librats 0.7.2 → 0.9.0

package/native-src/src/dht.h

@@ -13,6 +13,7 @@
 #include <atomic>
 #include <chrono>
 #include <memory>
+#include <random>
 #include <condition_variable>
 
 // Hash specialization for Peer and NodeId (must be defined before use in unordered_map/set)
@@ -165,8 +166,12 @@ public:
      * Constructor
      * @param port The UDP port to bind to (default: 6881)
      * @param bind_address The interface IP address to bind to (empty for all interfaces)
+     * @param data_directory Directory for routing-table persistence
+     * @param address_family Address family this node operates on. IPv4 and IPv6 form
+     *        separate Kademlia networks (BEP 32), so each family needs its own DhtClient.
      */
-    DhtClient(int port = DHT_PORT, const std::string& bind_address = "", const std::string& data_directory = "");
+    DhtClient(int port = DHT_PORT, const std::string& bind_address = "", const std::string& data_directory = "",
+              AddressFamily address_family = AddressFamily::IPv4);
     
     /**
      * Destructor
@@ -222,9 +227,33 @@ public:
     
     /**
      * Get our node ID
-     * @return The node ID
+     * @return The node ID (returned by value; the ID may be regenerated at runtime
+     *         when our external IP is learned, see set_external_ip)
      */
-    const NodeId& get_node_id() const { return node_id_; }
+    NodeId get_node_id() const { return node_id_; }
+
+    /**
+     * Set our external (public) IP address and regenerate the node ID from it per BEP 42.
+     * IPv4/IPv6 node IDs must be derived from the matching-family external address, so this
+     * is a no-op if the address family does not match this instance. Safe to call at runtime;
+     * the routing table is re-bucketed against the new ID. Non-public/invalid addresses are ignored.
+     * @param ip External IP address as seen by the network (e.g. from STUN or DHT "ip" voting)
+     */
+    void set_external_ip(const std::string& ip);
+
+    /**
+     * Get the external address currently used to derive our node ID ("" if none/random).
+     */
+    std::string get_external_address() const;
+
+    /**
+     * BEP 42 helpers (public for testing / explicit use).
+     * generate_node_id_from_ip: build an IP-derived node ID (random where BEP 42 allows).
+     * verify_node_id_for_ip: check whether a node ID is valid for the given source IP
+     *   (always true for non-public IPs, which cannot be verified).
+     */
+    static bool generate_node_id_from_ip(const std::string& ip, NodeId& out, std::mt19937& gen);
+    static bool verify_node_id_for_ip(const NodeId& id, const std::string& ip);
     
     /**
      * Get number of nodes in routing table
@@ -337,11 +366,26 @@ public:
 #endif // RATS_SEARCH_FEATURES
     
     /**
-     * Get default BitTorrent DHT bootstrap nodes
+     * Get default BitTorrent DHT bootstrap nodes.
+     * Hostnames are resolved per-family at send time, so the same list serves both
+     * IPv4 and IPv6 (nodes without an AAAA record are simply skipped on IPv6).
      * @return Vector of bootstrap nodes
      */
     static std::vector<Peer> get_default_bootstrap_nodes();
+
+    /**
+     * Address family this DHT node operates on.
+     */
+    AddressFamily address_family() const { return address_family_; }
+    bool is_ipv6() const { return address_family_ == AddressFamily::IPv6; }
     
+    /**
+     * Compute the routing-table persistence file path for this instance.
+     * Includes the address family so the IPv4 and IPv6 nodes (which may share a port)
+     * never overwrite each other's saved state.
+     */
+    std::string routing_table_file_path() const;
+
     /**
      * Save routing table to disk
      * @return true if successful, false otherwise
@@ -364,10 +408,23 @@ private:
     int port_;
     std::string bind_address_;
     std::string data_directory_;
-    NodeId node_id_;
+    AddressFamily address_family_;  // IPv4 or IPv6 (this node's Kademlia network)
+    NodeId node_id_;                // protected by routing_table_mutex_ for writes; lock-free reads are benign
     socket_t socket_;
     std::atomic<bool> running_;
-    
+
+    // BEP 42: external-IP-derived node ID.
+    // We learn our external address from the top-level "ip" field other nodes echo back in
+    // their responses, and vote across distinct responders before trusting it (so a single
+    // malicious node cannot poison our node ID). external_address_/voting are guarded by
+    // external_ip_mutex_, which is NEVER held while acquiring any other DHT mutex.
+    std::string external_address_;                          // IP currently used to derive node_id_ ("" = random)
+    std::unordered_map<std::string, int> external_ip_votes_;// reported external IP -> vote count
+    std::unordered_set<std::string> external_ip_voters_;    // responder IPs already counted (dedup)
+    mutable std::mutex external_ip_mutex_;                  // Lock order: independent (never nested with others)
+    static constexpr int EXTERNAL_IP_VOTE_THRESHOLD = 5;    // distinct responders that must agree
+    static constexpr size_t MAX_EXTERNAL_IP_VOTERS = 1000;  // cap voter set to bound memory
+
     // ============================================================================
     // MUTEX LOCK ORDER - CRITICAL: Always acquire mutexes in this order to avoid deadlocks
     // ============================================================================
@@ -507,6 +564,9 @@ private:
     // Used to decide whether to respond with neighbor_id (spider contact) or real node_id (organic DHT)
     std::unordered_set<std::string> spider_contacted_ips_;
     
+    // Rate-limit re-bootstrapping in spider_walk to avoid DDOSing bootstrap nodes
+    std::chrono::steady_clock::time_point last_spider_bootstrap_{};  // epoch = never bootstrapped
+    
     // Spider helper methods
     void add_spider_node(const DhtNode& node);
     void add_spider_nodes(const std::vector<DhtNode>& nodes);
@@ -549,6 +609,10 @@ private:
     int get_bucket_index(const NodeId& id);
     
     NodeId generate_node_id();
+    // BEP 42 internals
+    static bool is_public_address(const std::string& ip);
+    void rebuild_routing_table_unlocked();  // re-bucket all nodes after node_id_ changed (routing_table_mutex_ held)
+    void maybe_update_external_ip(const std::string& reported_ip, const Peer& responder);
     NodeId xor_distance(const NodeId& a, const NodeId& b);
     bool is_closer(const NodeId& a, const NodeId& b, const NodeId& target);