+                       QueryCallback /*cb*/,
+                       DoneCallback /*done_cb*/ = {},
+                       Query&& /*q*/ = {}) override
+    {}
+    virtual void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override
+    {
+        query(key, cb, bindDoneCb(std::move(done_cb)), std::forward<Query>(q));
+    }
+
+    /**
+     * Get data currently being put at the given hash.
+     */
+    std::vector<Sp<Value>> getPut(const InfoHash&) const override;
+
+    /**
+     * Get data currently being put at the given hash with the given id.
+     */
+    Sp<Value> getPut(const InfoHash&, const Value::Id&) const override;
+
+    /**
+     * Stop any put/announce operation at the given location,
+     * for the value with the given id.
+     */
+    bool cancelPut(const InfoHash&, const Value::Id&) override;
+
+    void pingNode(SockAddr, DoneCallbackSimple&& /*cb*/ = {}) override {}
+
+    virtual void registerType(const ValueType& type) override { types.registerType(type); }
+    const ValueType& getType(ValueType::Id type_id) const override { return types.getType(type_id); }
+
+    std::vector<Sp<Value>> getLocal(const InfoHash& k, const Value::Filter& filter) const override;
+    Sp<Value> getLocalById(const InfoHash& k, Value::Id id) const override;
+
+    /**
+     * NOTE: The following methods will not be implemented because the
+     * DhtProxyClient doesn't have any storage nor synchronization process
+     */
+    void insertNode(const InfoHash&, const SockAddr&) override {}
+    void insertNode(const NodeExport&) override {}
+    std::pair<size_t, size_t> getStoreSize() const override { return {}; }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return {}; }
+    std::vector<NodeExport> exportNodes() const override { return {}; }
+    std::vector<ValuesExport> exportValues() const override { return {}; }
+    void importValues(const std::vector<ValuesExport>&) override {}
+    std::string getStorageLog() const override { return {}; }
+    std::string getStorageLog(const InfoHash&) const override { return {}; }
+    std::string getRoutingTablesLog(sa_family_t) const override { return {}; }
+    std::string getSearchesLog(sa_family_t) const override { return {}; }
+    std::string getSearchLog(const InfoHash&, sa_family_t) const override { return {}; }
+    void dumpTables() const override {}
+    std::vector<unsigned> getNodeMessageStats(bool) override { return {}; }
+    void setStorageLimit(size_t) override {}
+    virtual size_t getStorageLimit() const override { return 0; }
+    void setLocalStorageLimit(size_t) override {}
+    virtual size_t getLocalStorageLimit() const override { return STORAGE_LIMIT_UNLIMITED; }
+    void connectivityChanged(sa_family_t) override { getProxyInfos(); }
+    void connectivityChanged() override
+    {
+        getProxyInfos();
+        loopSignal_();
+    }
+
+    void listenKeepIdle(uint32_t seconds) { listenKeepIdle_ = seconds; }
+    inline uint32_t listenKeepIdle() { return listenKeepIdle_; }
+
+private:
+    /**
+     * Start the connection with a server.
+     */
+    void startProxy();
+    void stop();
+
+    /**
+     * Get informations from the proxy node
+     * @return the JSON returned by the proxy
+     */
+    struct InfoState;
+    void getProxyInfos();
+    void queryProxyInfo(const std::shared_ptr<InfoState>& infoState,
+                        const std::shared_ptr<http::Resolver>& resolver,
+                        sa_family_t family);
+    void onProxyInfos(const Json::Value& val, const sa_family_t family);
+    SockAddr parsePublicAddress(const Json::Value& val);
+
+    void opFailed();
+
+    void handleExpireListener(const asio::error_code& ec, const InfoHash& key);
+
+    struct Listener;
+    struct OperationState;
+    enum class ListenMethod {
+        LISTEN,
+        SUBSCRIBE,
+        RESUBSCRIBE,
+    };
+    using CacheValueCallback
+        = std::function<bool(const std::vector<std::shared_ptr<Value>>& values, bool expired, system_clock::time_point)>;
+
+    /**
+     * Send Listen with httpClient_
+     */
+    void sendListen(const restinio::http_request_header_t& header,
+                    const CacheValueCallback& cb,
+                    const Sp<OperationState>& opstate,
+                    Listener& listener,
+                    ListenMethod method = ListenMethod::LISTEN);
+    void handleResubscribe(const asio::error_code& ec,
+                           const InfoHash& key,
+                           const size_t token,
+                           std::shared_ptr<OperationState> opstate);
+
+    void doPut(const InfoHash&, Sp<Value>, DoneCallbackSimple, time_point created, bool permanent);
+    void handleRefreshPut(const asio::error_code& ec, InfoHash key, Value::Id id);
+
+    /**
+     * Initialize statusIpvX_
+     */
+    void getConnectivityStatus();
+    /**
+     * cancel all Listeners
+     */
+    void cancelAllListeners();
+
+    std::atomic_bool isDestroying_ {false};
+
+    std::string proxyUrl_;
+    dht::crypto::Identity clientIdentity_;
+    std::shared_ptr<dht::crypto::Certificate> serverCertificate_;
+    std::string userAgent_ {"OpenDHT"};
+    std::string pushClientId_;
+    std::string pushSessionId_;
+
+    mutable std::mutex lockCurrentProxyInfos_;
+    NodeStatus statusIpv4_ {NodeStatus::Disconnected};
+    NodeStatus statusIpv6_ {NodeStatus::Disconnected};
+    NodeStats stats4_ {};
+    NodeStats stats6_ {};
+    SockAddr localAddrv4_;
+    SockAddr localAddrv6_;
+    SockAddr publicAddressV4_;
+    SockAddr publicAddressV6_;
+    std::atomic_bool launchConnectedCbs_ {false};
+    PublicAddressChangedCb publicAddressChangedCb_ {};
+
+    InfoHash myid {};
+
+    // registred types
+    TypeStore types;
+
+    /*
+     * ASIO I/O Context for sockets in httpClient_
+     * Note: Each context is used in one thread only
+     */
+    asio::io_context httpContext_;
+    mutable std::mutex resolverLock_;
+    std::shared_ptr<http::Resolver> resolver_;
+
+    mutable std::mutex requestLock_;
+    std::map<unsigned, std::shared_ptr<http::Request>> requests_;
+    /*
+     * Thread for executing the http io_context.run() blocking call
+     */
+    std::thread httpClientThread_;
+
+    /**
+     * Store listen requests.
+     */
+    struct ProxySearch;
+
+    mutable std::mutex searchLock_;
+    size_t listenerToken_ {0};
+    std::map<InfoHash, ProxySearch> searches_;
+
+    /**
+     * Keepalive idle time for listen
+     */
+    uint32_t listenKeepIdle_ {120};
+
+    /**
+     * Callbacks should be executed in the main thread.
+     */
+    std::mutex lockCallbacks_;
+    std::vector<std::function<void()>> callbacks_;
+
+    Sp<InfoState> infoState_;
+
+    /**
+     * Retrieve if we can connect to the proxy (update statusIpvX_)
+     */
+    void handleProxyConfirm(const asio::error_code& ec);
+    std::unique_ptr<asio::steady_timer> nextProxyConfirmationTimer_;
+    std::unique_ptr<asio::steady_timer> listenerRestartTimer_;
+
+    /**
+     * Relaunch LISTEN requests if the client disconnect/reconnect.
+     */
+    void restartListeners(const asio::error_code& ec);
+
+    /**
+     * Refresh a listen via a token
+     * @param token
+     */
+    void resubscribe(const InfoHash& key, const size_t token, Listener& listener);
+
+    /**
+     * If we want to use push notifications by default.
+     * NOTE: empty by default to avoid to use services like FCM or APN.
+     */
+    std::string deviceKey_ {};
+
+    /**
+     * Notification topic for ios notifications.
+     */
+    std::string notificationTopic_ {};
+
+    /**
+     * Platform for push notifications (supported android, ios, unifiedpush)
+     */
+    std::string platform_
+#ifdef __ANDROID__
+        {"android"};
+#else
+#ifdef __APPLE__
+        {"ios"};
+#else
+        {};
+#endif
+#endif
+
+    const std::function<void()> loopSignal_;
+
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+    std::string fillBody(bool resubscribe);
+    void getPushRequest(Json::Value&) const;
+#endif // OPENDHT_PUSH_NOTIFICATIONS
+
+    Json::StreamWriterBuilder jsonBuilder_;
+    std::unique_ptr<Json::CharReader> jsonReader_;
+
+    std::shared_ptr<http::Request> buildRequest(const std::string& target = {});
+};
+
+} // namespace dht

include/opendht/dht_proxy_server.h

@@ -0,0 +1,513 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "callbacks.h"
+#include "def.h"
+#include "infohash.h"
+#include "proxy.h"
+#include "scheduler.h"
+#include "sockaddr.h"
+#include "value.h"
+#include "http.h"
+
+#include <restinio/all.hpp>
+#include <restinio/tls.hpp>
+#include <json/json.h>
+
+#include <memory>
+#include <mutex>
+
+namespace dht {
+// Appended only: the values are serialized as integers by MSGPACK_ADD_ENUM,
+// so reordering would break compatibility with deployed proxies.
+enum class PushType { None = 0, Android, iOS, UnifiedPush, Huawei };
+}
+MSGPACK_ADD_ENUM(dht::PushType)
+
+namespace Json {
+class Value;
+}
+
+namespace dht {
+
+namespace http {
+class Request;
+struct ListenerSession;
+} // namespace http
+
+class DhtRunner;
+
+using RestRouter = restinio::router::express_router_t<>;
+using RequestStatus = restinio::request_handling_status_t;
+
+struct OPENDHT_PUBLIC ProxyServerConfig
+{
+    std::string address {};
+    in_port_t port {8000};
+    std::string pushServer {};
+    std::string persistStatePath {};
+    dht::crypto::Identity identity {};
+    std::string bundleId {};
+};
+
+/**
+ * Describes the REST API
+ */
+class OPENDHT_PUBLIC DhtProxyServer
+{
+public:
+    /**
+     * Start the Http server for OpenDHT
+     * @param dht the DhtRunner linked to this proxy server
+     * @param port to listen
+     * @param pushServer where to push notifications
+     * @note if the server fails to start (if port is already used or reserved),
+     * it will fails silently
+     */
+    DhtProxyServer(const std::shared_ptr<DhtRunner>& dht,
+                   const ProxyServerConfig& config = {},
+                   const std::shared_ptr<log::Logger>& logger = {});
+
+    virtual ~DhtProxyServer();
+
+    DhtProxyServer(const DhtProxyServer& other) = delete;
+    DhtProxyServer(DhtProxyServer&& other) = delete;
+    DhtProxyServer& operator=(const DhtProxyServer& other) = delete;
+    DhtProxyServer& operator=(DhtProxyServer&& other) = delete;
+
+    asio::io_context& io_context() const;
+
+    // Monotonic clock for elapsed-time statistics (request rate, uptime).
+    // Must stay on steady_clock so NTP/wall-clock corrections don't skew durations.
+    using clock = std::chrono::steady_clock;
+    using time_point = clock::time_point;
+    // Wall clock for persisted subscribe/permanent-put lease expirations,
+    // so they map directly to epoch time and survive restarts.
+    using sys_clock = std::chrono::system_clock;
+    using sys_time_point = sys_clock::time_point;
+
+    struct PushStats
+    {
+        uint64_t highPriorityCount {0};
+        uint64_t normalPriorityCount {0};
+
+        void increment(bool highPriority)
+        {
+            if (highPriority)
+                highPriorityCount++;
+            else
+                normalPriorityCount++;
+        }
+
+        Json::Value toJson() const
+        {
+            Json::Value val;
+            val["highPriorityCount"] = static_cast<Json::UInt64>(highPriorityCount);
+            val["normalPriorityCount"] = static_cast<Json::UInt64>(normalPriorityCount);
+            return val;
+        }
+
+        std::string toString() const
+        {
+            return fmt::format("{} high priority, {} normal priority", highPriorityCount, normalPriorityCount);
+        }
+    };
+
+    struct OPENDHT_PUBLIC ServerStats
+    {
+        /** Current number of listen operations */
+        size_t listenCount {0};
+        /** Current number of permanent put operations (hash used) */
+        size_t putCount {0};
+        /** Current number of permanent put values */
+        size_t totalPermanentPuts {0};
+        /** Current number of push tokens with at least one listen operation */
+        size_t pushListenersCount {0};
+
+        /** Time at which the server was started */
+        time_point serverStartTime;
+        /** Last time at which the stats were updated */
+        time_point lastUpdated;
+        /** Total number of push notification requests that the server attempted to
+         * send since being started, broken down by type and priority level */
+        PushStats androidPush;
+        PushStats iosPush;
+        PushStats unifiedPush;
+        PushStats huaweiPush;
+
+        /** Average requests per second */
+        double requestRate {0};
+        /** Node Info **/
+        std::shared_ptr<NodeInfo> nodeInfo {};
+
+        std::string toString() const;
+
+        /**
+         * Build a json object from a NodeStats
+         */
+        Json::Value toJson() const;
+    };
+
+    std::shared_ptr<ServerStats> stats() const { return stats_; }
+
+    std::shared_ptr<ServerStats> updateStats(std::shared_ptr<NodeInfo> info) const;
+
+    std::shared_ptr<DhtRunner> getNode() const { return dht_; }
+
+private:
+    class ConnectionListener;
+    struct RestRouterTraitsTls;
+    struct RestRouterTraits;
+
+    template<typename HttpResponse>
+    static HttpResponse initHttpResponse(HttpResponse response);
+    static restinio::request_handling_status_t serverError(restinio::request_t& request);
+
+    template<typename ServerSettings>
+    void addServerSettings(ServerSettings& serverSettings, const unsigned int max_pipelined_requests = 16);
+
+    std::unique_ptr<RestRouter> createRestRouter();
+
+    void onConnectionClosed(restinio::connection_id_t);
+
+    /**
+     * Return the PublicKey id, the node id and node stats
+     * Method: GET "/"
+     * Result: HTTP 200, body: Node infos in JSON format
+     * On error: HTTP 503, body: {"err":"xxxx"}
+     * @param session
+     */
+    RequestStatus getNodeInfo(restinio::request_handle_t request, restinio::router::route_params_t params) const;
+
+    /**
+     * Return ServerStats in JSON format
+     * Method: STATS "/"
+     * Result: HTTP 200, body: Node infos in JSON format
+     * @param session
+     */
+    RequestStatus getStats(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Return Values of an infoHash
+     * Method: GET "/{InfoHash: .*}"
+     * Return: Multiple JSON object in parts. Example:
+     * Value in JSON format\n
+     * Value in JSON format
+     *
+     * On error: HTTP 503, body: {"err":"xxxx"}
+     * @param session
+     */
+    RequestStatus get(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Listen incoming Values of an infoHash.
+     * Method: LISTEN "/{InfoHash: .*}"
+     * Return: Multiple JSON object in parts. Example:
+     * Value in JSON format\n
+     * Value in JSON format
+     *
+     * On error: HTTP 503, body: {"err":"xxxx"}
+     * @param session
+     */
+    RequestStatus listen(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Put a value on the DHT
+     * Method: POST "/{InfoHash: .*}"
+     * body = Value to put in JSON
+     * Return: HTTP 200 if success and the value put in JSON
+     * On error: HTTP 503, body: {"err":"xxxx"} if no dht
+     * HTTP 400, body: {"err":"xxxx"} if bad json or HTTP 502 if put fails
+     * @param session
+     */
+    RequestStatus put(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    void handleCancelPermamentPut(const asio::error_code& ec, const InfoHash& key, Value::Id vid);
+
+#ifdef OPENDHT_PROXY_SERVER_IDENTITY
+    /**
+     * Put a value to sign by the proxy on the DHT
+     * Method: SIGN "/{InfoHash: .*}"
+     * body = Value to put in JSON
+     * Return: HTTP 200 if success and the value put in JSON
+     * On error: HTTP 503, body: {"err":"xxxx"} if no dht
+     * HTTP 400, body: {"err":"xxxx"} if bad json
+     * @param session
+     */
+    RequestStatus putSigned(restinio::request_handle_t request, restinio::router::route_params_t params) const;
+
+    /**
+     * Put a value to encrypt by the proxy on the DHT
+     * Method: ENCRYPT "/{hash: .*}"
+     * body = Value to put in JSON + "to":"infoHash"
+     * Return: HTTP 200 if success and the value put in JSON
+     * On error: HTTP 503, body: {"err":"xxxx"} if no dht
+     * HTTP 400, body: {"err":"xxxx"} if bad json
+     * @param session
+     */
+    RequestStatus putEncrypted(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+#endif // OPENDHT_PROXY_SERVER_IDENTITY
+
+    /**
+     * Return Values of an infoHash filtered by a value id
+     * Method: GET "/{InfoHash: .*}/{ValueId: .*}"
+     * Return: Multiple JSON object in parts. Example:
+     * Value in JSON format\n
+     * Value in JSON format
+     *
+     * On error: HTTP 503, body: {"err":"xxxx"}
+     * @param session
+     */
+    RequestStatus getFiltered(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Respond allowed Methods
+     * Method: OPTIONS "/{hash: .*}"
+     * Return: HTTP 200 + Allow: allowed methods
+     * See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS
+     * @param session
+     */
+    RequestStatus options(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    struct PushSessionContext
+    {
+        std::mutex lock;
+        std::string sessionId;
+        /** Where to push: follows the latest subscription refresh of the device. */
+        PushType type {PushType::None};
+        std::string topic;
+        PushSessionContext(const std::string& id)
+            : sessionId(id)
+        {}
+    };
+
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+    PushType getTypeFromString(const std::string& type);
+    std::string getDefaultTopic(PushType type);
+
+    RequestStatus pingPush(restinio::request_handle_t request, restinio::router::route_params_t /*params*/);
+    /**
+     * Subscribe to push notifications for an iOS or Android device.
+     * Method: SUBSCRIBE "/{InfoHash: .*}"
+     * Body: {"key": "device_key", (optional)"isAndroid":false (default true)}"
+     * Return: {"token": x}" where x if a token to save
+     * @note: the listen will timeout after six hours (and send a push notification).
+     * so you need to refresh the operation each six hours.
+     * @param session
+     */
+    RequestStatus subscribe(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Unsubscribe to push notifications for an iOS or Android device.
+     * Method: UNSUBSCRIBE "/{InfoHash: .*}"
+     * Body: {"key": "device_key", "token": x} where x if the token to cancel
+     * Return: nothing
+     * @param session
+     */
+    RequestStatus unsubscribe(restinio::request_handle_t request, restinio::router::route_params_t params);
+
+    /**
+     * Send a push notification via a gorush push gateway
+     * @param key of the device
+     * @param json, the content to send
+     */
+    void sendPushNotification(
+        const std::string& key, Json::Value&& json, PushType type, bool highPriority, const std::string& topic);
+
+    /**
+     * Send push notification with an expire timeout.
+     * @param ec
+     * @param pushToken
+     * @param json
+     * @param type
+     * @param topic
+     */
+    void handleNotifyPushListenExpire(const asio::error_code& ec,
+                                      const std::string pushToken,
+                                      std::function<Json::Value()> json,
+                                      PushType type,
+                                      const std::string& topic);
+
+    /**
+     * Remove a push listener between a client and a hash
+     * @param ec
+     * @param pushToken
+     * @param key
+     * @param clientId
+     */
+    void handleCancelPushListen(const asio::error_code& ec,
+                                const std::string pushToken,
+                                const InfoHash key,
+                                const std::string clientId);
+
+    /**
+     * Handles a push listen request.
+     *
+     * @param infoHash The information hash associated with the push listen request.
+     * @param pushToken The push token associated with the push listen request.
+     * @param clientId The client ID associated with the push listen request.
+     * @param sessionCtx The push session context of the listener, giving the session, push type and topic to use.
+     * @param values The vector of shared pointers to values associated with the push listen request.
+     * @param expired A boolean indicating whether the push listen request has expired.
+     * @return true.
+     */
+    bool handlePushListen(const InfoHash& infoHash,
+                          const std::string& pushToken,
+                          const std::string& clientId,
+                          const std::shared_ptr<DhtProxyServer::PushSessionContext>& sessionCtx,
+                          const std::vector<std::shared_ptr<Value>>& values,
+                          bool expired);
+
+#endif // OPENDHT_PUSH_NOTIFICATIONS
+
+    void handlePrintStats(const asio::error_code& ec);
+    void updateStats();
+
+    template<typename Os>
+    void saveState(Os& stream);
+
+    template<typename Is>
+    void loadState(Is& is, size_t size);
+
+    std::shared_ptr<asio::io_context> ioContext_;
+    std::shared_ptr<DhtRunner> dht_;
+    Json::StreamWriterBuilder jsonBuilder_;
+    Json::CharReaderBuilder jsonReaderBuilder_;
+    std::mt19937_64 rd {crypto::getSeededRandomEngine<std::mt19937_64>()};
+
+    std::string persistPath_;
+
+    // http server
+    std::thread serverThread_;
+    std::unique_ptr<restinio::http_server_t<RestRouterTraitsTls>> httpsServer_;
+    std::unique_ptr<restinio::http_server_t<RestRouterTraits>> httpServer_;
+
+    // http client
+    std::pair<std::string, std::string> pushHostPort_;
+
+    mutable std::mutex requestLock_;
+    std::map<unsigned int /*id*/, std::shared_ptr<http::Request>> requests_;
+
+    std::shared_ptr<log::Logger> logger_;
+
+    std::shared_ptr<ServerStats> stats_;
+    std::shared_ptr<NodeInfo> nodeInfo_ {};
+    std::unique_ptr<asio::steady_timer> printStatsTimer_;
+    const time_point serverStartTime_;
+    mutable std::mutex pushStatsMutex_;
+    PushStats androidPush_;
+    PushStats iosPush_;
+    PushStats unifiedPush_;
+    PushStats huaweiPush_;
+
+    // Thread-safe access to listeners map.
+    std::mutex lockListener_;
+    // Shared with connection listener.
+    std::map<restinio::connection_id_t, http::ListenerSession> listeners_;
+    // Connection Listener observing conn state changes.
+    std::shared_ptr<ConnectionListener> connListener_;
+    struct PermanentPut
+    {
+        sys_time_point expiration;
+        std::string pushToken;
+        std::string clientId;
+        std::shared_ptr<PushSessionContext> sessionCtx;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
+        Sp<Value> value;
+        PushType type;
+        std::string topic;
+
+        template<typename Packer>
+        void msgpack_pack(Packer& p) const
+        {
+            p.pack_map(2 + (sessionCtx ? 1 : 0) + (clientId.empty() ? 0 : 1) + (type == PushType::None ? 0 : 2)
+                       + (topic.empty() ? 0 : 1));
+            p.pack("value");
+            p.pack(value);
+            p.pack("exp");
+            p.pack(sys_clock::to_time_t(expiration));
+            if (not clientId.empty()) {
+                p.pack("cid");
+                p.pack(clientId);
+            }
+            if (sessionCtx) {
+                std::lock_guard l(sessionCtx->lock);
+                p.pack("sid");
+                p.pack(sessionCtx->sessionId);
+            }
+            if (type != PushType::None) {
+                p.pack("t");
+                p.pack(type);
+                p.pack("token");
+                p.pack(pushToken);
+            }
+            if (not topic.empty()) {
+                p.pack("top");
+                p.pack(topic);
+            }
+        }
+
+        void msgpack_unpack(const msgpack::object& o);
+    };
+    struct SearchPuts
+    {
+        std::map<dht::Value::Id, PermanentPut> puts;
+        MSGPACK_DEFINE_ARRAY(puts)
+    };
+    std::mutex lockSearchPuts_;
+    std::map<InfoHash, SearchPuts> puts_;
+
+    mutable std::atomic<size_t> requestNum_ {0};
+    mutable std::atomic<time_point> lastStatsReset_ {time_point::min()};
+
+    std::string pushServer_;
+    std::string bundleId_;
+
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+    struct Listener
+    {
+        sys_time_point expiration;
+        std::string clientId;
+        std::shared_ptr<PushSessionContext> sessionCtx;
+        std::future<size_t> internalToken;
+        std::unique_ptr<asio::system_timer> expireTimer;
+        std::unique_ptr<asio::system_timer> expireNotifyTimer;
+        PushType type;
+        std::string topic;
+
+        template<typename Packer>
+        void msgpack_pack(Packer& p) const
+        {
+            p.pack_map(3 + (sessionCtx ? 1 : 0) + (topic.empty() ? 0 : 1));
+            p.pack("cid");
+            p.pack(clientId);
+            p.pack("exp");
+            p.pack(sys_clock::to_time_t(expiration));
+            if (sessionCtx) {
+                std::lock_guard l(sessionCtx->lock);
+                p.pack("sid");
+                p.pack(sessionCtx->sessionId);
+            }
+            p.pack("t");
+            p.pack(type);
+            if (!topic.empty()) {
+                p.pack("top");
+                p.pack(topic);
+            }
+        }
+
+        void msgpack_unpack(const msgpack::object& o);
+    };
+    struct PushListener
+    {
+        std::map<InfoHash, std::vector<Listener>> listeners;
+        MSGPACK_DEFINE_ARRAY(listeners)
+    };
+    std::map<std::string, PushListener> pushListeners_;
+#endif // OPENDHT_PUSH_NOTIFICATIONS
+};
+
+} // namespace dht

include/opendht/dhtrunner.h

@@ -1,36 +1,15 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
-#include "securedht.h"
+#include "def.h"
+#include "infohash.h"
+#include "value.h"
+#include "callbacks.h"
+#include "sockaddr.h"
+#include "logger.h"
+#include "network_utils.h"
+#include "node_export.h"
 
 #include <thread>
 #include <mutex>
@@ -43,146 +22,345 @@
 
 namespace dht {
 
+struct Node;
+class SecureDht;
+class PeerDiscovery;
+struct SecureDhtConfig;
+
 /**
  * Provides a thread-safe interface to run the (secure) DHT.
  * The class will open sockets on the provided port and will
  * either wait for (expectedly frequent) calls to ::loop() or start an internal
  * thread that will update the DHT when appropriate.
  */
-class DhtRunner {
-
+class OPENDHT_PUBLIC DhtRunner
+{
 public:
-    typedef std::function<void(Dht::Status, Dht::Status)> StatusCallback;
+    using StatusCallback = std::function<void(NodeStatus, NodeStatus)>;
+
+    struct Config
+    {
+        SecureDhtConfig dht_config {};
+        bool threaded {true};
+        std::string proxy_server {};
+        std::string push_node_id {};
+        std::string push_token {};
+        std::string push_topic {};
+        std::string push_platform {};
+        std::string proxy_user_agent {};
+        bool peer_discovery {false};
+        bool peer_publish {false};
+        std::shared_ptr<dht::crypto::Certificate> server_ca;
+        dht::crypto::Identity client_identity;
+        SockAddr bind4 {}, bind6 {};
+    };
+
+    struct Context
+    {
+        std::shared_ptr<Logger> logger {};
+        std::unique_ptr<net::DatagramSocket> sock;
+        std::shared_ptr<PeerDiscovery> peerDiscovery {};
+        StatusCallback statusChangedCallback {};
+        CertificateStoreQuery certificateStore {};
+        IdentityAnnouncedCb identityAnnouncedCb {};
+        PublicAddressChangedCb publicAddressChangedCb {};
+        std::unique_ptr<std::mt19937_64> rng {};
+        Context() {}
+    };
 
     DhtRunner();
     virtual ~DhtRunner();
 
-    void get(InfoHash id, Dht::GetCallbackSimple cb, Dht::DoneCallback donecb={}, Value::Filter f = Value::AllFilter()) {
-        get(id, Dht::bindGetCb(cb), donecb, f);
-    }
-
-    void get(InfoHash id, Dht::GetCallbackSimple cb, Dht::DoneCallbackSimple donecb={}, Value::Filter f = Value::AllFilter()) {
-        get(id, Dht::bindGetCb(cb), donecb, f);
-    }
-
-    void get(InfoHash hash, Dht::GetCallback vcb, Dht::DoneCallback dcb, Value::Filter f={});
-
-    void get(InfoHash id, Dht::GetCallback cb, Dht::DoneCallbackSimple donecb={}, Value::Filter f = Value::AllFilter()) {
-        get(id, cb, Dht::bindDoneCb(donecb), f);
-    }
-    void get(const std::string& key, Dht::GetCallback vcb, Dht::DoneCallbackSimple dcb={}, Value::Filter f = Value::AllFilter());
-
-    template <class T>
-    void get(InfoHash hash, std::function<bool(std::vector<T>&&)> cb, Dht::DoneCallbackSimple dcb={})
+    void get(InfoHash id, GetCallbackSimple cb, DoneCallback donecb = {}, Value::Filter f = {}, Where w = {})
     {
-        get(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
-            return cb(unpackVector<T>(vals));
-        },
-        dcb,
-        getFilterSet<T>());
+        get(id, bindGetCb(cb), donecb, f, w);
     }
-    template <class T>
-    void get(InfoHash hash, std::function<bool(T&&)> cb, Dht::DoneCallbackSimple dcb={})
+
+    void get(InfoHash id, GetCallbackSimple cb, DoneCallbackSimple donecb = {}, Value::Filter f = {}, Where w = {})
     {
-        get(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
-            for (const auto& v : vals) {
-                try {
-                    if (not cb(Value::unpack<T>(*v)))
-                        return false;
-                } catch (const std::exception&) {
-                    continue;
+        get(id, bindGetCb(cb), donecb, f, w);
+    }
+
+    void get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f = {}, Where w = {});
+
+    void get(InfoHash id, GetCallback cb, DoneCallbackSimple donecb = {}, Value::Filter f = {}, Where w = {})
+    {
+        get(id, cb, bindDoneCb(donecb), f, w);
+    }
+    void get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb = {}, Value::Filter f = {}, Where w = {});
+
+    template<class T>
+    void get(InfoHash hash, std::function<bool(std::vector<T>&&)> cb, DoneCallbackSimple dcb = {})
+    {
+        get(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) { return cb(unpackVector<T>(vals)); },
+            dcb,
+            getFilterSet<T>());
+    }
+    template<class T>
+    void get(InfoHash hash, std::function<bool(T&&)> cb, DoneCallbackSimple dcb = {})
+    {
+        get(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v)))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
                 }
-            }
-            return true;
-        },
-        dcb,
-        getFilterSet<T>());
+                return true;
+            },
+            dcb,
+            getFilterSet<T>());
     }
 
-    std::future<std::vector<std::shared_ptr<dht::Value>>> get(InfoHash key, Value::Filter f = Value::AllFilter()) {
-        auto p = std::make_shared<std::promise<std::vector<std::shared_ptr< dht::Value >>>>();
-        auto values = std::make_shared<std::vector<std::shared_ptr< dht::Value >>>();
-        get(key, [=](const std::vector<std::shared_ptr<dht::Value>>& vlist) {
-            values->insert(values->end(), vlist.begin(), vlist.end());
-            return true;
-        }, [=](bool) {
-            p->set_value(std::move(*values));
-        },
-        f);
+    std::future<std::vector<std::shared_ptr<dht::Value>>> get(InfoHash key, Value::Filter f = {}, Where w = {})
+    {
+        auto p = std::make_shared<std::promise<std::vector<std::shared_ptr<dht::Value>>>>();
+        auto values = std::make_shared<std::vector<std::shared_ptr<dht::Value>>>();
+        get(
+            key,
+            [=](const std::vector<std::shared_ptr<dht::Value>>& vlist) {
+                values->insert(values->end(), vlist.begin(), vlist.end());
+                return true;
+            },
+            [=](bool) { p->set_value(std::move(*values)); },
+            f,
+            w);
         return p->get_future();
     }
 
-    template <class T>
-    std::future<std::vector<T>> get(InfoHash key) {
+    template<class T>
+    std::future<std::vector<T>> get(InfoHash key)
+    {
         auto p = std::make_shared<std::promise<std::vector<T>>>();
         auto values = std::make_shared<std::vector<T>>();
-        get<T>(key, [=](T&& v) {
-            values->emplace_back(std::move(v));
-            return true;
-        }, [=](bool) {
-            p->set_value(std::move(*values));
-        });
+        get<T>(
+            key,
+            [=](T&& v) {
+                values->emplace_back(std::move(v));
+                return true;
+            },
+            [=](bool) { p->set_value(std::move(*values)); });
         return p->get_future();
     }
 
-    std::future<size_t> listen(InfoHash key, Dht::GetCallback vcb, Value::Filter f = Value::AllFilter());
-    std::future<size_t> listen(const std::string& key, Dht::GetCallback vcb, Value::Filter f = Value::AllFilter());
-    std::future<size_t> listen(InfoHash key, Dht::GetCallbackSimple cb, Value::Filter f = Value::AllFilter()) {
-        return listen(key, Dht::bindGetCb(cb), f);
+    void query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb = {}, Query q = {});
+    void query(const InfoHash& hash, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query q = {})
+    {
+        query(hash, cb, bindDoneCb(done_cb), q);
     }
 
-    template <class T>
+    std::future<size_t> listen(InfoHash key, ValueCallback vcb, Value::Filter f = {}, Where w = {});
+
+    std::future<size_t> listen(InfoHash key, GetCallback cb, Value::Filter f = {}, Where w = {})
+    {
+        return listen(
+            key,
+            [cb = std::move(cb)](const std::vector<Sp<Value>>& vals, bool expired) {
+                if (not expired)
+                    return cb(vals);
+                return true;
+            },
+            std::forward<Value::Filter>(f),
+            std::forward<Where>(w));
+    }
+    std::future<size_t> listen(const std::string& key, GetCallback vcb, Value::Filter f = {}, Where w = {});
+    std::future<size_t> listen(InfoHash key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {})
+    {
+        return listen(key, bindGetCb(cb), f, w);
+    }
+
+    template<class T>
     std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&)> cb)
     {
-        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
-            return cb(unpackVector<T>(vals));
-        },
-        getFilterSet<T>());
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) { return cb(unpackVector<T>(vals)); },
+            getFilterSet<T>());
     }
-    template <typename T>
-    std::future<size_t> listen(InfoHash hash, std::function<bool(T&&)> cb, Value::Filter f = Value::AllFilter())
+    template<class T>
+    std::future<size_t> listen(InfoHash hash, std::function<bool(std::vector<T>&&, bool)> cb)
     {
-        return listen(hash, [=](const std::vector<std::shared_ptr<Value>>& vals) {
-            for (const auto& v : vals) {
-                try {
-                    if (not cb(Value::unpack<T>(*v)))
-                        return false;
-                } catch (const std::exception&) {
-                    continue;
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+                return cb(unpackVector<T>(vals), expired);
+            },
+            getFilterSet<T>());
+    }
+
+    template<typename T>
+    std::future<size_t> listen(InfoHash hash, std::function<bool(T&&)> cb, Value::Filter f = {}, Where w = {})
+    {
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v)))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
                 }
-            }
-            return true;
-        },
-        getFilterSet<T>(f));
+                return true;
+            },
+            getFilterSet<T>(f),
+            w);
+    }
+    template<typename T>
+    std::future<size_t> listen(InfoHash hash, std::function<bool(T&&, bool)> cb, Value::Filter f = {}, Where w = {})
+    {
+        return listen(
+            hash,
+            [cb = std::move(cb)](const std::vector<std::shared_ptr<Value>>& vals, bool expired) {
+                for (const auto& v : vals) {
+                    try {
+                        if (not cb(Value::unpack<T>(*v), expired))
+                            return false;
+                    } catch (const std::exception&) {
+                        continue;
+                    }
+                }
+                return true;
+            },
+            getFilterSet<T>(f),
+            w);
     }
 
     void cancelListen(InfoHash h, size_t token);
     void cancelListen(InfoHash h, std::shared_future<size_t> token);
 
-    void put(InfoHash hash, Value&& value, Dht::DoneCallback cb=nullptr);
-    void put(InfoHash hash, const std::shared_ptr<Value>&, Dht::DoneCallback cb=nullptr);
-    void put(InfoHash hash, Value&& value, Dht::DoneCallbackSimple cb) {
-        put(hash, std::forward<Value>(value), Dht::bindDoneCb(cb));
-    }
-    void put(const std::string& key, Value&& value, Dht::DoneCallbackSimple cb=nullptr);
-
-    void cancelPut(const InfoHash& h, const Value::Id& id);
-
-    void putSigned(InfoHash hash, Value&& value, Dht::DoneCallback cb=nullptr);
-    void putSigned(const std::string& key, Value&& value, Dht::DoneCallbackSimple cb=nullptr);
-    void putSigned(InfoHash hash, Value&& value, Dht::DoneCallbackSimple cb) {
-        putSigned(hash, std::forward<Value>(value), Dht::bindDoneCb(cb));
+    void put(InfoHash hash,
+             std::shared_ptr<Value> value,
+             DoneCallback cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);
+    void put(InfoHash hash,
+             std::shared_ptr<Value> value,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false)
+    {
+        put(hash, value, bindDoneCb(cb), created, permanent);
     }
 
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, Dht::DoneCallback cb=nullptr);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, Dht::DoneCallbackSimple cb) {
-        putEncrypted(hash, to, std::forward<Value>(value), Dht::bindDoneCb(cb));
+    void put(InfoHash hash,
+             Value&& value,
+             DoneCallback cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);
+    void put(InfoHash hash,
+             Value&& value,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false)
+    {
+        put(hash, std::forward<Value>(value), bindDoneCb(cb), created, permanent);
     }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, Dht::DoneCallback cb=nullptr);
+    void put(const std::string& key,
+             Value&& value,
+             DoneCallbackSimple cb = {},
+             time_point created = time_point::max(),
+             bool permanent = false);
 
-    void bootstrap(const char* host, const char* service);
-    void bootstrap(const std::vector<std::pair<sockaddr_storage, socklen_t>>& nodes);
-    void bootstrap(const std::vector<NodeExport>& nodes);
+    void cancelPut(const InfoHash& h, Value::Id id);
+    void cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value);
+
+    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
+    void putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putSigned(hash, value, bindDoneCb(cb), permanent);
+    }
+
+    void putSigned(InfoHash hash, Value&& value, DoneCallback cb = {}, bool permanent = false);
+    void putSigned(InfoHash hash, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putSigned(hash, std::forward<Value>(value), bindDoneCb(cb), permanent);
+    }
+    void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);
+
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      std::shared_ptr<Value> value,
+                      DoneCallback cb = {},
+                      bool permanent = false);
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      std::shared_ptr<Value> value,
+                      DoneCallbackSimple cb,
+                      bool permanent = false)
+    {
+        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
+    }
+
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      Value&& value,
+                      DoneCallback cb = {},
+                      bool permanent = false);
+    void putEncrypted(InfoHash hash,
+                      const std::shared_ptr<crypto::PublicKey>& to,
+                      Value&& value,
+                      DoneCallbackSimple cb,
+                      bool permanent = false)
+    {
+        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
+    }
+
+    void putEncrypted(
+        InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
+    void putEncrypted(
+        InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }
+
+    /**
+     * Insert known nodes to the routing table, without necessarly ping them.
+     * Usefull to restart a node and get things running fast without putting load on the network.
+     */
+    void bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb = {});
+    void bootstrap(SockAddr addr, DoneCallbackSimple cb = {});
+
+    /**
+     * Insert known nodes to the routing table, without necessarly ping them.
+     * Usefull to restart a node and get things running fast without putting load on the network.
+     */
+    void bootstrap(std::vector<NodeExport> nodes);
+
+    /**
+     * Add host:service to bootstrap nodes, and ping this node.
+     * DNS resolution is performed asynchronously.
+     * When disconnected, all bootstrap nodes added with this method will be tried regularly until connection
+     * to the DHT network is established.
+     */
+    void bootstrap(const std::string& host, const std::string& service);
+    void bootstrap(const std::string& hostService);
+
+    /**
+     * Insert known nodes to the routing table, without necessarly ping them.
+     * Usefull to restart a node and get things running fast without putting load on the network.
+     */
+    void bootstrap(const InfoHash& id, const SockAddr& address);
+
+    /**
+     * Clear the list of bootstrap added using bootstrap(const std::string&, const std::string&).
+     */
+    void clearBootstrap();
 
     /**
      * Inform the DHT of lower-layer connectivity changes.
@@ -191,137 +369,81 @@ public:
      */
     void connectivityChanged();
 
-    void dumpTables() const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->dumpTables();
-    }
-
-    InfoHash getId() const {
-        if (!dht_)
-            return {};
-        return dht_->getId();
-    }
-
-    InfoHash getNodeId() const {
-        if (!dht_)
-            return {};
-        return dht_->getNodeId();
-    }
+    void dumpTables() const;
 
     /**
-     * @deprecated Use getNodeId()
+     * Get the public key fingerprint if an identity is used with this node, 0 otherwise.
      */
-    //[[deprecated]]
-    InfoHash getRoutingId() const {
-        return getNodeId();
-    }
+    [[deprecated("Use getPublicKey()->getLongId() instead")]] InfoHash getId() const;
+    std::shared_ptr<crypto::PublicKey> getPublicKey() const;
+
+    /**
+     * Get the ID of the DHT node.
+     */
+    InfoHash getNodeId() const;
 
     /**
      * Returns the currently bound address.
      * @param f: address family of the bound address to retreive.
      */
-    const Address& getBound(sa_family_t f = AF_INET) const {
-        return (f == AF_INET) ? bound4 : bound6;
-    }
+    SockAddr getBound(sa_family_t f = AF_INET) const;
 
     /**
      * Returns the currently bound port, in host byte order.
      * @param f: address family of the bound port to retreive.
      */
-    in_port_t getBoundPort(sa_family_t f = AF_INET) const {
-        return ntohs(((sockaddr_in*)&getBound(f).first)->sin_port);
-    }
+    in_port_t getBoundPort(sa_family_t f = AF_INET) const;
 
-    std::vector<NodeExport> exportNodes() const {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        if (!dht_)
-            return {};
-        return dht_->exportNodes();
-    }
+    std::pair<size_t, size_t> getStoreSize() const;
 
-    std::vector<Dht::ValuesExport> exportValues() const {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        if (!dht_)
-            return {};
-        return dht_->exportValues();
-    }
+    size_t getStorageLimit() const;
+    void setStorageLimit(size_t limit = 0);
 
-    void setLoggers(LogMethod&& error = NOLOG, LogMethod&& warn = NOLOG, LogMethod&& debug = NOLOG) {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->setLoggers(std::forward<LogMethod>(error), std::forward<LogMethod>(warn), std::forward<LogMethod>(debug));
-    }
+    size_t getLocalStorageLimit() const;
+    void setLocalStorageLimit(size_t limit = 0);
 
-    void registerType(const ValueType& type) {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->registerType(type);
-    }
+    std::vector<NodeExport> exportNodes() const;
 
-    void importValues(const std::vector<Dht::ValuesExport>& values) {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->importValues(values);
-    }
+    std::vector<ValuesExport> exportValues() const;
 
-    bool isRunning() const {
-        return running;
-    }
+    void setLogger(const Sp<Logger>& logger = {});
 
-    int getNodesStats(sa_family_t af, unsigned *good_return, unsigned *dubious_return, unsigned *cached_return, unsigned *incoming_return) const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getNodesStats(af, good_return, dubious_return, cached_return, incoming_return);
-    }
+    /**
+     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
+     */
+    void setLogFilter(const InfoHash& f = {});
 
-    std::vector<unsigned> getNodeMessageStats(bool in = false) const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getNodeMessageStats(in);
-    }
+    void registerType(const ValueType& type);
+    void registerInsecureType(const ValueType& type);
 
-    std::string getStorageLog() const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getStorageLog();
-    }
-    std::string getRoutingTablesLog(sa_family_t af) const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getRoutingTablesLog(af);
-    }
-    std::string getSearchesLog(sa_family_t af = 0) const
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getSearchesLog(af);
-    }
-    std::vector<Address> getPublicAddress()
-    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        return dht_->getPublicAddress();
-    }
-    std::vector<std::string> getPublicAddressStr()
-    {
-        auto addrs = getPublicAddress();
-        std::vector<std::string> ret(addrs.size());
-        std::transform(addrs.begin(), addrs.end(), ret.begin(), dht::printAddr);
-        return ret;
-    }
+    void importValues(const std::vector<ValuesExport>& values);
+
+    bool isRunning() const { return running != State::Idle; }
+
+    NodeStats getNodesStats(sa_family_t af) const;
+    unsigned getNodesStats(sa_family_t af,
+                           unsigned* good_return,
+                           unsigned* dubious_return,
+                           unsigned* cached_return,
+                           unsigned* incoming_return) const;
+    NodeInfo getNodeInfo() const;
+    void getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)>);
+
+    std::vector<unsigned> getNodeMessageStats(bool in = false) const;
+    std::string getStorageLog() const;
+    std::string getStorageLog(const InfoHash&) const;
+    std::string getRoutingTablesLog(sa_family_t af) const;
+    std::string getSearchesLog(sa_family_t af = AF_UNSPEC) const;
+    std::string getSearchLog(const InfoHash&, sa_family_t af = AF_UNSPEC) const;
+    std::vector<SockAddr> getPublicAddress(sa_family_t af = AF_UNSPEC) const;
+    std::vector<std::string> getPublicAddressStr(sa_family_t af = AF_UNSPEC) const;
+    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);
 
     // securedht methods
+    void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
 
-    void findCertificate(InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>)>);
-    void registerCertificate(std::shared_ptr<crypto::Certificate> cert) {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->registerCertificate(cert);
-    }
-    void setLocalCertificateStore(SecureDht::CertificateStoreQuery&& query_method) {
-        std::lock_guard<std::mutex> lck(dht_mtx);
-        dht_->setLocalCertificateStore(std::move(query_method));
-    }
-
-    struct Config {
-        SecureDht::Config dht_config;
-        bool threaded;
-    };
+    void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
+    void setLocalCertificateStore(CertificateStoreQuery&& query_method);
 
     /**
      * @param port: Local port to bind. Both IPv4 and IPv6 will be tried (ANY).
@@ -329,38 +451,31 @@ public:
      * @param threaded: If false, ::loop() must be called periodically. Otherwise a thread is launched.
      * @param cb: Optional callback to receive general state information.
      */
-    void run(in_port_t port, const crypto::Identity identity, bool threaded = false, bool is_bootstrap = false) {
-        run(port, {
-            .dht_config = {
-                .node_config = {
-                    .node_id = {},
-                    .is_bootstrap = is_bootstrap
-                },
-                .id = identity
-            },
-            .threaded = threaded
-        });
+    void run(in_port_t port = dht::net::DHT_DEFAULT_PORT,
+             const crypto::Identity& identity = {},
+             bool threaded = true,
+             NetId network = 0)
+    {
+        Config config;
+        config.dht_config.node_config.network = network;
+        config.dht_config.id = identity;
+        config.threaded = threaded;
+        run(port, config);
     }
-    void run(in_port_t port, Config config);
+    void run(in_port_t port, Config& config, Context&& context = {});
 
     /**
-     * @param local4: Local IPv4 address and port to bind. Can be null.
-     * @param local6: Local IPv6 address and port to bind. Can be null.
-     *         BEP-32 mandates that we should bind to one of our
-     *         global IPv6 addresses.
-     * @param identity: RSA key pair to use for cryptographic operations.
-     * @param threaded: If false, loop() must be called periodically. Otherwise a thread is launched.
-     * @param cb: Optional callback to receive general state information.
+     * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service
+     * (port).
      */
-    void run(const sockaddr_in* local4, const sockaddr_in6* local6, Config config);
+    void run(const char* ip4, const char* ip6, const char* service, Config& config, Context&& context = {});
 
-    /**
-     * Same as @run(sockaddr_in, sockaddr_in6, Identity, bool, StatusCallback), but with string IP addresses and service (port).
-     */
-    void run(const char* ip4, const char* ip6, const char* service, Config config);
+    void run(const Config& config, Context&& context);
 
-    void setOnStatusChanged(StatusCallback&& cb) {
-        statusCb = std::move(cb);
+    void setOnStatusChanged(StatusCallback&& cb)
+    {
+        if (cb)
+            statusCbs.emplace_back(std::move(cb));
     }
 
     /**
@@ -368,55 +483,117 @@ public:
      * regularly and everytime a new packet is received.
      * @return the next op
      */
-    time_point loop() {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+    time_point loop()
+    {
+        std::lock_guard lck(dht_mtx);
         return loop_();
     }
 
     /**
      * Gracefuly disconnect from network.
      */
-    void shutdown(Dht::ShutdownCallback cb);
+    void shutdown(ShutdownCallback cb = {}, bool stop = false);
 
     /**
-     * Quit and wait for all threads to terminate.
-     * No callbacks will be called after this method returns.
-     * All internal state will be lost. The DHT can then be run again with @run().
+     * Stop the node and wait for all threads to terminate.
+     * The node is reset to its default state. The DHT can then be run again with @run().
+     * No DHT callbacks will run after this method returns.
+     * Calling this method is optional. It allows to ensure the destructor won't block.
+     * This method is unable to be called from a DHT callback.
      */
     void join();
 
+    std::shared_ptr<PeerDiscovery> getPeerDiscovery() const { return peerDiscovery_; };
+
+    void setProxyServer(const std::string& proxy, const std::string& pushNodeId = "");
+
+    /**
+     * Start or stop the proxy
+     * @param proxify if we want to use the proxy
+     */
+    void enableProxy(bool proxify);
+
+    /* Push notification methods */
+
+    /**
+     * Updates the push notification device token
+     */
+    void setPushNotificationToken(const std::string& token);
+
+    /**
+     * Sets the push notification topic
+     */
+    void setPushNotificationTopic(const std::string& topic);
+
+    /**
+     * Sets the push notification platform
+     */
+    void setPushNotificationPlatform(const std::string& platform);
+
+    /**
+     * Insert a push notification to process for OpenDHT
+     * Returns an immediately ready future with IgnoredStopped if the runner is idle,
+     * or IgnoredDisabled if push notification support is disabled at build time.
+     */
+    std::future<PushNotificationResult> pushNotificationReceived(const std::map<std::string, std::string>& data);
+
+    /* Proxy server mothods */
+    void forwardAllMessages(bool forward);
+
 private:
+    enum class State { Idle, Running, Stopping };
 
-    void doRun(const sockaddr_in* sin4, const sockaddr_in6* sin6, SecureDht::Config config);
     time_point loop_();
 
-    static std::vector<std::pair<sockaddr_storage, socklen_t>> getAddrInfo(const char* host, const char* service);
+    NodeStatus getStatus() const { return std::max(status4, status6); }
 
-    Dht::Status getStatus() const {
-        return std::max(status4, status6);
-    }
+    bool checkShutdown();
+    void opEnded();
+    DoneCallback bindOpDoneCallback(DoneCallback&& cb);
+    DoneCallbackSimple bindOpDoneCallback(DoneCallbackSimple&& cb);
 
-    std::unique_ptr<SecureDht> dht_ {};
-    mutable std::mutex dht_mtx {};
+    /** DHT instance */
+    std::unique_ptr<SecureDht> dht_;
+
+    /** true if we are currently using a proxy */
+    std::atomic_bool use_proxy {false};
+
+    /** Current configuration */
+    Config config_;
+    IdentityAnnouncedCb identityAnnouncedCb_;
+
+    /**
+     * reset dht clients
+     */
+    void resetDht();
+
+    mutable std::mutex dht_mtx;
     std::thread dht_thread {};
     std::condition_variable cv {};
-
-    std::thread rcv_thread {};
-    std::mutex sock_mtx {};
-    std::vector<std::pair<Blob, std::pair<sockaddr_storage, socklen_t>>> rcv {};
+    std::mutex sock_mtx;
+    net::PacketList rcv {};
+    decltype(rcv) rcv_free {};
 
     std::queue<std::function<void(SecureDht&)>> pending_ops_prio {};
     std::queue<std::function<void(SecureDht&)>> pending_ops {};
-    std::mutex storage_mtx {};
+    std::mutex storage_mtx;
 
-    std::atomic<bool> running {false};
+    std::atomic<State> running {State::Idle};
+    std::atomic_size_t ongoing_ops {0};
+    std::vector<ShutdownCallback> shutdownCallbacks_;
 
-    Dht::Status status4 {Dht::Status::Disconnected},
-                status6 {Dht::Status::Disconnected};
-    StatusCallback statusCb {nullptr};
+    NodeStatus status4 {NodeStatus::Disconnected}, status6 {NodeStatus::Disconnected};
 
-    Address bound4 {};
-    Address bound6 {};
+    std::vector<StatusCallback> statusCbs {};
+
+    /** PeerDiscovery Parameters */
+    std::shared_ptr<PeerDiscovery> peerDiscovery_;
+
+    /**
+     * The Logger instance is used in enableProxy and other methods that
+     * would create instances of classes using a common logger.
+     */
+    std::shared_ptr<dht::Logger> logger_;
 };
 
-}
+} // namespace dht

include/opendht/http.h

@@ -0,0 +1,375 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+#include "infohash.h"
+#include "crypto.h"
+
+// some libraries may try to redefine snprintf
+// but restinio will use it in std namespace
+#ifdef _MSC_VER
+#undef snprintf
+#define snprintf snprintf
+#endif
+
+#include <asio/ip/tcp.hpp>
+#include <asio/streambuf.hpp>
+#include <asio/ssl/context.hpp>
+#include <restinio/message_builders.hpp>
+
+#include <memory>
+#include <queue>
+#include <mutex>
+#include <future>
+
+namespace Json {
+class Value;
+}
+
+namespace restinio {
+namespace impl {
+class tls_socket_t;
+}
+} // namespace restinio
+
+namespace dht {
+namespace log {
+struct Logger;
+}
+
+namespace crypto {
+struct Certificate;
+}
+
+namespace http {
+
+using HandlerCb = std::function<void(const asio::error_code& ec)>;
+using BytesHandlerCb = std::function<void(const asio::error_code& ec, size_t bytes)>;
+using ConnectHandlerCb = std::function<void(const asio::error_code& ec, const asio::ip::tcp::endpoint& endpoint)>;
+
+using ssl_socket_t = restinio::impl::tls_socket_t;
+using socket_t = asio::ip::tcp::socket;
+
+struct OPENDHT_PUBLIC Url
+{
+    Url() = default;
+    Url(std::string url);
+
+    std::string url;
+    std::string protocol {"http"};
+    std::string_view user;
+    std::string_view password;
+    std::string_view host;
+    std::string_view service;
+    std::string target;
+    std::string_view query;
+    std::string_view fragment;
+
+    std::string toString() const;
+};
+
+class OPENDHT_PUBLIC Connection : public std::enable_shared_from_this<Connection>
+{
+public:
+    Connection(asio::io_context& ctx, const bool ssl = true, std::shared_ptr<log::Logger> l = {});
+    Connection(asio::io_context& ctx,
+               std::shared_ptr<dht::crypto::Certificate> server_ca,
+               const dht::crypto::Identity& identity,
+               std::shared_ptr<log::Logger> l = {});
+    ~Connection();
+
+    inline unsigned int id() const { return id_; };
+    bool is_open() const;
+    bool is_ssl() const;
+    void checkOcsp(bool check = true) { checkOcsp_ = check; }
+
+    void set_ssl_verification(const std::string& hostname, const asio::ssl::verify_mode verify_mode);
+
+    asio::streambuf& input();
+    std::istream& data() { return istream_; }
+
+    std::string read_bytes(size_t bytes = 0);
+    std::string read_until(const char delim);
+
+    void async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, ConnectHandlerCb);
+    void async_handshake(HandlerCb cb);
+    void async_write(BytesHandlerCb cb);
+    void async_read_until(const char* delim, BytesHandlerCb cb);
+    void async_read_until(char delim, BytesHandlerCb cb);
+    void async_read(size_t bytes, BytesHandlerCb cb);
+    void async_read_some(size_t bytes, BytesHandlerCb cb);
+
+    void set_keepalive(uint32_t seconds);
+
+    const asio::ip::address& local_address() const;
+
+    void timeout(const std::chrono::seconds& timeout, HandlerCb cb = {});
+
+    /**
+     * Close the underlying socket.
+     * Safe to call from any thread: the actual close is dispatched to
+     * the thread running the io_context.
+     */
+    void close();
+
+private:
+    void doClose();
+
+    template<typename T>
+    T wrapCallback(T cb) const
+    {
+        return [t = shared_from_this(), cb = std::move(cb)](auto... params) {
+            cb(params...);
+        };
+    }
+
+    mutable std::mutex mutex_;
+
+    unsigned int id_;
+    static std::atomic_uint ids_;
+
+    asio::io_context& ctx_;
+    std::unique_ptr<socket_t> socket_;
+    std::shared_ptr<asio::ssl::context> ssl_ctx_;
+    std::unique_ptr<ssl_socket_t> ssl_socket_;
+
+    asio::ip::tcp::endpoint endpoint_;
+
+    asio::streambuf write_buf_;
+    asio::streambuf read_buf_;
+    std::istream istream_;
+
+    asio::ip::address local_address_;
+
+    std::unique_ptr<asio::steady_timer> timeout_timer_;
+    std::shared_ptr<log::Logger> logger_;
+    bool checkOcsp_ {false};
+};
+
+/* @class Resolver
+ * @brief The purpose is to only resolve once to avoid mutliple dns requests per operation.
+ */
+class OPENDHT_PUBLIC Resolver
+{
+public:
+    using ResolverCb
+        = std::function<void(const asio::error_code& ec, const std::vector<asio::ip::tcp::endpoint>& endpoints)>;
+
+    Resolver(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
+    Resolver(asio::io_context& ctx,
+             std::string_view host,
+             std::string_view service,
+             const bool ssl = false,
+             std::shared_ptr<log::Logger> logger = {});
+
+    // use already resolved endpoints with classes using this resolver
+    Resolver(asio::io_context& ctx,
+             std::vector<asio::ip::tcp::endpoint> endpoints,
+             const bool ssl = false,
+             std::shared_ptr<log::Logger> logger = {});
+
+    ~Resolver();
+
+    inline const Url& get_url() const { return url_; }
+
+    void add_callback(ResolverCb cb, sa_family_t family = AF_UNSPEC);
+
+    std::shared_ptr<log::Logger> getLogger() const { return logger_; }
+
+    void cancel();
+
+private:
+    void resolve(std::string_view host, std::string_view service);
+
+    mutable std::mutex mutex_;
+
+    Url url_;
+    asio::error_code ec_;
+    asio::ip::tcp::resolver resolver_;
+    std::shared_ptr<bool> destroyed_;
+    std::vector<asio::ip::tcp::endpoint> endpoints_;
+
+    bool completed_ {false};
+    std::queue<ResolverCb> cbs_;
+
+    std::shared_ptr<log::Logger> logger_;
+};
+
+class Request;
+
+struct Response
+{
+    unsigned status_code {0};
+    std::map<std::string, std::string> headers;
+    std::string body;
+    bool aborted {false};
+    std::weak_ptr<Request> request;
+};
+
+class OPENDHT_PUBLIC Request : public std::enable_shared_from_this<Request>
+{
+public:
+    enum class State { CREATED, SENDING, HEADER_RECEIVED, RECEIVING, DONE };
+    using OnStatusCb = std::function<void(unsigned status_code)>;
+    using OnDataCb = std::function<void(const char* at, size_t length)>;
+    using OnStateChangeCb = std::function<void(State state, const Response& response)>;
+    using OnJsonCb = std::function<void(Json::Value value, const Response& response)>;
+    using OnDoneCb = std::function<void(const Response& response)>;
+
+    // resolves implicitly
+    Request(asio::io_context& ctx,
+            std::string url,
+            const Json::Value& json,
+            OnJsonCb jsoncb,
+            std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnJsonCb jsoncb, std::shared_ptr<log::Logger> logger = {});
+
+    Request(asio::io_context& ctx, std::string url, std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx,
+            std::string_view host,
+            std::string_view service,
+            const bool ssl = false,
+            std::shared_ptr<log::Logger> logger = {});
+    Request(asio::io_context& ctx, std::string url, OnDoneCb onDone, std::shared_ptr<log::Logger> logger = {});
+
+    // user defined resolver
+    Request(asio::io_context& ctx, std::shared_ptr<Resolver> resolver, sa_family_t family = AF_UNSPEC);
+    Request(asio::io_context& ctx,
+            std::shared_ptr<Resolver> resolver,
+            const std::string& target,
+            sa_family_t family = AF_UNSPEC);
+
+    // user defined resolved endpoints
+    Request(asio::io_context& ctx,
+            std::vector<asio::ip::tcp::endpoint>&& endpoints,
+            const bool ssl = false,
+            std::shared_ptr<log::Logger> logger = {});
+
+    ~Request();
+
+    inline unsigned int id() const { return id_; };
+    void set_connection(std::shared_ptr<Connection> connection);
+    std::shared_ptr<Connection> get_connection() const;
+    inline const Url& get_url() const { return resolver_->get_url(); };
+
+    void timeout(const std::chrono::seconds& timeout, HandlerCb cb = {})
+    {
+        timeout_ = timeout;
+        timeoutCb_ = cb;
+    }
+
+    /** The previous request in case of redirect following */
+    std::shared_ptr<Request> getPrevious() const { return prev_.lock(); }
+
+    inline std::string& to_string() { return request_; }
+
+    void set_certificate_authority(std::shared_ptr<dht::crypto::Certificate> certificate);
+    void set_identity(const dht::crypto::Identity& identity);
+    void set_logger(std::shared_ptr<log::Logger> logger);
+
+    /**
+     * Define the HTTP header/body as per https://tools.ietf.org/html/rfc7230.
+     */
+    void set_header(restinio::http_request_header_t header);
+    void set_method(restinio::http_method_id_t method);
+    void set_target(std::string target);
+    void set_header_field(restinio::http_field_t field, std::string value);
+    void set_connection_type(restinio::http_connection_header_t connection);
+    void set_body(std::string body);
+    void set_body(const uint8_t* data, size_t length);
+    void set_auth(const std::string& username, const std::string& password);
+
+    void add_on_status_callback(OnStatusCb cb);
+    void add_on_body_callback(OnDataCb cb);
+    void add_on_state_change_callback(OnStateChangeCb cb);
+    void add_on_done_callback(OnDoneCb cb);
+
+    void send();
+
+    /** Send and block for response */
+    const Response& await();
+
+    /**
+     * User action to cancel the Request and call the completion callbacks.
+     */
+    void cancel();
+    void terminate(const asio::error_code& ec);
+
+private:
+    using OnCompleteCb = std::function<void()>;
+
+    struct Callbacks
+    {
+        OnStatusCb on_status;
+        OnDataCb on_header_field;
+        OnDataCb on_header_value;
+        OnDataCb on_body;
+        OnStateChangeCb on_state_change;
+    };
+
+    static std::string getRelativePath(const Url& origin, const std::string& path);
+
+    void notify_state_change(State state);
+
+    void build();
+
+    static std::string url_encode(std::string_view value);
+
+    void init_default_headers();
+    /**
+     * Initialized and wraps the llhttp callbacks with our user defined callbacks.
+     */
+    void init_parser();
+
+    void connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb = {});
+
+    void post();
+
+    void handle_request(const asio::error_code& ec);
+    void handle_response(const asio::error_code& ec, size_t bytes);
+
+    void onHeadersComplete();
+    void onBody(const char* at, size_t length);
+    void onComplete();
+
+    mutable std::mutex mutex_;
+
+    std::shared_ptr<log::Logger> logger_;
+
+    restinio::http_request_header_t header_;
+    std::map<restinio::http_field_t, std::string> headers_;
+    restinio::http_connection_header_t connection_type_ {restinio::http_connection_header_t::close};
+    std::string body_;
+
+    Callbacks cbs_;
+    State state_;
+
+    dht::crypto::Identity client_identity_;
+    std::shared_ptr<dht::crypto::Certificate> server_ca_;
+
+    unsigned int id_;
+    static std::atomic_uint ids_;
+    asio::io_context& ctx_;
+    sa_family_t family_ = AF_UNSPEC;
+    std::shared_ptr<Connection> conn_;
+    std::shared_ptr<Resolver> resolver_;
+
+    Response response_ {};
+    std::string request_;
+    std::atomic<bool> finishing_ {false};
+    std::unique_ptr<llhttp_t> parser_;
+    std::unique_ptr<llhttp_settings_t> parser_s_;
+
+    // Next request in case of redirect following
+    std::shared_ptr<Request> next_;
+    std::weak_ptr<Request> prev_;
+    unsigned num_redirect {0};
+    bool follow_redirect {true};
+
+    HandlerCb timeoutCb_ {};
+    std::chrono::seconds timeout_ {0};
+};
+
+} // namespace http
+} // namespace dht

include/opendht/indexation/pht.h

@@ -0,0 +1,538 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <string>
+#include <vector>
+#include <memory>
+#include <map>
+#include <functional>
+#include <stdexcept>
+#include <bitset>
+#include <iostream>
+#include <sstream>
+
+#include "../value.h"
+#include "../dhtrunner.h"
+#include "../infohash.h"
+
+namespace dht {
+namespace indexation {
+
+/*!
+ * @class   Prefix
+ * @brief   A blob structure which prefixes a Key in the PHT.
+ * @details
+ * Since the PHT structure is a "trie", every node in this structure have a
+ * label which is defined by the path from the root of the trie to the node. If
+ * the node in question is a leaf, *the label is a prefix of all the keys
+ * contained in the leaf*.
+ */
+struct OPENDHT_PUBLIC Prefix
+{
+    Prefix() {}
+    Prefix(InfoHash h)
+        : size_(h.size() * 8)
+        , content_(h.begin(), h.end())
+    {}
+    Prefix(const Blob& d, const Blob& f = {})
+        : size_(d.size() * 8)
+        , flags_(f)
+        , content_(d)
+    {}
+
+    Prefix(const Prefix& p, size_t first)
+        : size_(std::min(first, p.content_.size() * 8))
+        , content_(Blob(p.content_.begin(), p.content_.begin() + size_ / 8))
+    {
+        auto rem = size_ % 8;
+        if (not p.flags_.empty()) {
+            flags_ = Blob(p.flags_.begin(), p.flags_.begin() + size_ / 8);
+            if (rem)
+                flags_.push_back(p.flags_[size_ / 8] & (0xFF << (8 - rem)));
+        }
+
+        if (rem)
+            content_.push_back(p.content_[size_ / 8] & (0xFF << (8 - rem)));
+    }
+
+    /**
+     * Get a sub prefix of the Prefix
+     *
+     * @param len lenght of the prefix to get, could be negative
+     *            if len is negativ then you will get the prefix
+     *            of size of the previous prefix minus len
+     *
+     * @return Sub-prefix of size len or if len is negative sub-prefix of size
+     *         of prefix minus len
+     *
+     * @throw out_of_range if len is larger than size of the content
+     */
+    Prefix getPrefix(ssize_t len) const
+    {
+        if ((size_t) std::abs(len) >= content_.size() * 8)
+            throw std::out_of_range("len larger than prefix size.");
+        if (len < 0)
+            len += size_;
+
+        return Prefix(*this, len);
+    }
+
+    /**
+     * Flags are considered as active if flag is empty or if the flag
+     * at pos 'pos' is active
+ee     *
+     * @see isActiveBit in private function
+     */
+    bool isFlagActive(size_t pos) const { return flags_.empty() or isActiveBit(flags_, pos); }
+
+    /**
+     * @see isActiveBit in private function
+     */
+    bool isContentBitActive(size_t pos) const { return isActiveBit(content_, pos); }
+
+    Prefix getFullSize() { return Prefix(*this, content_.size() * 8); }
+
+    /**
+     * This methods gets the prefix of its sibling in the PHT structure.
+     *
+     * @return The prefix of this sibling.
+     */
+    Prefix getSibling() const
+    {
+        Prefix copy = *this;
+        if (size_)
+            copy.swapContentBit(size_ - 1);
+
+        return copy;
+    }
+
+    InfoHash hash() const
+    {
+        Blob copy(content_);
+        copy.push_back(size_);
+        return InfoHash::get(copy);
+    }
+
+    /**
+     * This method count total of bit in common between 2 prefix
+     *
+     * @param p1 first prefix to compared
+     * @param p2 second prefix to compared
+     * @return Lenght of the larger common prefix between both
+     */
+    static inline unsigned commonBits(const Prefix& p1, const Prefix& p2)
+    {
+        /* size_ counts bits, so the comparison walks bits: reading it as a
+           byte count would run past the end of the shorter content. */
+        auto longest_prefix_size = std::min(p1.size_, p2.size_);
+
+        unsigned common = 0;
+        while (common < longest_prefix_size) {
+            if (not p1.isFlagActive(common) or not p2.isFlagActive(common)
+                or p1.isContentBitActive(common) != p2.isContentBitActive(common))
+                break;
+            common++;
+        }
+
+        return common;
+    }
+
+    /**
+     * @see doc of swap private function
+     */
+    void swapContentBit(size_t bit) { swapBit(content_, bit); }
+
+    /**
+     * @see doc of swap private function
+     */
+    void swapFlagBit(size_t bit) { swapBit(flags_, bit); }
+
+    /**
+     * @see doc of addPadding private function
+     */
+    void addPaddingContent(size_t size) { content_ = addPadding(content_, size); }
+
+    void updateFlags()
+    {
+        /* Fill first known bit */
+        auto csize = size_ - flags_.size() * 8;
+        while (csize >= 8) {
+            flags_.push_back(0xFF);
+            csize -= 8;
+        }
+
+        /* if needed fill remaining bit */
+        if (csize)
+            flags_.push_back(0xFF << (8 - csize));
+
+        /* Complet vector space missing */
+        for (auto i = flags_.size(); i < content_.size(); i++)
+            flags_.push_back(0xFF);
+    }
+
+    std::string toString() const;
+
+    size_t size_ {0};
+
+    /* Will contain flags according to content_.
+       If flags_[i] == 0, then content_[i] is unknown
+       else if flags_[i] == 1, then content_[i] is known */
+    Blob flags_ {};
+    Blob content_ {};
+
+private:
+    /**
+     * Add a padding to the input blob
+     *
+     * @param toP  : Prefix where to add a padding
+     * @param size : Final size of the prefix with padding
+     *
+     * @return Copy of the input Blob but with a padding
+     */
+    Blob addPadding(Blob toP, size_t size)
+    {
+        Blob copy = toP;
+        for (auto i = copy.size(); i < size; i++)
+            copy.push_back(0);
+
+        swapBit(copy, size_);
+        return copy;
+    }
+
+    /**
+     * Check if the bit a pos 'pos' is active, i.e. equal to 1
+     *
+     * @param b   : Blob to check
+     * @param pos : Position to check
+     *
+     * @return true if the bit is equal to 1, false otherwise
+     *
+     * @throw out_of_range if bit is superior to blob size * 8
+     */
+    bool isActiveBit(const Blob& b, size_t pos) const
+    {
+        if (pos >= content_.size() * 8)
+            throw std::out_of_range("Can't detect active bit at pos, pos larger than prefix size or empty prefix");
+
+        return ((b[pos / 8] >> (7 - (pos % 8))) & 1) == 1;
+    }
+
+    /**
+     * Swap bit at position bit [from 0 to 1 and vice-versa]
+     *
+     * @param b   : Blob to swap
+     * @param bit : Bit to swap on b
+     *
+     * @return the input prefix with the bit at pos 'bit' swapped
+     *
+     * @throw out_of_range if bit is superior to blob size * 8
+     */
+    void swapBit(Blob& b, size_t bit)
+    {
+        if (bit >= b.size() * 8)
+            throw std::out_of_range("bit larger than prefix size.");
+
+        /* Bit 0 is the most significant one of the first byte, as
+           isActiveBit reads it. */
+        b[bit / 8] ^= (1 << (7 - (bit % 8)));
+    }
+};
+
+using Value = std::pair<InfoHash, dht::Value::Id>;
+struct OPENDHT_PUBLIC IndexEntry : public dht::Value::Serializable<IndexEntry>
+{
+    static const ValueType& TYPE;
+
+    virtual void unpackValue(const dht::Value& v)
+    {
+        Serializable<IndexEntry>::unpackValue(v);
+        name = v.user_type;
+    }
+
+    virtual dht::Value packValue() const
+    {
+        auto pack = Serializable<IndexEntry>::packValue();
+        pack.user_type = name;
+        return pack;
+    }
+
+    Blob prefix;
+    Value value;
+    std::string name;
+    MSGPACK_DEFINE_MAP(prefix, value)
+};
+
+class OPENDHT_PUBLIC Pht
+{
+    static constexpr const char* INVALID_KEY = "Key does not match the PHT key spec.";
+
+    /* Prefixes the user_type for all dht values put on the DHT */
+    static constexpr const char* INDEX_PREFIX = "index.pht.";
+
+public:
+    /* This is the maximum number of entries per node. This parameter is
+     * critical and influences the traffic a lot during a lookup operation.
+     */
+    static constexpr const size_t MAX_NODE_ENTRY_COUNT {16};
+
+    /* A key for a an index entry */
+    using Key = std::map<std::string, Blob>;
+
+    /* Specifications of the keys. It defines the number, the length and the
+     * serialization order of fields. */
+    using KeySpec = std::map<std::string, size_t>;
+    using LookupCallback = std::function<void(std::vector<std::shared_ptr<Value>>& values, const Prefix& p)>;
+
+    typedef void (*LookupCallbackRaw)(std::vector<std::shared_ptr<Value>>* values, Prefix* p, void* user_data);
+    static LookupCallback bindLookupCb(LookupCallbackRaw raw_cb, void* user_data)
+    {
+        if (not raw_cb)
+            return {};
+        return [=](std::vector<std::shared_ptr<Value>>& values, const Prefix& p) {
+            raw_cb((std::vector<std::shared_ptr<Value>>*) &values, (Prefix*) &p, user_data);
+        };
+    }
+    using LookupCallbackSimple = std::function<void(std::vector<std::shared_ptr<Value>>& values)>;
+    typedef void (*LookupCallbackSimpleRaw)(std::vector<std::shared_ptr<Value>>* values, void* user_data);
+    static LookupCallbackSimple bindLookupCbSimple(LookupCallbackSimpleRaw raw_cb, void* user_data)
+    {
+        if (not raw_cb)
+            return {};
+        return [=](std::vector<std::shared_ptr<Value>>& values) {
+            raw_cb((std::vector<std::shared_ptr<Value>>*) &values, user_data);
+        };
+    }
+
+    Pht(std::string name, KeySpec k_spec, std::shared_ptr<DhtRunner> dht)
+        : name_(INDEX_PREFIX + name)
+        , canary_(name_ + ".canary")
+        , keySpec_(k_spec)
+        , dht_(dht)
+    {}
+
+    virtual ~Pht() {}
+
+    /**
+     * Lookup a key for a value.
+     */
+    void lookup(Key k, LookupCallback cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true);
+    void lookup(Key k, LookupCallbackSimple cb = {}, DoneCallbackSimple done_cb = {}, bool exact_match = true)
+    {
+        lookup(
+            k,
+            [cb = std::move(cb)](std::vector<std::shared_ptr<Value>>& values, Prefix) { cb(values); },
+            done_cb,
+            exact_match);
+    }
+
+    /**
+     * Wrapper function which call the private one.
+     *
+     * @param k : Key to insert [i.e map of string, blob]
+     * @param v : Value to insert
+     * @param done_cb : Callbakc which going to be call when all the insert is done
+     */
+    void insert(Key k, Value v, DoneCallbackSimple done_cb = {})
+    {
+        Prefix p = linearize(k);
+
+        auto lo = std::make_shared<int>(0);
+        auto hi = std::make_shared<int>(p.size_);
+
+        IndexEntry entry;
+        entry.value = v;
+        entry.prefix = p.content_;
+        entry.name = name_;
+
+        Pht::insert(p, entry, lo, hi, clock::now(), true, done_cb);
+    }
+
+private:
+    /**
+     * Insert function which really insert onto the pht
+     *
+     * @param kp          : Prefix to insert (linearize the the key)
+     * @param entry       : Entry created from the value
+     * @param lo          : Lowest point to start in the prefix
+     * @param hi          : Highest point to end in the prefix
+     * @param time_p      : Timepoint to use for the insertion into the dht (must be < now)
+     * @param check_split : If this flag is true then the algoritm will not use the merge algorithm
+     * @param done_cb     : Callback to call when the insert is done
+     */
+
+    void insert(const Prefix& kp,
+                IndexEntry entry,
+                std::shared_ptr<int> lo,
+                std::shared_ptr<int> hi,
+                time_point time_p,
+                bool check_split,
+                DoneCallbackSimple done_cb = {});
+
+    class Cache
+    {
+    public:
+        /**
+         * Insert all needed node into the tree according to a prefix
+         * @param p : Prefix that we need to insert
+         */
+        void insert(const Prefix& p);
+
+        /**
+         * Lookup into the tree to return the maximum prefix length in the cache tree
+         *
+         * @param p : Prefix that we are looking for
+         *
+         * @return  : The size of the longest prefix known in the cache between 0 and p.size_
+         */
+
+        int lookup(const Prefix& p);
+
+    private:
+        static constexpr const size_t MAX_ELEMENT {1024};
+        static constexpr const std::chrono::minutes NODE_EXPIRE_TIME {5};
+
+        struct Node
+        {
+            time_point last_reply;           /* Made the assocation between leaves and leaves multimap */
+            std::shared_ptr<Node> parent;    /* Share_ptr to the parent, it allow the self destruction of tree */
+            std::weak_ptr<Node> left_child;  /* Left child, for bit equal to 1 */
+            std::weak_ptr<Node> right_child; /* Right child, for bit equal to 0 */
+        };
+
+        std::weak_ptr<Node> root_; /* Root of the tree */
+
+        /**
+         * This mutlimap contains all prefix insert in the tree in time order
+         * We could then delete the last one if there are too many nodes
+         * The tree will self destroy is branch ( thanks to share_ptr )
+         */
+        std::multimap<time_point, std::shared_ptr<Node>> leaves_;
+    };
+
+    /* Callback used for insert value by using the pht */
+    using RealInsertCallback = std::function<void(const Prefix& p, IndexEntry entry)>;
+    using LookupCallbackWrapper = std::function<void(std::vector<std::shared_ptr<IndexEntry>>& values, const Prefix& p)>;
+
+    /**
+     * Performs a step in the lookup operation. Each steps are performed
+     * asynchronously.
+     *
+     * @param k          : Prefix on which the lookup is performed
+     * @param lo         : lowest bound on the prefix (where to start)
+     * @param hi         : highest bound on the prefix (where to stop)
+     * @param vals       : Shared ptr to a vector of IndexEntry (going to contains all values found)
+     * @param cb         : Callback to use at the end of the lookupStep (call on the value of vals)
+     * @param done_cb    : Callback at the end of the lookupStep
+     * @param max_common_prefix_len: used in the inexacte lookup match case, indicate the longest common prefix found
+     * @param start      : If start is set then lo and hi will be ignore for the first step, if the step fail lo and hi
+     * will be used
+     * @param all_values : If all value is true then all value met during the lookupstep will be in the vector vals
+     */
+    void lookupStep(Prefix k,
+                    std::shared_ptr<int> lo,
+                    std::shared_ptr<int> hi,
+                    std::shared_ptr<std::vector<std::shared_ptr<IndexEntry>>> vals,
+                    LookupCallbackWrapper cb,
+                    DoneCallbackSimple done_cb,
+                    std::shared_ptr<unsigned> max_common_prefix_len,
+                    int start = -1,
+                    bool all_values = false);
+
+    /**
+     * Apply the zcurve algorithm on the list of input prefix
+     *
+     * @param all_prefix : Vector of prefix to interleave
+     *
+     * @return The output prefix where all flags and content are interleaves
+     */
+    Prefix zcurve(const std::vector<Prefix>& all_prefix) const;
+
+    /**
+     * Linearizes the key into a unidimensional key. A pht only takes
+     * unidimensional key.
+     *
+     * @param Key  The initial key.
+     *
+     * @return the prefix of the linearized key.
+     */
+    virtual Prefix linearize(Key k) const;
+
+    /**
+     * Looking where to put the data cause if there is free space on the node
+     * above then this node will became the real leave.
+     *
+     * @param p       Share_ptr on the Prefix to check
+     * @param entry   The entry to put at the prefix p
+     * @param end_cb  Callback to use at the end of counting
+     */
+    void getRealPrefix(const std::shared_ptr<Prefix>& p, IndexEntry entry, RealInsertCallback end_cb);
+
+    /**
+     * Looking where to put the data cause if there is free space on the node
+     * above then this node will became the real leave.
+     *
+     * @param p       Share_ptr on the Prefix to check
+     * @param entry   The entry to put at the prefix p
+     * @param end_cb  Callback to use at the end of counting
+     */
+    void checkPhtUpdate(Prefix p, IndexEntry entry, time_point time_p);
+
+    /**
+     * Search for the split location by comparing 'compared' to all values in vals.
+     *
+     * @param compared : Value which going to be compared
+     * @param vals     : The vector of values to compare with comapred
+     * @return position compared diverge from all others
+     */
+    static size_t findSplitLocation(const Prefix& compared, const std::vector<std::shared_ptr<IndexEntry>>& vals)
+    {
+        for (size_t i = 0; i < compared.content_.size() * 8 - 1; i++)
+            for (auto const& v : vals)
+                if (Prefix(v->prefix).isContentBitActive(i) != compared.isContentBitActive(i))
+                    return i + 1;
+        return compared.content_.size() * 8 - 1;
+    }
+
+    /**
+     * Put canary from the split point until the last known canary and add the prefix at the good place
+     *
+     * @param insert : Prefix to insertm but also prefix which going to check where we need to split
+     * @param vals   : Vector of vals for the comparaison
+     * @param entry  : Entry to put on the pht
+     * @param end_cb : Callback to apply to the insert prefi (here does the insert)
+     */
+    void split(const Prefix& insert,
+               const std::vector<std::shared_ptr<IndexEntry>>& vals,
+               IndexEntry entry,
+               RealInsertCallback end_cb);
+
+    /**
+     * Tells if the key is valid according to the key spec.
+     */
+    bool validKey(const Key& k) const
+    {
+        return k.size() == keySpec_.size()
+               and std::equal(k.begin(),
+                              k.end(),
+                              keySpec_.begin(),
+                              [&](const Key::value_type& key, const KeySpec::value_type& key_spec) {
+                                  return key.first == key_spec.first and key.second.size() <= key_spec.second;
+                              });
+    }
+
+    /**
+     * Updates the canary token on the node responsible for the specified
+     * Prefix.
+     */
+    void updateCanary(Prefix p);
+
+    const std::string name_;
+    const std::string canary_;
+    const KeySpec keySpec_;
+    Cache cache_;
+    std::shared_ptr<DhtRunner> dht_;
+};
+
+} // namespace indexation
+} // namespace dht

include/opendht/infohash.h

@@ -1,127 +1,179 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
+#include "def.h"
+#include "rng.h"
+
 #include <msgpack.hpp>
+#include <fmt/core.h>
+
+#ifndef _WIN32
+#include <netinet/in.h>
+#include <netdb.h>
+#ifdef __ANDROID__
+typedef uint16_t in_port_t;
+#endif
+#else
+#include <iso646.h>
+#include <ws2tcpip.h>
+typedef uint16_t sa_family_t;
+typedef uint16_t in_port_t;
+#endif
 
 #include <iostream>
 #include <iomanip>
 #include <array>
 #include <vector>
+#include <string_view>
 #include <algorithm>
 #include <stdexcept>
-#include <cstring>
+#include <sstream>
 
-// bytes
-#define HASH_LEN 20u
+#include <cstring>
+#include <cstddef>
 
 namespace dht {
 
-class DhtException : public std::runtime_error {
-    public:
-        DhtException(const std::string &str = "") :
-            std::runtime_error("DhtException occured: " + str) {}
-};
+using byte = uint8_t;
 
+namespace crypto {
+OPENDHT_PUBLIC void hash(const uint8_t* data, size_t data_length, uint8_t* hash, size_t hash_length);
+}
 
 /**
- * Represents an InfoHash.
- * An InfoHash is a byte array of HASH_LEN bytes.
- * InfoHashes identify nodes and values in the Dht.
+ * Represents an Hash, a byte array of N bytes.
+ * Hashes identify nodes and values in the Dht.
  */
-class InfoHash final : public std::array<uint8_t, HASH_LEN> {
+template<size_t N>
+class Hash
+{
 public:
-    constexpr InfoHash() : std::array<uint8_t, HASH_LEN>() {}
-    constexpr InfoHash(const std::array<uint8_t, HASH_LEN>& h) : std::array<uint8_t, HASH_LEN>(h) {}
-    InfoHash(const uint8_t* h, size_t h_len) : std::array<uint8_t, HASH_LEN>() {
-        if (h_len < HASH_LEN)
-            fill(0);
-        else
-            std::copy_n(h, HASH_LEN, begin());
-    }
+    using T = std::array<uint8_t, N>;
+    typedef typename T::iterator iterator;
+    typedef typename T::const_iterator const_iterator;
 
+    constexpr Hash() noexcept
+        : data_ {}
+    {}
+    constexpr Hash(const uint8_t* h, size_t data_len)
+        : data_(fromBytes(h, data_len))
+    {}
     /**
      * Constructor from an hexadecimal string (without "0x").
-     * hex must be at least 2.HASH_LEN characters long.
-     * If too long, only the first 2.HASH_LEN characters are read.
+     * hex must be at least 2.N characters long.
+     * If too long, only the first 2.N characters are read.
      */
-    explicit InfoHash(const std::string& hex);
+    explicit constexpr Hash(std::string_view hex)
+        : data_(fromString(hex))
+    {}
 
-    InfoHash(const msgpack::object& o) {
-        msgpack_unpack(o);
+    Hash(const msgpack::object& o) { msgpack_unpack(o); }
+
+    static constexpr size_t size() noexcept { return N; }
+    constexpr const uint8_t* data() const { return data_.data(); }
+    uint8_t* data() { return data_.data(); }
+    iterator begin() { return data_.begin(); }
+    const_iterator cbegin() const { return data_.cbegin(); }
+    iterator end() { return data_.end(); }
+    const_iterator cend() const { return data_.cend(); }
+
+    static constexpr inline Hash zero() noexcept { return Hash {}; }
+
+    constexpr bool operator==(const Hash& h) const
+    {
+#if __cplusplus >= 202002L
+        return data_ == h.data_;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != h.data_[i])
+                return false;
+        }
+        return true;
+#endif
     }
+    constexpr bool operator!=(const Hash& h) const { return !(*this == h); }
+
+    constexpr bool operator<(const Hash& o) const
+    {
+        for (unsigned i = 0; i < N; i++) {
+            if (data_[i] != o.data_[i])
+                return data_[i] < o.data_[i];
+        }
+        return false;
+    }
+
+    constexpr Hash operator^(const Hash& o) const
+    {
+        Hash result;
+        for (auto i = 0u; i < N; i++) {
+            result[i] = data_[i] ^ o.data_[i];
+        }
+        return result;
+    }
+
+    explicit constexpr operator bool() const
+    {
+#if __cplusplus >= 202002L
+        auto a = reinterpret_cast<const uint32_t*>(data_.data());
+        auto b = reinterpret_cast<const uint32_t*>(data_.data() + N);
+        for (; a != b; a++) {
+            if (*a)
+                return true;
+        }
+        return false;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != 0)
+                return true;
+        }
+        return false;
+#endif
+    }
+
+    uint8_t& operator[](size_t index) { return data_[index]; }
+    constexpr const uint8_t& operator[](size_t index) const { return data_[index]; }
 
     /**
      * Find the lowest 1 bit in an id.
-     * Result will allways be lower than 8*HASH_LEN
+     * Result will allways be lower than 8*N
      */
-    inline unsigned lowbit() const {
-        int i, j;
-        for(i = HASH_LEN-1; i >= 0; i--)
-            if((*this)[i] != 0)
+    constexpr int lowbit() const
+    {
+        int i = N - 1;
+        for (; i >= 0; i--)
+            if (data_[i] != 0)
                 break;
-        if(i < 0)
+        if (i < 0)
             return -1;
-        for(j = 7; j >= 0; j--)
-            if(((*this)[i] & (0x80 >> j)) != 0)
+        int j = 7;
+        for (; j >= 0; j--)
+            if ((data_[i] & (0x80 >> j)) != 0)
                 break;
         return 8 * i + j;
     }
 
-    /**
-     * Forget about the ``XOR-metric''.  An id is just a path from the
-     * root of the tree, so bits are numbered from the start.
-     */
-    static inline int cmp(const InfoHash& __restrict__ id1, const InfoHash& __restrict__ id2) {
-        return std::memcmp(id1.data(), id2.data(), HASH_LEN);
+    static inline int cmp(const Hash& id1, const Hash& id2)
+    {
+        return std::memcmp(id1.data_.data(), id2.data_.data(), N);
     }
 
     /** Find how many bits two ids have in common. */
-    static inline unsigned
-    commonBits(const InfoHash& id1, const InfoHash& id2)
+    static constexpr inline unsigned commonBits(const Hash& id1, const Hash& id2)
     {
-        unsigned i, j;
-        uint8_t x;
-        for(i = 0; i < HASH_LEN; i++) {
-            if(id1[i] != id2[i])
+        unsigned i = 0;
+        for (; i < N; i++) {
+            if (id1.data_[i] != id2.data_[i])
                 break;
         }
 
-        if(i == HASH_LEN)
-            return 8*HASH_LEN;
+        if (i == N)
+            return 8 * N;
 
-        x = id1[i] ^ id2[i];
+        uint8_t x = id1.data_[i] ^ id2.data_[i];
 
-        j = 0;
-        while((x & 0x80) == 0) {
+        unsigned j = 0;
+        while ((x & 0x80) == 0) {
             x <<= 1;
             j++;
         }
@@ -130,108 +182,268 @@ public:
     }
 
     /** Determine whether id1 or id2 is closer to this */
-    int
-    xorCmp(const InfoHash& id1, const InfoHash& id2) const
+    constexpr int xorCmp(const Hash& id1, const Hash& id2) const
     {
-        for(unsigned i = 0; i < HASH_LEN; i++) {
-            uint8_t xor1, xor2;
-            if(id1[i] == id2[i])
+        for (unsigned i = 0; i < N; i++) {
+            if (id1.data_[i] == id2.data_[i])
                 continue;
-            xor1 = id1[i] ^ (*this)[i];
-            xor2 = id2[i] ^ (*this)[i];
-            if(xor1 < xor2)
-                return -1;
-            else
-                return 1;
+            uint8_t xor1 = id1.data_[i] ^ data_[i];
+            uint8_t xor2 = id2.data_[i] ^ data_[i];
+            return (xor1 < xor2) ? -1 : 1;
         }
         return 0;
     }
 
-    bool
-    getBit(unsigned nbit) const
+    constexpr bool getBit(unsigned nbit) const
     {
-        auto& num = *(cbegin()+(nbit/8));
+        auto& num = *(data_.cbegin() + (nbit / 8));
         unsigned bit = 7 - (nbit % 8);
         return (num >> bit) & 1;
     }
 
-    void
-    setBit(unsigned nbit, bool b)
+    void setBit(unsigned nbit, bool b)
     {
-        auto& num = (*this)[nbit/8];
+        auto& num = data_[nbit / 8];
         unsigned bit = 7 - (nbit % 8);
         num ^= (-b ^ num) & (1 << bit);
     }
 
-    double
-    toFloat() const
+    double toFloat() const
     {
+        using D = size_t;
         double v = 0.;
-        for (unsigned i = 0; i < std::min<size_t>(HASH_LEN, sizeof(unsigned)-1); i++)
-            v += *(cbegin()+i)/(double)(1<<(8*(i+1)));
+        for (size_t i = 0; i < std::min<size_t>(N, sizeof(D) - 1); i++)
+            v += *(data_.cbegin() + i) / (double) ((D) 1 << 8 * (i + 1));
         return v;
     }
 
-    bool
-    operator<(const InfoHash& o) const {
-        for(unsigned i = 0; i < HASH_LEN; i++) {
-            if((*this)[i] != o[i])
-                return (*this)[i] < o[i];
-        }
-        return false;
-    }
+    static inline Hash get(std::string_view data) { return get((const uint8_t*) data.data(), data.size()); }
 
-    static inline InfoHash get(const std::string& data) {
-        return get((const uint8_t*)data.data(), data.size());
-    }
+    static inline Hash get(const std::vector<uint8_t>& data) { return get(data.data(), data.size()); }
 
-    static inline InfoHash get(const std::vector<uint8_t>& data) {
-        return get(data.data(), data.size());
+    template<size_t H>
+    static Hash get(const Hash<H>& o)
+    {
+        return get(o.data(), o.size());
     }
 
     /**
      * Computes the hash from a given data buffer of size data_len.
      */
-    static InfoHash get(const uint8_t* data, size_t data_len);
+    static Hash get(const uint8_t* data, size_t data_len)
+    {
+        Hash ret;
+        crypto::hash(data, data_len, ret.data(), N);
+        return ret;
+    }
 
-    static InfoHash getRandom();
+    static Hash getRandom();
 
-    friend std::ostream& operator<< (std::ostream& s, const InfoHash& h);
+    template<typename Rd>
+    static Hash getRandom(Rd&);
+
+    template<size_t M>
+    friend std::ostream& operator<<(std::ostream& s, const Hash<M>& h);
+
+    template<size_t M>
+    friend std::istream& operator>>(std::istream& s, Hash<M>& h);
+
+    /** Returns view to thread-allocated memory, only valid until the next call to this function. */
+    std::string_view to_view() const { return std::string_view(to_c_str(), N * 2); }
+    const char* to_c_str() const;
 
     std::string toString() const;
 
-    template <typename Packer>
+    template<typename Packer>
     void msgpack_pack(Packer& pk) const
     {
-        pk.pack_bin(HASH_LEN);
-        pk.pack_bin_body((char*)data(), HASH_LEN);
+        pk.pack_bin(N);
+        pk.pack_bin_body((char*) data_.data(), N);
     }
 
-    void msgpack_unpack(msgpack::object o) {
-        if (o.type != msgpack::type::BIN or o.via.bin.size != HASH_LEN)
+    void msgpack_unpack(msgpack::object o)
+    {
+        if (o.type != msgpack::type::BIN or o.via.bin.size != N)
             throw msgpack::type_error();
-        std::copy_n(o.via.bin.ptr, HASH_LEN, data());
+        std::copy_n(o.via.bin.ptr, N, data_.data());
     }
 
+private:
+    alignas(alignof(uint32_t)) T data_;
+    static constexpr T fromBytes(const uint8_t*, size_t);
+    static constexpr T fromString(std::string_view);
 };
 
+#define HASH_LEN 20u
+using InfoHash = Hash<HASH_LEN>;
+using h256 = Hash<32>;
+using PkId = h256;
+
+template<size_t N>
+std::ostream&
+operator<<(std::ostream& s, const Hash<N>& h)
+{
+    s.write(h.to_c_str(), N * 2);
+    return s;
 }
 
-namespace std
+template<size_t N>
+std::istream&
+operator>>(std::istream& s, Hash<N>& h)
 {
-    template<>
-    struct hash<dht::InfoHash>
-    {
-        typedef dht::InfoHash argument_type;
-        typedef std::size_t result_type;
+    std::array<char, h.size() * 2> dat;
+    s.exceptions(std::istream::eofbit | std::istream::failbit);
+    s.read(&(*dat.begin()), dat.size());
+    h = Hash<N>(std::string_view(dat.data(), dat.size()));
+    return s;
+}
 
-        result_type operator()(dht::InfoHash const& s) const
-        {
-            result_type r {};
-            std::hash<uint8_t> hash_fn;
-            for (size_t i = 0; i < HASH_LEN; i++)
-                r = r ^ (hash_fn(s[i]) << i*4);
-            return r;
+template<size_t N>
+constexpr typename Hash<N>::T
+Hash<N>::fromBytes(const uint8_t* in, size_t size)
+{
+    T data {};
+    if (size < N)
+        return data;
+    for (size_t i = 0; i < N; ++i)
+        data[i] = in[i];
+    return data;
+}
+
+template<size_t N>
+constexpr typename Hash<N>::T
+Hash<N>::fromString(std::string_view in)
+{
+    T data {};
+    if (in.size() < 2 * N)
+        return data;
+
+    constexpr auto hex2bin = [](char c, bool& valid) -> uint8_t {
+        if (c >= 'a' and c <= 'f')
+            return 10 + c - 'a';
+        else if (c >= 'A' and c <= 'F')
+            return 10 + c - 'A';
+        else if (c >= '0' and c <= '9')
+            return c - '0';
+        else {
+            valid = false;
+            return 0;
         }
     };
+    bool valid = true;
+    for (size_t i = 0; i < N && valid; i++) {
+        uint8_t high = hex2bin(in[2 * i], valid);
+        uint8_t low = hex2bin(in[2 * i + 1], valid);
+        data[i] = (high << 4) | low;
+    }
+    if (!valid)
+        return {};
+    return data;
 }
+
+template<size_t N>
+Hash<N>
+Hash<N>::getRandom()
+{
+    Hash h;
+    std::random_device rdev;
+    std::uniform_int_distribution<uint32_t> rand_int;
+    auto a = reinterpret_cast<uint32_t*>(h.data());
+    auto b = reinterpret_cast<uint32_t*>(h.data() + h.size());
+    std::generate(a, b, std::bind(rand_int, std::ref(rdev)));
+    return h;
+}
+
+template<size_t N>
+template<typename Rd>
+Hash<N>
+Hash<N>::getRandom(Rd& rdev)
+{
+    Hash h;
+    std::uniform_int_distribution<uint32_t> rand_int;
+    auto a = reinterpret_cast<uint32_t*>(h.data());
+    auto b = reinterpret_cast<uint32_t*>(h.data() + h.size());
+    std::generate(a, b, std::bind(rand_int, std::ref(rdev)));
+    return h;
+}
+
+struct alignas(std::max_align_t) HexMap : public std::array<std::array<char, 2>, 256>
+{
+    constexpr HexMap()
+        : std::array<std::array<char, 2>, 256>()
+    {
+        for (size_t i = 0; i < size(); i++) {
+            auto& e = (*this)[i];
+            e[0] = hex_digits[(i >> 4) & 0x0F];
+            e[1] = hex_digits[i & 0x0F];
+        }
+    }
+
+private:
+    static constexpr const char* hex_digits = "0123456789abcdef";
+};
+
+inline constexpr HexMap hex_map {};
+
+inline std::string
+toHex(const uint8_t* data, size_t size)
+{
+    std::string ret(size * 2, '\0');
+    for (size_t i = 0; i < size; i++) {
+        auto b = ret.data() + i * 2;
+        const auto& m = hex_map[data[i]];
+        *((uint16_t*) b) = *((uint16_t*) &m);
+    }
+    return ret;
+}
+
+inline std::string
+toHex(const std::vector<uint8_t>& data)
+{
+    return toHex(data.data(), data.size());
+}
+
+template<size_t N>
+constexpr std::array<char, N * 2>
+toHexArray(const Hash<N>& h)
+{
+    std::array<char, N * 2> ret {};
+    for (size_t i = 0; i < N; i++) {
+        const auto& m = hex_map[h[i]];
+        ret[i * 2] = m[0];
+        ret[i * 2 + 1] = m[1];
+    }
+    return ret;
+}
+
+template<size_t N>
+const char*
+Hash<N>::to_c_str() const
+{
+    alignas(std::max_align_t) thread_local std::array<char, N * 2 + 1> buf;
+    for (size_t i = 0; i < N; i++) {
+        auto b = buf.data() + i * 2;
+        const auto& m = hex_map[data_[i]];
+        *((uint16_t*) b) = *((uint16_t*) &m);
+    }
+    buf[N * 2] = '\0';
+    return buf.data();
+}
+
+template<size_t N>
+std::string
+Hash<N>::toString() const
+{
+    return std::string(to_c_str(), N * 2);
+}
+
+} // namespace dht
+
+template<size_t N>
+struct fmt::formatter<dht::Hash<N>> : formatter<string_view>
+{
+    constexpr auto format(const dht::Hash<N>& c, format_context& ctx) const
+    {
+        return formatter<string_view>::format(c.to_view(), ctx);
+    }
+};

include/opendht/log.h

@@ -0,0 +1,38 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+#include "logger.h"
+
+#include <iostream>
+#include <memory>
+
+namespace dht {
+
+class DhtRunner;
+
+/**
+ * Logging-related functions
+ */
+namespace log {
+
+OPENDHT_PUBLIC
+std::shared_ptr<Logger> getStdLogger();
+
+OPENDHT_PUBLIC
+std::shared_ptr<Logger> getFileLogger(const std::string& path);
+
+OPENDHT_PUBLIC
+std::shared_ptr<Logger> getSyslogLogger(const char* name);
+
+OPENDHT_PUBLIC void enableLogging(dht::DhtRunner& dht);
+
+OPENDHT_PUBLIC void enableFileLogging(dht::DhtRunner& dht, const std::string& path);
+
+OPENDHT_PUBLIC void disableLogging(dht::DhtRunner& dht);
+
+OPENDHT_PUBLIC void enableSyslog(dht::DhtRunner& dht, const char* name);
+
+} // namespace log
+} // namespace dht

include/opendht/logger.h

@@ -0,0 +1,206 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "infohash.h"
+
+#include <fmt/format.h>
+#include <fmt/printf.h>
+
+#include <functional>
+#include <mutex>
+#include <string_view>
+#include <type_traits>
+#include <cstdarg>
+
+#if __cplusplus >= 202002L
+#include <source_location>
+#endif
+
+namespace dht {
+namespace log {
+
+#if __cplusplus >= 202002L
+/**
+ * Extracts the filename from a full file path at compile time.
+ */
+consteval std::string_view
+getfilename(std::string_view path)
+{
+    size_t pos = path.size();
+    for (size_t i = path.size(); i-- > 0;) {
+        if (path[i] == '/' || path[i] == '\\') {
+            pos = i + 1;
+            break;
+        }
+    }
+    return path.substr(pos);
+}
+
+consteval std::string_view
+getfunctionname(std::string_view path)
+{
+    size_t pos = 0;
+    size_t end = path.size();
+    for (size_t i = 0; i < path.size(); i++) {
+        if (path[i] == ' ' || path[i] == '\t' || path[i] == ':') {
+            pos = i + 1;
+        } else if (path[i] == '(') {
+            end = i;
+            break;
+        }
+    }
+    return path.substr(pos, end - pos);
+}
+#endif
+
+struct source_loc
+{
+    std::string_view file;
+    std::uint_least32_t line;
+    std::string_view function;
+
+#if __cplusplus >= 202002L
+    consteval source_loc(const std::source_location& loc)
+        : file(getfilename(loc.file_name()))
+        , line(loc.line())
+        , function(getfunctionname(loc.function_name()))
+    {}
+#else
+    constexpr source_loc()
+        : file()
+        , line(0)
+        , function()
+    {}
+#endif
+};
+
+enum class LogLevel { debug, warning, error };
+
+using LogMethod = std::function<void(source_loc, LogLevel, std::string_view, std::string&&)>;
+
+template<typename... Args>
+struct LogFormat
+{
+    fmt::format_string<Args...> fmt;
+    source_loc loc;
+
+#if __cplusplus >= 202002L
+    template<typename S>
+    consteval LogFormat(const S& s, const std::source_location& l = std::source_location::current())
+        : fmt(s)
+        , loc(l)
+    {}
+#else
+    template<typename S>
+    constexpr LogFormat(const S& s)
+        : fmt(s)
+        , loc()
+    {}
+#endif
+};
+
+#if __cplusplus < 202002L
+template<class _Tp>
+struct type_identity
+{
+    typedef _Tp type;
+};
+template<class _Tp>
+using type_identity_t = typename type_identity<_Tp>::type;
+#else
+using std::type_identity_t;
+#endif
+
+struct OPENDHT_PUBLIC Logger
+{
+    Logger() = delete;
+    Logger(LogMethod&& l, std::string tag = "")
+        : logger_(std::move(l))
+        , tag_(std::move(tag))
+        , prefix_(tag_.empty() ? "" : fmt::format("[{}] ", tag_))
+    {
+        if (!logger_)
+            throw std::invalid_argument {"logger must be set"};
+    }
+    Logger(const Logger& parent, std::string tag)
+        : logger_(parent.logger_)
+        , tag_(std::move(tag))
+        , prefix_(fmt::format("{}[{}] ", parent.prefix_, tag_))
+    {}
+
+    std::shared_ptr<Logger> createChild(std::string tag)
+    {
+        std::lock_guard lock {children_mutex_};
+        auto child = std::make_shared<Logger>(*this, std::move(tag));
+        children_.push_back(child);
+        return child;
+    }
+
+    void setFilter(std::string_view filter)
+    {
+        std::lock_guard lock {children_mutex_};
+        enable_ = filter.empty() or tag_.find(filter) != std::string_view::npos;
+        for (auto it = children_.begin(); it != children_.end();) {
+            if (auto c = it->lock()) {
+                c->setFilter(enable_ ? std::string_view {} : filter);
+                ++it;
+            } else {
+                it = children_.erase(it);
+            }
+        }
+    }
+
+    void setFilter(const InfoHash& f) { setFilter(f.to_view()); }
+
+    inline void log0(source_loc loc, LogLevel level, fmt::string_view format, fmt::printf_args args) const
+    {
+        if (enable_)
+            logger_(loc, level, prefix_, fmt::vsprintf(format, args));
+    }
+    template<typename... Args>
+    inline void debug(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
+    {
+        if (enable_)
+            logger_(format.loc, LogLevel::debug, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
+    }
+    template<typename... Args>
+    inline void warn(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
+    {
+        if (enable_)
+            logger_(format.loc, LogLevel::warning, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
+    }
+    template<typename... Args>
+    inline void error(LogFormat<type_identity_t<Args>...> format, Args&&... args) const
+    {
+        if (enable_)
+            logger_(format.loc, LogLevel::error, prefix_, fmt::format(format.fmt, std::forward<Args>(args)...));
+    }
+    template<typename... T>
+    inline void d(LogFormat<type_identity_t<T>...> format, T&&... args) const
+    {
+        log0(format.loc, LogLevel::debug, format.fmt, fmt::make_printf_args(args...));
+    }
+    template<typename... T>
+    inline void w(LogFormat<type_identity_t<T>...> format, T&&... args) const
+    {
+        log0(format.loc, LogLevel::warning, format.fmt, fmt::make_printf_args(args...));
+    }
+    template<typename... T>
+    inline void e(LogFormat<type_identity_t<T>...> format, T&&... args) const
+    {
+        log0(format.loc, LogLevel::error, format.fmt, fmt::make_printf_args(args...));
+    }
+
+private:
+    const LogMethod logger_ = {};
+    const std::string tag_ {};
+    const std::string prefix_ {};
+    std::mutex children_mutex_;
+    std::vector<std::weak_ptr<Logger>> children_ {};
+    bool enable_ {true};
+};
+
+} // namespace log
+using Logger = log::Logger;
+} // namespace dht

include/opendht/network_engine.h

@@ -0,0 +1,592 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "node_cache.h"
+#include "value.h"
+#include "infohash.h"
+#include "node.h"
+#include "scheduler.h"
+#include "utils.h"
+#include "rng.h"
+#include "rate_limiter.h"
+#include "logger.h"
+#include "network_utils.h"
+
+#include <vector>
+#include <string>
+#include <functional>
+#include <algorithm>
+#include <memory>
+#include <queue>
+
+namespace dht {
+namespace net {
+
+struct Request;
+struct Socket;
+struct TransId;
+
+#ifndef MSG_CONFIRM
+#define MSG_CONFIRM 0
+#endif
+
+struct NetworkConfig
+{
+    NetId network {0};
+    ssize_t max_req_per_sec {0};
+    ssize_t max_peer_req_per_sec {0};
+    bool is_client {false};
+};
+
+class DhtProtocolException : public DhtException
+{
+public:
+    // sent to another peer (http-like).
+    static const constexpr uint16_t NON_AUTHORITATIVE_INFORMATION {203}; /* incomplete request packet. */
+    static const constexpr uint16_t UNAUTHORIZED {401};                  /* incorrect tokens. */
+    static const constexpr uint16_t NOT_FOUND {404};                     /* storage not found */
+    // for internal use (custom).
+    static const constexpr uint16_t INVALID_TID_SIZE {421};        /* id was truncated. */
+    static const constexpr uint16_t UNKNOWN_TID {422};             /* unknown tid */
+    static const constexpr uint16_t WRONG_NODE_INFO_BUF_LEN {423}; /* node info length is incorrect */
+
+    static const std::string GET_NO_INFOHASH;    /* received "get" request with no infohash */
+    static const std::string LISTEN_NO_INFOHASH; /* got "listen" request without infohash */
+    static const std::string LISTEN_WRONG_TOKEN; /* incorrect token in "listen" request */
+    static const std::string PUT_NO_INFOHASH;    /* no infohash in "put" request */
+    static const std::string PUT_WRONG_TOKEN;    /* got "put" request with incorrect token */
+    static const std::string STORAGE_NOT_FOUND;  /* got access request for an unknown storage */
+    static const std::string PUT_INVALID_ID;     /* invalid id in "put" request */
+
+    DhtProtocolException(uint16_t code, const std::string& msg = "", InfoHash failing_node_id = {})
+        : DhtException(msg)
+        , msg(msg)
+        , code(code)
+        , failing_node_id(failing_node_id)
+    {}
+
+    const std::string& getMsg() const { return msg; }
+    uint16_t getCode() const { return code; }
+    const InfoHash& getNodeId() const { return failing_node_id; }
+
+private:
+    std::string msg;
+    uint16_t code;
+    InfoHash failing_node_id;
+};
+
+struct ParsedMessage;
+
+/**
+ * Answer for a request.
+ */
+struct RequestAnswer
+{
+    Blob ntoken {};
+    Value::Id vid {};
+    std::vector<Sp<Value>> values {};
+    std::vector<Value::Id> refreshed_values {};
+    std::vector<Value::Id> expired_values {};
+    std::vector<Sp<FieldValueIndex>> fields {};
+    std::vector<Sp<Node>> nodes4 {};
+    std::vector<Sp<Node>> nodes6 {};
+    RequestAnswer() {}
+    RequestAnswer(ParsedMessage&& msg);
+};
+
+/*!
+ * @class   NetworkEngine
+ * @brief   An abstraction of communication protocol on the network.
+ * @details
+ * The NetworkEngine processes all requests to nodes by offering a public
+ * interface for handling sending and receiving packets. The following
+ * parameters specify callbacks for DHT work:
+ *
+ * @param onError        callback for handling error messages.
+ * @param onNewNode      callback for handling new nodes.
+ * @param onReportedAddr callback for reporting an our address as seen from the other peer.
+ * @param onPing         callback for ping request.
+ * @param onFindNode     callback for "find node" request.
+ * @param onGetValues    callback for "get values" request.
+ * @param onListen       callback for "listen" request.
+ * @param onAnnounce     callback for "announce" request.
+ * @param onRefresh      callback for "refresh" request.
+ */
+class NetworkEngine final
+{
+private:
+    /**
+     * Called when we receive an error message.
+     */
+    std::function<void(Sp<Request>, DhtProtocolException)> onError;
+
+    /**
+     * Called for every packets received for handling new nodes contacting us.
+     *
+     * @param node: the node
+     * @param confirm: 1 if the node sent a message, 2 if it sent us a reply.
+     */
+    std::function<void(const Sp<Node>&, int)> onNewNode;
+    /**
+     * Called when an addres is reported from a requested node.
+     *
+     * @param h: id
+     * @param saddr_len (type: socklen_t) lenght of the sockaddr struct.
+     */
+    std::function<void(const InfoHash&, const SockAddr&)> onReportedAddr;
+    /**
+     * Called on ping reception.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     */
+    std::function<RequestAnswer(Sp<Node>)> onPing {};
+    /**
+     * Called on find node request.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     * @param h (type: InfoHash) hash of the value of interest.
+     * @param want (type: want_t) states if nodes sent in the response are ipv4
+     *             or ipv6.
+     */
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, want_t)> onFindNode {};
+    /**
+     * Called on "get values" request.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     * @param h (type: InfoHash) hash of the value of interest.
+     * @param want (type: want_t) states if nodes sent in the response are ipv4
+     *             or ipv6.
+     */
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, want_t, const Query&)> onGetValues {};
+    /**
+     * Called on listen request.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     * @param h (type: InfoHash) hash of the value of interest.
+     * @param token (type: Blob) security token.
+     * @param rid (type: uint16_t) request id.
+     */
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, Tid, const Query&, int)> onListen {};
+    /**
+     * Called on announce request.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     * @param h (type: InfoHash) hash of the value of interest.
+     * @param token (type: Blob) security token.
+     * @param values (type: std::vector<Sp<Value>>) values to store.
+     * @param created (type: time_point) time when the value was created.
+     */
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, const std::vector<Sp<Value>>&, const time_point&)>
+        onAnnounce {};
+    /**
+     * Called on refresh request.
+     *
+     * @param node (type: Sp<Node>) the requesting node.
+     * @param h (type: InfoHash) hash of the value of interest.
+     * @param token (type: Blob) security token.
+     * @param vid (type: Value::id) the value id.
+     */
+    std::function<RequestAnswer(Sp<Node>, const InfoHash&, const Blob&, const Value::Id&)> onRefresh {};
+
+public:
+    using RequestCb = std::function<void(const Request&, RequestAnswer&&)>;
+    using RequestErrorCb = std::function<bool(const Request&, DhtProtocolException&&)>;
+    using RequestExpiredCb = std::function<void(const Request&, bool)>;
+
+    NetworkEngine(InfoHash& myid,
+                  NetworkConfig config,
+                  std::unique_ptr<DatagramSocket>&& sock,
+                  const Sp<Logger>& log,
+                  std::mt19937_64& rd,
+                  Scheduler& scheduler,
+                  decltype(NetworkEngine::onError)&& onError,
+                  decltype(NetworkEngine::onNewNode)&& onNewNode,
+                  decltype(NetworkEngine::onReportedAddr)&& onReportedAddr,
+                  decltype(NetworkEngine::onPing)&& onPing,
+                  decltype(NetworkEngine::onFindNode)&& onFindNode,
+                  decltype(NetworkEngine::onGetValues)&& onGetValues,
+                  decltype(NetworkEngine::onListen)&& onListen,
+                  decltype(NetworkEngine::onAnnounce)&& onAnnounce,
+                  decltype(NetworkEngine::onRefresh)&& onRefresh);
+
+    ~NetworkEngine();
+
+    net::DatagramSocket* getSocket() const { return dht_socket.get(); };
+
+    void clear();
+
+    /**
+     * Sends values (with closest nodes) to a listener.
+     *
+     * @deprecated
+     * @param sa          The address of the listener.
+     * @param sslen       The length of the sockaddr structure.
+     * @param socket_id  The tid to use to write to the request socket.
+     * @param hash        The hash key of the value.
+     * @param want        Wether to send ipv4 and/or ipv6 nodes.
+     * @param ntoken      Listen security token.
+     * @param nodes       The ipv4 closest nodes.
+     * @param nodes6      The ipv6 closest nodes.
+     * @param values      The values to send.
+     * @param version     If version = 1, a request will be used to answer to the listener
+     */
+    void tellListener(const Sp<Node>& n,
+                      Tid socket_id,
+                      const InfoHash& hash,
+                      want_t want,
+                      const Blob& ntoken,
+                      std::vector<Sp<Node>>&& nodes,
+                      std::vector<Sp<Node>>&& nodes6,
+                      std::vector<Sp<Value>>&& values,
+                      const Query& q,
+                      int version);
+
+    void tellListenerRefreshed(const Sp<Node>& n,
+                               Tid socket_id,
+                               const InfoHash& hash,
+                               const Blob& ntoken,
+                               const std::vector<Value::Id>& values,
+                               int version);
+    void tellListenerExpired(const Sp<Node>& n,
+                             Tid socket_id,
+                             const InfoHash& hash,
+                             const Blob& ntoken,
+                             const std::vector<Value::Id>& values,
+                             int version);
+
+    bool isRunning(sa_family_t af) const;
+    inline want_t want() const { return dht_socket->hasIPv4() and dht_socket->hasIPv6() ? (WANT4 | WANT6) : -1; }
+
+    void connectivityChanged(sa_family_t);
+
+    /**************
+     *  Requests  *
+     **************/
+
+    /**
+     * Send a "ping" request to a given node.
+     *
+     * @param n           The node.
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendPing(const Sp<Node>& n, RequestCb&& on_done, RequestExpiredCb&& on_expired);
+
+    /**
+     * Send a "ping" request to a given node.
+     *
+     * @param sa          The node's ip sockaddr info.
+     * @param salen       The associated sockaddr struct length.
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendPing(SockAddr&& sa, RequestCb&& on_done, RequestExpiredCb&& on_expired)
+    {
+        return sendPing(std::make_shared<Node>(InfoHash::zero(), std::move(sa), rd),
+                        std::forward<RequestCb>(on_done),
+                        std::forward<RequestExpiredCb>(on_expired));
+    }
+
+    /**
+     * Send a "find node" request to a given node.
+     *
+     * @param n           The node.
+     * @param target      The target hash.
+     * @param want        Indicating wether IPv4 or IPv6 are wanted in response.
+     *                    Use NetworkEngine::want()
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendFindNode(const Sp<Node>& n,
+                             const InfoHash& hash,
+                             want_t want = -1,
+                             RequestCb&& on_done = {},
+                             RequestExpiredCb&& on_expired = {});
+    /**
+     * Send a "get" request to a given node.
+     *
+     * @param n           The node.
+     * @param hash        The target hash.
+     * @param query       The query describing filters.
+     * @param token       A security token.
+     * @param want        Indicating wether IPv4 or IPv6 are wanted in response.
+     *                    Use NetworkEngine::want()
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendGetValues(const Sp<Node>& n,
+                              const InfoHash& hash,
+                              const Query& query,
+                              want_t want,
+                              RequestCb&& on_done,
+                              RequestExpiredCb&& on_expired);
+    /**
+     * Send a "listen" request to a given node.
+     *
+     * @param n           The node.
+     * @param hash        The storage's hash.
+     * @param query       The query describing filters.
+     * @param token       A security token.
+     * @param previous    The previous request "listen" sent to this node.
+     * @param socket      **UNUSED** The socket for further response.
+     *
+     *                    For backward compatibility purposes, sendListen has to
+     *                    handle creation of the socket. Therefore, you are unable to
+     *                    use openSocket yourself.
+     *                    TODO: Once we don't support the old "listen" negotiation,
+     *                    sendListen shall not create the socket itself.
+     *
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     * @param socket_cb   Callback to execute each time new updates arrive on
+     *                    the socket.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendListen(const Sp<Node>& n,
+                           const InfoHash& hash,
+                           const Query& query,
+                           const Blob& token,
+                           Tid socketId,
+                           RequestCb&& on_done,
+                           RequestExpiredCb&& on_expired);
+    /**
+     * Send a "announce" request to a given node.
+     *
+     * @param n           The node.
+     * @param hash        The target hash.
+     * @param created     The time when the value was created (avoiding extended
+     *                    value lifetime)
+     * @param token       A security token.
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendAnnounceValue(const Sp<Node>& n,
+                                  const InfoHash& hash,
+                                  const Sp<Value>& v,
+                                  time_point created,
+                                  const Blob& token,
+                                  RequestCb&& on_done,
+                                  RequestExpiredCb&& on_expired);
+    /**
+     * Send a "refresh" request to a given node. Asks a node to keep the
+     * associated value Value.type.expiration more minutes in its storage.
+     *
+     * @param n           The node.
+     * @param hash        The target hash.
+     * @param vid         The value id.
+     * @param token       A security token.
+     * @param on_done     Request callback when the request is completed.
+     * @param on_expired  Request callback when the request expires.
+     *
+     * @return the request with information concerning its success.
+     */
+    Sp<Request> sendRefreshValue(const Sp<Node>& n,
+                                 const InfoHash& hash,
+                                 const Value::Id& vid,
+                                 const Blob& token,
+                                 RequestCb&& on_done,
+                                 RequestErrorCb&& on_error,
+                                 RequestExpiredCb&& on_expired);
+    /**
+     * Send a "update" request to a given node. Used for Listen operations
+     *
+     * @param n           The node.
+     * @param hash        The target hash.
+     * @param values      The values.
+     * @param created     Time id.
+     * @param token       A security token.
+     * @param sid         The socket id.
+     *
+     * @return the request with information concerning its success.
+     */
+    void sendUpdateValues(const Sp<Node>& n,
+                          const InfoHash& infohash,
+                          std::vector<Sp<Value>>&& values,
+                          time_point created,
+                          const Blob& token,
+                          size_t sid);
+    Sp<Request> sendUpdateValues(const Sp<Node>& n,
+                                 const InfoHash& infohash,
+                                 std::vector<Sp<Value>>::iterator begin,
+                                 std::vector<Sp<Value>>::iterator end,
+                                 time_point created,
+                                 const Blob& token,
+                                 size_t sid);
+
+    /**
+     * Parses a message and calls appropriate callbacks.
+     *
+     * @param buf  The buffer containing the binary message.
+     * @param buflen  The length of the buffer.
+     * @param from  The address info of the sender.
+     * @param fromlen  The length of the corresponding sockaddr structure.
+     * @param now  The time to adjust the clock in the network engine.
+     */
+    void processMessage(const uint8_t* buf, size_t buflen, SockAddr addr);
+
+    Sp<Node> insertNode(const InfoHash& id, const SockAddr& addr)
+    {
+        auto n = cache.getNode(id, addr, scheduler.time(), 0);
+        onNewNode(n, 0);
+        return n;
+    }
+
+    std::vector<unsigned> getNodeMessageStats(bool in)
+    {
+        auto& st = in ? in_stats : out_stats;
+        std::vector<unsigned> stats {st.ping, st.find, st.get, st.listen, st.put};
+        st = {};
+        return stats;
+    }
+
+    void blacklistNode(const Sp<Node>& n);
+
+    std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, sa_family_t sa_f, size_t count)
+    {
+        return cache.getCachedNodes(id, sa_f, count);
+    }
+
+    size_t getNodeCacheSize() const { return cache.size(); }
+    size_t getNodeCacheSize(sa_family_t af) const { return cache.size(af); }
+
+    size_t getRateLimiterSize() const { return address_rate_limiter.size(); }
+
+    size_t getPartialCount() const { return partial_messages.size(); }
+
+private:
+    struct PartialMessage;
+
+    /***************
+     *  Constants  *
+     ***************/
+    /* the length of a node info buffer in ipv4 format */
+    static const constexpr size_t NODE4_INFO_BUF_LEN {HASH_LEN + sizeof(in_addr) + sizeof(in_port_t)};
+    /* the length of a node info buffer in ipv6 format */
+    static const constexpr size_t NODE6_INFO_BUF_LEN {HASH_LEN + sizeof(in6_addr) + sizeof(in_port_t)};
+    /* after a UDP reply, the period during which we tell the link layer about it */
+    static constexpr std::chrono::seconds UDP_REPLY_TIME {15};
+
+    /* Max. time to receive a full fragmented packet */
+    static constexpr std::chrono::seconds RX_MAX_PACKET_TIME {10};
+    /* Max. time between packet fragments */
+    static constexpr std::chrono::seconds RX_TIMEOUT {3};
+    /* The maximum number of nodes that we snub.  There is probably little
+        reason to increase this value. */
+    static constexpr unsigned BLACKLISTED_MAX {10};
+
+    static constexpr size_t MTU {1280};
+    static constexpr size_t MAX_PACKET_VALUE_SIZE {600};
+    static constexpr size_t MAX_MESSAGE_VALUE_SIZE {56 * 1024};
+    static constexpr size_t RX_MAX_EARLY_BYTES {MAX_MESSAGE_VALUE_SIZE + MAX_VALUE_SIZE + 32};
+    static constexpr size_t RX_MAX_EARLY_PARTS {RX_MAX_EARLY_BYTES / MTU + 2};
+
+    void process(std::unique_ptr<ParsedMessage>&&, const SockAddr& from);
+    bool isExpectedReply(const ParsedMessage&, const SockAddr& from);
+    bool tryCompleteMessage(PartialMessage&, const SockAddr& from);
+
+    bool rateLimit(const SockAddr& addr);
+
+    static bool isMartian(const SockAddr& addr);
+    bool isNodeBlacklisted(const SockAddr& addr) const;
+
+    void requestStep(Sp<Request> req);
+
+    /**
+     * Sends a request to a node. Request::MAX_ATTEMPT_COUNT attempts will
+     * be made before the request expires.
+     */
+    void sendRequest(const Sp<Request>& request);
+
+    struct MessageStats
+    {
+        unsigned ping {0};
+        unsigned find {0};
+        unsigned get {0};
+        unsigned put {0};
+        unsigned listen {0};
+        unsigned refresh {0};
+        unsigned updateValue {0};
+    };
+
+    // basic wrapper for socket sendto function
+    int send(const SockAddr& addr, const char* buf, size_t len, bool confirmed = false);
+
+    void sendValueParts(Tid tid, const std::vector<Blob>& svals, const SockAddr& addr);
+    std::vector<Blob> packValueHeader(msgpack::sbuffer&,
+                                      std::vector<Sp<Value>>::const_iterator,
+                                      std::vector<Sp<Value>>::const_iterator) const;
+    std::vector<Blob> packValueHeader(msgpack::sbuffer& buf, const std::vector<Sp<Value>>& values) const
+    {
+        return packValueHeader(buf, values.begin(), values.end());
+    }
+    using PartialMessageKey = std::pair<SockAddr, Tid>;
+    void maintainRxBuffer(const PartialMessageKey& key);
+
+    /*************
+     *  Answers  *
+     *************/
+    /* answer to a ping  request */
+    void sendPong(const SockAddr& addr, Tid tid);
+    /* answer to findnodes/getvalues request */
+    void sendNodesValues(const SockAddr& addr,
+                         Tid tid,
+                         const Blob& nodes,
+                         const Blob& nodes6,
+                         const std::vector<Sp<Value>>& st,
+                         const Query& query,
+                         const Blob& token);
+    Blob bufferNodes(sa_family_t af, const InfoHash& id, std::vector<Sp<Node>>& nodes);
+
+    std::pair<Blob, Blob> bufferNodes(
+        sa_family_t af, const InfoHash& id, want_t want, std::vector<Sp<Node>>& nodes, std::vector<Sp<Node>>& nodes6);
+    /* answer to a listen request */
+    void sendListenConfirmation(const SockAddr& addr, Tid tid, const Blob& token = {});
+    /* answer to put request */
+    void sendValueAnnounced(const SockAddr& addr, Tid, Value::Id);
+    /* answer in case of error */
+    void sendError(const SockAddr& addr, Tid tid, uint16_t code, const std::string& message, bool include_id = false);
+
+    void deserializeNodes(ParsedMessage& msg, const SockAddr& from);
+
+    /* DHT info */
+    const InfoHash& myid;
+    const NetworkConfig config {};
+    const std::unique_ptr<DatagramSocket> dht_socket;
+    Sp<Logger> logger_;
+    std::mt19937_64& rd;
+
+    NodeCache cache;
+
+    // global limiting should be triggered by at least 8 different IPs
+    using IpLimiter = RateLimiter;
+    using IpLimiterMap = std::map<SockAddr, IpLimiter, SockAddr::ipCmp>;
+    IpLimiterMap address_rate_limiter;
+    RateLimiter rate_limiter;
+    ssize_t limiter_maintenance {0};
+
+    // requests handling
+    std::map<Tid, Sp<Request>> requests {};
+    std::map<PartialMessageKey, PartialMessage> partial_messages;
+
+    MessageStats in_stats {}, out_stats {};
+    std::set<SockAddr> blacklist {};
+
+    Scheduler& scheduler;
+
+    bool logIncoming_ {false};
+};
+
+} /* namespace net  */
+} /* namespace dht */

include/opendht/network_utils.h

@@ -0,0 +1,161 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+
+#include "sockaddr.h"
+#include "utils.h"
+#include "logger.h"
+
+#ifdef _WIN32
+#include <ws2tcpip.h>
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <unistd.h>
+#endif
+
+#include <functional>
+#include <thread>
+#include <atomic>
+#include <mutex>
+#include <list>
+
+namespace dht {
+namespace net {
+
+static const constexpr in_port_t DHT_DEFAULT_PORT = 4222;
+static const constexpr size_t RX_QUEUE_MAX_SIZE = 1024 * 64;
+static const constexpr std::chrono::milliseconds RX_QUEUE_MAX_DELAY(650);
+
+int bindSocket(const SockAddr& addr, SockAddr& bound);
+
+bool setNonblocking(int fd, bool nonblocking = true);
+
+#ifdef _WIN32
+void udpPipe(int fds[2]);
+#endif
+struct ReceivedPacket
+{
+    Blob data;
+    SockAddr from;
+    time_point received;
+};
+using PacketList = std::list<ReceivedPacket>;
+
+class OPENDHT_PUBLIC DatagramSocket
+{
+public:
+    /** A function that takes a list of new received packets and
+     *  optionally returns consumed packets for recycling.
+     **/
+    using OnReceive = std::function<PacketList(PacketList&& packets)>;
+    virtual ~DatagramSocket() {};
+
+    virtual int sendTo(const SockAddr& dest, const uint8_t* data, size_t size, bool replied) = 0;
+
+    inline void setOnReceive(OnReceive&& cb)
+    {
+        std::lock_guard lk(lock);
+        rx_callback = std::move(cb);
+    }
+
+    virtual bool hasIPv4() const = 0;
+    virtual bool hasIPv6() const = 0;
+
+    SockAddr getBound(sa_family_t family = AF_UNSPEC) const
+    {
+        std::lock_guard lk(lock);
+        return getBoundRef(family);
+    }
+    in_port_t getPort(sa_family_t family = AF_UNSPEC) const
+    {
+        std::lock_guard lk(lock);
+        return getBoundRef(family).getPort();
+    }
+
+    virtual const SockAddr& getBoundRef(sa_family_t family = AF_UNSPEC) const = 0;
+
+    /** Virtual resolver mothod allows to implement custom resolver */
+    virtual std::vector<SockAddr> resolve(const std::string& host, const std::string& service = {})
+    {
+        return SockAddr::resolve(host, service);
+    }
+
+    virtual void stop() = 0;
+
+protected:
+    PacketList getNewPacket()
+    {
+        PacketList pkts;
+        if (toRecycle_.empty()) {
+            pkts.emplace_back();
+        } else {
+            auto begIt = toRecycle_.begin();
+            auto begItNext = std::next(begIt);
+            pkts.splice(pkts.end(), toRecycle_, begIt, begItNext);
+        }
+        return pkts;
+    }
+
+    inline void onReceived(PacketList&& packets)
+    {
+        std::lock_guard lk(lock);
+        if (rx_callback) {
+            auto r = rx_callback(std::move(packets));
+            if (not r.empty() and toRecycle_.size() < RX_QUEUE_MAX_SIZE)
+                toRecycle_.splice(toRecycle_.end(), std::move(r));
+        }
+    }
+
+protected:
+    mutable std::mutex lock;
+
+private:
+    OnReceive rx_callback;
+    PacketList toRecycle_;
+};
+
+class OPENDHT_PUBLIC UdpSocket : public DatagramSocket
+{
+public:
+    UdpSocket(in_port_t port, const std::shared_ptr<Logger>& l = {});
+    UdpSocket(const SockAddr& bind4, const SockAddr& bind6, const std::shared_ptr<Logger>& l = {});
+    ~UdpSocket();
+
+    int sendTo(const SockAddr& dest, const uint8_t* data, size_t size, bool replied) override;
+
+    const SockAddr& getBoundRef(sa_family_t family = AF_UNSPEC) const override
+    {
+        return (family == AF_INET6) ? bound6 : bound4;
+    }
+
+    bool hasIPv4() const override
+    {
+        std::lock_guard lk(lock);
+        return s4 != -1;
+    }
+    bool hasIPv6() const override
+    {
+        std::lock_guard lk(lock);
+        return s6 != -1;
+    }
+
+    void stop() override;
+
+private:
+    std::shared_ptr<Logger> logger;
+    int s4 {-1};
+    int s6 {-1};
+    int stopfd {-1};
+    SockAddr bound4, bound6;
+    std::thread rcv_thread {};
+    std::atomic_bool running {false};
+
+    void openSockets(const SockAddr& bind4, const SockAddr& bind6);
+};
+
+} // namespace net
+} // namespace dht

include/opendht/node.h

@@ -0,0 +1,160 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "infohash.h" // includes socket structures
+#include "utils.h"
+#include "sockaddr.h"
+#include "node_export.h"
+
+#include <list>
+#include <map>
+
+namespace dht {
+
+struct Node;
+namespace net {
+struct Request;
+struct Socket;
+struct RequestAnswer;
+} /* namespace net */
+
+using Tid = uint32_t;
+using SocketCb = std::function<void(const Sp<Node>&, net::RequestAnswer&&)>;
+struct Socket
+{
+    Socket() {}
+    Socket(SocketCb&& on_receive)
+        : on_receive(std::move(on_receive))
+    {}
+    SocketCb on_receive {};
+};
+
+struct Node
+{
+    const InfoHash id;
+
+    Node(const InfoHash& id, const SockAddr& addr, std::mt19937_64& rd, bool client = false);
+    Node(const InfoHash& id, SockAddr&& addr, std::mt19937_64& rd, bool client = false);
+    Node(const InfoHash& id, const sockaddr* sa, socklen_t salen, std::mt19937_64& rd)
+        : Node(id, SockAddr(sa, salen), rd)
+    {}
+
+    const InfoHash& getId() const { return id; }
+    const SockAddr& getAddr() const { return addr; }
+    std::string getAddrStr() const { return addr.toString(); }
+    bool isClient() const { return is_client; }
+    bool isIncoming() { return time > reply_time; }
+
+    const time_point& getTime() const { return time; }
+    const time_point& getReplyTime() const { return reply_time; }
+    void setTime(const time_point& t) { time = t; }
+
+    /**
+     * Makes notice about an additionnal authentication error with this node. Up
+     * to MAX_AUTH_ERRORS errors are accepted in order to let the node recover.
+     * Upon this limit, the node expires.
+     */
+    void authError()
+    {
+        if (++auth_errors > MAX_AUTH_ERRORS)
+            setExpired();
+    }
+    void authSuccess() { auth_errors = 0; }
+
+    bool isExpired() const { return expired_; }
+    bool isGood(time_point now) const;
+    bool isPendingMessage() const;
+    size_t getPendingMessageCount() const;
+
+    bool isOld(const time_point& now) const { return time + NODE_EXPIRE_TIME < now; }
+    bool isRemovable(const time_point& now) const { return isExpired() and isOld(now); }
+
+    NodeExport exportNode() const
+    {
+        NodeExport ne;
+        ne.id = id;
+        ne.addr = addr;
+        return ne;
+    }
+    sa_family_t getFamily() const { return addr.getFamily(); }
+
+    void update(const SockAddr&);
+
+    void requested(const Sp<net::Request>& req);
+    void received(time_point now, const Sp<net::Request>& req);
+    Sp<net::Request> getRequest(Tid tid);
+    void cancelRequest(const Sp<net::Request>& req);
+
+    void setExpired();
+
+    /**
+     * Opens a socket on which a node will be able allowed to write for further
+     * additionnal updates following the response to a previous request.
+     *
+     * @param node  The node which will be allowed to write on this socket.
+     * @param cb    The callback to execute once updates arrive on the socket.
+     *
+     * @return the socket.
+     */
+    Tid openSocket(SocketCb&& cb);
+
+    Sp<Socket> getSocket(Tid id);
+
+    /**
+     * Closes a socket so that no further data will be red on that socket.
+     *
+     * @param socket  The socket to close.
+     */
+    void closeSocket(Tid id);
+
+    /**
+     * Resets the state of the node so it's not expired anymore.
+     */
+    void reset()
+    {
+        expired_ = false;
+        reply_time = time_point::min();
+    }
+
+    /**
+     * Generates a new request id, skipping the invalid id.
+     *
+     * @return the new id.
+     */
+    Tid getNewTid()
+    {
+        ++transaction_id;
+        return transaction_id ? transaction_id : ++transaction_id;
+    }
+
+    std::string toString() const;
+
+    OPENDHT_PUBLIC friend std::ostream& operator<<(std::ostream& s, const Node& h);
+
+    static constexpr const std::chrono::minutes NODE_GOOD_TIME {120};
+
+    /* The time after which we consider a node to be expirable. */
+    static constexpr const std::chrono::minutes NODE_EXPIRE_TIME {10};
+
+    /* Time for a request to timeout */
+    static constexpr const std::chrono::seconds MAX_RESPONSE_TIME {1};
+
+private:
+    /* Number of times we accept authentication errors from this node. */
+    static const constexpr unsigned MAX_AUTH_ERRORS {3};
+
+    SockAddr addr;
+    bool is_client {false};
+    time_point time {time_point::min()};       /* last time eared about */
+    time_point reply_time {time_point::min()}; /* time of last correct reply received */
+    unsigned auth_errors {0};
+    bool expired_ {false};
+    Tid transaction_id;
+    using TransactionDist = std::uniform_int_distribution<decltype(transaction_id)>;
+
+    std::map<Tid, Sp<net::Request>> requests_ {};
+    std::map<Tid, Sp<Socket>> sockets_;
+};
+
+} // namespace dht

include/opendht/node_cache.h

@@ -0,0 +1,56 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "node.h"
+
+#include <list>
+#include <memory>
+
+namespace dht {
+
+struct NodeCache
+{
+    size_t size(sa_family_t family) const { return cache(family).count(); }
+    size_t size() const { return size(AF_INET) + size(AF_INET6); }
+
+    Sp<Node> getNode(const InfoHash& id, sa_family_t family);
+    Sp<Node> getNode(const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client = false);
+    std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, sa_family_t sa_f, size_t count) const;
+
+    /**
+     * Reset the connectivity state of every node,
+     * Giving them a new chance if they where expired.
+     * To use in case of connectivity change etc.
+     */
+    void clearBadNodes(sa_family_t family = 0);
+
+    NodeCache(std::mt19937_64& r)
+        : rd(r) {};
+    ~NodeCache();
+
+private:
+    class NodeMap : private std::map<InfoHash, std::weak_ptr<Node>>
+    {
+    public:
+        Sp<Node> getNode(const InfoHash& id);
+        Sp<Node> getNode(
+            const InfoHash& id, const SockAddr&, time_point now, bool confirmed, bool client, std::mt19937_64& rd);
+        std::vector<Sp<Node>> getCachedNodes(const InfoHash& id, size_t count) const;
+        void clearBadNodes();
+        void setExpired();
+        void cleanup();
+        size_t count() const { return size(); }
+
+    private:
+        size_t cleanup_counter {0};
+    };
+
+    const NodeMap& cache(sa_family_t af) const { return af == AF_INET ? cache_4 : cache_6; }
+    NodeMap& cache(sa_family_t af) { return af == AF_INET ? cache_4 : cache_6; }
+    NodeMap cache_4;
+    NodeMap cache_6;
+    std::mt19937_64& rd;
+};
+
+} // namespace dht

include/opendht/node_export.h

@@ -0,0 +1,35 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+#include "infohash.h"
+#include "sockaddr.h"
+
+#include <string_view>
+
+namespace dht {
+using namespace std::literals;
+
+struct OPENDHT_PUBLIC NodeExport
+{
+    InfoHash id;
+    SockAddr addr;
+
+    template<typename Packer>
+    void msgpack_pack(Packer& pk) const
+    {
+        pk.pack_map(2);
+        pk.pack("id"sv);
+        pk.pack(id);
+        pk.pack("addr"sv);
+        pk.pack_bin(addr.getLength());
+        pk.pack_bin_body((const char*) addr.get(), (size_t) addr.getLength());
+    }
+
+    void msgpack_unpack(msgpack::object o);
+
+    OPENDHT_PUBLIC friend std::ostream& operator<<(std::ostream& s, const NodeExport& h);
+};
+
+} // namespace dht

include/opendht/peer_discovery.h

@@ -0,0 +1,85 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+#include "sockaddr.h"
+#include "infohash.h"
+#include "logger.h"
+#include "utils.h"
+
+#include <asio/steady_timer.hpp>
+#include <thread>
+
+namespace asio {
+class io_context;
+}
+
+namespace dht {
+
+class OPENDHT_PUBLIC PeerDiscovery
+{
+public:
+    static constexpr in_port_t DEFAULT_PORT = 8888;
+    using ServiceDiscoveredCallback = std::function<void(msgpack::object&&, SockAddr&&)>;
+
+    PeerDiscovery(in_port_t port = DEFAULT_PORT,
+                  std::shared_ptr<asio::io_context> ioContext = {},
+                  std::shared_ptr<Logger> logger = {});
+    ~PeerDiscovery();
+
+    /**
+     * startDiscovery - Keep Listening data from the sender until node is joinned
+     * or stop is called
+     */
+    void startDiscovery(std::string_view type, ServiceDiscoveredCallback callback);
+
+    template<typename T>
+    void startDiscovery(std::string_view type, std::function<void(T&&, SockAddr&&)> cb)
+    {
+        startDiscovery(type, [cb](msgpack::object&& ob, SockAddr&& addr) { cb(ob.as<T>(), std::move(addr)); });
+    }
+
+    /**
+     * startPublish - Keeping sending data until node is joinned or stop is called
+     */
+    void startPublish(std::string_view type, const msgpack::sbuffer& pack_buf);
+    void startPublish(sa_family_t domain, std::string_view type, const msgpack::sbuffer& pack_buf);
+
+    template<typename T>
+    void startPublish(std::string_view type, const T& object)
+    {
+        msgpack::sbuffer buf;
+        msgpack::pack(buf, object);
+        startPublish(type, buf);
+    }
+
+    /**
+     * Thread Stopper
+     */
+    void stop();
+
+    /**
+     * Remove possible callBack to discovery
+     */
+    bool stopDiscovery(std::string_view type);
+
+    /**
+     * Remove different serivce message to send
+     */
+    bool stopPublish(std::string_view type);
+    bool stopPublish(sa_family_t domain, std::string_view type);
+
+    void connectivityChanged();
+
+    void stopConnectivityChanged();
+
+private:
+    class DomainPeerDiscovery;
+    std::unique_ptr<DomainPeerDiscovery> peerDiscovery4_;
+    std::unique_ptr<DomainPeerDiscovery> peerDiscovery6_;
+    std::shared_ptr<asio::io_context> ioContext_;
+    std::thread ioRunnner_;
+};
+
+} // namespace dht

include/opendht/proxy.h

@@ -0,0 +1,16 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <chrono>
+
+namespace dht {
+namespace proxy {
+
+constexpr const std::chrono::hours OP_TIMEOUT {24}; // one day
+constexpr const std::chrono::hours OP_MARGIN {8};   // eight hours
+
+using ListenToken = uint64_t;
+
+} // namespace proxy
+} // namespace dht

include/opendht/rate_limiter.h

@@ -0,0 +1,44 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "utils.h"
+#include <queue>
+
+namespace dht {
+
+class RateLimiter
+{
+public:
+    RateLimiter(size_t quota, const duration& period = std::chrono::seconds(1))
+        : quota_(quota)
+        , period_(period)
+    {}
+
+    /** Clear outdated records and return current quota usage */
+    size_t maintain(const time_point& now)
+    {
+        auto limit = now - period_;
+        while (not records.empty() and records.front() < limit)
+            records.pop();
+        return records.size();
+    }
+    /** Return false if quota is reached, insert record and return true otherwise. */
+    bool limit(const time_point& now)
+    {
+        if (quota_ == std::numeric_limits<size_t>::max())
+            return true;
+        if (maintain(now) >= quota_)
+            return false;
+        records.emplace(now);
+        return true;
+    }
+    bool empty() const { return records.empty(); }
+
+private:
+    const size_t quota_;
+    const duration period_;
+    std::queue<time_point> records {};
+};
+
+} // namespace dht

include/opendht/rng.h

@@ -1,113 +1,62 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
 
 #include <random>
+#include <algorithm>
+#include <functional>
+#include <thread>
+#include <stdexcept>
 
 namespace dht {
 namespace crypto {
 
-#ifdef _WIN32
+/**
+ * Generate a seeded random engine.
+ */
+template<class T = std::mt19937, std::size_t N = T::state_size + 1>
+auto
+getSeededRandomEngine() -> typename std::enable_if<!!N, T>::type
+{
+    std::array<typename T::result_type, N> random_data;
+    constexpr auto gen = [](std::random_device& source) -> typename T::result_type {
+        for (unsigned j = 0; j < 64; j++) {
+            try {
+                return source();
+            } catch (...) {
+                std::this_thread::sleep_for(std::chrono::microseconds(500));
+            }
+        }
+        throw std::runtime_error("Can't generate random number");
+    };
+    for (unsigned i = 0; i < 8; i++) {
+        try {
+            std::random_device source;
+            for (auto& r : random_data)
+                r = gen(source);
+            std::seed_seq seed((std::seed_seq::result_type*) random_data.data(),
+                               (std::seed_seq::result_type*) (random_data.data() + random_data.size()));
+            return T(seed);
+        } catch (...) {
+            std::this_thread::sleep_for(std::chrono::microseconds(500));
+        }
+    }
+    throw std::runtime_error("Can't seed random seed");
+}
 
 /**
- * Hardware random rumber generator using Intel RDRAND/RDSEED,
- * API-compatible with std::random_device.
+ * Generate a random engine from another source.
  */
-class random_device {
-public:
-    using result_type = std::random_device::result_type;
-    using pseudo_engine = std::mt19937_64;
+template<class T = std::mt19937, std::size_t N = T::state_size + 1>
+auto
+getDerivedRandomEngine(T& source) -> typename std::enable_if<!!N, T>::type
+{
+    std::array<typename T::result_type, N> random_data;
+    std::generate(random_data.begin(), random_data.end(), std::ref(source));
+    std::seed_seq seed((std::seed_seq::result_type*) random_data.data(),
+                       (std::seed_seq::result_type*) (random_data.data() + random_data.size()));
+    return T(seed);
+}
 
-    /**
-     * Current implementation assumption : result_type must be of a size
-     * supported by Intel RDRAND/RDSEED.
-     * result_type is unsigned int so this is currently safe.
-     */
-    static_assert(
-        sizeof(result_type) == 2 || 
-        sizeof(result_type) == 4 || 
-        sizeof(result_type) == 8,
-        "result_type must be 16, 32 or 64 bits");
-
-    random_device();
-
-    result_type operator()();
-
-    static constexpr result_type min() {
-        return std::numeric_limits<result_type>::lowest();
-    }
-
-    static constexpr result_type max() {
-        return std::numeric_limits<result_type>::max();
-    }
-
-    double entropy() const {
-        if (hasRdrand() or hasRdseed())
-            return 1.;
-        return 0.;
-    }
-
-private:
-    random_device& operator=(random_device&) = delete;
-
-    pseudo_engine gen;
-    std::uniform_int_distribution<result_type> dis {};
-
-    static bool hasIntelCpu();
-    static bool hasRdrand() {
-        static const bool hasrdrand = _hasRdrand();
-        return hasrdrand;
-    }
-    static bool hasRdseed() {
-        static const bool hasrdseed = _hasRdseed();
-        return hasrdseed;
-    }
-    static bool _hasRdrand();
-    static bool _hasRdseed();
-
-    struct CPUIDinfo {
-        unsigned int EAX;
-        unsigned int EBX;
-        unsigned int ECX;
-        unsigned int EDX;
-        void get(const unsigned int func, const unsigned int subfunc);
-    };
-    bool rdrandStep(result_type* r);
-    bool rdrand(result_type* r);
-    bool rdseedStep(result_type* r);
-    bool rdseed(result_type* r);
-};
-
-#else
-
-using random_device = std::random_device;
-
-#endif
-
-}} // dht::crypto
+} // namespace crypto
+} // namespace dht

include/opendht/routing_table.h

@@ -0,0 +1,95 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "node.h"
+
+namespace dht {
+
+static constexpr unsigned TARGET_NODES {8};
+namespace net {
+class NetworkEngine;
+}
+
+struct Bucket
+{
+    Bucket()
+        : cached()
+    {}
+    Bucket(sa_family_t af, const InfoHash& f = {}, time_point t = time_point::min())
+        : af(af)
+        , first(f)
+        , time(t)
+        , cached()
+    {}
+    sa_family_t af {0};
+    InfoHash first {};
+    time_point time {time_point::min()}; /* time of last reply in this bucket */
+    std::list<Sp<Node>> nodes {};
+    Sp<Node> cached; /* the address of a likely candidate */
+
+    /** Return a random node in a bucket. */
+    Sp<Node> randomNode(std::mt19937_64& rd);
+
+    void sendCachedPing(net::NetworkEngine& ne);
+    void connectivityChanged()
+    {
+        time = time_point::min();
+        for (auto& node : nodes)
+            node->setTime(time_point::min());
+    }
+};
+
+class RoutingTable : public std::list<Bucket>
+{
+public:
+    using std::list<Bucket>::list;
+
+    time_point grow_time {time_point::min()};
+    bool is_client {false};
+
+    InfoHash middle(const RoutingTable::const_iterator&) const;
+
+    std::vector<Sp<Node>> findClosestNodes(const InfoHash id, time_point now, size_t count = TARGET_NODES) const;
+
+    RoutingTable::iterator findBucket(const InfoHash& id);
+    RoutingTable::const_iterator findBucket(const InfoHash& id) const;
+
+    /**
+     * Return true if the id is in the bucket's range.
+     */
+    inline bool contains(const RoutingTable::const_iterator& bucket, const InfoHash& id) const
+    {
+        return InfoHash::cmp(bucket->first, id) <= 0
+               && (std::next(bucket) == end() || InfoHash::cmp(id, std::next(bucket)->first) < 0);
+    }
+
+    /**
+     * Return true if the table has no bucket ore one empty buket.
+     */
+    inline bool isEmpty() const { return empty() || (size() == 1 && front().nodes.empty()); }
+
+    void connectivityChanged(const time_point& now)
+    {
+        grow_time = now;
+        for (auto& b : *this)
+            b.connectivityChanged();
+    }
+
+    bool onNewNode(
+        const Sp<Node>& node, int comfirm, const time_point& now, const InfoHash& myid, net::NetworkEngine& ne);
+
+    /**
+     * Return a random id in the bucket's range.
+     */
+    InfoHash randomId(const RoutingTable::const_iterator& bucket, std::mt19937_64& rd) const;
+
+    unsigned depth(const RoutingTable::const_iterator& bucket) const;
+
+    /**
+     * Split a bucket in two equal parts.
+     */
+    bool split(const RoutingTable::iterator& b);
+};
+
+} // namespace dht

include/opendht/scheduler.h

@@ -0,0 +1,121 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "utils.h"
+
+#include <functional>
+#include <map>
+
+namespace dht {
+
+/*!
+ * @class   Scheduler
+ * @brief   Job scheduler
+ * @details
+ * Maintains the timings upon which to execute a job.
+ */
+class Scheduler
+{
+public:
+    struct Job
+    {
+        Job(std::function<void()>&& f, time_point t)
+            : do_(std::move(f))
+            , t_(t)
+        {}
+        std::function<void()> do_;
+        const time_point t_;
+        void cancel() { do_ = {}; }
+    };
+
+    /**
+     * Adds another job to the queue.
+     *
+     * @param time  The time upon which the job shall be executed.
+     * @param job_func  The job function to execute.
+     *
+     * @return pointer to the newly scheduled job.
+     */
+    Sp<Scheduler::Job> add(time_point t, std::function<void()>&& job_func)
+    {
+        auto job = std::make_shared<Job>(std::move(job_func), t);
+        if (t != time_point::max())
+            timers.emplace(std::move(t), job);
+        return job;
+    }
+
+    /**
+     * Reschedules a job.
+     *
+     * @param job  The job to edit.
+     * @param t  The time at which the job shall be rescheduled.
+     */
+    void edit(Sp<Scheduler::Job>& job, time_point t)
+    {
+        if (not job)
+            return;
+        // std::function move doesn't garantee to leave the object empty.
+        // Force clearing old value.
+        auto task = std::move(job->do_);
+        cancel(job);
+        job = add(t, std::move(task));
+    }
+
+    bool cancel(Sp<Scheduler::Job>& job)
+    {
+        if (job) {
+            job->cancel();
+            for (auto r = timers.equal_range(job->t_); r.first != r.second; ++r.first) {
+                if (r.first->second == job) {
+                    timers.erase(r.first);
+                    job.reset();
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Runs the jobs to do up to now.
+     *
+     * @return The time for the next job to run.
+     */
+    time_point run()
+    {
+        while (not timers.empty()) {
+            auto timer = timers.begin();
+            /*
+             * Running jobs scheduled before "now" prevents run+rescheduling
+             * loops before this method ends. It is garanteed by the fact that a
+             * job will at least be scheduled for "now" and not before.
+             */
+            if (timer->first > now)
+                break;
+
+            auto job = std::move(timer->second);
+            timers.erase(timer);
+
+            if (job->do_)
+                job->do_();
+        }
+        return getNextJobTime();
+    }
+
+    inline time_point getNextJobTime() const { return timers.empty() ? time_point::max() : timers.begin()->first; }
+
+    /**
+     * Accessors for the common time reference used for synchronizing
+     * operations.
+     */
+    inline const time_point& time() const { return now; }
+    inline time_point syncTime() { return (now = clock::now()); }
+    inline void syncTime(const time_point& n) { now = n; }
+
+private:
+    time_point now {clock::now()};
+    std::multimap<time_point, Sp<Job>> timers {}; /* the jobs ordered by time */
+};
+
+} // namespace dht

include/opendht/securedht.h

@@ -1,33 +1,5 @@
-/*
- *  Copyright (C) 2014-2015 Savoir-Faire Linux Inc.
- *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
- *
- *  Additional permission under GNU GPL version 3 section 7:
- *
- *  If you modify this program, or any covered work, by linking or
- *  combining it with the OpenSSL project's OpenSSL library (or a
- *  modified version of that library), containing parts covered by the
- *  terms of the OpenSSL or SSLeay licenses, Savoir-Faire Linux Inc.
- *  grants you additional permission to convey the resulting work.
- *  Corresponding Source for a non-source form of such a combination
- *  shall include the source code for the parts of OpenSSL used as well
- *  as that of the covered work.
- */
-
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
 #pragma once
 
 #include "dht.h"
@@ -40,18 +12,20 @@
 
 namespace dht {
 
-class SecureDht : public Dht {
+class OPENDHT_PUBLIC SecureDht final : public DhtInterface
+{
 public:
-
     typedef std::function<void(bool)> SignatureCheckCallback;
 
-    struct Config
-    {
-        Dht::Config node_config;
-        crypto::Identity id;
-    };
+    using Config = SecureDhtConfig;
 
-    SecureDht() {}
+    static dht::Config getConfig(const SecureDht::Config& conf)
+    {
+        auto c = conf.node_config;
+        if (not c.node_id and conf.id.second)
+            c.node_id = InfoHash::get("node:" + conf.id.second->getId().toString());
+        return c;
+    }
 
     /**
      * s, s6: bound socket descriptors for IPv4 and IPv6, respectively.
@@ -59,49 +33,79 @@ public:
      * id:    the identity to use for the crypto layer and to compute
      *        our own hash on the Dht.
      */
-    SecureDht(int s, int s6, Config config);
+    SecureDht(std::unique_ptr<DhtInterface> dht,
+              Config config,
+              IdentityAnnouncedCb iacb = {},
+              const std::shared_ptr<Logger>& l = {});
 
     virtual ~SecureDht();
 
-    InfoHash getId() const {
-        return key_ ? key_->getPublicKey().getId() : InfoHash();
-    }
+    InfoHash getId() const { return key_ ? key_->getPublicKey().getId() : InfoHash(); }
+    PkId getLongId() const { return key_ ? key_->getPublicKey().getLongId() : PkId(); }
+    Sp<crypto::PublicKey> getPublicKey() const { return key_ ? key_->getSharedPublicKey() : Sp<crypto::PublicKey> {}; }
 
     ValueType secureType(ValueType&& type);
 
-    ValueType secureType(const ValueType& type) {
+    ValueType secureType(const ValueType& type)
+    {
         ValueType tmp_type = type;
         return secureType(std::move(tmp_type));
     }
 
-    virtual void registerType(const ValueType& type) {
-        Dht::registerType(secureType(type));
+    void registerType(const ValueType& type) override
+    {
+        if (dht_)
+            dht_->registerType(secureType(type));
     }
-    virtual void registerType(ValueType&& type) {
-        Dht::registerType(secureType(std::forward<ValueType>(type)));
+    void registerType(ValueType&& type)
+    {
+        if (dht_)
+            dht_->registerType(secureType(std::forward<ValueType>(type)));
     }
-    virtual void registerInsecureType(const ValueType& type) {
-        Dht::registerType(type);
+    void registerInsecureType(const ValueType& type)
+    {
+        if (dht_)
+            dht_->registerType(type);
     }
 
     /**
      * "Secure" get(), that will check the signature of signed data, and decrypt encrypted data.
-     * If the signature can't be checked, or if the data can't be decrypted, it is not returned.
+     * If the signature is unable to be checked, or if the data is unable to be decrypted, it is not returned.
      * Public, non-signed & non-encrypted data is retransmitted as-is.
      */
-    void get(const InfoHash& id, GetCallback cb, DoneCallback donecb, Value::Filter&& = {});
-    void get(const InfoHash& id, GetCallback cb, DoneCallbackSimple donecb, Value::Filter&& f = {}) {
-        get(id, cb, bindDoneCb(donecb), std::forward<Value::Filter>(f));
+    void get(const InfoHash& id, GetCallback cb, DoneCallback donecb = {}, Value::Filter&& = {}, Where&& w = {}) override;
+    void get(const InfoHash& id,
+             GetCallback cb,
+             DoneCallbackSimple donecb = {},
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
+        get(id, cb, bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+    void get(const InfoHash& key,
+             GetCallbackSimple cb,
+             DoneCallback donecb = {},
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
+        get(key, bindGetCb(cb), donecb, std::forward<Value::Filter>(f), std::forward<Where>(w));
+    }
+    void get(const InfoHash& key,
+             GetCallbackSimple cb,
+             DoneCallbackSimple donecb,
+             Value::Filter&& f = {},
+             Where&& w = {}) override
+    {
+        get(key, bindGetCb(cb), bindDoneCb(donecb), std::forward<Value::Filter>(f), std::forward<Where>(w));
     }
-
-    size_t listen(const InfoHash& id, GetCallback cb, Value::Filter&& = {});
 
     /**
      * Will take ownership of the value, sign it using our private key and put it in the DHT.
      */
-    void putSigned(const InfoHash& hash, std::shared_ptr<Value> val, DoneCallback callback);
-    void putSigned(const InfoHash& hash, Value&& v, DoneCallback callback) {
-        putSigned(hash, std::make_shared<Value>(std::move(v)), callback);
+    void putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback, bool permanent = false);
+    void putSigned(const InfoHash& hash, Value&& v, DoneCallback callback, bool permanent = false)
+    {
+        putSigned(hash, std::make_shared<Value>(std::move(v)), callback, permanent);
     }
 
     /**
@@ -109,11 +113,21 @@ public:
      * and put it in the DHT.
      * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
      */
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, std::shared_ptr<Value> val, DoneCallback callback);
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback) {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback);
+    void putEncrypted(const InfoHash& hash,
+                      const crypto::PublicKey& to,
+                      Sp<Value> val,
+                      DoneCallback callback,
+                      bool permanent = false);
+
+    [[deprecated("Use the shared_ptr version instead")]]
+    void putEncrypted(
+        const InfoHash& hash, const crypto::PublicKey& to, Value&& v, DoneCallback callback, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
     }
 
+    void putEncrypted(const InfoHash& hash, const PkId& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
+
     /**
      * Take ownership of the value and sign it using our private key.
      */
@@ -123,61 +137,231 @@ public:
 
     Value decrypt(const Value& v);
 
-    void findCertificate(const InfoHash& node, std::function<void(const std::shared_ptr<crypto::Certificate>)> cb);
+    void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
+    void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);
 
-    const std::shared_ptr<crypto::Certificate> registerCertificate(const InfoHash& node, const Blob& cert);
-    void registerCertificate(std::shared_ptr<crypto::Certificate>& cert);
+    void registerCertificate(const Sp<crypto::Certificate>& cert);
 
-    const std::shared_ptr<crypto::Certificate> getCertificate(const InfoHash& node) const;
-
-
-    using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
+    Sp<crypto::Certificate> getCertificate(const PkId& node) const;
+    Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;
 
     /**
      * Allows to set a custom callback called by the library to find a locally-stored certificate.
      * The search key used is the public key ID, so there may be multiple certificates retured, signed with
      * the same private key.
      */
-    void setLocalCertificateStore(CertificateStoreQuery&& query_method) {
-        localQueryMethod_ = std::move(query_method);
+    void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
+    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }
+
+    /**
+     * SecureDht to Dht proxy
+     */
+    void shutdown(ShutdownCallback cb, bool stop = false) override { dht_->shutdown(cb, stop); }
+    void dumpTables() const override { dht_->dumpTables(); }
+    inline const InfoHash& getNodeId() const override { return dht_->getNodeId(); }
+
+    std::pair<size_t, size_t> getStoreSize() const override { return dht_->getStoreSize(); }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return dht_->getLocalStoreSize(); }
+    std::string getStorageLog() const override { return dht_->getStorageLog(); }
+    std::string getStorageLog(const InfoHash& h) const override { return dht_->getStorageLog(h); }
+    void setStorageLimit(size_t limit = 0) override { dht_->setStorageLimit(limit); }
+    size_t getStorageLimit() const override { return dht_->getStorageLimit(); }
+    void setLocalStorageLimit(size_t limit = 0) override { dht_->setLocalStorageLimit(limit); }
+    size_t getLocalStorageLimit() const override { return dht_->getLocalStorageLimit(); }
+
+    std::vector<NodeExport> exportNodes() const override { return dht_->exportNodes(); }
+    std::vector<ValuesExport> exportValues() const override { return dht_->exportValues(); }
+    void importValues(const std::vector<ValuesExport>& v) override { dht_->importValues(v); }
+    NodeStats getNodesStats(sa_family_t af) const override { return dht_->getNodesStats(af); }
+
+    NodeInfo getNodeInfo()
+    {
+        NodeInfo info;
+        info.id = getId();
+        info.node_id = getNodeId();
+        info.ipv4 = getNodesStats(AF_INET);
+        info.ipv6 = getNodesStats(AF_INET6);
+        std::tie(info.storage_size, info.storage_values) = getStoreSize();
+        std::tie(info.local_storage_size, info.local_storage_values) = getLocalStoreSize();
+        if (auto sock = getSocket()) {
+            info.bound4 = sock->getBoundRef(AF_INET).getPort();
+            info.bound6 = sock->getBoundRef(AF_INET6).getPort();
+        }
+        return info;
+    }
+
+    std::vector<unsigned> getNodeMessageStats(bool in = false) override { return dht_->getNodeMessageStats(in); }
+    std::string getRoutingTablesLog(sa_family_t af) const override { return dht_->getRoutingTablesLog(af); }
+    std::string getSearchesLog(sa_family_t af) const override { return dht_->getSearchesLog(af); }
+    std::string getSearchLog(const InfoHash& h, sa_family_t af = AF_UNSPEC) const override
+    {
+        return dht_->getSearchLog(h, af);
+    }
+    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override { return dht_->getPublicAddress(family); }
+    time_point periodic(const uint8_t* buf, size_t buflen, SockAddr sa, const time_point& now) override
+    {
+        return dht_->periodic(buf, buflen, std::move(sa), now);
+    }
+    time_point periodic(
+        const uint8_t* buf, size_t buflen, const sockaddr* from, socklen_t fromlen, const time_point& now) override
+    {
+        return dht_->periodic(buf, buflen, from, fromlen, now);
+    }
+    NodeStatus updateStatus(sa_family_t af) override { return dht_->updateStatus(af); }
+    NodeStatus getStatus(sa_family_t af) const override { return dht_->getStatus(af); }
+    NodeStatus getStatus() const override { return dht_->getStatus(); }
+    net::DatagramSocket* getSocket() const override { return dht_->getSocket(); };
+    bool isRunning(sa_family_t af = 0) const override { return dht_->isRunning(af); }
+    const ValueType& getType(ValueType::Id type_id) const override { return dht_->getType(type_id); }
+    void addBootstrap(const std::string& host, const std::string& service) override
+    {
+        dht_->addBootstrap(host, service);
+    }
+    void clearBootstrap() override { dht_->clearBootstrap(); }
+    void insertNode(const InfoHash& id, const SockAddr& sa) override { dht_->insertNode(id, sa); }
+    void insertNode(const NodeExport& n) override { dht_->insertNode(n); }
+    void pingNode(SockAddr sa, DoneCallbackSimple&& cb = {}) override { dht_->pingNode(std::move(sa), std::move(cb)); }
+    void query(const InfoHash& key, QueryCallback cb, DoneCallback done_cb = {}, Query&& q = {}) override
+    {
+        dht_->query(key, cb, done_cb, std::move(q));
+    }
+    void query(const InfoHash& key, QueryCallback cb, DoneCallbackSimple done_cb = {}, Query&& q = {}) override
+    {
+        dht_->query(key, cb, done_cb, std::move(q));
+    }
+    std::vector<Sp<Value>> getLocal(const InfoHash& key, const Value::Filter& f = {}) const override
+    {
+        return dht_->getLocal(key, f);
+    }
+    Sp<Value> getLocalById(const InfoHash& key, Value::Id vid) const override { return dht_->getLocalById(key, vid); }
+    void put(const InfoHash& key,
+             Sp<Value> v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        dht_->put(key, v, cb, created, permanent);
+    }
+    void put(const InfoHash& key,
+             const Sp<Value>& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        dht_->put(key, v, cb, created, permanent);
+    }
+
+    void put(const InfoHash& key,
+             Value&& v,
+             DoneCallback cb = nullptr,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        dht_->put(key, std::move(v), cb, created, permanent);
+    }
+    void put(const InfoHash& key,
+             Value&& v,
+             DoneCallbackSimple cb,
+             time_point created = time_point::max(),
+             bool permanent = false) override
+    {
+        dht_->put(key, std::move(v), cb, created, permanent);
+    }
+    std::vector<Sp<Value>> getPut(const InfoHash& h) const override { return dht_->getPut(h); }
+    Sp<Value> getPut(const InfoHash& h, const Value::Id& vid) const override { return dht_->getPut(h, vid); }
+    bool cancelPut(const InfoHash& h, const Value::Id& vid) override { return dht_->cancelPut(h, vid); }
+
+    size_t listen(const InfoHash& key, ValueCallback, Value::Filter = {}, Where = {}) override;
+    size_t listen(const InfoHash& key, GetCallback cb, Value::Filter = {}, Where w = {}) override;
+    size_t listen(const InfoHash& key, GetCallbackSimple cb, Value::Filter f = {}, Where w = {}) override
+    {
+        return listen(key, bindGetCb(cb), f, w);
+    }
+    bool cancelListen(const InfoHash& h, size_t token) override { return dht_->cancelListen(h, token); }
+    void connectivityChanged(sa_family_t af) override { dht_->connectivityChanged(af); }
+    void connectivityChanged() override { dht_->connectivityChanged(); }
+
+    void forwardAllMessages(bool forward) { forward_all_ = forward; }
+
+    void setPushNotificationToken(const std::string& token = "") override { dht_->setPushNotificationToken(token); }
+    void setPushNotificationTopic(const std::string& topic) override { dht_->setPushNotificationTopic(topic); }
+    void setPushNotificationPlatform(const std::string& platform) override
+    {
+        dht_->setPushNotificationPlatform(platform);
+    }
+
+    /**
+     * Call linked callback with push_notification
+     * @param notification to process
+     */
+    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>& notification) override
+    {
+        return dht_->pushNotificationReceived(notification);
+    }
+
+    void setLogger(const std::shared_ptr<Logger>& logger) override
+    {
+        DhtInterface::setLogger(logger);
+        dht_->setLogger(logger);
+    }
+
+    /**
+     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
+     */
+    void setLogFilter(const InfoHash& f) override
+    {
+        DhtInterface::setLogFilter(f);
+        dht_->setLogFilter(f);
     }
 
 private:
+    std::unique_ptr<DhtInterface> dht_;
     // prevent copy
     SecureDht(const SecureDht&) = delete;
     SecureDht& operator=(const SecureDht&) = delete;
 
-    GetCallback getCallbackFilter(GetCallback, Value::Filter&&);
+    Sp<Value> checkValue(const Sp<Value>& v);
+    ValueCallback getCallbackFilter(const ValueCallback&, Value::Filter&&);
+    GetCallback getCallbackFilter(const GetCallback&, Value::Filter&&);
 
-    std::shared_ptr<crypto::PrivateKey> key_ {};
-    std::shared_ptr<crypto::Certificate> certificate_ {};
+    Sp<crypto::Certificate> registerCertificate(const InfoHash& node, const Blob& cert);
+    Sp<crypto::Certificate> registerCertificate(const PkId& node, const Blob& cert);
+
+    Sp<crypto::PrivateKey> key_ {};
+    Sp<crypto::Certificate> certificate_ {};
 
     // method to query the local certificate store
     CertificateStoreQuery localQueryMethod_ {};
 
     // our certificate cache
-    std::map<InfoHash, std::shared_ptr<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};
 
-    std::uniform_int_distribution<Value::Id> rand_id {};
+    std::atomic_bool forward_all_ {false};
+    bool enableCache_ {false};
 };
 
-const ValueType CERTIFICATE_TYPE = {
-    8, "Certificate", std::chrono::hours(24 * 7),
-    // A certificate can only be stored at it's public key ID.
-    [](InfoHash id, std::shared_ptr<Value>& v, InfoHash, const sockaddr*, socklen_t) {
-        try {
-            crypto::Certificate crt(v->data);
-            // TODO check certificate signature
-            return crt.getPublicKey().getId() == id;
-        } catch (const std::exception& e) {}
-        return false;
-    },
-    [](InfoHash, const std::shared_ptr<Value>& o, std::shared_ptr<Value>& n, InfoHash, const sockaddr*, socklen_t) {
-        try {
-            return crypto::Certificate(o->data).getPublicKey().getId() == crypto::Certificate(n->data).getPublicKey().getId();
-        } catch (const std::exception& e) {}
-        return false;
-    }
-};
+const ValueType CERTIFICATE_TYPE = {8,
+                                    "Certificate",
+                                    std::chrono::hours(24 * 7),
+                                    // A certificate can only be stored at its public key ID.
+                                    [](InfoHash id, Sp<Value>& v, const InfoHash&, const SockAddr&) {
+                                        try {
+                                            crypto::Certificate crt(v->data);
+                                            // TODO check certificate signature
+                                            return crt.getPublicKey().getId() == id
+                                                   || InfoHash::get(crt.getPublicKey().getLongId()) == id;
+                                        } catch (const std::exception& e) {
+                                        }
+                                        return false;
+                                    },
+                                    [](InfoHash, const Sp<Value>& o, Sp<Value>& n, const InfoHash&, const SockAddr&) {
+                                        try {
+                                            return crypto::Certificate(o->data).getPublicKey().getLongId()
+                                                   == crypto::Certificate(n->data).getPublicKey().getLongId();
+                                        } catch (const std::exception& e) {
+                                        }
+                                        return false;
+                                    }};
 
-}
+} // namespace dht

include/opendht/sockaddr.h

@@ -0,0 +1,339 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+
+#include <fmt/core.h>
+#include <fmt/format.h>
+#include <fmt/ostream.h>
+
+#ifndef _WIN32
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#ifdef __ANDROID__
+typedef uint16_t in_port_t;
+#endif
+#else
+#include <iso646.h>
+#include <stdint.h>
+#include <winsock2.h>
+#include <ws2def.h>
+#include <ws2tcpip.h>
+typedef uint16_t sa_family_t;
+typedef uint16_t in_port_t;
+#endif
+
+#include <string>
+#include <memory>
+#include <vector>
+#include <stdexcept>
+#include <stdlib.h>
+
+#include <cstring>
+#include <cstddef>
+
+namespace dht {
+
+OPENDHT_PUBLIC void print_addr(std::ostream& os, const sockaddr* sa, socklen_t slen);
+OPENDHT_PUBLIC std::string print_addr(const sockaddr* sa, socklen_t slen);
+OPENDHT_PUBLIC std::string print_addr(const sockaddr_storage& ss, socklen_t sslen);
+
+/**
+ * A Socket Address (sockaddr*), with abstraction for IPv4, IPv6 address families.
+ */
+class OPENDHT_PUBLIC SockAddr
+{
+public:
+    SockAddr() {}
+    SockAddr(const SockAddr& o) { set(o.get(), o.getLength()); }
+    SockAddr(SockAddr&& o) noexcept
+        : addr(std::move(o.addr))
+        , len(o.len)
+    {
+        o.len = 0;
+    }
+
+    /**
+     * Build from existing address.
+     */
+    SockAddr(const sockaddr* sa, socklen_t length)
+    {
+        if (length > static_cast<socklen_t>(sizeof(sockaddr_storage)))
+            throw std::runtime_error("Socket address length is too large");
+        set(sa, length);
+    }
+    SockAddr(const sockaddr* sa)
+    {
+        socklen_t len = 0;
+        if (sa) {
+            if (sa->sa_family == AF_INET)
+                len = sizeof(sockaddr_in);
+            else if (sa->sa_family == AF_INET6)
+                len = sizeof(sockaddr_in6);
+            else
+                throw std::runtime_error("Unknown address family");
+        }
+        set(sa, len);
+    }
+
+    /**
+     * Build from an existing sockaddr_storage structure.
+     */
+    SockAddr(const sockaddr_storage& ss, socklen_t len)
+        : SockAddr((const sockaddr*) &ss, len)
+    {}
+
+    static std::vector<SockAddr> resolve(const std::string& host, const std::string& service = {});
+
+    bool operator<(const SockAddr& o) const
+    {
+        if (len != o.len)
+            return len < o.len;
+        return std::memcmp((const uint8_t*) get(), (const uint8_t*) o.get(), len) < 0;
+    }
+
+    bool equals(const SockAddr& o) const
+    {
+        return len == o.len && std::memcmp((const uint8_t*) get(), (const uint8_t*) o.get(), len) == 0;
+    }
+    bool operator==(const SockAddr& o) const { return equals(o); }
+    bool operator!=(const SockAddr& o) const { return !equals(o); }
+
+    SockAddr& operator=(const SockAddr& o)
+    {
+        set(o.get(), o.getLength());
+        return *this;
+    }
+    SockAddr& operator=(SockAddr&& o)
+    {
+        len = o.len;
+        o.len = 0;
+        addr = std::move(o.addr);
+        return *this;
+    }
+
+    std::string toString() const { return print_addr(get(), getLength()); }
+
+    /**
+     * Returns the address family or AF_UNSPEC if the address is not set.
+     */
+    sa_family_t getFamily() const { return len ? addr->sa_family : AF_UNSPEC; }
+
+    /**
+     * Resize the managed structure to the appropriate size (if needed),
+     * in which case the sockaddr structure is cleared to zero,
+     * and set the address family field (sa_family).
+     */
+    void setFamily(sa_family_t af)
+    {
+        socklen_t new_length;
+        switch (af) {
+        case AF_INET:
+            new_length = sizeof(sockaddr_in);
+            break;
+        case AF_INET6:
+            new_length = sizeof(sockaddr_in6);
+            break;
+        default:
+            new_length = 0;
+        }
+        if (new_length != len) {
+            len = new_length;
+            if (len)
+                addr.reset((sockaddr*) ::calloc(len, 1));
+            else
+                addr.reset();
+        }
+        if (len)
+            addr->sa_family = af;
+    }
+
+    /**
+     * Set address to any
+     */
+    void setAny()
+    {
+        auto family = getFamily();
+        switch (family) {
+        case AF_INET:
+            getIPv4().sin_addr.s_addr = htonl(INADDR_ANY);
+            break;
+        case AF_INET6:
+            getIPv6().sin6_addr = in6addr_any;
+            break;
+        }
+    }
+
+    /**
+     * Set address to loopback.
+     */
+    void setLoopback()
+    {
+        auto family = getFamily();
+        switch (family) {
+        case AF_INET:
+            getIPv4().sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            break;
+        case AF_INET6:
+            getIPv6().sin6_addr = in6addr_loopback;
+            break;
+        }
+    }
+
+    /**
+     * Retreive the port (in host byte order) or 0 if the address is not
+     * of a supported family.
+     */
+    in_port_t getPort() const
+    {
+        switch (getFamily()) {
+        case AF_INET:
+            return ntohs(getIPv4().sin_port);
+        case AF_INET6:
+            return ntohs(getIPv6().sin6_port);
+        default:
+            return 0;
+        }
+    }
+    /**
+     * Set the port. The address must be of a supported family.
+     * @param p The port in host byte order.
+     */
+    void setPort(in_port_t p)
+    {
+        switch (getFamily()) {
+        case AF_INET:
+            getIPv4().sin_port = htons(p);
+            break;
+        case AF_INET6:
+            getIPv6().sin6_port = htons(p);
+            break;
+        }
+    }
+
+    /**
+     * Set the address part of the socket address from a numeric IP address (string representation).
+     * Family must be already set. Throws in case of parse failue.
+     */
+    void setAddress(const char* address);
+
+    /**
+     * Returns the accessible byte length at the pointer returned by #get().
+     * If zero, #get() returns null.
+     */
+    socklen_t getLength() const { return len; }
+
+    /**
+     * An address is defined to be true if its length is not zero.
+     */
+    explicit operator bool() const noexcept { return len; }
+
+    /**
+     * Returns the address to the managed sockaddr structure.
+     * The accessible length is returned by #getLength().
+     */
+    const sockaddr* get() const { return addr.get(); }
+
+    /**
+     * Returns the address to the managed sockaddr structure.
+     * The accessible length is returned by #getLength().
+     */
+    sockaddr* get() { return addr.get(); }
+
+    inline const sockaddr_in& getIPv4() const { return *reinterpret_cast<const sockaddr_in*>(get()); }
+    inline const sockaddr_in6& getIPv6() const { return *reinterpret_cast<const sockaddr_in6*>(get()); }
+    inline sockaddr_in& getIPv4() { return *reinterpret_cast<sockaddr_in*>(get()); }
+    inline sockaddr_in6& getIPv6() { return *reinterpret_cast<sockaddr_in6*>(get()); }
+
+    /**
+     * Releases the ownership of the managed object, if any.
+     * The caller is responsible for deleting the object with free().
+     */
+    inline sockaddr* release()
+    {
+        len = 0;
+        return addr.release();
+    }
+
+    /**
+     * Return true if address is a loopback IP address.
+     */
+    bool isLoopback() const;
+
+    /**
+     * Return true if address is not a public IP address.
+     */
+    bool isPrivate() const;
+
+    bool isUnspecified() const;
+
+    bool isMappedIPv4() const;
+    SockAddr getMappedIPv4();
+    SockAddr getMappedIPv6();
+
+    /**
+     * A comparator to classify IP addresses, only considering the
+     * first 64 bits in IPv6.
+     */
+    struct ipCmp
+    {
+        bool operator()(const SockAddr& a, const SockAddr& b) const
+        {
+            if (a.len != b.len)
+                return a.len < b.len;
+            socklen_t start, len;
+            switch (a.getFamily()) {
+            case AF_INET:
+                start = offsetof(sockaddr_in, sin_addr);
+                len = sizeof(in_addr);
+                break;
+            case AF_INET6:
+                start = offsetof(sockaddr_in6, sin6_addr);
+                // don't consider more than 64 bits (IPv6)
+                len = 8;
+                break;
+            default:
+                start = 0;
+                len = a.len;
+                break;
+            }
+            return std::memcmp((uint8_t*) a.get() + start, (uint8_t*) b.get() + start, len) < 0;
+        }
+    };
+    friend std::ostream& operator<<(std::ostream& s, const SockAddr& h)
+    {
+        print_addr(s, h.get(), h.getLength());
+        return s;
+    }
+
+private:
+    struct free_delete
+    {
+        void operator()(void* p) { ::free(p); }
+    };
+    std::unique_ptr<sockaddr, free_delete> addr {};
+    socklen_t len {0};
+
+    void set(const sockaddr* sa, socklen_t length)
+    {
+        if (len != length) {
+            len = length;
+            if (len)
+                addr.reset((sockaddr*) ::malloc(len));
+            else
+                addr.reset();
+        }
+        if (len)
+            std::memcpy((uint8_t*) get(), (const uint8_t*) sa, len);
+    }
+};
+
+} // namespace dht
+
+#if FMT_VERSION >= 90000
+template<>
+struct fmt::formatter<dht::SockAddr> : ostream_formatter
+{};
+#endif

include/opendht/thread_pool.h

@@ -0,0 +1,166 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+
+#include <condition_variable>
+#include <vector>
+#include <queue>
+#include <future>
+#include <functional>
+
+#if __cplusplus < 202002L
+#include <ciso646>
+#endif
+
+namespace dht {
+
+class OPENDHT_PUBLIC ThreadPool
+{
+public:
+    static ThreadPool& computation();
+    static ThreadPool& io();
+
+    ThreadPool();
+    ThreadPool(unsigned minThreads, unsigned maxThreads = 0);
+    ~ThreadPool();
+
+    void run(std::function<void()>&& cb);
+
+    template<class T>
+    std::future<T> get(std::function<T()>&& cb)
+    {
+        auto ret = std::make_shared<std::promise<T>>();
+        run([cb = std::move(cb), ret]() mutable {
+            try {
+                ret->set_value(cb());
+            } catch (...) {
+                try {
+                    ret->set_exception(std::current_exception());
+                } catch (...) {
+                }
+            }
+        });
+        return ret->get_future();
+    }
+    template<class T>
+    std::shared_future<T> getShared(std::function<T()>&& cb)
+    {
+        return get(std::move(cb));
+    }
+
+    void stop(bool wait = true);
+    void join();
+    void detach();
+
+private:
+    std::mutex lock_;
+    std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
+    std::queue<std::function<void()>> tasks_ {};
+    std::vector<std::unique_ptr<std::thread>> threads_;
+    unsigned readyThreads_ {0};
+    bool running_ {true};
+    bool stopping_ {false};
+
+    unsigned minThreads_;
+    const unsigned maxThreads_;
+    std::chrono::steady_clock::duration threadExpirationDelay {std::chrono::minutes(5)};
+    double threadDelayRatio_ {2};
+
+    void threadEnded(std::thread&);
+};
+
+class OPENDHT_PUBLIC Executor : public std::enable_shared_from_this<Executor>
+{
+public:
+    Executor(ThreadPool& pool, unsigned maxConcurrent = 1)
+        : threadPool_(pool)
+        , maxConcurrent_(maxConcurrent)
+    {}
+
+    void run(std::function<void()>&& task);
+
+private:
+    std::reference_wrapper<ThreadPool> threadPool_;
+    const unsigned maxConcurrent_ {1};
+    std::mutex lock_;
+    unsigned current_ {0};
+    std::queue<std::function<void()>> tasks_ {};
+
+    void run_(std::function<void()>&& task);
+    void schedule();
+};
+
+class OPENDHT_PUBLIC ExecutionContext
+{
+public:
+    ExecutionContext(ThreadPool& pool)
+        : threadPool_(pool)
+        , state_(std::make_shared<SharedState>())
+    {}
+
+    ~ExecutionContext() { state_->destroy(); }
+
+    /** Wait for ongoing tasks to complete execution and drop other pending tasks */
+    void stop() { state_->destroy(false); }
+
+    void run(std::function<void()>&& task)
+    {
+        std::lock_guard lock(state_->mtx);
+        if (state_->shutdown_)
+            return;
+        state_->pendingTasks++;
+        threadPool_.get().run([task = std::move(task), state = state_] { state->run(task); });
+    }
+
+private:
+    struct SharedState
+    {
+        std::mutex mtx;
+        std::condition_variable cv {};
+        unsigned pendingTasks {0};
+        unsigned ongoingTasks {0};
+        /** When true, prevents new tasks to be scheduled */
+        bool shutdown_ {false};
+        /** When true, prevents scheduled tasks to be executed */
+        std::atomic_bool destroyed {false};
+
+        void destroy(bool wait = true)
+        {
+            std::unique_lock lock(mtx);
+            if (destroyed)
+                return;
+            if (wait) {
+                cv.wait(lock, [this] { return pendingTasks == 0 && ongoingTasks == 0; });
+            }
+            shutdown_ = true;
+            if (not wait) {
+                cv.wait(lock, [this] { return ongoingTasks == 0; });
+            }
+            destroyed = true;
+        }
+
+        void run(const std::function<void()>& task)
+        {
+            {
+                std::lock_guard lock(mtx);
+                pendingTasks--;
+                ongoingTasks++;
+            }
+            if (destroyed)
+                return;
+            task();
+            {
+                std::lock_guard lock(mtx);
+                ongoingTasks--;
+                cv.notify_all();
+            }
+        }
+    };
+    std::reference_wrapper<ThreadPool> threadPool_;
+    std::shared_ptr<SharedState> state_;
+};
+
+} // namespace dht

include/opendht/utils.h

@@ -0,0 +1,210 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "def.h"
+
+#include <type_traits>
+#include <msgpack.hpp>
+#include <fmt/format.h>
+
+#include <chrono>
+#include <random>
+#include <functional>
+#include <map>
+#include <string_view>
+
+#include <cstdarg>
+
+#define WANT4 1
+#define WANT6 2
+
+/**
+ * OpenDHT C++ namespace
+ */
+namespace dht {
+
+using NetId = uint32_t;
+using want_t = int_fast8_t;
+
+OPENDHT_PUBLIC const char* version();
+
+// shortcut for std::shared_ptr
+template<class T>
+using Sp = std::shared_ptr<T>;
+
+template<typename Key, typename Item, typename Condition>
+void
+erase_if(std::map<Key, Item>& map, const Condition& condition)
+{
+    for (auto it = map.begin(); it != map.end();) {
+        if (condition(*it)) {
+            it = map.erase(it);
+        } else {
+            ++it;
+        }
+    }
+}
+
+template<typename... Args>
+std::string
+concat(Args&&... args)
+{
+    static_assert((std::is_constructible_v<std::string_view, Args&&> && ...));
+    std::string s;
+    s.reserve((std::string_view {args}.size() + ...));
+    (s.append(std::forward<Args>(args)), ...);
+    return s;
+}
+
+/**
+ * Split "[host]:port" or "host:port" to pair<"host", "port">.
+ */
+OPENDHT_PUBLIC std::pair<std::string_view, std::string_view> splitPort(std::string_view s);
+
+class OPENDHT_PUBLIC DhtException : public std::runtime_error
+{
+public:
+    DhtException(const std::string& str = "")
+        : std::runtime_error("DhtException occurred: " + str)
+    {}
+};
+
+class OPENDHT_PUBLIC SocketException : public DhtException
+{
+public:
+    SocketException(int err)
+        : DhtException(strerror(err))
+    {}
+};
+
+// Time related definitions and utility functions
+
+using clock = std::chrono::steady_clock;
+using system_clock = std::chrono::system_clock;
+using time_point = clock::time_point;
+using duration = clock::duration;
+
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t,
+                                           time_point steady_now,
+                                           system_clock::time_point system_now);
+OPENDHT_PUBLIC time_point from_system_time(system_clock::time_point t);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t,
+                                                       time_point steady_now,
+                                                       system_clock::time_point system_now);
+OPENDHT_PUBLIC system_clock::time_point to_system_time(time_point t);
+OPENDHT_PUBLIC time_point from_time_t(std::time_t t);
+OPENDHT_PUBLIC std::time_t to_time_t(time_point t);
+
+template<class DT>
+static std::string
+print_duration(DT d)
+{
+    if (d < std::chrono::seconds(0)) {
+        return "-" + print_duration(-d);
+    } else if (d < std::chrono::milliseconds(1)) {
+        return fmt::format("{:.3g} us",
+                           std::chrono::duration_cast<std::chrono::duration<double, std::micro>>(d).count());
+    } else if (d < std::chrono::seconds(1)) {
+        return fmt::format("{:.3g} ms",
+                           std::chrono::duration_cast<std::chrono::duration<double, std::milli>>(d).count());
+    } else if (d < std::chrono::minutes(1)) {
+        return fmt::format("{:.3g} s", std::chrono::duration_cast<std::chrono::duration<double>>(d).count());
+    } else if (d < std::chrono::hours(1)) {
+        return fmt::format("{:.3g} min",
+                           std::chrono::duration_cast<std::chrono::duration<double, std::ratio<60>>>(d).count());
+    } else if (d < std::chrono::hours(72)) {
+        return fmt::format("{:.3g} h",
+                           std::chrono::duration_cast<std::chrono::duration<double, std::ratio<3600>>>(d).count());
+    } else {
+        return fmt::format("{:.3g} days",
+                           std::chrono::duration_cast<std::chrono::duration<double, std::ratio<86400>>>(d).count());
+    }
+}
+
+template<class TimePoint>
+static std::string
+print_time_relative(TimePoint now, TimePoint d)
+{
+    using namespace std::literals;
+    if (d == TimePoint::min())
+        return "never"s;
+    if (d == now)
+        return "now"s;
+    return (d > now) ? concat("in "sv, print_duration(d - now)) : concat(print_duration(now - d), " ago"sv);
+}
+
+OPENDHT_PUBLIC std::string printByteCount(size_t bytes);
+
+template<typename Duration = duration>
+class uniform_duration_distribution : public std::uniform_int_distribution<typename Duration::rep>
+{
+    using Base = std::uniform_int_distribution<typename Duration::rep>;
+    using param_type = typename Base::param_type;
+
+public:
+    uniform_duration_distribution(Duration min, Duration max)
+        : Base(min.count(), max.count())
+    {}
+    template<class Generator>
+    Duration operator()(Generator&& g)
+    {
+        return Duration(Base::operator()(g));
+    }
+    template<class Generator>
+    Duration operator()(Generator&& g, const param_type& params)
+    {
+        return Duration(Base::operator()(g, params));
+    }
+};
+
+// Serialization related definitions and utility functions
+
+/**
+ * Arbitrary binary data.
+ */
+using Blob = std::vector<uint8_t>;
+
+/**
+ * Provides backward compatibility with msgpack 1.0
+ */
+OPENDHT_PUBLIC Blob unpackBlob(const msgpack::object& o);
+
+template<typename Type>
+Blob
+packMsg(const Type& t)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack(t);
+    return {buffer.data(), buffer.data() + buffer.size()};
+}
+
+template<typename Type>
+Type
+unpackMsg(const Blob& b)
+{
+    msgpack::unpacked msg_res = msgpack::unpack((const char*) b.data(), b.size());
+    return msg_res.get().as<Type>();
+}
+
+inline msgpack::unpacked
+unpackMsg(const Blob& b)
+{
+    return msgpack::unpack((const char*) b.data(), b.size());
+}
+
+OPENDHT_PUBLIC msgpack::object* findMapValue(const msgpack::object& map, const char* key, size_t length);
+
+inline msgpack::object*
+findMapValue(const msgpack::object& map, const char* key)
+{
+    return findMapValue(map, key, strlen(key));
+}
+inline msgpack::object*
+findMapValue(const msgpack::object& map, std::string_view key)
+{
+    return findMapValue(map, key.data(), key.size());
+}
+
+} // namespace dht

m4/ax_cxx_compile_stdcxx_11.m4

@@ -1,135 +0,0 @@
-# ============================================================================
-#  http://www.gnu.org/software/autoconf-archive/ax_cxx_compile_stdcxx_11.html
-# ============================================================================
-#
-# SYNOPSIS
-#
-#   AX_CXX_COMPILE_STDCXX_11([ext|noext],[mandatory|optional])
-#
-# DESCRIPTION
-#
-#   Check for baseline language coverage in the compiler for the C++11
-#   standard; if necessary, add switches to CXXFLAGS to enable support.
-#
-#   The first argument, if specified, indicates whether you insist on an
-#   extended mode (e.g. -std=gnu++11) or a strict conformance mode (e.g.
-#   -std=c++11).  If neither is specified, you get whatever works, with
-#   preference for an extended mode.
-#
-#   The second argument, if specified 'mandatory' or if left unspecified,
-#   indicates that baseline C++11 support is required and that the macro
-#   should error out if no mode with that support is found.  If specified
-#   'optional', then configuration proceeds regardless, after defining
-#   HAVE_CXX11 if and only if a supporting mode is found.
-#
-# LICENSE
-#
-#   Copyright (c) 2008 Benjamin Kosnik <bkoz@redhat.com>
-#   Copyright (c) 2012 Zack Weinberg <zackw@panix.com>
-#   Copyright (c) 2013 Roy Stogner <roystgnr@ices.utexas.edu>
-#   Copyright (c) 2014 Alexey Sokolov <sokolov@google.com>
-#
-#   Copying and distribution of this file, with or without modification, are
-#   permitted in any medium without royalty provided the copyright notice
-#   and this notice are preserved. This file is offered as-is, without any
-#   warranty.
-
-#serial 4
-
-m4_define([_AX_CXX_COMPILE_STDCXX_11_testbody], [[
-  template <typename T>
-    struct check
-    {
-      static_assert(sizeof(int) <= sizeof(T), "not big enough");
-    };
-
-    typedef check<check<bool>> right_angle_brackets;
-
-    int a;
-    decltype(a) b;
-
-    typedef check<int> check_type;
-    check_type c;
-    check_type&& cr = static_cast<check_type&&>(c);
-
-    auto d = a;
-    auto l = [](){};
-]])
-
-AC_DEFUN([AX_CXX_COMPILE_STDCXX_11], [dnl
-  m4_if([$1], [], [],
-        [$1], [ext], [],
-        [$1], [noext], [],
-        [m4_fatal([invalid argument `$1' to AX_CXX_COMPILE_STDCXX_11])])dnl
-  m4_if([$2], [], [ax_cxx_compile_cxx11_required=true],
-        [$2], [mandatory], [ax_cxx_compile_cxx11_required=true],
-        [$2], [optional], [ax_cxx_compile_cxx11_required=false],
-        [m4_fatal([invalid second argument `$2' to AX_CXX_COMPILE_STDCXX_11])])
-  AC_LANG_PUSH([C++])dnl
-  ac_success=no
-  AC_CACHE_CHECK(whether $CXX supports C++11 features by default,
-  ax_cv_cxx_compile_cxx11,
-  [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_AX_CXX_COMPILE_STDCXX_11_testbody])],
-    [ax_cv_cxx_compile_cxx11=yes],
-    [ax_cv_cxx_compile_cxx11=no])])
-  if test x$ax_cv_cxx_compile_cxx11 = xyes; then
-    ac_success=yes
-  fi
-
-  m4_if([$1], [noext], [], [dnl
-  if test x$ac_success = xno; then
-    for switch in -std=gnu++11 -std=gnu++0x; do
-      cachevar=AS_TR_SH([ax_cv_cxx_compile_cxx11_$switch])
-      AC_CACHE_CHECK(whether $CXX supports C++11 features with $switch,
-                     $cachevar,
-        [ac_save_CXXFLAGS="$CXXFLAGS"
-         CXXFLAGS="$CXXFLAGS $switch"
-         AC_COMPILE_IFELSE([AC_LANG_SOURCE([_AX_CXX_COMPILE_STDCXX_11_testbody])],
-          [eval $cachevar=yes],
-          [eval $cachevar=no])
-         CXXFLAGS="$ac_save_CXXFLAGS"])
-      if eval test x\$$cachevar = xyes; then
-        CXXFLAGS="$CXXFLAGS $switch"
-        ac_success=yes
-        break
-      fi
-    done
-  fi])
-
-  m4_if([$1], [ext], [], [dnl
-  if test x$ac_success = xno; then
-    for switch in -std=c++11 -std=c++0x; do
-      cachevar=AS_TR_SH([ax_cv_cxx_compile_cxx11_$switch])
-      AC_CACHE_CHECK(whether $CXX supports C++11 features with $switch,
-                     $cachevar,
-        [ac_save_CXXFLAGS="$CXXFLAGS"
-         CXXFLAGS="$CXXFLAGS $switch"
-         AC_COMPILE_IFELSE([AC_LANG_SOURCE([_AX_CXX_COMPILE_STDCXX_11_testbody])],
-          [eval $cachevar=yes],
-          [eval $cachevar=no])
-         CXXFLAGS="$ac_save_CXXFLAGS"])
-      if eval test x\$$cachevar = xyes; then
-        CXXFLAGS="$CXXFLAGS $switch"
-        ac_success=yes
-        break
-      fi
-    done
-  fi])
-  AC_LANG_POP([C++])
-  if test x$ax_cxx_compile_cxx11_required = xtrue; then
-    if test x$ac_success = xno; then
-      AC_MSG_ERROR([*** A compiler with support for C++11 language features is required.])
-    fi
-  else
-    if test x$ac_success = xno; then
-      HAVE_CXX11=0
-      AC_MSG_NOTICE([No compiler with C++11 support was found])
-    else
-      HAVE_CXX11=1
-      AC_DEFINE(HAVE_CXX11,1,
-                [define if the compiler supports basic C++11 syntax])
-    fi
-
-    AC_SUBST(HAVE_CXX11)
-  fi
-])

meson.build

@@ -0,0 +1,398 @@
+project(
+    'opendht',
+    'c',
+    'cpp',
+    'cython',
+    license: 'MIT',
+    license_files: 'LICENSE',
+    version: '4.5.0-rc.1',
+    meson_version: '>=1.1.0',
+    default_options: ['cpp_std=c++20', 'warning_level=3'],
+)
+
+gnutls = dependency('gnutls')
+nettle = dependency('nettle')
+msgpack = dependency('msgpack-cxx', required: false)
+argon2 = dependency('libargon2')
+fmt = dependency('fmt')
+
+proxy_enabled = get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
+
+openssl = dependency('openssl', required: proxy_enabled)
+jsoncpp = dependency('jsoncpp', required: proxy_enabled)
+llhttp = dependency('llhttp', 'libllhttp', required: proxy_enabled)
+simdutf = dependency('simdutf', required: proxy_enabled)
+
+# restinio is a header-only library that may not ship a pkg-config file
+restinio_dep = dependency('restinio', required: false)
+if not restinio_dep.found()
+    cpp = meson.get_compiler('cpp')
+    if cpp.has_header('restinio/all.hpp', required: proxy_enabled)
+        restinio_dep = declare_dependency()
+    endif
+endif
+
+io_uring = host_machine.system() == 'linux' ? dependency('liburing', required: false) : disabler()
+
+deps = [
+    fmt,
+    gnutls,
+    nettle,
+    msgpack,
+    argon2,
+    openssl,
+    jsoncpp,
+    simdutf,
+    llhttp,
+]
+
+if restinio_dep.found()
+    deps += restinio_dep
+endif
+
+if host_machine.system() == 'linux' and io_uring.found()
+    deps += io_uring
+endif
+conf_data = configuration_data()
+
+add_project_arguments(
+    '-DMSGPACK_NO_BOOST',
+    '-DASIO_STANDALONE',
+    '-DPACKAGE_VERSION="' + meson.project_version() + '"',
+    language: 'cpp',
+)
+if io_uring.found()
+    add_project_arguments('-DASIO_HAS_IO_URING', '-DASIO_DISABLE_EPOLL', language: 'cpp')
+    conf_data.set('iouring_lib', ', liburing')
+endif
+add_project_arguments(
+    [
+        '-Wno-return-type',
+        '-Wno-deprecated',
+        '-Wnon-virtual-dtor',
+        '-pedantic-errors',
+        '-fvisibility=hidden',
+    ],
+    language: 'cpp',
+)
+
+opendht_inc = include_directories('include/opendht')
+opendht_interface_inc = include_directories('include', is_system: true)
+opendht_src = [
+    'src/utils.cpp',
+    'src/crypto.cpp',
+    'src/default_types.cpp',
+    'src/node.cpp',
+    'src/value.cpp',
+    'src/dht.cpp',
+    'src/callbacks.cpp',
+    'src/routing_table.cpp',
+    'src/node_cache.cpp',
+    'src/network_engine.cpp',
+    'src/securedht.cpp',
+    'src/dhtrunner.cpp',
+    'src/log.cpp',
+    'src/op_cache.cpp',
+    'src/network_utils.cpp',
+    'src/thread_pool.cpp',
+]
+
+if get_option('indexation').enabled()
+    opendht_src += 'src/indexation/pht.cpp'
+    add_project_arguments('-DOPENDHT_INDEXATION', language: 'cpp')
+endif
+if jsoncpp.found() and simdutf.found()
+    opendht_src += ['src/base64.cpp']
+    add_project_arguments('-DOPENDHT_JSONCPP', language: 'cpp')
+    conf_data.set('jsoncpp_lib', ', jsoncpp')
+endif
+if llhttp.found()
+    opendht_src += ['src/http.cpp', 'src/compat/os_cert.cpp']
+    if host_machine.system() == 'darwin'
+        deps += dependency('appleframeworks', modules: ['CoreFoundation', 'Security'])
+    endif
+    conf_data.set('http_lib', '-lllhttp')
+endif
+if openssl.found()
+    conf_data.set('openssl_lib', ', openssl')
+endif
+if get_option('proxy_client').enabled()
+    opendht_src += ['src/dht_proxy_client.cpp']
+    add_project_arguments('-DOPENDHT_PROXY_CLIENT', language: 'cpp')
+endif
+if get_option('proxy_server').enabled()
+    opendht_src += 'src/dht_proxy_server.cpp'
+    add_project_arguments('-DOPENDHT_PROXY_SERVER', language: 'cpp')
+endif
+if get_option('push_notifications').enabled()
+    add_project_arguments('-DOPENDHT_PUSH_NOTIFICATIONS', language: 'cpp')
+endif
+if get_option('peer_discovery').enabled()
+    opendht_src += 'src/peer_discovery.cpp'
+    add_project_arguments('-DOPENDHT_PEER_DISCOVERY', language: 'cpp')
+endif
+opendht = library(
+    'opendht',
+    opendht_src,
+    include_directories: opendht_inc,
+    dependencies: deps,
+    cpp_args: ['-DOPENDHT_BUILD', '-Dopendht_EXPORTS'],
+    install: true,
+)
+
+opendht_dep_args = []
+if get_option('default_library') != 'static'
+    opendht_dep_args += '-Dopendht_EXPORTS'
+endif
+
+opendht_dep = declare_dependency(
+    link_with: opendht,
+    include_directories: opendht_interface_inc,
+    compile_args: opendht_dep_args,
+)
+
+# Install library headers.
+install_subdir('include', install_dir: get_option('includedir'), strip_directory: true)
+
+conf_data.set('VERSION', meson.project_version())
+conf_data.set('prefix', get_option('prefix'))
+conf_data.set('exec_prefix', get_option('prefix'))
+conf_data.set('libdir', join_paths(get_option('prefix'), get_option('libdir')))
+conf_data.set('includedir', join_paths(get_option('prefix'), get_option('includedir')))
+conf_data.set('argon2_lib', ', libargon2')
+conf_data.set('simdutf_lib', ', simdutf')
+conf_data.set('opendht_public_cflags', '')
+conf_data.set('opendht_c_public_cflags', '')
+
+if get_option('default_library') != 'static'
+    conf_data.set('opendht_public_cflags', ' -Dopendht_EXPORTS')
+    conf_data.set('opendht_c_public_cflags', ' -Dopendht_c_EXPORTS')
+endif
+
+configure_file(
+    input: 'opendht.pc.in',
+    output: 'opendht.pc',
+    configuration: conf_data,
+    install: true,
+    install_dir: join_paths(get_option('prefix'), get_option('libdir'), 'pkgconfig'),
+)
+
+readline = meson.get_compiler('c').find_library('readline', required: get_option('tools'))
+
+if get_option('c').enabled()
+    opendht_c = library(
+        'opendht-c',
+        ['c/opendht.cpp', 'c/opendht_c.h'],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt],
+        cpp_args: ['-DOPENDHT_C_BUILD', '-Dopendht_c_EXPORTS'],
+        install: true,
+    )
+
+    install_headers('c/opendht_c.h', subdir: 'opendht')
+
+    configure_file(
+        input: 'opendht-c.pc.in',
+        output: 'opendht-c.pc',
+        configuration: conf_data,
+        install: true,
+        install_dir: join_paths(get_option('prefix'), get_option('libdir'), 'pkgconfig'),
+    )
+
+    if get_option('tools').enabled()
+        dhtcnode = executable(
+            'dhtcnode',
+            'tools/dhtcnode.c',
+            include_directories: ['c', opendht_interface_inc],
+            link_with: opendht_c,
+            dependencies: [readline],
+            install: true,
+        )
+    endif
+endif
+
+if get_option('python').require(
+    get_option('indexation').enabled(),
+    error_message: 'python requires indexation',
+).allowed()
+    py = import('python').find_installation(pure: false)
+    dep_py = py.dependency()
+    py.extension_module(
+        '_core',
+        'python/opendht.pyx',
+        subdir: 'opendht',
+        cython_args: ['--module-name', 'opendht._core'],
+        override_options: ['cython_language=cpp'],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt, dep_py],
+        install: true,
+    )
+    py.install_sources(
+        'python/opendht/__init__.py',
+        'python/opendht/aio.py',
+        subdir: 'opendht',
+    )
+endif
+
+if get_option('tools').enabled()
+    dhtnode = executable(
+        'dhtnode',
+        'tools/dhtnode.cpp',
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
+        install: true,
+    )
+    dhtchat = executable(
+        'dhtchat',
+        'tools/dhtchat.cpp',
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
+        install: true,
+    )
+    dhtscanner = executable(
+        'dhtscanner',
+        'tools/dhtscanner.cpp',
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
+        install: true,
+    )
+    if llhttp.found()
+        durl_deps = [msgpack, openssl]
+
+        if io_uring.found()
+            durl_deps += io_uring
+        endif
+
+        durl = executable(
+            'durl',
+            'tools/durl.cpp',
+            dependencies: [opendht_dep] + durl_deps,
+        )
+    endif
+endif
+
+# Unit tests
+if get_option('tests').enabled()
+    if get_option('c').enabled()
+        test_c = executable(
+            'test_c',
+            'tests/test_c.c',
+            include_directories: ['c', opendht_interface_inc],
+            dependencies: [gnutls],
+            link_with: opendht_c,
+        )
+        test('CBindings', test_c)
+    endif
+    cppunit = dependency('cppunit')
+
+    test_infohash = executable(
+        'test_infohash',
+        'tests/test_infohash.cpp',
+        'tests/tests_runner.cpp',
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('Infohash', test_infohash)
+
+    test_value = executable(
+        'test_value',
+        'tests/test_value.cpp',
+        'tests/tests_runner.cpp',
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('Value', test_value)
+
+    test_parsedmessage = executable(
+        'test_parsedmessage',
+        'tests/test_parsedmessage.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ParsedMessage', test_parsedmessage)
+
+    test_networkengine = executable(
+        'test_networkengine',
+        'tests/test_networkengine.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('NetworkEngine', test_networkengine)
+
+    test_opcache = executable(
+        'test_opcache',
+        'tests/test_opcache.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('OpCache', test_opcache)
+
+    test_valuecache = executable(
+        'test_valuecache',
+        'tests/test_valuecache.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ValueCache', test_valuecache)
+
+    test_crypto = executable(
+        'test_crypto',
+        'tests/test_crypto.cpp',
+        'tests/tests_runner.cpp',
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack, gnutls],
+    )
+    test('Crypto', test_crypto, timeout: 60)
+
+    test_dhtrunner = executable(
+        'test_dhtrunner',
+        'tests/test_dhtrunner.cpp',
+        'tests/tests_runner.cpp',
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('DhtRunner', test_dhtrunner, timeout: 60)
+
+    test_threadpool = executable(
+        'test_threadpool',
+        'tests/test_threadpool.cpp',
+        'tests/tests_runner.cpp',
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ThreadPool', test_threadpool)
+
+    if get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
+        test_http = executable(
+            'test_http',
+            'tests/test_http.cpp',
+            'tests/tests_runner.cpp',
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+        )
+        test('Http', test_http)
+    endif
+
+    if get_option('peer_discovery').enabled()
+        test_peerdiscovery = executable(
+            'test_peerdiscovery',
+            'tests/test_peerdiscovery.cpp',
+            'tests/tests_runner.cpp',
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+        )
+        test('PeerDiscovery', test_peerdiscovery)
+    endif
+
+    if get_option('proxy_server').enabled()
+        test_proxy = executable(
+            'test_dhtproxy',
+            'tests/test_dhtproxy.cpp',
+            'tests/tests_runner.cpp',
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+        )
+        test('DhtProxy', test_proxy)
+
+        if get_option('long_tests').enabled()
+            test_proxystress = executable(
+                'test_dhtproxystress',
+                'tests/dhtproxy_stress_tester.cpp',
+                'tests/tests_runner.cpp',
+                dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+            )
+            test('DhtProxy Stress', test_proxystress)
+        endif
+    endif
+endif

meson.options

@@ -0,0 +1,10 @@
+option('proxy_client', type : 'feature', value : 'disabled')
+option('proxy_server', type : 'feature', value : 'disabled')
+option('push_notifications', type : 'feature', value : 'disabled')
+option('peer_discovery', type : 'feature', value : 'enabled')
+option('tools', type : 'feature', value : 'enabled')
+option('c', type : 'feature', value : 'enabled')
+option('indexation', type : 'feature', value : 'enabled')
+option('python', type : 'feature', value : 'enabled')
+option('tests', type : 'feature', value : 'enabled')
+option('long_tests', type : 'feature', value : 'disabled')

nodejs/.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+build*/
+prebuilds/
+dist/
+examples/dhtnode.js

nodejs/CMakeLists.txt

@@ -0,0 +1,64 @@
+cmake_minimum_required(VERSION 3.21)
+project(opendht_node LANGUAGES C CXX)
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+set(OPENDHT_TOOLS OFF CACHE BOOL "Build DHT tools")
+set(OPENDHT_PYTHON OFF CACHE BOOL "Build Python bindings")
+set(OPENDHT_PROXY_CLIENT ON CACHE BOOL "Enable DHT proxy client")
+set(OPENDHT_PEER_DISCOVERY OFF CACHE BOOL "Enable multicast peer discovery")
+set(OPENDHT_DOCUMENTATION OFF CACHE BOOL "Build documentation")
+set(BUILD_TESTING OFF CACHE BOOL "Build native tests")
+add_subdirectory(.. native EXCLUDE_FROM_ALL)
+
+find_program(NODE_EXECUTABLE node REQUIRED)
+execute_process(
+    COMMAND "${NODE_EXECUTABLE}" --input-type=module -e "import addon from 'node-addon-api'; process.stdout.write(addon.include_dir)"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    OUTPUT_VARIABLE NODE_ADDON_API_DIR
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+    COMMAND_ERROR_IS_FATAL ANY
+)
+
+add_library(opendht_node MODULE addon.cpp crypto.cpp ${CMAKE_JS_SRC})
+target_compile_definitions(opendht_node PRIVATE NAPI_VERSION=8 NAPI_CPP_EXCEPTIONS)
+target_include_directories(opendht_node PRIVATE
+    ${CMAKE_JS_INC}
+    "${CMAKE_CURRENT_SOURCE_DIR}/${NODE_ADDON_API_DIR}"
+    "${CMAKE_CURRENT_SOURCE_DIR}/../include"
+    "${CMAKE_CURRENT_BINARY_DIR}/native/include"
+)
+target_link_libraries(opendht_node PRIVATE opendht ${CMAKE_JS_LIB})
+if(OPENDHT_SANITIZE AND CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
+    target_compile_options(opendht_node PRIVATE -fsanitize=address -fstack-protector-strong)
+    target_link_options(opendht_node PRIVATE -fsanitize=address)
+endif()
+set_target_properties(opendht_node PROPERTIES
+    PREFIX ""
+    SUFFIX ".node"
+    OUTPUT_NAME "opendht"
+    LIBRARY_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/$<CONFIG>"
+    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/$<CONFIG>"
+)
+if(APPLE)
+    target_link_options(opendht_node PRIVATE "-undefined" "dynamic_lookup")
+endif()
+if(WIN32)
+    add_custom_command(TARGET opendht_node POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E copy_if_different
+            $<TARGET_RUNTIME_DLLS:opendht_node> $<TARGET_FILE_DIR:opendht_node>
+        COMMAND_EXPAND_LISTS
+    )
+endif()
+if(MSVC)
+    target_compile_options(opendht_node PRIVATE /EHsc)
+    target_include_directories(opendht_node PRIVATE
+        "${CMAKE_CURRENT_SOURCE_DIR}/../src/compat/msvc"
+        "${CMAKE_CURRENT_SOURCE_DIR}/../src/compat/win32"
+    )
+    if(CMAKE_JS_NODELIB_DEF AND CMAKE_JS_NODELIB_TARGET)
+        execute_process(COMMAND ${CMAKE_AR} /def:${CMAKE_JS_NODELIB_DEF}
+            /out:${CMAKE_JS_NODELIB_TARGET} ${CMAKE_STATIC_LINKER_FLAGS})
+    endif()
+endif()

nodejs/README.md

@@ -0,0 +1,243 @@
+# OpenDHT Node.js Bindings
+
+Initial Node-API bindings using `node-addon-api` directly over the C++ library.
+Node.js 22.9 or later is required; the addon targets Node-API version 8.
+
+## Install
+
+```sh
+npm install opendht
+```
+
+## Build
+
+Install the native dependencies described in [BUILD.md](../BUILD.md), plus Node.js,
+a C++17 compiler, and CMake 3.21 or later. Ninja is optional. Proxy-client support
+defaults to enabled and requires ASIO, llhttp, RESTinio, and expected-lite headers.
+
+```sh
+cd nodejs
+npm ci
+npm run build
+npm test
+npm run typecheck
+```
+
+CMake.js builds OpenDHT from the parent source directory in `nodejs/build/native`.
+It does not change the repository's existing build directory. Tools, Python,
+peer discovery, documentation, and native tests default to disabled in this build.
+Native CMake options can be passed through, for example:
+
+```sh
+npm run build -- --CDOPENDHT_PEER_DISCOVERY=ON
+```
+
+For an existing build, change cached options directly with CMake, for example
+`cmake -S . -B build -DOPENDHT_PROXY_CLIENT=ON`, then rebuild. A custom build can
+disable proxy support with `-DOPENDHT_PROXY_CLIENT=OFF`; requesting a proxy then
+throws an explicit unsupported-build error.
+
+The loader checks local builds, then compatible Node-API binaries under `prebuilds/`.
+Set `OPENDHT_NODE_BINDING` to an absolute addon path to select an explicit build.
+Packaged binaries include OpenDHT and non-system native dependencies, so archive
+installation does not require a compiler or a system OpenDHT installation.
+
+## Usage
+
+```js
+import { DhtRunner, hash } from 'opendht';
+
+async function main() {
+    const writer = new DhtRunner();
+    const reader = new DhtRunner();
+    try {
+        writer.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        reader.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        const key = hash('example');
+        const stored = await writer.put(key, Buffer.from('hello'), { id: 42n });
+        if (!stored) throw new Error('DHT put failed');
+        for await (const value of reader.get(key)) {
+            console.log(value.id, value.data.toString());
+        }
+    } finally {
+        await Promise.all([writer.close(), reader.close()]);
+    }
+}
+
+main().catch(console.error);
+```
+
+## API
+
+- `hash(string | Uint8Array)` returns a SHA-1 hash as a 40-character hex string.
+  All get/put/listen keys must be hex hashes, not unhashed application keys.
+- `version` is the underlying OpenDHT version.
+- `run({port, ipv4, ipv6, network, persistPath, identity})` starts a threaded node. Port 0
+  selects a free port. The defaults bind both IP families on all interfaces.
+  `persistPath` is optional; use an empty string to disable persistence.
+  `proxyServer` and `proxyUserAgent` configure proxy mode (see below).
+- `getBoundPort(4 | 6)` defaults to IPv4; `getNodeId()` returns the node's hex ID.
+- `getStatus()` returns the latest JS-dispatched `{ipv4, ipv6}` connectivity
+  snapshot. Each family is `'disconnected'`, `'connecting'`, or `'connected'`.
+  `runner.on('statusChanged', status => {})` receives changes on the JS thread.
+  New and closing/closed runners report both families as disconnected. No status
+  events are delivered after close begins; close does not emit a final event.
+- `bootstrap(host, port)` queues bootstrap discovery. Returning does not mean the
+  peer is connected; subsequent DHT operations report their own completion.
+- `put(key, Uint8Array, {id, type, userType, permanent})` copies the input and
+  resolves to the native success boolean. IDs are unsigned 64-bit `bigint` values.
+- `get(key)` returns an async iterator of values as they arrive. The iterator
+  ends when the lookup completes, or rejects with `ERR_DHT_GET_FAILED` on failure.
+  `getAll(key)` returns a single promise resolving to the complete value array.
+  Values contain `id`, `type`, `seq`, `userType`, copied `Buffer` data, `isSigned`,
+  `isEncrypted`, and an `owner` long fingerprint (or null for unsigned values).
+- `listen(key, (value, expired) => {})` returns a listener with idempotent
+  `cancel()`. Queued deliveries are suppressed after cancellation. Callback
+  return values are ignored; callbacks may cancel or close the runner.
+- `listen(key)` without a callback returns an async iterator of `{value, expired}`
+  events. It continues until cancelled or the runner closes.
+- `close()` is idempotent and returns the same promise on repeated calls. It
+  waits off the JS thread for graceful shutdown, then joins the native threads.
+  After two seconds it forces the join if graceful shutdown has not completed.
+  Pending operations reject with `ERR_DHT_CLOSED`. A closed runner cannot restart.
+- `ref()` and `unref()` control whether the runner keeps Node's event loop alive.
+  Running nodes are referenced by default. `Symbol.asyncDispose` calls `close()`.
+
+Callbacks run only on their owning JS thread. There is no polling timer or worker
+thread waiting on each get/put. Explicitly close runners; GC cleanup and Node
+environment cleanup hooks are fallbacks, including forced worker termination.
+Pending operations, active listeners, and registered status handlers keep their
+runner alive until completion, cancellation, handler removal, or explicit close.
+Graceful persistence cannot be guaranteed if the process is killed.
+
+The binding does not cap the callback queue, accumulated `getAll()` results, or
+iterator buffers. Slow iterator consumers can accumulate values without
+backpressure. Queued callbacks retain their native values until delivery or cleanup.
+
+## Async Iteration
+
+`get()` and callback-free `listen()` start immediately and return iterators with
+`next()`, `return()`, `throw()`, `cancel()`, and `Symbol.asyncDispose`.
+Leaving a `for await` loop with `break` or an exception cancels the subscription.
+Explicit cancellation discards buffered values and settles pending reads as done.
+Closing the runner rejects active get iterators with `ERR_DHT_CLOSED`; listener
+iterators end normally. Successful get completion preserves unread buffered values.
+
+```js
+for await (const value of runner.get(hash('example'))) {
+  console.log(value.id, value.data);
+}
+const snapshots = await runner.getAll(hash('example'));
+
+for await (const { value, expired } of runner.listen(hash('updates'))) {
+  console.log(value.id, expired);
+  if (expired) break;
+}
+```
+
+## Proxy Configuration
+
+Pass the URL of an OpenDHT HTTP(S) proxy at startup:
+
+```js
+runner.run({
+  proxyServer: 'https://proxy.example.com',
+  proxyUserAgent: 'my-app/1.0',
+});
+```
+
+This selects the native OpenDHT proxy client, not an HTTP CONNECT or SOCKS proxy.
+The node does not bind UDP sockets in this mode; `port`, `ipv4`, `ipv6`, and
+`bootstrap()` are for direct DHT nodes. Omit `proxyServer` or use an empty string
+for direct networking. Proxy settings are startup-only; create a new runner to
+change transports or servers. Packaged binaries include proxy-client support.
+
+## Crypto
+
+`PrivateKey.generate(options)` and `Identity.generate(name, options)` return
+promises and generate keys off the JS thread. Options accept `algorithm: 'ec'`
+(the default, using OpenDHT's default EC curve) or `'rsa'`. RSA `bits` must be an
+integer between 2048 and 8192; the default is 2048.
+
+- `new PrivateKey(bytes, password?)` imports PEM/DER; `serialize(password?)`
+  exports PKCS#8 PEM. A nonempty password encrypts the exported key.
+- `privateKey.getPublicKey()` returns an owned public key. `sign(bytes)` and
+  `decrypt(bytes)` return copied Buffers.
+- `new PublicKey(bytes)` imports a public key; `serialize()` exports DER.
+  `checkSignature(data, signature)` returns a boolean. `encrypt(bytes)` requires
+  an RSA key; EC keys support signatures, not this encryption scheme.
+- `new Certificate(bytes)` imports PEM/DER or a PEM certificate chain;
+  `serialize()` exports a PEM chain. Import does not establish trust or validate
+  the chain against a trust store. `getPublicKey()` returns its public key.
+- Public keys and certificates expose `getId()` (40 hex characters) and
+  `getLongId()` (64 hex characters).
+- `new Identity(privateKey, certificate)` requires matching fingerprints.
+  Its read-only `privateKey` and `certificate` properties return owned wrappers.
+- Pass `identity` to `run()` to enable `putSigned(key, data, options?)` and
+  `putEncrypted(key, data, recipientPublicKey, options?)`. Both return the same
+  success boolean as `put()`. Encrypted values are signed by the sender and
+  transparently decrypted for the recipient by OpenDHT's get/listen layer.
+
+```js
+import { Identity, DhtRunner } from 'opendht';
+
+async function createAuthenticatedNode() {
+    const identity = await Identity.generate('example', { algorithm: 'rsa', bits: 2048 });
+    const runner = new DhtRunner();
+    runner.run({ port: 0, identity });
+    return { runner, identity };
+}
+```
+
+Crypto methods take Uint8Array/Buffer inputs, not implicit text encodings. Imports
+must be nonempty. Malformed handles/data,
+mismatched identities, and unsupported encryption keys raise JS exceptions.
+Only generation is asynchronous; import/export/sign/encrypt/decrypt are
+synchronous and should be used from worker threads for large workloads.
+
+## Packaging And CI
+
+From a successful Release build:
+
+```sh
+npm run package
+npm run test:package
+```
+
+`bundle` copies the addon into `prebuilds/<platform>-<arch>/`, gathers its runtime
+dependencies, rewrites native loader paths, and copies dependency license
+notices. macOS needs `dylibbundler` and Apple developer tools; Linux needs
+`patchelf` and Debian/Ubuntu dependency copyright files. Windows uses the vcpkg
+installed tree (`VCPKG_INSTALLED_DIR`, `VCPKG_DEFAULT_TRIPLET`) and MSVC tools.
+`OPENDHT_LIBRARY_PATH` adds native library search directories when bundling.
+An explicit addon path may be passed to `npm run bundle -- /absolute/addon.node`.
+Bundling replaces only the current platform's generated prebuild directory.
+
+`test:package` creates an npm archive, installs it in a temporary consumer with
+install scripts disabled and no dev dependencies, forces prebuild-only loading,
+and runs the full runtime suite. Pass an archive file or a directory containing
+one archive to test it directly, for example `npm run test:package -- dist`.
+Only runtime JS, declarations, the example's TypeScript source, documentation,
+and prebuilds are included in the archive. `prepack` compiles the example, so
+archive creation needs the development dependencies; archive installation does not.
+
+The [Node.js package workflow](../.github/workflows/nodejs-package.yml) builds:
+
+| Target | Build Baseline |
+| --- | --- |
+| Linux x64 | Ubuntu 24.04 / glibc 2.39 (Noble dependency image) |
+| macOS ARM64 and x64 | macOS 15 |
+| Windows x64 | Windows Server 2022 / MSVC |
+
+CI combines platform prebuilds into one npm archive and verifies that archive on
+Node 22, 24, and 26 on each platform, including Ubuntu 24.04 and 26.04. Branch
+pushes, pull requests, and manual runs build and test without publishing.
+musl/Alpine and other architectures are not currently built. Node-API stability
+does not remove OS/libc or native dependency compatibility requirements. Review
+the included dependency licenses and source-distribution obligations before
+redistributing binaries.
+
+Query filters, AbortSignal support, certificate trust-store validation, CA
+issuance controls, and runtime proxy switching remain future work.

nodejs/addon.cpp

@@ -0,0 +1,734 @@
+#include <napi.h>
+#include <opendht.h>
+#include <gnutls/gnutls.h>
+#include "crypto.h"
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cmath>
+#include <condition_variable>
+#include <functional>
+#include <mutex>
+#include <optional>
+#include <unordered_map>
+
+namespace {
+
+struct GnuTlsContext
+{
+    const int result = gnutls_global_init();
+
+    ~GnuTlsContext()
+    {
+        if (result == GNUTLS_E_SUCCESS)
+            gnutls_global_deinit();
+    }
+};
+
+using opendht_node::guarded;
+
+uint32_t
+unsignedNumber(Napi::Value value, uint32_t maximum, const char* name)
+{
+    if (!value.IsNumber())
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must be a number");
+    const auto number = value.As<Napi::Number>().DoubleValue();
+    if (!std::isfinite(number) || number < 0 || number > maximum || std::floor(number) != number)
+        throw Napi::RangeError::New(value.Env(), std::string(name) + " is out of range");
+    return static_cast<uint32_t>(number);
+}
+
+uint64_t
+unsignedBigInt(Napi::Value value)
+{
+    if (!value.IsBigInt())
+        throw Napi::TypeError::New(value.Env(), "id must be a bigint");
+    int sign = 0;
+    size_t count = 1;
+    uint64_t word = 0;
+    value.As<Napi::BigInt>().ToWords(&sign, &count, &word);
+    if (sign || count > 1)
+        throw Napi::RangeError::New(value.Env(), "id must fit in an unsigned 64-bit integer");
+    return word;
+}
+
+std::string
+text(Napi::Value value, const char* name)
+{
+    if (!value.IsString())
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must be a string");
+    auto result = value.As<Napi::String>().Utf8Value();
+    if (result.find('\0') != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), std::string(name) + " must not contain NUL bytes");
+    return result;
+}
+
+dht::InfoHash
+infoHash(Napi::Value value)
+{
+    const auto result = text(value, "hash");
+    if (result.size() != 40 || result.find_first_not_of("0123456789abcdefABCDEF") != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), "Expected a 40-character hexadecimal hash");
+    return dht::InfoHash(result);
+}
+
+Napi::Object
+optionsObject(Napi::Value value)
+{
+    if (!value.IsObject() || value.IsArray() || value.IsNull())
+        throw Napi::TypeError::New(value.Env(), "options must be an object");
+    return value.As<Napi::Object>();
+}
+
+Napi::Object
+valueToJS(Napi::Env env, const dht::Value& value)
+{
+    auto result = Napi::Object::New(env);
+    result.Set("id", Napi::BigInt::New(env, value.id));
+    result.Set("type", Napi::Number::New(env, value.type));
+    result.Set("seq", Napi::Number::New(env, value.seq));
+    result.Set("data", Napi::Buffer<uint8_t>::Copy(env, value.data.data(), value.data.size()));
+    result.Set("userType", Napi::String::New(env, value.user_type));
+    result.Set("owner",
+               value.owner ? Napi::Value(Napi::String::New(env, value.owner->getLongId().to_view()))
+                           : Napi::Value(env.Null()));
+    result.Set("isSigned", Napi::Boolean::New(env, value.isSigned()));
+    result.Set("isEncrypted", Napi::Boolean::New(env, value.isEncrypted()));
+    return result;
+}
+
+struct PendingOperation
+{
+    Napi::Promise::Deferred deferred;
+    bool get;
+    std::vector<std::shared_ptr<const dht::Value>> values;
+    Napi::FunctionReference onValue;
+    std::shared_ptr<std::atomic_bool> cancelled;
+};
+
+struct Subscription
+{
+    dht::InfoHash key;
+    std::shared_future<size_t> token;
+    Napi::FunctionReference callback;
+};
+
+struct RunnerState
+{
+    using Callback = std::function<void(RunnerState&)>;
+
+    explicit RunnerState(Napi::Env environment)
+        : env(environment)
+    {}
+
+    static std::shared_ptr<RunnerState> create(Napi::Env env)
+    {
+        auto state = std::make_shared<RunnerState>(env);
+        auto dispatchOwner = std::make_unique<std::shared_ptr<RunnerState>>(state);
+        napi_threadsafe_function function;
+        if (napi_create_threadsafe_function(env,
+                                            nullptr,
+                                            nullptr,
+                                            Napi::String::New(env, "OpenDHT callbacks"),
+                                            0,
+                                            1,
+                                            dispatchOwner.get(),
+                                            finalizeDispatcher,
+                                            state.get(),
+                                            dispatch,
+                                            &function)
+            != napi_ok)
+            throw Napi::Error::New(env, "Could not create OpenDHT callback dispatcher");
+        dispatchOwner.release();
+        state->dispatcher = Napi::ThreadSafeFunction(function);
+        state->dispatcher.Unref(env);
+        auto closeOwner = std::make_unique<std::shared_ptr<RunnerState>>(state);
+        if (napi_create_async_work(env,
+                                   nullptr,
+                                   Napi::String::New(env, "OpenDHT close"),
+                                   executeClose,
+                                   completeClose,
+                                   closeOwner.get(),
+                                   &state->closeWork)
+            != napi_ok) {
+            state->dispatcher.Release();
+            throw Napi::Error::New(env, "Could not create OpenDHT cleanup work");
+        }
+        if (napi_add_async_cleanup_hook(env, cleanup, state.get(), &state->cleanupHook) != napi_ok) {
+            napi_delete_async_work(env, state->closeWork);
+            state->dispatcher.Release();
+            throw Napi::Error::New(env, "Could not register OpenDHT cleanup hook");
+        }
+        state->closeOwner = closeOwner.release();
+        return state;
+    }
+
+    void requireRunning() const
+    {
+        if (closing)
+            throw Napi::Error::New(env, "DHT runner is closed");
+        if (!started)
+            throw Napi::Error::New(env, "DHT runner is not running");
+    }
+
+    void startClose()
+    {
+        if (closing.exchange(true))
+            return;
+        if (napi_queue_async_work(env, closeWork) != napi_ok) {
+            executeClose(env, closeOwner);
+            completeClose(env, napi_ok, closeOwner);
+        }
+    }
+
+    void send(Callback callback)
+    {
+        if (closing)
+            return;
+        auto task = std::make_unique<Callback>(std::move(callback));
+        if (dispatcher.NonBlockingCall(static_cast<void*>(task.get())) == napi_ok)
+            task.release();
+    }
+
+    void sendValue(uint64_t operation, std::shared_ptr<const dht::Value> value, bool expired = false)
+    {
+        send([operation, value = std::move(value), expired](RunnerState& state) mutable {
+            const auto listener = state.listeners.find(operation);
+            if (listener != state.listeners.end()) {
+                listener->second.callback.Call({valueToJS(state.env, *value), Napi::Boolean::New(state.env, expired)});
+            } else if (const auto pending = state.operations.find(operation); pending != state.operations.end()) {
+                if (!pending->second.onValue.IsEmpty())
+                    pending->second.onValue.Call({valueToJS(state.env, *value)});
+                else
+                    pending->second.values.emplace_back(std::move(value));
+            }
+        });
+    }
+
+    void completeOperation(uint64_t identifier, bool ok)
+    {
+        const auto pending = operations.find(identifier);
+        if (pending == operations.end())
+            return;
+        auto operation = std::move(pending->second);
+        operations.erase(pending);
+        if (!operation.get) {
+            operation.deferred.Resolve(Napi::Boolean::New(env, ok));
+        } else if (!ok) {
+            auto error = Napi::Error::New(env, "DHT get failed");
+            error.Set("code", "ERR_DHT_GET_FAILED");
+            operation.deferred.Reject(error.Value());
+        } else if (!operation.onValue.IsEmpty()) {
+            operation.deferred.Resolve(env.Undefined());
+        } else {
+            auto values = Napi::Array::New(env, operation.values.size());
+            for (size_t index = 0; index < operation.values.size(); ++index)
+                values.Set(static_cast<uint32_t>(index), valueToJS(env, *operation.values[index]));
+            operation.deferred.Resolve(values);
+        }
+    }
+
+    Napi::Object status() const
+    {
+        auto result = Napi::Object::New(env);
+        result.Set("ipv4", Napi::String::New(env, dht::statusToStr(closing ? dht::NodeStatus::Disconnected : status4)));
+        result.Set("ipv6", Napi::String::New(env, dht::statusToStr(closing ? dht::NodeStatus::Disconnected : status6)));
+        return result;
+    }
+
+    static void dispatch(napi_env environment, napi_value, void* context, void* data)
+    {
+        auto state = static_cast<RunnerState*>(context);
+        std::unique_ptr<Callback> callback(static_cast<Callback*>(data));
+        if (!environment || state->envClosing || state->closing)
+            return;
+        try {
+            (*callback)(*state);
+        } catch (const Napi::Error& error) {
+            napi_fatal_exception(environment, error.Value());
+        } catch (const std::exception& error) {
+            napi_fatal_exception(environment, Napi::Error::New(environment, error.what()).Value());
+        }
+    }
+
+    static void finalizeDispatcher(napi_env, void* data, void*)
+    {
+        delete static_cast<std::shared_ptr<RunnerState>*>(data);
+    }
+
+    static void cleanup(napi_async_cleanup_hook_handle, void* data)
+    {
+        auto state = static_cast<RunnerState*>(data);
+        state->envClosing = true;
+        state->startClose();
+    }
+
+    static void executeClose(napi_env, void* data)
+    {
+        auto state = *static_cast<std::shared_ptr<RunnerState>*>(data);
+        struct ShutdownSignal
+        {
+            std::mutex mutex;
+            std::condition_variable condition;
+            bool done = false;
+        };
+        try {
+            auto signal = std::make_shared<ShutdownSignal>();
+            state->runner.shutdown(
+                [signal] {
+                    std::lock_guard lock(signal->mutex);
+                    signal->done = true;
+                    signal->condition.notify_one();
+                },
+                true);
+            std::unique_lock lock(signal->mutex);
+            signal->condition.wait_for(lock, std::chrono::seconds(2), [&] { return signal->done; });
+        } catch (const std::exception& error) {
+            state->closeError = error.what();
+        }
+        state->runner.join();
+    }
+
+    Napi::Error makeCloseError() const
+    {
+        auto error = Napi::Error::New(env, closeError.empty() ? "DHT runner is closed" : closeError);
+        error.Set("code", "ERR_DHT_CLOSED");
+        return error;
+    }
+
+    static void completeClose(napi_env environment, napi_status, void* data)
+    {
+        std::unique_ptr<std::shared_ptr<RunnerState>> owner(static_cast<std::shared_ptr<RunnerState>*>(data));
+        auto state = *owner;
+        state->finished = true;
+        if (!state->envClosing) {
+            state->dispatcher.Release();
+            auto error = state->makeCloseError();
+            for (auto& pending : state->operations)
+                pending.second.deferred.Reject(error.Value());
+            if (state->closeDeferred) {
+                if (state->closeError.empty())
+                    state->closeDeferred->Resolve(Napi::Env(environment).Undefined());
+                else
+                    state->closeDeferred->Reject(error.Value());
+            }
+        }
+        state->operations.clear();
+        state->listeners.clear();
+        state->closeDeferred.reset();
+        state->closePromise.Reset();
+        state->onStatus.Reset();
+        state->owner.Reset();
+        napi_delete_async_work(environment, state->closeWork);
+        napi_remove_async_cleanup_hook(state->cleanupHook);
+        state->closeOwner = nullptr;
+    }
+
+    Napi::Env env;
+    dht::DhtRunner runner;
+    Napi::ThreadSafeFunction dispatcher;
+    napi_async_work closeWork {};
+    napi_async_cleanup_hook_handle cleanupHook {};
+    std::shared_ptr<RunnerState>* closeOwner {};
+    std::atomic_bool closing {false};
+    bool envClosing = false;
+    bool started = false;
+    bool hasIdentity = false;
+    bool finished = false;
+    uint64_t nextOperation = 1;
+    std::string closeError;
+    std::unordered_map<uint64_t, PendingOperation> operations;
+    std::unordered_map<uint64_t, Subscription> listeners;
+    std::optional<Napi::Promise::Deferred> closeDeferred;
+    Napi::Reference<Napi::Promise> closePromise;
+    Napi::FunctionReference onStatus;
+    Napi::ObjectReference owner;
+    dht::NodeStatus status4 = dht::NodeStatus::Disconnected;
+    dht::NodeStatus status6 = dht::NodeStatus::Disconnected;
+};
+
+class Runner : public Napi::ObjectWrap<Runner>
+{
+public:
+    explicit Runner(const Napi::CallbackInfo& info)
+        : Napi::ObjectWrap<Runner>(info)
+        , state_(RunnerState::create(info.Env()))
+    {
+        if (info.Length() && info[0].IsFunction())
+            state_->onStatus = Napi::Persistent(info[0].As<Napi::Function>());
+    }
+
+    ~Runner() override { state_->startClose(); }
+
+    static Napi::Function define(Napi::Env env)
+    {
+        return DefineClass(env,
+                           "NativeRunner",
+                           {
+                               InstanceMethod("run", &Runner::run),
+                               InstanceMethod("close", &Runner::close),
+                               InstanceMethod("isRunning", &Runner::isRunning),
+                               InstanceMethod("getBoundPort", &Runner::getBoundPort),
+                               InstanceMethod("getNodeId", &Runner::getNodeId),
+                               InstanceMethod("getStatus", &Runner::getStatus),
+                               InstanceMethod("bootstrap", &Runner::bootstrap),
+                               InstanceMethod("get", &Runner::get),
+                               InstanceMethod("getAll", &Runner::getAll),
+                               InstanceMethod("cancelGet", &Runner::cancelGet),
+                               InstanceMethod("put", &Runner::put),
+                               InstanceMethod("putSigned", &Runner::putSigned),
+                               InstanceMethod("putEncrypted", &Runner::putEncrypted),
+                               InstanceMethod("listen", &Runner::listen),
+                               InstanceMethod("cancelListen", &Runner::cancelListen),
+                               InstanceMethod("ref", &Runner::ref),
+                               InstanceMethod("unref", &Runner::unref),
+                               InstanceMethod("setOwner", &Runner::setOwner),
+                           });
+    }
+
+private:
+    Napi::Value run(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (state_->closing)
+                throw Napi::Error::New(info.Env(), "DHT runner is closed");
+            if (state_->started)
+                throw Napi::Error::New(info.Env(), "DHT runner is already running");
+            auto options = info.Length() && !info[0].IsUndefined() ? optionsObject(info[0])
+                                                                   : Napi::Object::New(info.Env());
+            const auto port = options.Has("port") ? unsignedNumber(options.Get("port"), 65535, "port") : 0;
+            const auto ipv4 = options.Has("ipv4") ? text(options.Get("ipv4"), "ipv4") : "0.0.0.0";
+            const auto ipv6 = options.Has("ipv6") ? text(options.Get("ipv6"), "ipv6") : "::";
+            dht::DhtRunner::Config config;
+            if (options.Has("network"))
+                config.dht_config.node_config.network = unsignedNumber(options.Get("network"), UINT32_MAX, "network");
+            if (options.Has("persistPath"))
+                config.dht_config.node_config.persist_path = text(options.Get("persistPath"), "persistPath");
+            if (options.Has("identity"))
+                config.dht_config.id = opendht_node::readIdentity(options.Get("identity"));
+            if (options.Has("proxyServer"))
+                config.proxy_server = text(options.Get("proxyServer"), "proxyServer");
+            if (options.Has("proxyUserAgent")) {
+                config.proxy_user_agent = text(options.Get("proxyUserAgent"), "proxyUserAgent");
+                if (config.proxy_user_agent.find_first_of("\r\n") != std::string::npos)
+                    throw Napi::TypeError::New(info.Env(), "proxyUserAgent must not contain line breaks");
+            }
+            dht::DhtRunner::Context context;
+            const std::weak_ptr<RunnerState> state = state_;
+            context.statusChangedCallback = [state](dht::NodeStatus ipv4, dht::NodeStatus ipv6) {
+                if (auto owner = state.lock())
+                    owner->send([ipv4, ipv6](RunnerState& state) {
+                        state.status4 = ipv4;
+                        state.status6 = ipv6;
+                        if (!state.onStatus.IsEmpty())
+                            state.onStatus.Call({state.status()});
+                    });
+            };
+            const auto service = std::to_string(port);
+            state_->runner.run(ipv4.c_str(), ipv6.c_str(), service.c_str(), config, std::move(context));
+            state_->started = true;
+            state_->hasIdentity = bool(config.dht_config.id.first);
+            state_->dispatcher.Ref(info.Env());
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value close(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (!state_->closePromise.IsEmpty())
+                return state_->closePromise.Value();
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            if (state_->finished) {
+                if (!state_->closeError.empty())
+                    deferred.Reject(state_->makeCloseError().Value());
+                else
+                    deferred.Resolve(info.Env().Undefined());
+            } else {
+                state_->closeDeferred = deferred;
+                state_->closePromise = Napi::Persistent(deferred.Promise());
+                state_->startClose();
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value isRunning(const Napi::CallbackInfo& info)
+    {
+        return Napi::Boolean::New(info.Env(), !state_->closing && state_->runner.isRunning());
+    }
+
+    Napi::Value getStatus(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value { return state_->status(); });
+    }
+
+    Napi::Value getBoundPort(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto family = info.Length() ? unsignedNumber(info[0], 6, "family") : 4;
+            if (family != 4 && family != 6)
+                throw Napi::RangeError::New(info.Env(), "family must be 4 or 6");
+            return Napi::Number::New(info.Env(), state_->runner.getBoundPort(family == 4 ? AF_INET : AF_INET6));
+        });
+    }
+
+    Napi::Value getNodeId(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            return Napi::String::New(info.Env(), state_->runner.getNodeId().to_view());
+        });
+    }
+
+    Napi::Value bootstrap(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto host = text(info[0], "host");
+            const auto port = unsignedNumber(info[1], 65535, "port");
+            if (host.empty() || !port)
+                throw Napi::RangeError::New(info.Env(), "bootstrap requires a host and nonzero port");
+            state_->runner.bootstrap(host, std::to_string(port));
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value get(const Napi::CallbackInfo& info) { return getValues(info, true); }
+
+    Napi::Value getAll(const Napi::CallbackInfo& info) { return getValues(info, false); }
+
+    Napi::Value getValues(const Napi::CallbackInfo& info, bool stream)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto key = infoHash(info[0]);
+            if (stream && !info[1].IsFunction())
+                throw Napi::TypeError::New(info.Env(), "callback must be a function");
+            const auto operation = state_->nextOperation++;
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            auto cancelled = std::make_shared<std::atomic_bool>(false);
+            PendingOperation pending {deferred, true, {}, {}, cancelled};
+            if (stream)
+                pending.onValue = Napi::Persistent(info[1].As<Napi::Function>());
+            state_->operations.emplace(operation, std::move(pending));
+            const std::weak_ptr<RunnerState> state = state_;
+            try {
+                state_->runner.get(key,
+                                   dht::GetCallback([state, operation, cancelled](
+                                                        const std::vector<std::shared_ptr<dht::Value>>& values) {
+                                       const auto owner = state.lock();
+                                       if (!owner || owner->closing || *cancelled)
+                                           return false;
+                                       for (const auto& value : values)
+                                           owner->sendValue(operation, value);
+                                       return !owner->closing && !*cancelled;
+                                   }),
+                                   dht::DoneCallbackSimple([state, operation](bool ok) {
+                                       if (const auto owner = state.lock())
+                                           owner->send([operation, ok](RunnerState& state) {
+                                               state.completeOperation(operation, ok);
+                                           });
+                                   }));
+            } catch (...) {
+                state_->operations.erase(operation);
+                throw;
+            }
+            if (stream) {
+                auto result = Napi::Object::New(info.Env());
+                result.Set("token", Napi::BigInt::New(info.Env(), operation));
+                result.Set("done", deferred.Promise());
+                return result;
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value cancelGet(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            const auto operation = state_->operations.find(unsignedBigInt(info[0]));
+            if (operation != state_->operations.end() && !operation->second.onValue.IsEmpty()) {
+                *operation->second.cancelled = true;
+                operation->second.deferred.Resolve(info.Env().Undefined());
+                state_->operations.erase(operation);
+            }
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value put(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Plain); }
+
+    Napi::Value putSigned(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Signed); }
+
+    Napi::Value putEncrypted(const Napi::CallbackInfo& info) { return putValue(info, PutMode::Encrypted); }
+
+    enum class PutMode { Plain, Signed, Encrypted };
+
+    Napi::Value putValue(const Napi::CallbackInfo& info, PutMode mode)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            if (mode != PutMode::Plain && !state_->hasIdentity)
+                throw Napi::Error::New(info.Env(), "Signed and encrypted puts require an identity");
+            std::shared_ptr<dht::crypto::PublicKey> recipient;
+            if (mode == PutMode::Encrypted) {
+                recipient = opendht_node::readEncryptionKey(info[3]);
+            }
+            const auto key = infoHash(info[0]);
+            if (!info[1].IsTypedArray() || info[1].As<Napi::TypedArray>().TypedArrayType() != napi_uint8_array)
+                throw Napi::TypeError::New(info.Env(), "data must be a Uint8Array");
+            const auto data = info[1].As<Napi::Uint8Array>();
+            dht::Blob bytes(data.ElementLength());
+            if (!bytes.empty())
+                std::copy_n(data.Data(), bytes.size(), bytes.data());
+            auto value = std::make_shared<dht::Value>(std::move(bytes));
+            auto options = info.Length() > 2 && !info[2].IsUndefined() ? optionsObject(info[2])
+                                                                       : Napi::Object::New(info.Env());
+            if (options.Has("id"))
+                value->id = unsignedBigInt(options.Get("id"));
+            if (options.Has("type"))
+                value->type = unsignedNumber(options.Get("type"), 65535, "type");
+            if (options.Has("userType")) {
+                if (!options.Get("userType").IsString())
+                    throw Napi::TypeError::New(info.Env(), "userType must be a string");
+                value->user_type = options.Get("userType").As<Napi::String>().Utf8Value();
+            }
+            bool permanent = false;
+            if (options.Has("permanent")) {
+                if (!options.Get("permanent").IsBoolean())
+                    throw Napi::TypeError::New(info.Env(), "permanent must be a boolean");
+                permanent = options.Get("permanent").As<Napi::Boolean>().Value();
+            }
+            const auto operation = state_->nextOperation++;
+            auto deferred = Napi::Promise::Deferred::New(info.Env());
+            state_->operations.emplace(operation, PendingOperation {deferred, false, {}, {}, {}});
+            const std::weak_ptr<RunnerState> state = state_;
+            try {
+                dht::DoneCallbackSimple done = [state, operation](bool ok) {
+                    if (const auto owner = state.lock())
+                        owner->send([operation, ok](RunnerState& state) { state.completeOperation(operation, ok); });
+                };
+                if (mode == PutMode::Signed)
+                    state_->runner.putSigned(key, value, std::move(done), permanent);
+                else if (mode == PutMode::Encrypted)
+                    state_->runner.putEncrypted(key, recipient, value, std::move(done), permanent);
+                else
+                    state_->runner.put(key, value, std::move(done), dht::time_point::max(), permanent);
+            } catch (...) {
+                state_->operations.erase(operation);
+                throw;
+            }
+            return deferred.Promise();
+        });
+    }
+
+    Napi::Value listen(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            const auto key = infoHash(info[0]);
+            if (!info[1].IsFunction())
+                throw Napi::TypeError::New(info.Env(), "callback must be a function");
+            const auto operation = state_->nextOperation++;
+            const std::weak_ptr<RunnerState> state = state_;
+            auto token = state_->runner
+                             .listen(key,
+                                     dht::ValueCallback(
+                                         [state, operation](const std::vector<std::shared_ptr<dht::Value>>& values,
+                                                            bool expired) {
+                                             const auto owner = state.lock();
+                                             if (!owner || owner->closing)
+                                                 return false;
+                                             for (const auto& value : values)
+                                                 owner->sendValue(operation, value, expired);
+                                             return !owner->closing;
+                                         }))
+                             .share();
+            state_->listeners.emplace(operation,
+                                      Subscription {key,
+                                                    std::move(token),
+                                                    Napi::Persistent(info[1].As<Napi::Function>())});
+            return Napi::BigInt::New(info.Env(), operation);
+        });
+    }
+
+    Napi::Value cancelListen(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            if (state_->closing)
+                return info.Env().Undefined();
+            const auto listener = state_->listeners.find(unsignedBigInt(info[0]));
+            if (listener != state_->listeners.end()) {
+                state_->runner.cancelListen(listener->second.key, listener->second.token);
+                state_->listeners.erase(listener);
+            }
+            return info.Env().Undefined();
+        });
+    }
+
+    Napi::Value ref(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            state_->dispatcher.Ref(info.Env());
+            return info.This();
+        });
+    }
+
+    Napi::Value unref(const Napi::CallbackInfo& info)
+    {
+        return guarded(info, [&]() -> Napi::Value {
+            state_->requireRunning();
+            state_->dispatcher.Unref(info.Env());
+            return info.This();
+        });
+    }
+
+    Napi::Value setOwner(const Napi::CallbackInfo& info)
+    {
+        if (!state_->closing) {
+            state_->owner.Reset();
+            if (info[0].IsObject())
+                state_->owner = Napi::Persistent(info[0].As<Napi::Object>());
+        }
+        return info.Env().Undefined();
+    }
+
+    std::shared_ptr<RunnerState> state_;
+};
+
+Napi::Value
+hash(const Napi::CallbackInfo& info)
+{
+    const auto env = info.Env();
+    dht::InfoHash result;
+    if (info.Length() == 1 && info[0].IsString()) {
+        result = dht::InfoHash::get(info[0].As<Napi::String>().Utf8Value());
+    } else if (info.Length() == 1 && info[0].IsTypedArray()
+               && info[0].As<Napi::TypedArray>().TypedArrayType() == napi_uint8_array) {
+        const auto data = info[0].As<Napi::Uint8Array>();
+        result = dht::InfoHash::get(data.Data(), data.ElementLength());
+    } else {
+        throw Napi::TypeError::New(env, "Expected a string or Uint8Array");
+    }
+    return Napi::String::New(env, result.to_view());
+}
+
+Napi::Object
+initialize(Napi::Env env, Napi::Object exports)
+{
+    static const GnuTlsContext crypto;
+    if (crypto.result != GNUTLS_E_SUCCESS)
+        throw Napi::Error::New(env, std::string("Unable to initialize GnuTLS: ") + gnutls_strerror(crypto.result));
+    opendht_node::initializeCrypto(env, exports);
+    exports.Set("NativeRunner", Runner::define(env));
+    exports.Set("hash", Napi::Function::New(env, hash));
+    exports.Set("version", Napi::String::New(env, dht::version()));
+    return exports;
+}
+
+} // namespace
+
+NODE_API_MODULE(opendht, initialize)

nodejs/crypto.cpp

@@ -0,0 +1,304 @@
+#include "crypto.h"
+
+#include <algorithm>
+#include <cmath>
+#include <variant>
+
+namespace opendht_node {
+namespace {
+
+using PublicKey = std::shared_ptr<dht::crypto::PublicKey>;
+using PrivateKey = std::shared_ptr<dht::crypto::PrivateKey>;
+using Certificate = std::shared_ptr<dht::crypto::Certificate>;
+using Identity = dht::crypto::Identity;
+using Handle = std::variant<PublicKey, PrivateKey, Certificate, Identity>;
+
+constexpr napi_type_tag cryptoTag {0x37cdf3e4648e4cb5ULL, 0x964fb031062c245aULL};
+
+Handle&
+handle(Napi::Value value)
+{
+    bool matches = false;
+    if (!value.IsExternal() || napi_check_object_type_tag(value.Env(), value, &cryptoTag, &matches) != napi_ok
+        || !matches)
+        throw Napi::TypeError::New(value.Env(), "Invalid OpenDHT crypto handle");
+    return *value.As<Napi::External<Handle>>().Data();
+}
+
+template<typename Type>
+Type
+read(Napi::Value value)
+{
+    if (auto result = std::get_if<Type>(&handle(value)))
+        return *result;
+    throw Napi::TypeError::New(value.Env(), "Wrong OpenDHT crypto handle type");
+}
+
+Napi::Value
+wrap(Napi::Env env, Handle value)
+{
+    auto owner = std::make_unique<Handle>(std::move(value));
+    auto result = Napi::External<Handle>::New(env, owner.get(), [](Napi::Env, Handle* data) { delete data; });
+    owner.release();
+    if (napi_type_tag_object(env, result, &cryptoTag) != napi_ok)
+        throw Napi::Error::New(env, "Could not tag OpenDHT crypto handle");
+    return result;
+}
+
+dht::Blob
+bytes(Napi::Value value)
+{
+    if (!value.IsTypedArray() || value.As<Napi::TypedArray>().TypedArrayType() != napi_uint8_array)
+        throw Napi::TypeError::New(value.Env(), "Expected a Uint8Array");
+    auto array = value.As<Napi::Uint8Array>();
+    dht::Blob result(array.ElementLength());
+    if (!result.empty())
+        std::copy_n(array.Data(), result.size(), result.data());
+    return result;
+}
+
+std::string
+string(Napi::Value value)
+{
+    if (!value.IsString())
+        throw Napi::TypeError::New(value.Env(), "Expected a string");
+    auto result = value.As<Napi::String>().Utf8Value();
+    if (result.find('\0') != std::string::npos)
+        throw Napi::TypeError::New(value.Env(), "Crypto strings must not contain NUL bytes");
+    return result;
+}
+
+Napi::Buffer<uint8_t>
+buffer(Napi::Env env, const dht::Blob& value)
+{
+    return Napi::Buffer<uint8_t>::Copy(env, value.data(), value.size());
+}
+
+PublicKey
+publicKey(const Handle& value)
+{
+    if (auto key = std::get_if<PublicKey>(&value))
+        return *key;
+    if (auto key = std::get_if<PrivateKey>(&value))
+        return (*key)->getSharedPublicKey();
+    if (auto certificate = std::get_if<Certificate>(&value))
+        return (*certificate)->getSharedPublicKey();
+    return std::get<Identity>(value).second->getSharedPublicKey();
+}
+
+class GenerateWorker : public Napi::AsyncWorker
+{
+public:
+    GenerateWorker(Napi::Env env, bool identity, std::string name, bool rsa, unsigned bits)
+        : Napi::AsyncWorker(env, "OpenDHT crypto generation")
+        , deferred_(Napi::Promise::Deferred::New(env))
+        , identity_(identity)
+        , name_(std::move(name))
+        , rsa_(rsa)
+        , bits_(bits)
+    {}
+
+    Napi::Promise promise() const { return deferred_.Promise(); }
+
+    void Execute() override
+    {
+        try {
+            if (identity_)
+                result_ = rsa_ ? dht::crypto::generateIdentity(name_, {}, bits_)
+                               : dht::crypto::generateEcIdentity(name_);
+            else
+                result_ = std::make_shared<dht::crypto::PrivateKey>(rsa_ ? dht::crypto::PrivateKey::generate(bits_)
+                                                                         : dht::crypto::PrivateKey::generateEC());
+        } catch (const std::exception& error) {
+            SetError(error.what());
+        }
+    }
+
+    void OnOK() override { deferred_.Resolve(wrap(Env(), std::move(result_))); }
+    void OnError(const Napi::Error& error) override { deferred_.Reject(error.Value()); }
+
+private:
+    Napi::Promise::Deferred deferred_;
+    bool identity_;
+    std::string name_;
+    bool rsa_;
+    unsigned bits_;
+    Handle result_;
+};
+
+Napi::Value
+generate(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto kind = string(info[0]);
+        const auto name = string(info[1]);
+        const auto algorithm = string(info[2]);
+        if (algorithm != "rsa" && algorithm != "ec")
+            throw Napi::TypeError::New(info.Env(), "algorithm must be rsa or ec");
+        if (!info[3].IsNumber())
+            throw Napi::TypeError::New(info.Env(), "bits must be a number");
+        const auto bits = info[3].As<Napi::Number>().DoubleValue();
+        if (!std::isfinite(bits) || std::floor(bits) != bits || bits < 2048 || bits > 8192)
+            throw Napi::RangeError::New(info.Env(), "RSA bits must be an integer between 2048 and 8192");
+        if (kind != "private" && kind != "identity")
+            throw Napi::TypeError::New(info.Env(), "Invalid crypto generation type");
+        auto worker = std::make_unique<GenerateWorker>(info.Env(), kind == "identity", name, algorithm == "rsa", bits);
+        auto promise = worker->promise();
+        worker->Queue();
+        worker.release();
+        return promise;
+    });
+}
+
+Napi::Value
+import(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto kind = string(info[0]);
+        auto data = bytes(info[1]);
+        if (data.empty())
+            throw Napi::TypeError::New(info.Env(), "Crypto imports must not be empty");
+        if (kind == "private")
+            return wrap(info.Env(), std::make_shared<dht::crypto::PrivateKey>(data, string(info[2])));
+        if (kind == "public")
+            return wrap(info.Env(), std::make_shared<dht::crypto::PublicKey>(data));
+        if (kind == "certificate")
+            return wrap(info.Env(), std::make_shared<dht::crypto::Certificate>(data));
+        throw Napi::TypeError::New(info.Env(), "Invalid crypto import type");
+    });
+}
+
+Napi::Value
+serialize(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        auto& value = handle(info[0]);
+        if (auto key = std::get_if<PrivateKey>(&value))
+            return buffer(info.Env(), (*key)->serialize(string(info[1])));
+        if (auto certificate = std::get_if<Certificate>(&value))
+            return buffer(info.Env(), (*certificate)->getPacked());
+        dht::Blob result;
+        readPublicKey(info[0])->pack(result);
+        return buffer(info.Env(), result);
+    });
+}
+
+Napi::Value
+getPublicKey(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&] { return wrap(info.Env(), publicKey(handle(info[0]))); });
+}
+
+Napi::Value
+getId(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto key = publicKey(handle(info[0]));
+        if (!info[1].IsBoolean())
+            throw Napi::TypeError::New(info.Env(), "Expected a boolean");
+        return Napi::String::New(info.Env(),
+                                 info[1].As<Napi::Boolean>().Value() ? key->getLongId().toString()
+                                                                     : key->getId().toString());
+    });
+}
+
+Napi::Value
+sign(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return buffer(info.Env(), read<PrivateKey>(info[0])->sign(bytes(info[1])));
+    });
+}
+
+Napi::Value
+verify(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return Napi::Boolean::New(info.Env(), readPublicKey(info[0])->checkSignature(bytes(info[1]), bytes(info[2])));
+    });
+}
+
+Napi::Value
+encrypt(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto key = readEncryptionKey(info[0]);
+        return buffer(info.Env(), key->encrypt(bytes(info[1])));
+    });
+}
+
+Napi::Value
+decrypt(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        return buffer(info.Env(), read<PrivateKey>(info[0])->decrypt(bytes(info[1])));
+    });
+}
+
+Napi::Value
+identity(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        auto key = read<PrivateKey>(info[0]);
+        auto certificate = read<Certificate>(info[1]);
+        if (key->getPublicKey().getLongId() != certificate->getLongId())
+            throw Napi::TypeError::New(info.Env(), "Identity key and certificate do not match");
+        return wrap(info.Env(), Identity {std::move(key), std::move(certificate)});
+    });
+}
+
+Napi::Value
+identityPart(const Napi::CallbackInfo& info)
+{
+    return guarded(info, [&]() -> Napi::Value {
+        const auto value = readIdentity(info[0]);
+        if (!info[1].IsBoolean())
+            throw Napi::TypeError::New(info.Env(), "Expected a boolean");
+        return info[1].As<Napi::Boolean>().Value() ? wrap(info.Env(), value.first) : wrap(info.Env(), value.second);
+    });
+}
+
+} // namespace
+
+dht::crypto::Identity
+readIdentity(Napi::Value value)
+{
+    return read<Identity>(value);
+}
+std::shared_ptr<dht::crypto::PublicKey>
+readPublicKey(Napi::Value value)
+{
+    return read<PublicKey>(value);
+}
+
+std::shared_ptr<dht::crypto::PublicKey>
+readEncryptionKey(Napi::Value value)
+{
+    const auto key = readPublicKey(value);
+    const auto algorithm = gnutls_pubkey_get_pk_algorithm(key->pk, nullptr);
+    if (algorithm != GNUTLS_PK_RSA
+#if GNUTLS_VERSION_NUMBER >= 0x030804
+        && algorithm != GNUTLS_PK_RSA_OAEP
+#endif
+    )
+        throw Napi::TypeError::New(value.Env(), "Encryption requires an RSA public key");
+    return key;
+}
+
+void
+initializeCrypto(Napi::Env env, Napi::Object exports)
+{
+    exports.Set("cryptoGenerate", Napi::Function::New(env, generate));
+    exports.Set("cryptoImport", Napi::Function::New(env, import));
+    exports.Set("cryptoSerialize", Napi::Function::New(env, serialize));
+    exports.Set("cryptoPublicKey", Napi::Function::New(env, getPublicKey));
+    exports.Set("cryptoId", Napi::Function::New(env, getId));
+    exports.Set("cryptoSign", Napi::Function::New(env, sign));
+    exports.Set("cryptoVerify", Napi::Function::New(env, verify));
+    exports.Set("cryptoEncrypt", Napi::Function::New(env, encrypt));
+    exports.Set("cryptoDecrypt", Napi::Function::New(env, decrypt));
+    exports.Set("cryptoIdentity", Napi::Function::New(env, identity));
+    exports.Set("cryptoIdentityPart", Napi::Function::New(env, identityPart));
+}
+
+} // namespace opendht_node

nodejs/crypto.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include <napi.h>
+#include <opendht/crypto.h>
+
+namespace opendht_node {
+
+template<typename Callback>
+Napi::Value
+guarded(const Napi::CallbackInfo& info, Callback&& callback)
+{
+    try {
+        return callback();
+    } catch (const Napi::Error&) {
+        throw;
+    } catch (const std::exception& error) {
+        throw Napi::Error::New(info.Env(), error.what());
+    }
+}
+
+dht::crypto::Identity readIdentity(Napi::Value value);
+std::shared_ptr<dht::crypto::PublicKey> readPublicKey(Napi::Value value);
+std::shared_ptr<dht::crypto::PublicKey> readEncryptionKey(Napi::Value value);
+void initializeCrypto(Napi::Env env, Napi::Object exports);
+
+} // namespace opendht_node

nodejs/crypto.js

@@ -0,0 +1,56 @@
+export default function createCrypto(native) {
+    const handles = new WeakMap();
+
+    function handle(value, Type) {
+        if (!(value instanceof Type) || !handles.has(value)) throw new TypeError(`Expected ${Type.name}`);
+        return handles.get(value);
+    }
+
+    function wrap(Type, nativeHandle) {
+        const result = Object.create(Type.prototype);
+        handles.set(result, nativeHandle);
+        return result;
+    }
+
+    function generate(kind, name, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options)) throw new TypeError('Invalid crypto options');
+        return native.cryptoGenerate(kind, name, options.algorithm ?? 'ec', options.bits ?? 2048);
+    }
+
+    class PublicKey {
+        constructor(data) { handles.set(this, native.cryptoImport('public', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, PublicKey)); }
+        getId() { return native.cryptoId(handle(this, PublicKey), false); }
+        getLongId() { return native.cryptoId(handle(this, PublicKey), true); }
+        checkSignature(data, signature) { return native.cryptoVerify(handle(this, PublicKey), data, signature); }
+        encrypt(data) { return native.cryptoEncrypt(handle(this, PublicKey), data); }
+    }
+
+    class PrivateKey {
+        constructor(data, password = '') { handles.set(this, native.cryptoImport('private', data, password)); }
+        static generate(options) { return generate('private', '', options).then(value => wrap(PrivateKey, value)); }
+        serialize(password = '') { return native.cryptoSerialize(handle(this, PrivateKey), password); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, PrivateKey))); }
+        sign(data) { return native.cryptoSign(handle(this, PrivateKey), data); }
+        decrypt(data) { return native.cryptoDecrypt(handle(this, PrivateKey), data); }
+    }
+
+    class Certificate {
+        constructor(data) { handles.set(this, native.cryptoImport('certificate', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, Certificate)); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, Certificate))); }
+        getId() { return native.cryptoId(handle(this, Certificate), false); }
+        getLongId() { return native.cryptoId(handle(this, Certificate), true); }
+    }
+
+    class Identity {
+        constructor(privateKey, certificate) {
+            handles.set(this, native.cryptoIdentity(handle(privateKey, PrivateKey), handle(certificate, Certificate)));
+        }
+        static generate(name = 'dhtnode', options) { return generate('identity', name, options).then(value => wrap(Identity, value)); }
+        get privateKey() { return wrap(PrivateKey, native.cryptoIdentityPart(handle(this, Identity), true)); }
+        get certificate() { return wrap(Certificate, native.cryptoIdentityPart(handle(this, Identity), false)); }
+    }
+
+    return { PublicKey, PrivateKey, Certificate, Identity, handle };
+}

nodejs/examples/dhtnode.ts

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+
+import { clearLine, createInterface, cursorTo, type Interface } from 'node:readline';
+import { parseArgs } from 'node:util';
+import type { ConnectivityStatus, Listener, Value } from '../index.js';
+
+const commands = 'get KEY | put KEY TEXT | sign KEY TEXT | listen KEY | cancel KEY | help | quit';
+
+function portNumber(value: string, name: string, minimum = 0): number {
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < minimum || port > 65535) {
+        throw new Error(`${name} must be an integer between ${minimum} and 65535`);
+    }
+    return port;
+}
+
+function errorMessage(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+}
+
+function report(error: unknown): void {
+    console.error(errorMessage(error));
+    process.exitCode = 1;
+}
+
+async function main(): Promise<void> {
+    const { values } = parseArgs({
+        options: {
+            help: { type: 'boolean', short: 'h' },
+            port: { type: 'string', short: 'p', default: '4222' },
+            ipv4: { type: 'string', default: '0.0.0.0' },
+            ipv6: { type: 'string', default: '::' },
+            bootstrap: { type: 'string', short: 'b' },
+            'bootstrap-port': { type: 'string', default: '4222' },
+        },
+    });
+    if (values.help) {
+        console.log(`Usage: npm run dhtnode -- [options]
+
+  -p, --port PORT           Local UDP port (default: 4222; 0 selects a free port)
+  -b, --bootstrap HOST      Optional bootstrap hostname or IP address
+      --bootstrap-port PORT  Bootstrap UDP port (default: 4222)
+      --ipv4 ADDRESS       IPv4 bind address (default: 0.0.0.0)
+      --ipv6 ADDRESS       IPv6 bind address (default: ::)
+  -h, --help               Show help
+
+Commands: ${commands}
+Keys are text labels hashed with SHA-1. Values are UTF-8 text.`);
+        return;
+    }
+    const port = portNumber(values.port, 'port');
+    const bootstrapPort = portNumber(values['bootstrap-port'], 'bootstrap-port', 1);
+    const { DhtRunner, Identity, hash } = await import('../index.js');
+    const identity = await Identity.generate('dhtnode.ts');
+    const runner = new DhtRunner();
+    const listeners = new Map<string, Listener>();
+    const pending = new Set<Promise<void>>();
+    let lines: Interface | undefined;
+    let closing: Promise<void> | undefined;
+
+    function close(): Promise<void> {
+        if (!closing) {
+            for (const listener of listeners.values()) listener.cancel();
+            listeners.clear();
+            lines?.close();
+            closing = runner.close();
+        }
+        return closing;
+    }
+
+    function print(message: string): void {
+        if (process.stdout.isTTY && lines) {
+            clearLine(process.stdout, 0);
+            cursorTo(process.stdout, 0);
+        }
+        console.log(message);
+        if (!closing && process.stdin.isTTY) lines?.prompt(true);
+    }
+
+    const stop = (): void => { close().catch(report); };
+    const printValue = (label: string, value: Value): void => {
+        print(`${label} ${value.id}: ${JSON.stringify(value.data.toString('utf8'))}${value.isSigned ? ' [signed]' : ''}`);
+    };
+    const printStatus = (status: ConnectivityStatus): void => {
+        print(`Connectivity: IPv4 ${status.ipv4}, IPv6 ${status.ipv6}`);
+    };
+
+    async function execute(line: string): Promise<void> {
+        const [, command, key, data] = line.trim().match(/^(\S+)(?:\s+(\S+))?(?:\s+(.+))?$/) || [];
+        if (!command) return;
+        if (command === 'help') {
+            print(commands);
+            return;
+        }
+        if (!key) throw new Error('Expected a key. Type help for commands.');
+        const location = hash(key);
+        switch (command) {
+            case 'get': {
+                const found = await runner.getAll(location);
+                if (closing) return;
+                for (const value of found) printValue(key, value);
+                if (!found.length) print(`No values for ${key}`);
+                break;
+            }
+            case 'put':
+            case 'sign': {
+                if (data === undefined) throw new Error(`Usage: ${command} KEY TEXT`);
+                const payload = Buffer.from(data, 'utf8');
+                const ok = command === 'sign' ? await runner.putSigned(location, payload)
+                    : await runner.put(location, payload);
+                if (closing) return;
+                if (!ok) throw new Error(`Put failed for ${key}`);
+                print(`Stored ${key}`);
+                break;
+            }
+            case 'listen':
+                if (!listeners.has(key)) {
+                    listeners.set(key, runner.listen(location, (value, expired) => {
+                        printValue(`${expired ? 'Expired' : 'Value'} ${key}`, value);
+                    }));
+                }
+                print(`Listening ${key}`);
+                break;
+            case 'cancel':
+                listeners.get(key)?.cancel();
+                listeners.delete(key);
+                print(`Cancelled ${key}`);
+                break;
+            default:
+                throw new Error('Unknown command. Type help for commands.');
+        }
+    }
+
+    runner.on('error', error => { report(error); stop(); });
+    runner.on('statusChanged', printStatus);
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    try {
+        runner.run({ port, ipv4: values.ipv4, ipv6: values.ipv6, identity });
+        if (values.bootstrap) runner.bootstrap(values.bootstrap, bootstrapPort);
+        lines = createInterface({ input: process.stdin, output: process.stdout });
+        lines.on('SIGINT', stop);
+        lines.setPrompt('dht> ');
+        print(`Node ${runner.getNodeId()} listening on UDP ${runner.getBoundPort()}`);
+        printStatus(runner.getStatus());
+        if (process.stdin.isTTY) print(commands);
+        for await (const line of lines) {
+            if (closing) break;
+            if (/^(quit|exit)(?:\s|$)/.test(line.trim())) {
+                stop();
+                break;
+            }
+            const operation = execute(line).catch(error => {
+                if (!closing) console.error(errorMessage(error));
+            }).finally(() => { pending.delete(operation); });
+            pending.add(operation);
+            if (process.stdin.isTTY) lines.prompt();
+        }
+        if (!closing) await Promise.all(pending);
+    } finally {
+        try {
+            await close();
+            await Promise.all(pending);
+        } finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+    }
+}
+
+main().catch(report);

nodejs/index.d.ts

@@ -0,0 +1,120 @@
+import { Buffer } from 'node:buffer';
+import { EventEmitter } from 'node:events';
+
+export const version: string;
+export function hash(data: string | Uint8Array): string;
+
+export interface KeyOptions {
+    algorithm?: 'ec' | 'rsa';
+    bits?: number;
+}
+
+export class PublicKey {
+    constructor(data: Uint8Array);
+    serialize(): Buffer;
+    getId(): string;
+    getLongId(): string;
+    checkSignature(data: Uint8Array, signature: Uint8Array): boolean;
+    encrypt(data: Uint8Array): Buffer;
+}
+
+export class PrivateKey {
+    constructor(data: Uint8Array, password?: string);
+    static generate(options?: KeyOptions): Promise<PrivateKey>;
+    serialize(password?: string): Buffer;
+    getPublicKey(): PublicKey;
+    sign(data: Uint8Array): Buffer;
+    decrypt(data: Uint8Array): Buffer;
+}
+
+export class Certificate {
+    constructor(data: Uint8Array);
+    serialize(): Buffer;
+    getPublicKey(): PublicKey;
+    getId(): string;
+    getLongId(): string;
+}
+
+export class Identity {
+    constructor(privateKey: PrivateKey, certificate: Certificate);
+    static generate(name?: string, options?: KeyOptions): Promise<Identity>;
+    readonly privateKey: PrivateKey;
+    readonly certificate: Certificate;
+}
+
+export interface RunOptions {
+    port?: number;
+    ipv4?: string;
+    ipv6?: string;
+    network?: number;
+    persistPath?: string;
+    identity?: Identity;
+    proxyServer?: string;
+    proxyUserAgent?: string;
+}
+
+export interface PutOptions {
+    id?: bigint;
+    type?: number;
+    userType?: string;
+    permanent?: boolean;
+}
+
+export interface Value {
+    id: bigint;
+    type: number;
+    seq: number;
+    data: Buffer;
+    userType: string;
+    owner: string | null;
+    isSigned: boolean;
+    isEncrypted: boolean;
+}
+
+export interface Listener {
+    cancel(): void;
+}
+
+export interface ListenEvent {
+    value: Value;
+    expired: boolean;
+}
+
+export interface ValueIterator<T> extends AsyncIterableIterator<T, undefined>, Listener, AsyncDisposable {
+    return(): Promise<IteratorResult<T, undefined>>;
+    throw(error?: unknown): Promise<IteratorResult<T, undefined>>;
+}
+
+export interface ListenerIterator extends ValueIterator<ListenEvent> { }
+
+export type NodeStatus = 'disconnected' | 'connecting' | 'connected';
+
+export interface ConnectivityStatus {
+    ipv4: NodeStatus;
+    ipv6: NodeStatus;
+}
+
+export interface RunnerEvents {
+    statusChanged: [status: ConnectivityStatus];
+    error: [error: Error];
+}
+
+export class DhtRunner extends EventEmitter<RunnerEvents> implements AsyncDisposable {
+    run(options?: RunOptions): void;
+    isRunning(): boolean;
+    getBoundPort(family?: 4 | 6): number;
+    getNodeId(): string;
+    getStatus(): ConnectivityStatus;
+    bootstrap(host: string, port: number): void;
+    get(key: string): ValueIterator<Value>;
+    getAll(key: string): Promise<Value[]>;
+    put(key: string, data: Uint8Array, options?: PutOptions): Promise<boolean>;
+    putSigned(key: string, data: Uint8Array, options?: PutOptions): Promise<boolean>;
+    putEncrypted(key: string, data: Uint8Array, recipient: PublicKey, options?: PutOptions): Promise<boolean>;
+    listen(key: string): ListenerIterator;
+    listen(key: string, callback: (value: Value, expired: boolean) => void): Listener;
+    close(): Promise<void>;
+    ref(): this;
+    unref(): this;
+    [Symbol.asyncDispose](): Promise<void>;
+}

nodejs/index.js

@@ -0,0 +1,187 @@
+import { EventEmitter } from 'node:events';
+import { constants } from 'node:os';
+import { dlopen } from 'node:process';
+import load from 'node-gyp-build';
+import createCrypto from './crypto.js';
+
+const binding = { exports: {} };
+const flags = process.platform === 'linux'
+    ? constants.dlopen.RTLD_LAZY | constants.dlopen.RTLD_DEEPBIND
+    : undefined;
+dlopen(binding, process.env.OPENDHT_NODE_BINDING || load.path(import.meta.dirname),
+    flags);
+const native = binding.exports;
+const { PublicKey, PrivateKey, Certificate, Identity, handle } = createCrypto(native);
+
+function eventReporter(owner, event) {
+    return value => { owner.deref()?.emit(event, value); };
+}
+
+class DhtRunner extends EventEmitter {
+    #native;
+    #closing;
+    #listeners = 0;
+    #pending = 0;
+    #iterators = new Set();
+
+    constructor() {
+        super();
+        const owner = new WeakRef(this);
+        this.#native = new native.NativeRunner(eventReporter(owner, 'statusChanged'));
+    }
+
+    #updateOwner() {
+        this.#native.setOwner(this.#listeners || this.#pending || this.listenerCount('statusChanged') ? this : null);
+    }
+
+    #track(operation) {
+        this.#pending++;
+        this.#updateOwner();
+        return operation.finally(() => {
+            this.#pending--;
+            this.#updateOwner();
+        });
+    }
+
+    on(event, listener) { super.on(event, listener); this.#updateOwner(); return this; }
+    addListener(event, listener) { return this.on(event, listener); }
+    prependListener(event, listener) { super.prependListener(event, listener); this.#updateOwner(); return this; }
+    removeListener(event, listener) { super.removeListener(event, listener); this.#updateOwner(); return this; }
+    off(event, listener) { return this.removeListener(event, listener); }
+    removeAllListeners(...args) { super.removeAllListeners(...args); this.#updateOwner(); return this; }
+
+    run(options) {
+        if (typeof options?.proxyServer === 'string' && options.proxyServer) {
+            const proxy = new URL(options.proxyServer);
+            if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:')
+                throw new TypeError('proxyServer must be an HTTP(S) URL');
+        }
+        if (options?.identity !== undefined) options = { ...options, identity: handle(options.identity, Identity) };
+        this.#native.run(options);
+    }
+    isRunning() { return this.#native.isRunning(); }
+    getBoundPort(family = 4) { return this.#native.getBoundPort(family); }
+    getNodeId() { return this.#native.getNodeId(); }
+    getStatus() { return this.#native.getStatus(); }
+    bootstrap(host, port) { this.#native.bootstrap(host, port); }
+    get(key) {
+        return this.#iterate((push, finish) => {
+            const operation = this.#native.get(key, push);
+            this.#track(operation.done).then(() => finish(), finish);
+            return () => this.#native.cancelGet(operation.token);
+        }, true);
+    }
+    getAll(key) { return this.#track(this.#native.getAll(key)); }
+    put(key, data, options) { return this.#track(this.#native.put(key, data, options)); }
+    putSigned(key, data, options) { return this.#track(this.#native.putSigned(key, data, options)); }
+    putEncrypted(key, data, recipient, options) {
+        return this.#track(this.#native.putEncrypted(key, data, options, handle(recipient, PublicKey)));
+    }
+
+    listen(key, callback) {
+        if (callback === undefined) {
+            return this.#iterate(push => {
+                const subscription = this.listen(key, (value, expired) => push({ value, expired }));
+                return () => subscription.cancel();
+            });
+        }
+        const token = this.#native.listen(key, callback);
+        this.#listeners++;
+        this.#updateOwner();
+        let cancelled = false;
+        return {
+            cancel: () => {
+                if (cancelled) return;
+                this.#native.cancelListen(token);
+                cancelled = true;
+                this.#listeners--;
+                this.#updateOwner();
+            },
+        };
+    }
+
+    #iterate(subscribe, rejectOnClose = false) {
+        let values = [];
+        let offset = 0;
+        const pending = [];
+        let done = false;
+        let failure;
+        const finish = error => {
+            if (done) return;
+            done = true;
+            failure = error;
+            unsubscribe();
+            this.#iterators.delete(onClose);
+            if (failure) {
+                values = [];
+                offset = 0;
+            }
+            for (const { resolve, reject } of pending.splice(0)) {
+                if (failure) reject(failure);
+                else resolve({ value: undefined, done: true });
+            }
+        };
+        const cancel = () => {
+            values = [];
+            offset = 0;
+            failure = undefined;
+            finish();
+        };
+        const onClose = () => {
+            if (rejectOnClose) {
+                const error = new Error('DHT runner is closed');
+                error.code = 'ERR_DHT_CLOSED';
+                finish(error);
+            } else cancel();
+        };
+        const unsubscribe = subscribe(value => {
+            if (done) return;
+            const waiter = pending.shift();
+            if (waiter) waiter.resolve({ value, done: false });
+            else values.push(value);
+        }, finish);
+        this.#iterators.add(onClose);
+        return {
+            next() {
+                if (failure) return Promise.reject(failure);
+                if (offset < values.length) {
+                    const value = values[offset];
+                    values[offset++] = undefined;
+                    if (offset === values.length) {
+                        values = [];
+                        offset = 0;
+                    }
+                    return Promise.resolve({ value, done: false });
+                }
+                if (done) return Promise.resolve({ value: undefined, done: true });
+                return new Promise((resolve, reject) => pending.push({ resolve, reject }));
+            },
+            return() {
+                cancel();
+                return Promise.resolve({ value: undefined, done: true });
+            },
+            throw(error) {
+                cancel();
+                return Promise.reject(error);
+            },
+            cancel,
+            [Symbol.asyncIterator]() { return this; },
+            [Symbol.asyncDispose]() { cancel(); return Promise.resolve(); },
+        };
+    }
+
+    close() {
+        if (!this.#closing) {
+            this.#closing = this.#native.close();
+            for (const cancel of this.#iterators) cancel();
+        }
+        return this.#closing;
+    }
+    ref() { this.#native.ref(); return this; }
+    unref() { this.#native.unref(); return this; }
+    [Symbol.asyncDispose]() { return this.close(); }
+}
+
+export { DhtRunner, PublicKey, PrivateKey, Certificate, Identity };
+export const hash = native.hash;
+export const version = native.version;