Initial Haiku UI added

Fix default parameter for httproxy.keys, socksproxy.keys

.github/workflows/build-deb.yml

@@ -28,7 +28,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        dist: ['buster', 'bullseye', 'bookworm']
+        dist: ['bullseye', 'bookworm', 'trixie']
 
     steps:
     - name: Checkout

.github/workflows/build-windows.yml

@@ -128,8 +128,13 @@ jobs:
         cache: true
         update: true
 
-    - name: Clone MinGW packages repository
-      run: git clone https://github.com/msys2/MINGW-packages
+    - name: Clone MinGW packages repository and revert boost to 1.85.0
+      run: |
+        git clone https://github.com/msys2/MINGW-packages
+        cd MINGW-packages
+        git checkout 4cbb366edf2f268ac3146174b40ce38604646fc5 mingw-w64-boost
+        cd mingw-w64-boost
+        sed -i 's/boostorg.jfrog.io\/artifactory\/main/archives.boost.io/' PKGBUILD
 
     # headers
     - name: Get headers package version
@@ -205,26 +210,30 @@ jobs:
       run: |
         cd MINGW-packages/mingw-w64-openssl
         gpg --recv-keys D894E2CE8B3D79F5
+        gpg --recv-keys 216094DFD0CB81EF
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install openssl package
       run: pacman --noconfirm -U MINGW-packages/mingw-w64-openssl/mingw-w64-i686-*-any.pkg.tar.zst
 
     # Boost
-    - name: Get boost package version
-      id:  version-boost
-      run: |
-        echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+    #- name: Get boost package version
+    #  id:  version-boost
+    #  run: |
+    #    echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache boost package
       uses: actions/cache@v4
       id: cache-boost
       with:
         path: MINGW-packages/mingw-w64-boost/*.zst
-        key: winxp-winpthreads-${{ steps.version-boost.outputs.version }}
+        key: winxp-boost-1.85.0+crt-${{ steps.version-headers.outputs.version }}+ossl-${{ steps.version-openssl.outputs.version }}
+    # Rebuild package if packages above has changed
     - name: Build WinXP-capable boost package
       if: steps.cache-boost.outputs.cache-hit != 'true'
       run: |
         cd MINGW-packages/mingw-w64-boost
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
+    - name: Remove boost packages
+      run: pacman --noconfirm -R mingw-w64-i686-boost mingw-w64-i686-boost-libs
     - name: Install boost package
       run: pacman --noconfirm -U MINGW-packages/mingw-w64-boost/mingw-w64-i686-*-any.pkg.tar.zst
 

.github/workflows/docker.yml

@@ -108,7 +108,7 @@ jobs:
       uses: Noelware/docker-manifest-action@master
       with:
         inputs: purplei2p/i2pd:latest
-        images: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
+        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
         push: true
 
     - name: Create and push latest manifest image to GHCR
@@ -116,7 +116,7 @@ jobs:
       uses: Noelware/docker-manifest-action@master
       with:
         inputs: ghcr.io/purplei2p/i2pd:latest
-        images: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
+        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
         push: true
 
     - name: Store release version to env
@@ -128,7 +128,7 @@ jobs:
       uses: Noelware/docker-manifest-action@master
       with:
         inputs: purplei2p/i2pd:latest,purplei2p/i2pd:latest-release,purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        images: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
+        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
         push: true
 
     - name: Create and push release manifest to GHCR
@@ -136,5 +136,5 @@ jobs:
       uses: Noelware/docker-manifest-action@master
       with:
         inputs: ghcr.io/purplei2p/i2pd:latest,ghcr.io/purplei2p/i2pd:latest-release,ghcr.io/purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        images: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
+        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
         push: true

ChangeLog

@@ -1,6 +1,167 @@
 # for this file format description,
 # see https://github.com/olivierlacan/keep-a-changelog
 
+## [2.58.0] - 2025-09-08
+### Added
+- Post-quantum end-to-end crypto(ML-KEM-512, ML-KEM-768, ML-KEM-1024) support if openssl >= 3.5.0
+- Datagram2 and Datagram3
+- SAM PING command
+- Support boost 1.89
+- Specify light or dark theme for webconsole
+- "ssu2.firewalled4" and "ssu2.firewalled6" params to force Firewalled even if network is OK
+- Streaming ping through BOB
+- Ability to specify bandwidth with "mb" and "gb" suffixes
+- "i2p.streaming.maxWindowSize" and "i2p.streaming.dontSign" params
+### Changed
+- Don't verify streaming SYN packet signature if comes from an ECIESx25519 session 
+- Non-blocking mode for UDP sockets in UDP tunnels
+- Accept "HELLO VERSION" without "MIN" and "MAX" in SAM
+- Try to resolve host again in server tunnel if failed before
+- Don't call deprecated functions for openssl 3
+- Enable post-quantum crypto by default if supported
+- Create unique loopback address from fd00::/8 range for ::1 if explicitly set in server tunnels
+- Limit number of outbound streaming packets if the peer can't handle them
+- Don't show Network status if ipv6 only
+- Reseeds list
+### Fixed
+- Version in I2CP SetDate message
+- Crash when SAM session is getting closed
+- Max UDP buffer size for OpenBSD
+- Lack of file descriptors for Haiku
+- Outgoing stream constantly re-requests LeaseSet if the remote peer has gone away
+- Numeric value for "i2p.streaming.answerPings" param
+- 'R' and 'U' router caps together if operating through a proxy
+
+## [2.57.0] - 2025-06-02
+### Added
+- Local domain sockets for I2PControl
+- "keys=shareddest" tunnel param to run on shared local destination
+- HTTP and SOCKS proxy through BOB
+- Localization to Hebrew and Hindi
+- NTCP2 probing resistance
+- Support SAM v1 datagram sessions without port
+- OpenIndiana support
+### Changed
+- Don't request LeaseSet until I2CP destination is ready
+- Keep receiving new data from I2PTunnel/SAM socket while previous is being sent to stream
+- Insert phony record to inbound tunnel build message with real x25519 ephemeral key
+- Set min peer test version to 0.9.62
+- Increase I2NP message expiration timeout in SSU2
+- Cleanup ECIESx25519 new session reply keys on Alice side
+- Reduced router profile persist interval to 22 minutes
+- SSU2 max padding size to 32 bytes
+- Send SSU2 path challenge of 8 bytes. Add datetime and address blocks
+- Don't delete trusted routers from netdb
+- Disable loss-control in streaming
+- Reseeds list
+### Fixed
+- Crash after SAM stream disconnect
+- FORWARD session host handling in SAM
+- x86 build for Haiku
+- SSU2 session's remote endpoint after receiving path response
+
+## [2.56.0] - 2025-02-11
+### Added
+- Config params for shared local destination
+- AddressBook full addresses cache
+- Decline transit tunnel to duplicated router
+- Recreate tunnels in random order
+### Changed
+- Exclude disk operations from SSU2 and NTCP2 threads
+- Set minimal version for peer test to 0.9.62
+- Send ack requested flag after second SSU2 resend attempt
+- Shorter ECIESx25519 ack request interval for datagram and I2CP sessions
+- Don't change datagram routing path too often if unidirectional data stream
+- Reduce LeaseSet and local RouterInfo publishing confirmation intervals
+- Don't delete buffer of connected routers or if an update received
+- Smaller RouterInfo request timeout if sent directly
+- Persist local RouterInfo in separate thread
+- Don't recalculate and process ranges for every SSU2 Ack block
+- Reseeds list
+### Fixed
+- Termination deadlock if SAM session is active
+- Race condition at tunnel endpoint
+- Inbound tunnel build encryption
+
+## [2.55.0] - 2024-12-30
+### Added
+- Support boost 1.87
+- "i2p.streaming.maxConcurrentStreams" tunnel's param to limit number of simultaneous streams
+- Separate thread for tunnel build requests
+- Show next peer and connectivity on "Transit tunnels" page
+- Tunnel name for local destination thread
+- Throttle incoming ECIESx25519 sessions
+- Send tunnel data to transport session directly if possible
+- Publish 'R' cap for yggdrasil-only routers, and 'U' cap for routers through proxy
+- Random tunnel rejection when medium congestion
+- Save unreachable router's endpoint to use it next time without introducers
+- Recognize symmetric NAT from peer test message 7
+- Resend HolePunch and RelayResponse messages
+### Changed
+- Removed own implementation of AESNI and always use one from openssl
+- Renamed main thread to i2pd-daemon
+- Set i2p.streaming.profile=2 for shared local destination
+- Reduced LeaseSet and RouterInfo lookup timeouts
+- Cleanup ECIES sessions and tags more often
+- Check LeaseSet expiration time
+- Handle NTCP2 session handshakes in separate thread
+- Limit last decline time by 1.5 hours in router's profile
+- Don't handle RelayRequest and RelayIntro with same nonce twice
+- Increased hole punch expiration interval
+- Send peer test message 6 with delay if message 4 was received before message 5
+- Pre-calculate more x25519 keys for transports in runtime
+- Don't request LeaseSet for incoming stream
+- Terminate incoming stream right away if no remote LeaseSet
+- Handle choked, new RTO and window size calculation and resetting algorithm for streams
+### Fixed
+- Empty string in addressbook subscriptions
+- ECIESx25519 sessions without destination
+- Missing RouterInfo buffer in NetDb
+- Invalid I2PControl certificate
+- Routers disappear from NetDb when offline
+- Peer test message 6 sent to unknown endpoint
+- Race condition with LeaseSet update
+- Excessive CPU usage by streams
+- Crash on shutdown
+
+## [2.54.0] - 2024-10-06
+### Added
+- Maintain recently connected routers list to avoid false-positive peer test
+- Limited connectivity mode(through proxy)
+- "i2p.streaming.profile" tunnel's param to let tunnel select also low-bandwidth routers
+- Limit stream's inbound speed
+- Periodic ack requests in ratchets session
+- Set congestion cap G immediately if through proxy
+- Show tunnel's routers bandwidth caps in web console
+- Handle immediate ack requested flag in SSU2 data packets
+- Resend and ack peer test and relay messages
+- "senduseragent" HTTP proxy's param to pass through user's User-Agent
+### Changed
+- Exclude 'N' routers from high-bandwidth routers for client tunnels
+- C++11 support has been dropped, the minimal requirement is C++17 now, C++20 for some compilers
+- Removed dependency from boost::date_time and boost::filesystem
+- Set default i2cp.leaseSetEncType to 0,4 and to 4 for server tunnels
+- Handle i2cp.inboundlimit and i2cp.outboundlimit params in I2CP
+- Publish LeaseSet with new timestamp update if tunnel was replaced in the same second
+- Increase max number of generated tags to 800 per tagset
+- Routing path expiration by time instead num attempts
+- Save timestamp from epoch instead local time to profiles
+- Update introducer's iTag if session to introducer was replaced to new one
+- RTT, window size and number of NACKs calculation for streaming
+- Don't select same peer for tunnel too often
+- Use WinApi for data path UTF-8 conversion for Windows
+### Fixed
+- Jump link crash if address book is disabled
+- Race condition if connect through an introducer
+- "Date" header in I2PControl response
+- Incomplete response from web console
+- AEAD verification with LibreSSL
+- Number of generated tags and new keys for follow-on tagsets
+- Expired leases in LeaseSet
+- Attempts to send HolePunch to 0.0.0.0
+- Incorrect options size in quick ack streaming packet
+- Low bandwidth router appeared as first peer in high-bandwidth client tunnel
+
 ## [2.53.1] - 2024-07-29
 ### Changed
 - I2CP performance improvement

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2013-2023, The PurpleI2P Project
+Copyright (c) 2013-2025, The PurpleI2P Project
 
 All rights reserved.
 

Makefile

@@ -29,7 +29,6 @@ DAEMON_SRC_DIR := daemon
 # import source files lists
 include filelist.mk
 
-USE_AESNI       := $(or $(USE_AESNI),yes)
 USE_STATIC      := $(or $(USE_STATIC),no)
 USE_UPNP        := $(or $(USE_UPNP),no)
 DEBUG           := $(or $(DEBUG),yes)
@@ -52,7 +51,6 @@ ifneq (, $(DESTDIR))
 endif
 
 ifneq (, $(findstring darwin, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	ifeq ($(HOMEBREW),1)
 		include Makefile.homebrew
 	else
@@ -62,20 +60,18 @@ else ifneq (, $(findstring mingw, $(SYS))$(findstring windows-gnu, $(SYS))$(find
 	DAEMON_SRC += Win32/DaemonWin32.cpp Win32/Win32App.cpp Win32/Win32Service.cpp Win32/Win32NetState.cpp
 	include Makefile.mingw
 else ifneq (, $(findstring linux, $(SYS))$(findstring gnu, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	include Makefile.linux
 else ifneq (, $(findstring freebsd, $(SYS))$(findstring openbsd, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	include Makefile.bsd
 else ifneq (, $(findstring haiku, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	include Makefile.haiku
+else ifneq (, $(findstring solaris, $(SYS)))
+	include Makefile.solaris
 else # not supported
 	$(error Not supported platform)
 endif
 
 INCFLAGS += -I$(LIB_SRC_DIR) -I$(LIB_CLIENT_SRC_DIR) -I$(LANG_SRC_DIR)
-DEFINES += -DOPENSSL_SUPPRESS_DEPRECATED
 NEEDED_CXXFLAGS += -MMD -MP
 
 ifeq ($(USE_GIT_VERSION),yes)

Makefile.bsd

@@ -1,18 +1,22 @@
 CXX = clang++
 CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wextra -Wno-unused-parameter -pedantic -Wno-misleading-indentation
+DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
+INCFLAGS = -I/usr/include/ -I/usr/local/include/
+LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
+LDLIBS = -lssl -lcrypto -lz -lpthread -lboost_program_options
+
 ## NOTE: NEEDED_CXXFLAGS is here so that custom CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
 ## For example, when adding 'hardening flags' to the build
 ## (e.g. -fstack-protector-strong -Wformat -Werror=format-security), we do not want to remove
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FLAGS to work at build-time.
-CXXVER := $(shell $(CXX) -dumpversion)
-ifeq (${CXXVER}, "4.2.1") # older clang always returned 4.2.1
-	NEEDED_CXXFLAGS = -std=c++11
-else # newer versions support C++17
+CXXVER := $(shell $(CXX) -dumpversion|cut -c 1-2)
+ifeq (${CXXVER}, "4.") # older clang always returned 4.2.1
+	$(error Compiler too old)
+else ifeq (${CXXVER}, ${filter ${CXXVER},16 17 18 19})  # clang 16 - 19
+	NEEDED_CXXFLAGS = -std=c++20
+else
 	NEEDED_CXXFLAGS = -std=c++17
 endif
-DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
-LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
-LDLIBS = -lcrypto -lssl -lz -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
+

Makefile.haiku

@@ -1,8 +1,12 @@
+ifeq ($(shell $(CXX) -dumpmachine | cut -c 1-4), i586)
+CXX = g++-x86
+else
 CXX = g++
-CXXFLAGS := -Wall -std=c++11
+endif
+CXXFLAGS := -Wall -std=c++20
 INCFLAGS = -I/system/develop/headers
 DEFINES = -D_DEFAULT_SOURCE -D_GNU_SOURCE
-LDLIBS = -lbe -lbsd -lnetwork -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
+LDLIBS = -lbe -lbsd -lnetwork -lz -lssl -lcrypto -lboost_program_options -lpthread
 
 ifeq ($(USE_UPNP),yes)
 	DEFINES += -DUSE_UPNP

Makefile.homebrew

@@ -5,20 +5,20 @@ SSLROOT = ${BREWROOT}/opt/openssl@1.1
 UPNPROOT = ${BREWROOT}/opt/miniupnpc
 
 CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wno-overloaded-virtual
-NEEDED_CXXFLAGS ?= -std=c++11
+NEEDED_CXXFLAGS ?= -std=c++17
 INCFLAGS ?= -I${SSLROOT}/include -I${BOOSTROOT}/include
 LDFLAGS ?= ${LD_DEBUG}
 DEFINES += -DMAC_OSX
 
 ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz ${SSLROOT}/lib/libcrypto.a ${SSLROOT}/lib/libssl.a ${BOOSTROOT}/lib/libboost_system.a ${BOOSTROOT}/lib/libboost_date_time.a ${BOOSTROOT}/lib/libboost_filesystem.a ${BOOSTROOT}/lib/libboost_program_options.a
+	LDLIBS = -lz ${SSLROOT}/lib/libcrypto.a ${SSLROOT}/lib/libssl.a ${BOOSTROOT}/lib/libboost_system.a ${BOOSTROOT}/lib/libboost_filesystem.a ${BOOSTROOT}/lib/libboost_program_options.a
 ifeq ($(USE_UPNP),yes)
 	LDLIBS += ${UPNPROOT}/lib/libminiupnpc.a
 endif
 	LDLIBS +=  -lpthread -ldl
 else
 	LDFLAGS += -L${SSLROOT}/lib -L${BOOSTROOT}/lib
-	LDLIBS = -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
+	LDLIBS = -lz -lssl -lcrypto -lboost_program_options -lpthread
 ifeq ($(USE_UPNP),yes)
 	LDFLAGS += -L${UPNPROOT}/lib
 	LDLIBS += -lminiupnpc
@@ -30,13 +30,6 @@ ifeq ($(USE_UPNP),yes)
 	INCFLAGS += -I${UPNPROOT}/include
 endif
 
-ifeq ($(USE_AESNI),yes)
-ifneq (, $(findstring i386, $(SYS))$(findstring i686, $(SYS))$(findstring x86_64, $(SYS))) # only x86-based CPU supports that
-	NEEDED_CXXFLAGS += -maes
-	DEFINES += -D__AES__
-endif
-endif
-
 install: all
 	install -d ${PREFIX}/bin
 	install -m 755 ${I2PD} ${PREFIX}/bin

Makefile.linux

@@ -9,24 +9,17 @@ LDFLAGS ?= ${LD_DEBUG}
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FDLAGS to work at build-time.
 
-# detect proper flag for c++11 support by compilers
+# detect proper flag for c++17 support by compilers
 CXXVER := $(shell $(CXX) -dumpversion)
 ifeq ($(shell expr match $(CXX) 'clang'),5)
-	NEEDED_CXXFLAGS += -std=c++11
-else ifeq ($(shell expr match ${CXXVER} "4\.[0-9][0-9]"),4) # gcc >= 4.10
-	NEEDED_CXXFLAGS += -std=c++11
-else ifeq ($(shell expr match ${CXXVER} "4\.[8-9]"),3) # gcc 4.8 - 4.9
-	NEEDED_CXXFLAGS += -std=c++11 -D_GLIBCXX_USE_NANOSLEEP=1
-else ifeq ($(shell expr match ${CXXVER} "[5-6]"),1) # gcc 5 - 6
-	NEEDED_CXXFLAGS += -std=c++11
-	LDLIBS = -latomic
-else ifeq ($(shell expr match ${CXXVER} "[7-9]"),1) # gcc 7 - 9
 	NEEDED_CXXFLAGS += -std=c++17
-	LDLIBS = -latomic
-else ifeq ($(shell expr match ${CXXVER} "1[0-9]"),2) # gcc 10+
-#	NEEDED_CXXFLAGS += -std=c++20
+else ifeq ($(shell expr match ${CXXVER} "[8-9]"),1) # gcc 8 - 9
 	NEEDED_CXXFLAGS += -std=c++17
-	LDLIBS = -latomic
+	LDLIBS = -lboost_system -lstdc++fs
+else ifeq ($(shell expr match ${CXXVER} "1[0-2]"),2) # gcc 10 - 12
+	NEEDED_CXXFLAGS += -std=c++17
+else ifeq ($(shell expr match ${CXXVER} "1[3-9]"),2) # gcc 13+
+	NEEDED_CXXFLAGS += -std=c++20
 else # not supported
 $(error Compiler too old)
 endif
@@ -38,9 +31,6 @@ ifeq ($(USE_STATIC),yes)
 #   Using 'getaddrinfo' in statically linked applications requires at runtime
 #   the shared libraries from the glibc version used for linking
 	LIBDIR := /usr/lib/$(SYS)
-	LDLIBS += $(LIBDIR)/libboost_system.a
-	LDLIBS += $(LIBDIR)/libboost_date_time.a
-	LDLIBS += $(LIBDIR)/libboost_filesystem.a
 	LDLIBS += $(LIBDIR)/libboost_program_options.a
 	LDLIBS += $(LIBDIR)/libssl.a
 	LDLIBS += $(LIBDIR)/libcrypto.a
@@ -50,7 +40,7 @@ ifeq ($(USE_UPNP),yes)
 endif
 	LDLIBS += -lpthread -ldl
 else
-	LDLIBS += -lcrypto -lssl -lz -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
+	LDLIBS += -lssl -lcrypto -lz -lboost_program_options -lpthread -latomic
 ifeq ($(USE_UPNP),yes)
 	LDLIBS += -lminiupnpc
 endif
@@ -61,13 +51,6 @@ ifeq ($(USE_UPNP),yes)
 	DEFINES += -DUSE_UPNP
 endif
 
-ifeq ($(USE_AESNI),yes)
-ifneq (, $(findstring i386, $(SYS))$(findstring i686, $(SYS))$(findstring x86_64, $(SYS))) # only x86-based CPU supports that
-	NEEDED_CXXFLAGS += -maes
-	DEFINES += -D__AES__
-endif
-endif
-
 install: all
 	install -d ${PREFIX}/bin
 	install -m 755 ${I2PD} ${PREFIX}/bin

Makefile.mingw

@@ -7,7 +7,7 @@ CXXFLAGS := $(CXX_DEBUG) -fPIC -msse
 INCFLAGS := -I$(DAEMON_SRC_DIR) -IWin32
 LDFLAGS := ${LD_DEBUG} -static -fPIC -msse
 
-NEEDED_CXXFLAGS += -std=c++17
+NEEDED_CXXFLAGS += -std=c++20
 DEFINES += -DWIN32_LEAN_AND_MEAN
 
 # UPNP Support
@@ -16,9 +16,11 @@ ifeq ($(USE_UPNP),yes)
 	LDLIBS = -lminiupnpc
 endif
 
+ifeq ($(USE_WINXP_FLAGS), yes)
+	DEFINES += -DWINVER=0x0501 -D_WIN32_WINNT=0x0501
+endif
+
 LDLIBS += \
-	$(MINGW_PREFIX)/lib/libboost_system-mt.a \
-	$(MINGW_PREFIX)/lib/libboost_date_time-mt.a \
 	$(MINGW_PREFIX)/lib/libboost_filesystem-mt.a \
 	$(MINGW_PREFIX)/lib/libboost_program_options-mt.a \
 	$(MINGW_PREFIX)/lib/libssl.a \
@@ -40,16 +42,6 @@ ifeq ($(USE_WIN32_APP), yes)
 	DAEMON_OBJS += $(patsubst %.rc,obj/%.o,$(DAEMON_RC))
 endif
 
-ifeq ($(USE_WINXP_FLAGS), yes)
-	DEFINES += -DWINVER=0x0501 -D_WIN32_WINNT=0x0501
-endif
-
-ifeq ($(USE_AESNI),yes)
-	NEEDED_CXXFLAGS += -maes
-	LDFLAGS += -maes
-	DEFINES += -D__AES__
-endif
-
 ifeq ($(USE_ASLR),yes)
 	LDFLAGS += -Wl,--nxcompat -Wl,--high-entropy-va -Wl,--dynamicbase,--export-all-symbols
 endif

Makefile.osx

@@ -1,5 +1,5 @@
 CXX = clang++
-CXXFLAGS := ${CXX_DEBUG} -Wall -std=c++11
+CXXFLAGS := ${CXX_DEBUG} -Wall -std=c++17
 INCFLAGS = -I/usr/local/include
 DEFINES := -DMAC_OSX
 LDFLAGS := -Wl,-rpath,/usr/local/lib -L/usr/local/lib
@@ -7,9 +7,9 @@ LDFLAGS += -Wl,-dead_strip
 LDFLAGS += -Wl,-dead_strip_dylibs
 
 ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz /usr/local/lib/libcrypto.a /usr/local/lib/libssl.a /usr/local/lib/libboost_system.a /usr/local/lib/libboost_date_time.a /usr/local/lib/libboost_filesystem.a /usr/local/lib/libboost_program_options.a -lpthread
+	LDLIBS = -lz /usr/local/lib/libssl.a /usr/local/lib/libcrypto.a /usr/local/lib/libboost_system.a /usr/local/lib/libboost_filesystem.a /usr/local/lib/libboost_program_options.a -lpthread
 else
-	LDLIBS = -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
+	LDLIBS = -lz -lssl -lcrypto -lboost_program_options -lpthread
 endif
 
 ifeq ($(USE_UPNP),yes)
@@ -25,9 +25,5 @@ endif
 OSARCH = $(shell uname -p)
 
 ifneq ($(OSARCH),powerpc)
-	ifeq ($(USE_AESNI),yes)
-		CXXFLAGS += -D__AES__ -maes
-	else
-		CXXFLAGS += -msse
-	endif
+	CXXFLAGS += -msse
 endif

Makefile.solaris

@@ -0,0 +1,9 @@
+CXX = g++
+INCFLAGS = -I/usr/openssl/3/include
+CXXFLAGS := -Wall -std=c++20
+LDLIBS = -L/usr/openssl/3/lib/64 -lssl -lcrypto -lboost_program_options -lz -lpthread -lsocket
+
+ifeq ($(USE_UPNP),yes)
+	DEFINES += -DUSE_UPNP
+	LDLIBS += -lminiupnpc
+endif

README.md

@@ -3,6 +3,7 @@
 [![License](https://img.shields.io/github/license/PurpleI2P/i2pd.svg)](https://github.com/PurpleI2P/i2pd/blob/openssl/LICENSE)
 [![Packaging status](https://repology.org/badge/tiny-repos/i2pd.svg)](https://repology.org/project/i2pd/versions)
 [![Docker Pulls](https://img.shields.io/docker/pulls/purplei2p/i2pd)](https://hub.docker.com/r/purplei2p/i2pd)
+[![Github Downloads](https://img.shields.io/github/downloads/PurpleI2P/i2pd/total.svg)]()
 [![Crowdin](https://badges.crowdin.net/i2pd/localized.svg)](https://crowdin.com/project/i2pd)
 
 *note: i2pd for Android can be found in [i2pd-android](https://github.com/PurpleI2P/i2pd-android) repository and with Qt GUI in [i2pd-qt](https://github.com/PurpleI2P/i2pd-qt) repository*
@@ -77,7 +78,7 @@ Build instructions:
 * Docker image - [![Build containers](https://github.com/PurpleI2P/i2pd/actions/workflows/docker.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/docker.yml)
 * Snap - [![i2pd](https://snapcraft.io/i2pd/badge.svg)](https://snapcraft.io/i2pd) [![i2pd](https://snapcraft.io/i2pd/trending.svg?name=0)](https://snapcraft.io/i2pd)
 * FreeBSD - [![Build on FreeBSD](https://github.com/PurpleI2P/i2pd/actions/workflows/build-freebsd.yml/badge.svg)](https://github.com/PurpleI2P/i2pd/actions/workflows/build-freebsd.yml)
-* Android - [![Android CI](https://github.com/PurpleI2P/i2pd-android/actions/workflows/android.yml/badge.svg)](https://github.com/PurpleI2P/i2pd-android/actions/workflows/android.yml)
+* Android
 * iOS
 
 Using i2pd

Win32/Win32App.cpp

@@ -313,7 +313,7 @@ namespace win32
 					}
 					case ID_DATADIR:
 					{
-						std::string datadir(i2p::fs::GetUTF8DataDir());
+						std::string datadir(i2p::fs::GetDataDir());
 						ShellExecute(NULL, "explore", datadir.c_str(), NULL, NULL, SW_SHOWNORMAL);
 						return 0;
 					}
@@ -355,9 +355,7 @@ namespace win32
 						}
 					}
 				}
-#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
-#endif
 			}
 			case WM_TRAYICON:
 			{

Win32/Win32NetState.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *

Win32/Win32NetState.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *

build/CMakeLists.txt

@@ -29,7 +29,6 @@ project(
 )
 
 # configurable options
-option(WITH_AESNI           "Use AES-NI instructions set"             ON)
 option(WITH_HARDENING       "Use hardening compiler flags"            OFF)
 option(WITH_LIBRARY         "Build library"                           ON)
 option(WITH_BINARY          "Build binary"                            ON)
@@ -156,20 +155,6 @@ else()
   endif()
   set(CMAKE_CXX_FLAGS_MINSIZEREL "${CMAKE_CXX_FLAGS_MINSIZEREL} -ffunction-sections -fdata-sections")
   set(CMAKE_EXE_LINKER_FLAGS_MINSIZEREL "-Wl,--gc-sections") # -flto is added from above
-
-  # check for c++17 & c++11 support
-  include(CheckCXXCompilerFlag)
-
-  CHECK_CXX_COMPILER_FLAG("-std=c++17" CXX17_SUPPORTED)
-  CHECK_CXX_COMPILER_FLAG("-std=c++11" CXX11_SUPPORTED)
-
-  if(CXX17_SUPPORTED)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
-  elseif(CXX11_SUPPORTED)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
-  else()
-    message(SEND_ERROR "C++17 nor C++11 standard not seems to be supported by compiler. Too old version?")
-  endif()
 endif()
 
 if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
@@ -199,16 +184,6 @@ if(UNIX)
   endif()
 endif()
 
-# Note: AES-NI and AVX is available on x86-based CPU's.
-# Here also ARM64 implementation, but currently we don't support it.
-# MSVC is not supported due to different ASM processing, so we hope OpenSSL has its own checks to run optimized code.
-if(WITH_AESNI AND (ARCHITECTURE MATCHES "x86_64" OR ARCHITECTURE MATCHES "i386"))
-  if(NOT MSVC)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -maes")
-  endif()
-  add_definitions(-D__AES__)
-endif()
-
 if(WITH_ADDRSANITIZER)
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address -fno-omit-frame-pointer")
   set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fsanitize=address")
@@ -223,6 +198,10 @@ if(WITH_THREADSANITIZER)
   endif()
 endif()
 
+if (CMAKE_COMPILER_IS_GNUCC AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 10.0 AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 8.0) # gcc 8-9
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "stdc++fs")
+endif()
+
 # Use std::atomic instead of GCC builtins on macOS PowerPC:
 # For more information refer to: https://github.com/PurpleI2P/i2pd/issues/1726#issuecomment-1306335111
 # This has been fixed in Boost 1.81, nevertheless we retain the setting for the sake of compatibility.
@@ -277,14 +256,14 @@ else()
   if(NOT MSVC)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC")
   endif()
-  add_definitions(-DBOOST_ATOMIC_DYN_LINK -DBOOST_SYSTEM_DYN_LINK -DBOOST_FILESYSTEM_DYN_LINK -DBOOST_PROGRAM_OPTIONS_DYN_LINK -DBOOST_DATE_TIME_DYN_LINK -DBOOST_REGEX_DYN_LINK)
+  add_definitions(-DBOOST_ATOMIC_DYN_LINK -DBOOST_SYSTEM_DYN_LINK -DBOOST_FILESYSTEM_DYN_LINK -DBOOST_PROGRAM_OPTIONS_DYN_LINK)
   if(WIN32)
     set(Boost_USE_STATIC_LIBS OFF)
     set(Boost_USE_STATIC_RUNTIME OFF)
   endif()
 endif()
 
-find_package(Boost REQUIRED COMPONENTS system filesystem program_options date_time OPTIONAL_COMPONENTS atomic)
+find_package(Boost REQUIRED COMPONENTS system filesystem program_options)
 if(NOT DEFINED Boost_FOUND)
   message(SEND_ERROR "Boost is not found, or your boost version was below 1.46. Please download Boost!")
 endif()
@@ -312,6 +291,26 @@ if(ZLIB_FOUND)
   link_directories(${ZLIB_ROOT}/lib)
 endif()
 
+# C++ standard to use, based on compiler and version of boost
+if(NOT MSVC)
+# check for c++20 & c++17 support
+  include(CheckCXXCompilerFlag)
+
+  if(Boost_VERSION VERSION_GREATER_EQUAL "1.83") # min boost version for c++20
+    CHECK_CXX_COMPILER_FLAG("-std=c++20" CXX20_SUPPORTED)
+  endif()
+  CHECK_CXX_COMPILER_FLAG("-std=c++17" CXX17_SUPPORTED)
+ 
+
+  if(CXX20_SUPPORTED)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++20")
+  elseif(CXX17_SUPPORTED)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
+  else()
+    message(SEND_ERROR "C++20 nor C++17 standard not seems to be supported by compiler. Too old version?")
+  endif()
+endif()
+
 # load includes
 include_directories(SYSTEM ${Boost_INCLUDE_DIRS} ${OPENSSL_INCLUDE_DIR} ${ZLIB_INCLUDE_DIR})
 
@@ -322,9 +321,9 @@ message(STATUS "Compiler vendor    : ${CMAKE_CXX_COMPILER_ID}")
 message(STATUS "Compiler version   : ${CMAKE_CXX_COMPILER_VERSION}")
 message(STATUS "Compiler path      : ${CMAKE_CXX_COMPILER}")
 message(STATUS "Architecture       : ${ARCHITECTURE}")
+message(STATUS "Compiler flags     : ${CMAKE_CXX_FLAGS}")
 message(STATUS "Install prefix:    : ${CMAKE_INSTALL_PREFIX}")
 message(STATUS "Options:")
-message(STATUS "  AESNI            : ${WITH_AESNI}")
 message(STATUS "  HARDENING        : ${WITH_HARDENING}")
 message(STATUS "  LIBRARY          : ${WITH_LIBRARY}")
 message(STATUS "  BINARY           : ${WITH_BINARY}")

build/cmake_modules/CheckAtomic.cmake

@@ -8,7 +8,7 @@ INCLUDE(CheckLibraryExists)
 
 function(check_working_cxx_atomics varname)
   set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -std=c++11")
+  set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -std=c++17")
   CHECK_CXX_SOURCE_COMPILES("
 #include <atomic>
 std::atomic<int> x;
@@ -25,7 +25,7 @@ endfunction(check_working_cxx_atomics)
 
 function(check_working_cxx_atomics64 varname)
   set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS "-std=c++11 ${CMAKE_REQUIRED_FLAGS}")
+  set(CMAKE_REQUIRED_FLAGS "-std=c++17 ${CMAKE_REQUIRED_FLAGS}")
   CHECK_CXX_SOURCE_COMPILES("
 #include <atomic>
 #include <cstdint>

build/cmake_modules/GetGitRevisionDescription.cmake

@@ -59,7 +59,7 @@ get_filename_component(_gitdescmoddir ${CMAKE_CURRENT_LIST_FILE} PATH)
 # function returns an empty string via _git_dir_var.
 #
 # Example: Given a path C:/bla/foo/bar and assuming C:/bla/.git exists and
-# neither foo nor bar contain a file/directory .git. This wil return
+# neither foo nor bar contain a file/directory .git. This will return
 # C:/bla/.git
 #
 function(_git_find_closest_git_dir _start_dir _git_dir_var)

contrib/certificates/reseed/arnavbhatt288_at_mail.i2p.crt

@@ -1,34 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIF2TCCA8GgAwIBAgIQIHQPtSoFU+cUpYD8PZaWZjANBgkqhkiG9w0BAQsFADB2
-MQswCQYDVQQGEwJYWDELMAkGA1UEBxMCWFgxCzAJBgNVBAkTAlhYMR4wHAYDVQQK
-ExVJMlAgQW5vbnltb3VzIE5ldHdvcmsxDDAKBgNVBAsTA0kyUDEfMB0GA1UEAwwW
-YXJuYXZiaGF0dDI4OEBtYWlsLmkycDAeFw0yMzAxMjUxODUzNDFaFw0zMzAxMjUx
-ODUzNDFaMHYxCzAJBgNVBAYTAlhYMQswCQYDVQQHEwJYWDELMAkGA1UECRMCWFgx
-HjAcBgNVBAoTFUkyUCBBbm9ueW1vdXMgTmV0d29yazEMMAoGA1UECxMDSTJQMR8w
-HQYDVQQDDBZhcm5hdmJoYXR0Mjg4QG1haWwuaTJwMIICIjANBgkqhkiG9w0BAQEF
-AAOCAg8AMIICCgKCAgEAtwG73sC0jYd3fgEzZh0SveAdUd5yD35nINJRrdPSrSwY
-n3i1qGe3fNLj877PvUDU+qiHH0fFZfyFkXTaq3TUp1u4YkmvaoPHy6FZlojB08lK
-FBm+iJ1hifQ7MFmvIKUGv+cjlN6xSoQ0U6B2QOy6iZnBgFZ/7jbRY4iZOIj7VJtY
-aodeHfy0bWe447VJovbkUi7NJPFZQS65LMcAIWcWTxrC0Gj8SmdxL3a5+hxpmmg0
-+KCQvWQDdxAQjsc16sgUCdUc6cWYO4yw9H6fgdq9GJX+LnXR9OB58GsAjjlLlFoI
-CZxdARDpoqcIj6AoKIanALf8yfbIyrqqJE47cuaqV9bht5MWKnXbwHplEkT4ZNkh
-PnRDia7B5HY3uwbt39CBm264PEWXvWG2sozTWKQqBjmMN2cj/NFDUEqKv6BggMY1
-HcqxWFKRcgKCtRvrmTmfp5l0/ou+OtUaFUg0a6Qhtb93Hj10vK6wZzidBqj0ggzB
-eJDI95b89u8JgzRoOBriuMKTc91WTkOvBLkB3dgUbUpx2p8KHjvf/pppBH9u0oxp
-qJFFK840DbnJydEvjKezeVe5Ax6YRSRxyEdKzRoWdvKVxb3qBBKMdCKTYEPxHPBu
-JMEQVUCXJMti++1KEiQGhcfWvLyT7OewbcIZNk9XWNrxlKcGrTp9AOwaaNC5m1kC
-AwEAAaNjMGEwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggr
-BgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MB8GA1UdDgQYBBZhcm5hdmJoYXR0Mjg4
-QG1haWwuaTJwMA0GCSqGSIb3DQEBCwUAA4ICAQAHiK0ld/1PF9DIhutD660/bzBg
-mF2Z76hcBqDZ8tnQai/u/RXYrH9wso9BYyrVsvk3fr6tpGT49Ian0MVpPOxMoTU2
-oBEmQlYrfclQLFsOLmA0y2r1ggXzIrt69jB710Vhwdnz09oOE8rS4E2T5oDD8Wvy
-Kony+AarRceqtkOlzyquc42KjzdrbHsosF7G2iGhNI6t+T3BfWJ+Q+d5sj3OIh6e
-gSfvHL44E4vZt6dtofRN3MAZ60kNLF5YWyaUo3Snv9Lso1IwIz3AVr5ehv+8sFL/
-KxaXdkZ5Yn2YUX7p1t4VQd+eXVPYjf1befg4PvrwSkylu3Jpee3fllZSKXeSVx9x
-jpJiq5vIakqk22pnWb1Vn7xzSW1vtEG7QLjobOr1WrcGiwdv+HKiWcXJXDzKoWXs
-h3VEfr51Kap8cIJv+D6lJIG9IcIhiQ6CXWBmtjWJvbdVwFBy1/3Fhaou9liHi+gK
-4Yh5a5OGCzc7xjtpGaTmoLEz7NzDNOdd/r840qRDOh70izzmFZd5Gwq4hoVcPJcS
-EAySwtgqK0/4d0zDd2Wg9ASJV9DnDf8QuSmHZgZ9Efs47XcWz9TvkWUS1E66AJsN
-mmI1NDQ3mv3dv5+WPq+dqqYFsnx3xWL1g5Z3buk0opeuXMzoHwM7UfN8h7Q1M5+t
-+XBgkaYA4iEwYKqlCQ==
------END CERTIFICATE-----

contrib/certificates/reseed/hiduser0_at_mail.i2p.crt

@@ -1,32 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFgTCCA2mgAwIBAgIETWAY1DANBgkqhkiG9w0BAQ0FADBxMQswCQYDVQQGEwJY
-WDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMR4wHAYDVQQKDBVJMlAgQW5vbnlt
-b3VzIE5ldHdvcmsxDDAKBgNVBAsMA0kyUDEaMBgGA1UEAwwRaGlkdXNlcjBAbWFp
-bC5pMnAwHhcNMjExMjEzMTU0MDI3WhcNMzExMjExMTU0MDI3WjBxMQswCQYDVQQG
-EwJYWDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMR4wHAYDVQQKDBVJMlAgQW5v
-bnltb3VzIE5ldHdvcmsxDDAKBgNVBAsMA0kyUDEaMBgGA1UEAwwRaGlkdXNlcjBA
-bWFpbC5pMnAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXnjJ8UQ0f
-lHHpfPMiHofBPSuL4sbOJY6fOXwPhSg/h6THh9DS/ZWmJXQ3qRD0glDVtv4/Dr/9
-ldGQ5eltF9iCFXCQlMEy2HjQrBKq0nsl7RpYK12cyMaod0kkzCUk9ITLi9CmHM3Z
-gQZcmG8TWjFEpDR+idx/QkQt2pcO4vzWlDit3Vh4ivnbX5jGQHbsVjQEMQWxr+pX
-dsS+YQpjZ6RBmrooGTPO8QDOOeYLAn0lCjmffc/kzIH9E/p4/O0rOpyhVYbdxUD1
-5wkqN9l4yrtxmORG/PudnRQQ0r4TUq8vsxfGY0Euo9IbhgXF2Parel1ZhDxB1WZV
-VwWtgLIh9jGA1UMa8SYKnEfp8LWNZ3b3mUUnZb3kMrLk6jGYRWNsHmamhd4mC7AZ
-qf/8lOkEIw3bPd3YguCDRVcLui5BwIEZmqXg8uoESxfO/sW3pBrN/8M7MkTex9kN
-vjitGDDXvenK27qmNgZxbBlX72yTSfys7XTYTLnxZC8AwdAo2Wz9Z6HhGiPonf2h
-vZkc9ZxuE0jFIrsbJra4X7iyjXgi4vV4ARNg/9Ft6F4/OIbECgeDcBQqq4TlT2bZ
-EfWVrBbqXoj5vNsLigIkd+AyUNwPYEcB5IFSiiOh98pC7BH3pg0m8U5YBjxe1i+9
-EQOOG0Qtx+JigXZHu6bGE0Twy9zy+UzoKQIDAQABoyEwHzAdBgNVHQ4EFgQUGK1b
-0DkL6aLalcfBc/Uj/SF08C0wDQYJKoZIhvcNAQENBQADggIBAMpXM82bJDpH1TlH
-TvhU3Z7nfZdvEhOQfujaFUYiuNripuEKcFGn948+DvAG0FUN+uNlJoqOVs8D7InD
-gWlA9zpqw5Cl5Hij/Wns9QbXuAHJeA23fVUoaM2A6v9ifcIQ1A+rDuRQAo6/64KW
-ChTg2e99RBpfGOyqgeh7tLLe0lPPekVpKHFuXabokaKRDuBcVHcUL4tWXe3dcyqa
-Ej/PJrrS+nWL0EGZ4q80CEd2LPuDzPxNGCJt/R7ZfadENWajcgcXGceh1QBzozrB
-SL/Ya6wF9SrsB7V/r5wX0LM4ZdDaLWbtmUe5Op0h/ZMH25Sa8xAXVz+O9L6sWSoO
-FaiYTOvAiyyPz+nsxKa3xYryDHno7eKSt+hGOcaurhxbdZaEFY/CegEc73tCt9xK
-e9qF8O/WkDLmixuErw3f5en4IfzGR7p3lJAwW/8WD8C6HS39h/eE7dVZNaWgtQnZ
-SgGjgZMTJqTcQ3aZmfuCZefxGFok8w6AIkdbnd1pdMBRjYu8aXgl2hQSB9ZADDE9
-R5d3rXi0PkSFLIvsNjVa5KXrZk/tB0Hpfmepq7CufBqjP/LG9TieRoXzLYUKFF74
-QRwjP+y7AJ+VDUTpY1NV1P+k+2raubU2bOnLF3zL5DtyoyieGPhyeMMvp0fRIxdg
-bSl5VHgPXHNM8mcnndMAuzvl7jEK
------END CERTIFICATE-----

contrib/certificates/reseed/hottuna_at_mail.i2p.crt

@@ -1,33 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFxzCCA6+gAwIBAgIQZfqn0yiJL3dGgCjeOeWS6DANBgkqhkiG9w0BAQsFADBw
-MQswCQYDVQQGEwJYWDELMAkGA1UEBxMCWFgxCzAJBgNVBAkTAlhYMR4wHAYDVQQK
-ExVJMlAgQW5vbnltb3VzIE5ldHdvcmsxDDAKBgNVBAsTA0kyUDEZMBcGA1UEAwwQ
-aG90dHVuYUBtYWlsLmkycDAeFw0xNjExMDkwMzE1MzJaFw0yNjExMDkwMzE1MzJa
-MHAxCzAJBgNVBAYTAlhYMQswCQYDVQQHEwJYWDELMAkGA1UECRMCWFgxHjAcBgNV
-BAoTFUkyUCBBbm9ueW1vdXMgTmV0d29yazEMMAoGA1UECxMDSTJQMRkwFwYDVQQD
-DBBob3R0dW5hQG1haWwuaTJwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
-AgEA21Bfgcc9VVH4l2u1YvYlTw2OPUyQb16X2IOW0PzdsUO5W78Loueu974BkiKi
-84lQZanLr0OwEopdfutGc6gegSLmwaWx5YCG5uwpLOPkDiObfX+nptH6As/B1cn+
-mzejYdVKRnWd7EtHW0iseSsILBK1YbGw4AGpXJ8k18DJSzUt2+spOkpBW6XqectN
-8y2JDSTns8yiNxietVeRN/clolDXT9ZwWHkd+QMHTKhgl3Uz1knOffU0L9l4ij4E
-oFgPfQo8NL63kLM24hF1hM/At7XvE4iOlObFwPXE+H5EGZpT5+A7Oezepvd/VMzM
-tCJ49hM0OlR393tKFONye5GCYeSDJGdPEB6+rBptpRrlch63tG9ktpCRrg2wQWgC
-e3aOE1xVRrmwiTZ+jpfsOCbZrrSA/C4Bmp6AfGchyHuDGGkRU/FJwa1YLJe0dkWG
-ITLWeh4zeVuAS5mctdv9NQ5wflSGz9S8HjsPBS5+CDOFHh4cexXRG3ITfk6aLhuY
-KTMlkIO4SHKmnwAvy1sFlsqj6PbfVjpHPLg625fdNxBpe57TLxtIdBB3C7ccQSRW
-+UG6Cmbcmh80PbsSR132NLMlzLhbaOjxeCWWJRo6cLuHBptAFMNwqsXt8xVf9M0N
-NdJoKUmblyvjnq0N8aMEqtQ1uGMTaCB39cutHQq+reD/uzsCAwEAAaNdMFswDgYD
-VR0PAQH/BAQDAgKEMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAPBgNV
-HRMBAf8EBTADAQH/MBkGA1UdDgQSBBBob3R0dW5hQG1haWwuaTJwMA0GCSqGSIb3
-DQEBCwUAA4ICAQCibFV8t4pajP176u3jx31x1kgqX6Nd+0YFARPZQjq99kUyoZer
-GyHGsMWgM281RxiZkveHxR7Hm7pEd1nkhG3rm+d7GdJ2p2hujr9xUvl0zEqAAqtm
-lkYI6uJ13WBjFc9/QuRIdeIeSUN+eazSXNg2nJhoV4pF9n2Q2xDc9dH4GWO93cMX
-JPKVGujT3s0b7LWsEguZBPdaPW7wwZd902Cg/M5fE1hZQ8/SIAGUtylb/ZilVeTS
-spxWP1gX3NT1SSvv0s6oL7eADCgtggWaMxEjZhi6WMnPUeeFY8X+6trkTlnF9+r/
-HiVvvzQKrPPtB3j1xfQCAF6gUKN4iY+2AOExv4rl/l+JJbPhpd/FuvD8AVkLMZ8X
-uPe0Ew2xv30cc8JjGDzQvoSpBmVTra4f+xqH+w8UEmxnx97Ye2aUCtnPykACnFte
-oT97K5052B1zq+4fu4xaHZnEzPYVK5POzOufNLPgciJsWrR5GDWtHd+ht/ZD37+b
-+j1BXpeBWUBQgluFv+lNMVNPJxc2OMELR1EtEwXD7mTuuUEtF5Pi63IerQ5LzD3G
-KBvXhMB0XhpE6WG6pBwAvkGf5zVv/CxClJH4BQbdZwj9HYddfEQlPl0z/XFR2M0+
-9/8nBfGSPYIt6KeHBCeyQWTdE9gqSzMwTMFsennXmaT8gyc7eKqKF6adqw==
------END CERTIFICATE-----

contrib/debian/trusty/patches/01-upnp.patch

@@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>
 
 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2022-03-23
+Last-Update: 2024-12-30
 
 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ include filelist.mk
+@@ -31,7 +31,7 @@ # import source files lists
+ include filelist.mk
  
- USE_AESNI       := $(or $(USE_AESNI),yes)
  USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)

contrib/debian/xenial/patches/01-upnp.patch

@@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>
 
 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2022-03-23
+Last-Update: 2024-12-30
 
 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ include filelist.mk
+@@ -31,7 +31,7 @@ # import source files lists
+ include filelist.mk
  
- USE_AESNI       := $(or $(USE_AESNI),yes)
  USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)

contrib/i2pd.conf

@@ -142,7 +142,9 @@ ipv6 = false
 ## Address and port service will listen on (default: 127.0.0.1:4444)
 # address = 127.0.0.1
 # port = 4444
-## Optional keys file for proxy local destination (default: http-proxy-keys.dat)
+## Optional keys file for proxy local destination (default: transient-proxy)
+## "Transient" means it changes on every new app launch 
+# If you want not change address then set like http-proxy-keys.dat
 # keys = http-proxy-keys.dat
 ## Enable address helper for adding .i2p domains with "jump URLs" (default: true)
 ## You should disable this feature if your i2pd HTTP Proxy is public,
@@ -158,10 +160,12 @@ ipv6 = false
 ## Address and port service will listen on (default: 127.0.0.1:4447)
 # address = 127.0.0.1
 # port = 4447
-## Optional keys file for proxy local destination (default: socks-proxy-keys.dat)
+## Optional keys file for proxy local destination (default: transient-proxy)
+# "Transient" means it changes on every new app launch 
+# If you don't want the address to change, set a file name like socks-proxy-keys.dat
 # keys = socks-proxy-keys.dat
 ## Socks outproxy. Example below is set to use Tor for all connections except i2p
-## Enable using of SOCKS outproxy (works only with SOCKS4, default: false)
+## Enable SOCKS outproxy (works only with SOCKS4, default: false)
 # outproxy.enabled = false
 ## Address and port of outproxy
 # outproxy = 127.0.0.1
@@ -243,12 +247,12 @@ verify = true
 ## Default: reg.i2p at "mainline" I2P Network
 # defaulturl = http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt
 ## Optional subscriptions URLs, separated by comma
-# subscriptions = http://reg.i2p/hosts.txt,http://identiguy.i2p/hosts.txt,http://stats.i2p/cgi-bin/newhosts.txt,http://rus.i2p/hosts.txt
+# subscriptions = http://reg.i2p/hosts.txt,http://identiguy.i2p/hosts.txt,http://stats.i2p/cgi-bin/newhosts.txt
 
 [limits]
-## Maximum active transit sessions (default: 5000)
+## Maximum active transit sessions (default: 10000)
 ## This value is doubled if floodfill mode is enabled!
-# transittunnels = 5000
+# transittunnels = 10000
 ## Limit number of open file descriptors (0 - use system limit)
 # openfiles = 0
 ## Maximum size of corefile in Kb (0 - use system limit)
@@ -277,9 +281,3 @@ verify = true
 ## Save full addresses on disk (default: true)
 # addressbook = true
 
-[cpuext]
-## Use CPU AES-NI instructions set when work with cryptography when available (default: true)
-# aesni = true
-## Force usage of CPU instructions set, even if they not found (default: false)
-## DO NOT TOUCH that option if you really don't know what are you doing!
-# force = false

contrib/i2pd.service

@@ -1,7 +1,8 @@
 [Unit]
 Description=I2P Router written in C++
 Documentation=man:i2pd(1) https://i2pd.readthedocs.io/en/latest/
-After=network.target
+Wants=network.target
+After=network.target network-online.target
 
 [Service]
 User=i2pd

contrib/rpm/i2pd-git.spec

@@ -1,7 +1,7 @@
 %define git_hash %(git rev-parse HEAD | cut -c -7)
 
 Name:          i2pd-git
-Version:       2.53.1
+Version:       2.58.0
 Release:       git%{git_hash}%{?dist}
 Summary:       I2P router written in C++
 Conflicts:     i2pd
@@ -10,11 +10,7 @@ License:       BSD
 URL:           https://github.com/PurpleI2P/i2pd
 Source0:       https://github.com/PurpleI2P/i2pd/archive/openssl/i2pd-openssl.tar.gz
 
-%if 0%{?rhel} == 7
-BuildRequires: cmake3
-%else
 BuildRequires: cmake
-%endif
 
 BuildRequires: chrpath
 BuildRequires: gcc-c++
@@ -24,7 +20,7 @@ BuildRequires: openssl-devel
 BuildRequires: miniupnpc-devel
 BuildRequires: systemd-units
 
-%if 0%{?fedora} > 40 || 0%{?eln}
+%if 0%{?fedora} == 41
 BuildRequires: openssl-devel-engine
 %endif
 
@@ -43,26 +39,18 @@ C++ implementation of I2P.
 
 %build
 cd build
-%if 0%{?rhel} == 7
-  %cmake3 \
-    -DWITH_LIBRARY=OFF \
-    -DWITH_UPNP=ON \
-    -DWITH_HARDENING=ON \
-    -DBUILD_SHARED_LIBS:BOOL=OFF
+%cmake \
+  -DWITH_LIBRARY=OFF \
+  -DWITH_UPNP=ON \
+  -DWITH_HARDENING=ON \
+%if 0%{?fedora} > 29
+  -DBUILD_SHARED_LIBS:BOOL=OFF \
+  .
 %else
-  %cmake \
-    -DWITH_LIBRARY=OFF \
-    -DWITH_UPNP=ON \
-    -DWITH_HARDENING=ON \
-  %if 0%{?fedora} > 29
-    -DBUILD_SHARED_LIBS:BOOL=OFF \
-    .
-  %else
-    -DBUILD_SHARED_LIBS:BOOL=OFF
-  %endif
+  -DBUILD_SHARED_LIBS:BOOL=OFF
 %endif
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 35 || 0%{?eln}
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 35 || 0%{?eln}
   pushd redhat-linux-build
 %else
   %if 0%{?fedora} >= 33
@@ -76,7 +64,7 @@ cd build
 
 make %{?_smp_mflags}
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 33 || 0%{?mageia} > 7
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 33 || 0%{?mageia} > 7
   popd
 %endif
 
@@ -84,7 +72,7 @@ make %{?_smp_mflags}
 %install
 pushd build
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 35 || 0%{?eln}
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 35 || 0%{?eln}
   pushd redhat-linux-build
 %else
   %if 0%{?fedora} >= 33
@@ -148,6 +136,21 @@ getent passwd i2pd >/dev/null || \
 
 
 %changelog
+* Mon Sep 08 2025 orignal <orignal@i2pmail.org> - 2.58.0
+- update to 2.58.0
+
+* Mon Jun 02 2025 orignal <orignal@i2pmail.org> - 2.57.0
+- update to 2.57.0
+
+* Tue Feb 11 2025 orignal <orignal@i2pmail.org> - 2.56.0
+- update to 2.56.0
+
+* Mon Dec 30 2024 orignal <orignal@i2pmail.org> - 2.55.0
+- update to 2.55.0
+
+* Sun Oct 6 2024 orignal <orignal@i2pmail.org> - 2.54.0
+- update to 2.54.0
+
 * Tue Jul 30 2024 orignal <orignal@i2pmail.org> - 2.53.1
 - update to 2.53.1
 

contrib/rpm/i2pd.spec

@@ -1,5 +1,5 @@
 Name:          i2pd
-Version:       2.53.1
+Version:       2.58.0
 Release:       1%{?dist}
 Summary:       I2P router written in C++
 Conflicts:     i2pd-git
@@ -8,11 +8,7 @@ License:       BSD
 URL:           https://github.com/PurpleI2P/i2pd
 Source0:       https://github.com/PurpleI2P/i2pd/archive/%{version}/%name-%version.tar.gz
 
-%if 0%{?rhel} == 7
-BuildRequires: cmake3
-%else
 BuildRequires: cmake
-%endif
 
 BuildRequires: chrpath
 BuildRequires: gcc-c++
@@ -22,7 +18,7 @@ BuildRequires: openssl-devel
 BuildRequires: miniupnpc-devel
 BuildRequires: systemd-units
 
-%if 0%{?fedora} > 40 || 0%{?eln}
+%if 0%{?fedora} == 41
 BuildRequires: openssl-devel-engine
 %endif
 
@@ -41,26 +37,18 @@ C++ implementation of I2P.
 
 %build
 cd build
-%if 0%{?rhel} == 7
-  %cmake3 \
-    -DWITH_LIBRARY=OFF \
-    -DWITH_UPNP=ON \
-    -DWITH_HARDENING=ON \
-    -DBUILD_SHARED_LIBS:BOOL=OFF
+%cmake \
+  -DWITH_LIBRARY=OFF \
+  -DWITH_UPNP=ON \
+  -DWITH_HARDENING=ON \
+%if 0%{?fedora} > 29
+  -DBUILD_SHARED_LIBS:BOOL=OFF \
+  .
 %else
-  %cmake \
-    -DWITH_LIBRARY=OFF \
-    -DWITH_UPNP=ON \
-    -DWITH_HARDENING=ON \
-  %if 0%{?fedora} > 29
-    -DBUILD_SHARED_LIBS:BOOL=OFF \
-    .
-  %else
-    -DBUILD_SHARED_LIBS:BOOL=OFF
-  %endif
+  -DBUILD_SHARED_LIBS:BOOL=OFF
 %endif
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 35 || 0%{?eln}
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 35 || 0%{?eln}
   pushd redhat-linux-build
 %else
   %if 0%{?fedora} >= 33
@@ -74,7 +62,7 @@ cd build
 
 make %{?_smp_mflags}
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 33 || 0%{?mageia} > 7
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 33 || 0%{?mageia} > 7
   popd
 %endif
 
@@ -82,7 +70,7 @@ make %{?_smp_mflags}
 %install
 pushd build
 
-%if 0%{?rhel} == 9 || 0%{?fedora} >= 35 || 0%{?eln}
+%if 0%{?rhel} >= 9 || 0%{?fedora} >= 35 || 0%{?eln}
   pushd redhat-linux-build
 %else
   %if 0%{?fedora} >= 33
@@ -146,6 +134,21 @@ getent passwd i2pd >/dev/null || \
 
 
 %changelog
+* Mon Sep 08 2025 orignal <orignal@i2pmail.org> - 2.58.0
+- update to 2.58.0
+
+* Mon Jun 02 2025 orignal <orignal@i2pmail.org> - 2.57.0
+- update to 2.57.0
+
+* Tue Feb 11 2025 orignal <orignal@i2pmail.org> - 2.56.0
+- update to 2.56.0
+
+* Mon Dec 30 2024 orignal <orignal@i2pmail.org> - 2.55.0
+- update to 2.55.0
+
+* Sun Oct 6 2024 orignal <orignal@i2pmail.org> - 2.54.0
+- update to 2.54.0
+
 * Tue Jul 30 2024 orignal <orignal@i2pmail.org> - 2.53.1
 - update to 2.53.1
 

contrib/tunnels.conf

@@ -5,6 +5,7 @@ port = 6668
 destination = irc.ilita.i2p
 destinationport = 6667
 keys = irc-keys.dat
+i2p.streaming.profile=2
 
 #[IRC-IRC2P]
 #type = client

contrib/webconsole/hacker.css

@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2021-2025, The PurpleI2P Project
+ *
+ * This file is part of Purple i2pd project and licensed under BSD3
+ *
+ * See full license text in LICENSE file at top of project tree
+ *
+ ******************************************************************
+ *
+ * This is style sheet for webconsole, with @media selectors for adaptive
+ * view on desktop and mobile devices, respecting preferred user's color
+ * scheme used in system/browser.
+ *
+ * Minified copy of that style sheet is bundled inside i2pd sources.
+*/
+:root {
+	--main-bg-color: #0b0b0b; 
+	--main-text-color: #00ff99;  
+	--main-link-color: #ff00ff;    
+	--main-link-hover-color: #00ffff; 
+}
+
+body {
+	font: 100%/1.5em "Courier New", Courier, monospace;
+	margin: 0;
+	padding: 1.5em;
+	background: var(--main-bg-color);
+	color: var(--main-text-color);
+}
+
+a, .slide label {
+	text-decoration: none;
+	color: var(--main-link-color);
+}
+
+a:hover, a.button.selected, .slide label:hover, button[type=submit]:hover {
+	color: var(--main-link-hover-color);
+	background: var(--main-link-color);
+}
+.slidecontent {
+	display:none;
+}
+#slide-info {
+	display:none;
+}
+.enabled {
+	color: green;
+	text-shadow: 2px green;
+}
+.disabled {
+	color: red;
+}
+#slide-info:checked ~ .slidecontent {
+    display: block;
+}
+#slide_ntcp2 {
+	display: none;
+}
+#slide_ssu2 {
+	display: none;
+}
+#slide_ssu2:checked ~ .slidecontent {
+	display: block;
+}
+#slide_ntcp2:checked ~ .slidecontent{
+	display:block;
+}
+.header {
+	font-size: 2.5em;
+	text-align: center;
+	margin: 1em 0;
+	color: var(--main-link-color);
+	text-shadow: 0 0 5px #ff00ff, 0 0 10px #ff00ff;
+}
+
+.wrapper {
+	margin: 0 auto;
+	padding: 1em;
+	max-width: 64em;
+}
+
+.menu {
+	display: block;
+	float: left;
+	overflow: hidden;
+	padding: 4px;
+	max-width: 12em;
+	white-space: nowrap;
+	text-overflow: ellipsis;
+}
+
+.listitem, .tableitem {
+	display: block;
+	font-family: monospace;
+	font-size: 1.2em;
+	white-space: nowrap;
+	color: #00ff99;
+}
+
+.content {
+/*	float: left;*/
+	font-size: 1em;
+	margin-left: 2em;
+	padding: 4px;
+	max-width: 50em;
+	overflow: auto;
+ 	left: 35%;
+	position: absolute;
+}
+
+.tunnel.established {
+	color: #0ff; 
+}
+
+.tunnel.expiring {
+	color: #ff0; 
+}
+
+.tunnel.failed {
+	color: #f00; 
+}
+
+.tunnel.building {
+	color: #888;
+}
+
+caption {
+	font-size: 1.5em;
+	text-align: center;
+	color: var(--main-link-color);
+	text-shadow: 0 0 3px #ff00ff;
+}
+
+table {
+	display: table;
+	border-collapse: collapse;
+	text-align: center;
+}
+
+textarea, input, select {
+	background-color: #111;
+	color: var(--main-text-color);
+	border: 1px solid var(--main-link-color);
+	font-family: monospace;
+	font-size: 14px;
+	padding: 5px;
+	border-radius: 3px;
+}
+
+button[type=submit], a.button {
+	background-color: transparent;
+	color: var(--main-link-color);
+	border: 1px solid var(--main-link-color);
+	padding: 5px 10px;
+	font-family: monospace;
+	border-radius: 4px;
+	cursor: pointer;
+	text-decoration: none;
+}
+
+button[type=submit]:hover, a.button:hover {
+	color: var(--main-link-hover-color);
+	background-color: #222;
+	box-shadow: 0 0 5px var(--main-link-hover-color);
+}
+
+@media screen and (max-width: 980px) {
+	.menu, .content, input, select, textarea, button[type=submit], a.button {
+		width: 90%;
+		margin: 0 auto 10px auto;
+		display: block;
+		text-align: center;
+	}
+}

contrib/webconsole/style.css

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021-2023, The PurpleI2P Project
+ * Copyright (c) 2021-2025, The PurpleI2P Project
  *
  * This file is part of Purple i2pd project and licensed under BSD3
  *
@@ -92,12 +92,14 @@ a.button {
 }
 
 .content {
-	float: left;
+/*	float: left;*/
 	font-size: 1em;
 	margin-left: 2em;
 	padding: 4px;
 	max-width: 50em;
 	overflow: auto;
+ 	left: 35%;
+	position: absolute;
 }
 
 .tunnel.established {
@@ -230,6 +232,8 @@ input[type=number]::-webkit-inner-spin-button {
 		max-width: 100%;
 		width: 100%;
 		text-align: center;
+		position: absolute;
+		left: 0;
 	}
 
 	a, .slide label {

daemon/Daemon.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -8,6 +8,7 @@
 
 #include <thread>
 #include <memory>
+#include <regex>
 
 #include "Daemon.h"
 
@@ -117,8 +118,8 @@ namespace util
 		if (logclftime)
 			i2p::log::Logger().SetTimeFormat ("[%d/%b/%Y:%H:%M:%S %z]");
 
-#ifdef WIN32_APP
-		// Win32 app with GUI supports only logging to file
+#if defined(WIN32_APP) || defined(__HAIKU__)
+		// Win32 app with GUI or Haiku supports only logging to file
 		logs = "file";
 #else
 		if (isDaemon && (logs == "" || logs == "stdout"))
@@ -149,12 +150,10 @@ namespace util
 		LogPrint(eLogDebug, "FS: Certificates directory: ", certsdir);
 
 		bool precomputation; i2p::config::GetOption("precomputation.elgamal", precomputation);
-		bool aesni; i2p::config::GetOption("cpuext.aesni", aesni);
-		bool forceCpuExt; i2p::config::GetOption("cpuext.force", forceCpuExt);
 		bool ssu; i2p::config::GetOption("ssu", ssu);
 		if (!ssu && i2p::config::IsDefault ("precomputation.elgamal"))
 			precomputation = false; // we don't elgamal table if no ssu, unless it's specified explicitly
-		i2p::crypto::InitCrypto (precomputation, aesni, forceCpuExt);
+		i2p::crypto::InitCrypto (precomputation);
 
 		i2p::transport::InitAddressFromIface (); // get address4/6 from interfaces
 
@@ -188,12 +187,41 @@ namespace util
 		std::string bandwidth; i2p::config::GetOption("bandwidth", bandwidth);
 		if (bandwidth.length () > 0)
 		{
+			const auto NumBandwithRegex = std::regex(R"(^\d+$)");
+			const auto BandwithRegex = std::regex(R"((\d+)(b|kb|mb|gb))");	
+			std::smatch bandWithMatch;
+
 			if (bandwidth.length () == 1 && ((bandwidth[0] >= 'K' && bandwidth[0] <= 'P') || bandwidth[0] == 'X' ))
 			{
 				i2p::context.SetBandwidth (bandwidth[0]);
 				LogPrint(eLogInfo, "Daemon: Bandwidth set to ", i2p::context.GetBandwidthLimit (), "KBps");
 			}
-			else
+			else if (std::regex_match(bandwidth, bandWithMatch, BandwithRegex)) {
+				const auto number = bandWithMatch[1].str();
+				const auto unit   = bandWithMatch[2].str();
+				int limit = std::atoi(number.c_str());
+				std::cout << unit;
+				if (unit == "b")
+				{
+					limit /= 1000;
+				} 
+				else if(unit == "mb")
+				{
+					limit *= 1000;
+				} else if(unit == "gb")
+				{
+					limit *= 1000000;
+				}
+				// if limit more than 32 bits then its will be negative
+				if (limit < 0)
+				{
+					LogPrint(eLogInfo, "Daemon: Unexpected bandwidth ", bandwidth, ". Set to 'low'");
+					i2p::context.SetBandwidth (i2p::data::CAPS_FLAG_LOW_BANDWIDTH2);					
+				} else {
+					i2p::context.SetBandwidth(limit);
+				}
+			}
+			else if(std::regex_search(bandwidth, NumBandwithRegex))
 			{
 				auto value = std::atoi(bandwidth.c_str());
 				if (value > 0)
@@ -206,7 +234,7 @@ namespace util
 					LogPrint(eLogInfo, "Daemon: Unexpected bandwidth ", bandwidth, ". Set to 'low'");
 					i2p::context.SetBandwidth (i2p::data::CAPS_FLAG_LOW_BANDWIDTH2);
 				}
-			}
+			} 
 		}
 		else if (isFloodfill)
 		{

daemon/Daemon.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -97,15 +97,14 @@ namespace util
 				return instance;
 			}
 	};
-#else
-#define Daemon i2p::util::DaemonLinux::Instance()
-	class DaemonLinux : public Daemon_Singleton
+#else // Unix-like systems, including Linux
+	class DaemonUnix : public Daemon_Singleton
 	{
 		public:
 
-			static DaemonLinux& Instance()
+			static DaemonUnix& Instance()
 			{
-				static DaemonLinux instance;
+				static DaemonUnix instance;
 				return instance;
 			}
 
@@ -122,6 +121,24 @@ namespace util
 
 			int gracefulShutdownInterval; // in seconds
 	};
+#if !defined(__HAIKU__)
+	#define Daemon i2p::util::DaemonUnix::Instance()
+#else
+	class DaemonHaiku: public DaemonUnix
+	{
+		public:
+			
+			static DaemonHaiku& Instance ()
+			{
+				static DaemonHaiku instance;
+				return instance;
+			}	
+			
+			void run ();
+	};	
+#define Daemon i2p::util::DaemonHaiku::Instance()
+#endif
+	
 #endif
 }
 }

daemon/HTTPServer.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -10,6 +10,7 @@
 #include <sstream>
 #include <thread>
 #include <memory>
+#include <regex>
 
 #include <boost/asio.hpp>
 #include <boost/algorithm/string.hpp>
@@ -42,10 +43,11 @@
 
 namespace i2p {
 namespace http {
-	static void LoadExtCSS ()
+
+	static void LoadExtCSS (std::string fileName = "style")
 	{
 		std::stringstream s;
-		std::string styleFile = i2p::fs::DataDirPath ("webconsole/style.css");
+		std::string styleFile = i2p::fs::DataDirPath ("webconsole/"+fileName+".css");
 		if (i2p::fs::Exists(styleFile)) {
 			std::ifstream f(styleFile, std::ifstream::binary);
 			s << f.rdbuf();
@@ -132,8 +134,9 @@ namespace http {
 
 	static void ShowTunnelDetails (std::stringstream& s, enum i2p::tunnel::TunnelState eState, bool explr, int bytes)
 	{
-		std::string state, stateText;
-		switch (eState) 
+		std::string state;
+		std::string_view stateText;
+		switch (eState)
 		{
 			case i2p::tunnel::eTunnelStateBuildReplyReceived :
 			case i2p::tunnel::eTunnelStatePending     : state = "building";    break;
@@ -145,8 +148,8 @@ namespace http {
 			default: state = "unknown"; break;
 		}
 		if (stateText.empty ()) stateText = tr(state);
-		
-		s << "<span class=\"tunnel " << state << "\"> " << stateText << ((explr) ? " (" + tr("exploratory") + ")" : "") << "</span>, ";
+
+		s << "<span class=\"tunnel " << state << "\"> " << stateText << ((explr) ? " (" + std::string(tr("exploratory")) + ")" : "") << "</span>, "; // TODO:
 		ShowTraffic(s, bytes);
 		s << "\r\n";
 	}
@@ -165,21 +168,46 @@ namespace http {
 	static void ShowPageHead (std::stringstream& s)
 	{
 		std::string webroot; i2p::config::GetOption("http.webroot", webroot);
+		std::string theme; i2p::config::GetOption("http.theme", theme);
+
+		const auto isThemeRegex = std::regex("^(white|black|light)");
+		if (!std::regex_search(theme, isThemeRegex))
+		{
+			LoadExtCSS(theme);
+		}
+		else 
+		{
+			LoadExtCSS();
+		}		
 
 		// Page language
 		std::string currLang = i2p::client::context.GetLanguage ()->GetLanguage(); // get current used language
 		auto it = i2p::i18n::languages.find(currLang);
 		std::string langCode = it->second.ShortCode;
 
+		// Right to Left language option
+		bool rtl = i2p::client::context.GetLanguage ()->GetRTL();
+
 		s <<
 			"<!DOCTYPE html>\r\n"
-			"<html lang=\"" << langCode << "\">\r\n"
+			"<html lang=\"" << langCode << "\"" << (rtl ? " dir=\"rtl\"" : "") << ">\r\n"
 			"  <head>\r\n" /* TODO: Find something to parse html/template system. This is horrible. */
 			"  <meta charset=\"UTF-8\">\r\n"
 			"  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\r\n"
 			"  <link rel=\"shortcut icon\" href=\"" << itoopieFavicon << "\">\r\n"
 			"  <title>" << tr(/* tr: Webconsole page title */ "Purple I2P Webconsole") << "</title>\r\n";
 		GetStyles(s);
+		if (theme == "black") 
+		{
+		s << 
+		"<style>:root {\r\n"
+         	"--main-bg-color: #242424;\r\n"
+                "--main-text-color: #17ab5c;\r\n"
+                "--main-link-color: #bf64b7;\r\n"
+                "--main-link-hover-color: #000000;\r\n"
+        	"}\r\n</style>";
+		
+		}
 		s <<
 			"</head>\r\n"
 			"<body>\r\n"
@@ -213,7 +241,7 @@ namespace http {
 			"</html>\r\n";
 	}
 
-	static void ShowError(std::stringstream& s, const std::string& string)
+	static void ShowError(std::stringstream& s, std::string_view string)
 	{
 		s << "<b>" << tr("ERROR") << ":</b>&nbsp;" << string << "<br>\r\n";
 	}
@@ -260,9 +288,12 @@ namespace http {
 		s << "<b>" << tr("Uptime") << ":</b> ";
 		ShowUptime(s, i2p::context.GetUptime ());
 		s << "<br>\r\n";
-		s << "<b>" << tr("Network status") << ":</b> ";
-		ShowNetworkStatus (s, i2p::context.GetStatus (), i2p::context.GetTesting(), i2p::context.GetError ());
-		s << "<br>\r\n";
+		if (i2p::context.SupportsV4 () || i2p::context.GetStatus () != eRouterStatusUnknown) // don't show Unknown for ipv6-only
+		{	
+			s << "<b>" << tr("Network status") << ":</b> ";
+			ShowNetworkStatus (s, i2p::context.GetStatus (), i2p::context.GetTesting(), i2p::context.GetError ());
+			s << "<br>\r\n";
+		}	
 		if (i2p::context.SupportsV6 ())
 		{
 			s << "<b>" << tr("Network status v6") << ":</b> ";
@@ -657,7 +688,7 @@ namespace http {
 					else
 					{
 						ls.reset (new i2p::data::LeaseSet2 (storeType));
-						ls->Update (leaseSet->GetBuffer(), leaseSet->GetBufferLen(), false);
+						ls->Update (leaseSet->GetBuffer(), leaseSet->GetBufferLen(), nullptr, false);
 					}
 					if (!ls) return;
 					s << "<div class=\"leaseset listitem";
@@ -701,6 +732,7 @@ namespace http {
 	{
 		s << "<b>" << tr("Tunnels") << ":</b><br>\r\n";
 		s << "<b>" << tr("Queue size") << ":</b> " << i2p::tunnel::tunnels.GetQueueSize () << "<br>\r\n<br>\r\n";
+		s << "<b>" << tr("TBM Queue size") << ":</b> " << i2p::tunnel::tunnels.GetTBMQueueSize () << "<br>\r\n<br>\r\n";
 
 		auto ExplPool = i2p::tunnel::tunnels.GetExploratoryPool ();
 
@@ -825,7 +857,7 @@ namespace http {
 		if (i2p::tunnel::tunnels.CountTransitTunnels())
 		{
 			s << "<b>" << tr("Transit Tunnels") << ":</b><br>\r\n";
-			s << "<table><thead><th>&#8658;</th><th>ID</th><th>&#8658;</th><th>" << tr("Amount") << "</th></thead><tbody class=\"tableitem\">";
+			s << "<table><thead><th>&#8658;</th><th>ID</th><th>&#8658;</th><th>" << tr("Amount") << "</th><th>" << tr("Next") << "</th></thead><tbody class=\"tableitem\">";
 			for (const auto& it: i2p::tunnel::tunnels.GetTransitTunnels ())
 			{
 				if (std::dynamic_pointer_cast<i2p::tunnel::TransitTunnelGateway>(it))
@@ -835,7 +867,7 @@ namespace http {
 				else
 					s << "<tr><td>&#8658;</td><td>" << it->GetTunnelID () << "</td><td>&#8658;</td><td>";
 				ShowTraffic(s, it->GetNumTransmittedBytes ());
-				s << "</td></tr>\r\n";
+				s << "</td><td>" << it->GetNextPeerName () << "</td></tr>\r\n";
 			}
 			s << "</tbody></table>\r\n";
 		}
@@ -942,7 +974,8 @@ namespace http {
 			for (auto& it: sam->GetSessions ())
 			{
 				auto& name = it.second->GetLocalDestination ()->GetNickname ();
-				s << "<div class=\"listitem\"><a href=\"" << webroot << "?page=" << HTTP_PAGE_SAM_SESSION << "&sam_id=" << it.first << "\">";
+				auto sam_id = i2p::data::ByteStreamToBase64 ((const uint8_t *)it.first.data (), it.first.length ()); // base64, becuase session name might be UTF-8
+				s << "<div class=\"listitem\"><a href=\"" << webroot << "?page=" << HTTP_PAGE_SAM_SESSION << "&sam_id=" << sam_id << "\">";
 				s << name << " (" << it.first << ")</a></div>\r\n" << std::endl;
 			}
 			s << "</div>\r\n";
@@ -954,13 +987,26 @@ namespace http {
 	void ShowSAMSession (std::stringstream& s, const std::string& id)
 	{
 		auto sam = i2p::client::context.GetSAMBridge ();
-		if (!sam) {
+		if (!sam) 
+		{
 			ShowError(s, tr("SAM disabled"));
 			return;
 		}
-
-		auto session = sam->FindSession (id);
-		if (!session) {
+		if (id.empty ())
+		{
+			ShowError(s, tr("No sam_id"));
+			return;
+		}		
+		std::vector<uint8_t> sam_id(id.length ()); // id is in base64
+		size_t l = i2p::data::Base64ToByteStream (id, sam_id.data (), sam_id.size ());
+		if (!l)
+		{
+			ShowError(s, tr("Invalid sam_id"));
+			return;
+		}
+		auto session = sam->FindSession ( { (const char *)sam_id.data (), l });
+		if (!session) 
+		{
 			ShowError(s, tr("SAM session not found"));
 			return;
 		}
@@ -972,18 +1018,19 @@ namespace http {
 		s << i2p::client::context.GetAddressBook ().ToAddress(ident) << "</a></div>\r\n";
 		s << "<br>\r\n";
 		s << "<b>" << tr("Streams") << ":</b><br>\r\n<div class=\"list\">\r\n";
-		for (const auto& it: sam->ListSockets(id))
+		for (const auto& it: sam->ListSockets({ (const char *)sam_id.data (), l }))
 		{
 			s << "<div class=\"listitem\">";
 			switch (it->GetSocketType ())
 			{
-				case i2p::client::eSAMSocketTypeSession  : s << "session";  break;
-				case i2p::client::eSAMSocketTypeStream   : s << "stream";   break;
-				case i2p::client::eSAMSocketTypeAcceptor : s << "acceptor"; break;
-				case i2p::client::eSAMSocketTypeForward  : s << "forward";  break;
+				case i2p::client::SAMSocketType::eSAMSocketTypeSession  : s << "session";  break;
+				case i2p::client::SAMSocketType::eSAMSocketTypeStream   : s << "stream";   break;
+				case i2p::client::SAMSocketType::eSAMSocketTypeAcceptor : s << "acceptor"; break;
+				case i2p::client::SAMSocketType::eSAMSocketTypeForward  : s << "forward";  break;
 				default: s << "unknown"; break;
 			}
-			s << " [" << it->GetSocket ().remote_endpoint() << "]";
+			if (it->GetSocketType () != i2p::client::SAMSocketType::eSAMSocketTypeTerminated && it->GetSocket ().is_open ())	
+				s << " [" << it->GetSocket ().remote_endpoint() << "]";
 			s << "</div>\r\n";
 		}
 		s << "</div>\r\n";
@@ -1261,7 +1308,7 @@ namespace http {
 			ShowLeasesSets(s);
 		else {
 			res.code = 400;
-			ShowError(s, tr("Unknown page") + ": " + page);
+			ShowError(s, std::string (tr("Unknown page")) + ": " + page); // TODO
 			return;
 		}
 	}
@@ -1417,13 +1464,11 @@ namespace http {
 					{
 						auto signatureLen = dest->GetIdentity ()->GetSignatureLen ();
 						uint8_t * signature = new uint8_t[signatureLen];
-						char * sig = new char[signatureLen*2];
 						std::stringstream out;
 
 						out << name << "=" << dest->GetIdentity ()->ToBase64 ();
 						dest->Sign ((uint8_t *)out.str ().c_str (), out.str ().length (), signature);
-						auto len = i2p::data::ByteStreamToBase64 (signature, signatureLen, sig, signatureLen*2);
-						sig[len] = 0;
+						auto sig = i2p::data::ByteStreamToBase64 (signature, signatureLen);
 						out << "#!sig=" << sig;
 						s << "<b>" << tr("SUCCESS") << "</b>:<br>\r\n<form action=\"http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/add\" method=\"post\" rel=\"noreferrer\" target=\"_blank\">\r\n"
 						     "<textarea readonly name=\"record\" cols=\"80\" rows=\"10\">" << out.str () << "</textarea>\r\n<br>\r\n<br>\r\n"
@@ -1432,7 +1477,6 @@ namespace http {
 						     "<input type=\"submit\" value=\"" << tr("Submit") << "\">\r\n"
 						     "</form>\r\n<br>\r\n";
 						delete[] signature;
-						delete[] sig;
 					}
 					else
 						s << "<b>" << tr("ERROR") << "</b>:&nbsp;" << tr("Domain can't end with .b32.i2p") << "\r\n<br>\r\n<br>\r\n";
@@ -1456,12 +1500,15 @@ namespace http {
 		}
 		else if (cmd == HTTP_COMMAND_RELOAD_CSS)
 		{
-			LoadExtCSS();
+			std::string theme; i2p::config::GetOption("http.theme", theme);
+			
+			if (theme != "light" && theme != "black" && theme !="white") LoadExtCSS(theme);
+			else LoadExtCSS();
 		}
 		else
 		{
 			res.code = 400;
-			ShowError(s, tr("Unknown command") + ": " + cmd);
+			ShowError(s, std::string (tr("Unknown command")) + ": " + cmd); // TODO
 			return;
 		}
 
@@ -1480,13 +1527,13 @@ namespace http {
 		reply.body = content;
 
 		m_SendBuffer = reply.to_string();
-		boost::asio::async_write (*m_Socket, boost::asio::buffer(m_SendBuffer),
+		boost::asio::async_write (*m_Socket, boost::asio::buffer(m_SendBuffer), boost::asio::transfer_all (),
 			std::bind (&HTTPConnection::Terminate, shared_from_this (), std::placeholders::_1));
 	}
 
 	HTTPServer::HTTPServer (const std::string& address, int port):
-		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service),
-		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::address::from_string(address), port)),
+		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service.get_executor ()),
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::make_address(address), port)),
 		m_Hostname(address)
 	{
 	}

daemon/HTTPServer.h

@@ -83,8 +83,8 @@ namespace http
 
 			bool m_IsRunning;
 			std::unique_ptr<std::thread> m_Thread;
-			boost::asio::io_service m_Service;
-			boost::asio::io_service::work m_Work;
+			boost::asio::io_context m_Service;
+			boost::asio::executor_work_guard<boost::asio::io_context::executor_type> m_Work;
 			boost::asio::ip::tcp::acceptor m_Acceptor;
 			std::string m_Hostname;
 	};

daemon/HTTPServerResources.h

@@ -45,7 +45,7 @@ namespace http
 		".menu { display: block; float: left; overflow: hidden; padding: 4px; max-width: 12em; white-space: nowrap; text-overflow: ellipsis ;}\r\n"
 		".listitem { display: block; font-family: monospace; font-size: 1.2em; white-space: nowrap; }\r\n"
 		".tableitem { font-family: monospace; font-size: 1.2em; white-space: nowrap; }\r\n"
-		".content { float: left; font-size: 1em; margin-left: 2em; padding: 4px; max-width: 50em; overflow: auto; }\r\n"
+		".content { font-size: 1em; margin-left: 2em; padding: 4px; max-width: 50em; overflow: auto; position: absolute; left: 35%; }\r\n"
 		".tunnel.established { color: #56B734; }\r\n"
 		".tunnel.expiring { color: #D3AE3F; }\r\n"
 		".tunnel.failed { color: #D33F3F; }\r\n"
@@ -73,7 +73,7 @@ namespace http
 		"@media screen and (max-width: 980px) { body { font: 100%/1.2em sans-serif; padding: 1.2em 0 0 0; }\r\n"
 		"	.menu { width: 100%; max-width: unset; display: block; float: none; position: unset; font-size: 16px; text-align: center; }\r\n"
 		"	.menu a, .commands a { display: inline-block; padding: 4px; }\r\n"
-		"	.content { float: none; margin-left: unset; margin-top: 16px; max-width: 100%; width: 100%; text-align: center; }\r\n"
+		"	.content { float: none; margin-left: unset; margin-top: 16px; max-width: 100%; width: 100%; text-align: center; position: absolute; left: 0; }\r\n"
 		"	a, .slide label { display: block; }\r\n"
 		"	.header { margin: unset; font-size: 1.5em; }\r\n"
 		"	small { display: block; }\r\n"

daemon/HaikuDaemon.cpp

@@ -0,0 +1,67 @@
+/*
+* Copyright (c) 2025, The PurpleI2P Project
+*
+* This file is part of Purple i2pd project and licensed under BSD3
+*
+* See full license text in LICENSE file at top of project tree
+*/
+
+#if defined(__HAIKU__)
+
+#include "Daemon.h"
+
+#include <MenuItem.h>
+#include <MenuBar.h>
+#include <Window.h>
+#include <Application.h>
+
+class MainWindow: public BWindow
+{
+	public:
+		MainWindow ();
+};	
+
+class I2PApp: public BApplication
+{
+	public:
+		I2PApp ();
+};
+
+MainWindow::MainWindow ():
+	BWindow (BRect(100, 100, 500, 400), "i2pd", B_TITLED_WINDOW, B_QUIT_ON_WINDOW_CLOSE)
+{	
+	auto r = Bounds (); r.bottom = 20;
+	auto menuBar = new BMenuBar (r, "menubar");
+	AddChild (menuBar);
+	auto runMenu = new BMenu ("Run");
+	runMenu->AddItem (new BMenuItem ("Quit", new BMessage (B_QUIT_REQUESTED), 'Q'));
+	menuBar->AddItem (runMenu);
+}	
+
+I2PApp::I2PApp (): BApplication("application/x-vnd.purplei2p-i2pd")
+{
+	auto mainWindow = new MainWindow ();
+	mainWindow->Show ();
+}	
+
+namespace i2p
+{
+namespace util
+{
+	void DaemonHaiku::run ()
+	{
+		if (isDaemon)
+			DaemonUnix::run ();
+		else
+		{
+			I2PApp app;
+			app.Run ();
+		}		
+	}	
+}	
+}	
+
+#endif
+
+
+

daemon/I2PControl.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -8,16 +8,13 @@
 
 #include <stdio.h>
 #include <sstream>
+#include <iomanip>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 
 // Use global placeholders from boost introduced when local_time.hpp is loaded
 #define BOOST_BIND_GLOBAL_PLACEHOLDERS
-
-#include <boost/date_time/local_time/local_time.hpp>
-#include <boost/date_time/posix_time/posix_time.hpp>
 #include <boost/property_tree/json_parser.hpp>
-#include <boost/lexical_cast.hpp>
 
 #include "FS.h"
 #include "Log.h"
@@ -32,11 +29,24 @@ namespace i2p
 namespace client
 {
 	I2PControlService::I2PControlService (const std::string& address, int port):
-		m_IsRunning (false), m_Thread (nullptr),
-		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint(boost::asio::ip::address::from_string(address), port)),
+		m_IsRunning (false),	
 		m_SSLContext (boost::asio::ssl::context::sslv23),
 		m_ShutdownTimer (m_Service)
 	{
+		if (port)		
+			m_Acceptor = std::make_unique<boost::asio::ip::tcp::acceptor>(m_Service,
+				boost::asio::ip::tcp::endpoint(boost::asio::ip::make_address(address), port));
+		else
+#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
+		{		
+			std::remove (address.c_str ());	// just in case
+			m_LocalAcceptor = std::make_unique<boost::asio::local::stream_protocol::acceptor>(m_Service,
+				boost::asio::local::stream_protocol::endpoint(address));	
+		}	
+#else
+			LogPrint(eLogError, "I2PControl: Local sockets are not supported");
+#endif				
+				
 		i2p::config::GetOption("i2pcontrol.password", m_Password);
 
 		// certificate / keys
@@ -47,15 +57,29 @@ namespace client
 			i2pcp_crt = i2p::fs::DataDirPath(i2pcp_crt);
 		if (i2pcp_key.at(0) != '/')
 			i2pcp_key = i2p::fs::DataDirPath(i2pcp_key);
-		if (!i2p::fs::Exists (i2pcp_crt) || !i2p::fs::Exists (i2pcp_key)) {
+		if (!i2p::fs::Exists (i2pcp_crt) || !i2p::fs::Exists (i2pcp_key)) 
+		{
 			LogPrint (eLogInfo, "I2PControl: Creating new certificate for control connection");
 			CreateCertificate (i2pcp_crt.c_str(), i2pcp_key.c_str());
-		} else {
+		} 
+		else 
 			LogPrint(eLogDebug, "I2PControl: Using cert from ", i2pcp_crt);
-		}
 		m_SSLContext.set_options (boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::no_sslv2 | boost::asio::ssl::context::single_dh_use);
-		m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem);
-		m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem);
+		boost::system::error_code ec;
+		m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem, ec);
+		if (!ec)		
+			m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem, ec);
+		if (ec)
+		{
+			LogPrint (eLogInfo, "I2PControl: Failed to load ceritifcate: ", ec.message (), ". Recreating");
+			CreateCertificate (i2pcp_crt.c_str(), i2pcp_key.c_str());
+			m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem, ec);
+			if (!ec)		
+				m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem, ec);
+			if (ec) 
+				// give up
+				LogPrint (eLogError, "I2PControl: Can't load certificates");
+		}	
 
 		// handlers
 		m_MethodHandlers["Authenticate"]       = &I2PControlService::AuthenticateHandler;
@@ -86,7 +110,7 @@ namespace client
 		{
 			Accept ();
 			m_IsRunning = true;
-			m_Thread = new std::thread (std::bind (&I2PControlService::Run, this));
+			m_Thread = std::make_unique<std::thread>(std::bind (&I2PControlService::Run, this));
 		}
 	}
 
@@ -95,12 +119,19 @@ namespace client
 		if (m_IsRunning)
 		{
 			m_IsRunning = false;
-			m_Acceptor.cancel ();
+			if (m_Acceptor) m_Acceptor->cancel ();
+#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
+			if (m_LocalAcceptor) 
+			{
+				auto path = m_LocalAcceptor->local_endpoint().path();
+				m_LocalAcceptor->cancel ();
+				std::remove (path.c_str ());
+			}	
+#endif			
 			m_Service.stop ();
 			if (m_Thread)
 			{
 				m_Thread->join ();
-				delete m_Thread;
 				m_Thread = nullptr;
 			}
 		}
@@ -122,40 +153,60 @@ namespace client
 
 	void I2PControlService::Accept ()
 	{
-		auto newSocket = std::make_shared<ssl_socket> (m_Service, m_SSLContext);
-		m_Acceptor.async_accept (newSocket->lowest_layer(), std::bind (&I2PControlService::HandleAccept, this,
-			std::placeholders::_1, newSocket));
+		if (m_Acceptor)
+		{	
+			auto newSocket = std::make_shared<boost::asio::ssl::stream<boost::asio::ip::tcp::socket> > (m_Service, m_SSLContext);
+			m_Acceptor->async_accept (newSocket->lowest_layer(),
+				[this, newSocket](const boost::system::error_code& ecode)
+				{
+					HandleAccepted (ecode, newSocket);
+				});		
+		}	
+#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
+		else if (m_LocalAcceptor)
+		{
+			auto newSocket = std::make_shared<boost::asio::ssl::stream<boost::asio::local::stream_protocol::socket> > (m_Service, m_SSLContext);
+			m_LocalAcceptor->async_accept (newSocket->lowest_layer(),
+				[this, newSocket](const boost::system::error_code& ecode)
+				{
+					HandleAccepted (ecode, newSocket);
+				});		
+		}	
+#endif		
 	}
 
-	void I2PControlService::HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket)
+	template<typename ssl_socket> 
+	void I2PControlService::HandleAccepted (const boost::system::error_code& ecode,
+		std::shared_ptr<ssl_socket> newSocket)
 	{
 		if (ecode != boost::asio::error::operation_aborted)
 			Accept ();
 
-		if (ecode) {
+		if (ecode) 
+		{
 			LogPrint (eLogError, "I2PControl: Accept error: ", ecode.message ());
 			return;
 		}
-		LogPrint (eLogDebug, "I2PControl: New request from ", socket->lowest_layer ().remote_endpoint ());
-		Handshake (socket);
-	}
-
+		LogPrint (eLogDebug, "I2PControl: New request from ", newSocket->lowest_layer ().remote_endpoint ());
+		Handshake (newSocket);
+	}	
+		
+	template<typename ssl_socket>
 	void I2PControlService::Handshake (std::shared_ptr<ssl_socket> socket)
 	{
 		socket->async_handshake(boost::asio::ssl::stream_base::server,
-		std::bind( &I2PControlService::HandleHandshake, this, std::placeholders::_1, socket));
-	}
-
-	void I2PControlService::HandleHandshake (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket)
-	{
-		if (ecode) {
-			LogPrint (eLogError, "I2PControl: Handshake error: ", ecode.message ());
-			return;
-		}
-		//std::this_thread::sleep_for (std::chrono::milliseconds(5));
-		ReadRequest (socket);
+			[this, socket](const boost::system::error_code& ecode)
+		    {
+				if (ecode) 
+				{
+					LogPrint (eLogError, "I2PControl: Handshake error: ", ecode.message ());
+					return;
+				}
+				ReadRequest (socket);
+			});			                        
 	}
 
+	template<typename ssl_socket>
 	void I2PControlService::ReadRequest (std::shared_ptr<ssl_socket> socket)
 	{
 		auto request = std::make_shared<I2PControlBuffer>();
@@ -165,10 +216,13 @@ namespace client
 #else
 			boost::asio::buffer (request->data (), request->size ()),
 #endif
-			std::bind(&I2PControlService::HandleRequestReceived, this,
-			std::placeholders::_1, std::placeholders::_2, socket, request));
+		    [this, socket, request](const boost::system::error_code& ecode, size_t bytes_transferred)
+		    {
+				HandleRequestReceived (ecode, bytes_transferred, socket, request);
+			});
 	}
 
+	template<typename ssl_socket>
 	void I2PControlService::HandleRequestReceived (const boost::system::error_code& ecode,
 		size_t bytes_transferred, std::shared_ptr<ssl_socket> socket,
 		std::shared_ptr<I2PControlBuffer> buf)
@@ -246,6 +300,7 @@ namespace client
 		}
 	}
 
+	template<typename ssl_socket>
 	void I2PControlService::SendResponse (std::shared_ptr<ssl_socket> socket,
 		std::shared_ptr<I2PControlBuffer> buf, std::ostringstream& response, bool isHtml)
 	{
@@ -255,12 +310,12 @@ namespace client
 			std::ostringstream header;
 			header << "HTTP/1.1 200 OK\r\n";
 			header << "Connection: close\r\n";
-			header << "Content-Length: " << boost::lexical_cast<std::string>(len) << "\r\n";
+			header << "Content-Length: " << std::to_string(len) << "\r\n";
 			header << "Content-Type: application/json\r\n";
 			header << "Date: ";
-			auto facet = new boost::local_time::local_time_facet ("%a, %d %b %Y %H:%M:%S GMT");
-			header.imbue(std::locale (header.getloc(), facet));
-			header << boost::posix_time::second_clock::local_time() << "\r\n";
+			std::time_t t = std::time (nullptr);
+    		std::tm tm = *std::gmtime (&t);
+			header << std::put_time(&tm, "%a, %d %b %Y %T GMT") << "\r\n";
 			header << "\r\n";
 			offset = header.str ().size ();
 			memcpy (buf->data (), header.str ().c_str (), offset);
@@ -268,16 +323,11 @@ namespace client
 		memcpy (buf->data () + offset, response.str ().c_str (), len);
 		boost::asio::async_write (*socket, boost::asio::buffer (buf->data (), offset + len),
 			boost::asio::transfer_all (),
-			std::bind(&I2PControlService::HandleResponseSent, this,
-				std::placeholders::_1, std::placeholders::_2, socket, buf));
-	}
-
-	void I2PControlService::HandleResponseSent (const boost::system::error_code& ecode, std::size_t bytes_transferred,
-		std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf)
-	{
-		if (ecode) {
-			LogPrint (eLogError, "I2PControl: Write error: ", ecode.message ());
-		}
+		    [socket, buf](const boost::system::error_code& ecode, std::size_t bytes_transferred)
+		    {
+				if (ecode)
+					LogPrint (eLogError, "I2PControl: Write error: ", ecode.message ());
+			});	
 	}
 
 // handlers
@@ -387,48 +437,54 @@ namespace client
 	void I2PControlService::CreateCertificate (const char *crt_path, const char *key_path)
 	{
 		FILE *f = NULL;
+#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
+		EVP_PKEY *  pkey = EVP_RSA_gen(4096); // e = 65537
+#else		
 		EVP_PKEY * pkey = EVP_PKEY_new ();
 		RSA * rsa = RSA_new ();
 		BIGNUM * e = BN_dup (i2p::crypto::GetRSAE ());
 		RSA_generate_key_ex (rsa, 4096, e, NULL);
-		BN_free (e);
-		if (rsa)
-		{
-			EVP_PKEY_assign_RSA (pkey, rsa);
-			X509 * x509 = X509_new ();
-			ASN1_INTEGER_set (X509_get_serialNumber (x509), 1);
-			X509_gmtime_adj (X509_getm_notBefore (x509), 0);
-			X509_gmtime_adj (X509_getm_notAfter (x509), I2P_CONTROL_CERTIFICATE_VALIDITY*24*60*60); // expiration
-			X509_set_pubkey (x509, pkey); // public key
-			X509_NAME * name = X509_get_subject_name (x509);
-			X509_NAME_add_entry_by_txt (name, "C",  MBSTRING_ASC, (unsigned char *)"A1", -1, -1, 0); // country (Anonymous proxy)
-			X509_NAME_add_entry_by_txt (name, "O",  MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_ORGANIZATION, -1, -1, 0); // organization
-			X509_NAME_add_entry_by_txt (name, "CN", MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_COMMON_NAME, -1, -1, 0); // common name
-			X509_set_issuer_name (x509, name); // set issuer to ourselves
-			X509_sign (x509, pkey, EVP_sha1 ()); // sign
-
-			// save cert
-			if ((f = fopen (crt_path, "wb")) != NULL) {
-				LogPrint (eLogInfo, "I2PControl: Saving new cert to ", crt_path);
-				PEM_write_X509 (f, x509);
-				fclose (f);
-			} else {
-				LogPrint (eLogError, "I2PControl: Can't write cert: ", strerror(errno));
-			}
-
-			// save key
-			if ((f = fopen (key_path, "wb")) != NULL) {
-				LogPrint (eLogInfo, "I2PControl: saving cert key to ", key_path);
-				PEM_write_PrivateKey (f, pkey, NULL, NULL, 0, NULL, NULL);
-				fclose (f);
-			} else {
-				LogPrint (eLogError, "I2PControl: Can't write key: ", strerror(errno));
-			}
-
-			X509_free (x509);
-		} else {
+		BN_free (e);	
+		if (rsa) EVP_PKEY_assign_RSA (pkey, rsa);
+		else
+		{	
 			LogPrint (eLogError, "I2PControl: Can't create RSA key for certificate");
+			EVP_PKEY_free (pkey);
+			return;
+		}	
+#endif			
+		X509 * x509 = X509_new ();
+		ASN1_INTEGER_set (X509_get_serialNumber (x509), 1);
+		X509_gmtime_adj (X509_getm_notBefore (x509), 0);
+		X509_gmtime_adj (X509_getm_notAfter (x509), I2P_CONTROL_CERTIFICATE_VALIDITY*24*60*60); // expiration
+		X509_set_pubkey (x509, pkey); // public key
+		X509_NAME * name = X509_get_subject_name (x509);
+		X509_NAME_add_entry_by_txt (name, "C",  MBSTRING_ASC, (unsigned char *)"A1", -1, -1, 0); // country (Anonymous proxy)
+		X509_NAME_add_entry_by_txt (name, "O",  MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_ORGANIZATION, -1, -1, 0); // organization
+		X509_NAME_add_entry_by_txt (name, "CN", MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_COMMON_NAME, -1, -1, 0); // common name
+		X509_set_issuer_name (x509, name); // set issuer to ourselves
+		X509_sign (x509, pkey, EVP_sha1 ()); // sign, last param must be NULL for EdDSA
+
+		// save cert
+		if ((f = fopen (crt_path, "wb")) != NULL) 
+		{
+			LogPrint (eLogInfo, "I2PControl: Saving new cert to ", crt_path);
+			PEM_write_X509 (f, x509);
+			fclose (f);
+		} 
+		else
+			LogPrint (eLogError, "I2PControl: Can't write cert: ", strerror(errno));
+		X509_free (x509);
+		
+		// save key
+		if ((f = fopen (key_path, "wb")) != NULL) 
+		{
+			LogPrint (eLogInfo, "I2PControl: saving cert key to ", key_path);
+			PEM_write_PrivateKey (f, pkey, NULL, NULL, 0, NULL, NULL);
+			fclose (f);
 		}
+		else
+			LogPrint (eLogError, "I2PControl: Can't write key: ", strerror(errno));
 		EVP_PKEY_free (pkey);
 	}
 }

daemon/I2PControl.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2022, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -35,8 +35,6 @@ namespace client
 
 	class I2PControlService: public I2PControlHandlers
 	{
-		typedef boost::asio::ssl::stream<boost::asio::ip::tcp::socket> ssl_socket;
-
 		public:
 
 			I2PControlService (const std::string& address, int port);
@@ -49,16 +47,18 @@ namespace client
 
 			void Run ();
 			void Accept ();
-			void HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket);
+			template<typename ssl_socket> 
+			void HandleAccepted (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> newSocket);
+			template<typename ssl_socket>
 			void Handshake (std::shared_ptr<ssl_socket> socket);
-			void HandleHandshake (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket);
+			template<typename ssl_socket>
 			void ReadRequest (std::shared_ptr<ssl_socket> socket);
+			template<typename ssl_socket>
 			void HandleRequestReceived (const boost::system::error_code& ecode, size_t bytes_transferred,
 				std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf);
+			template<typename ssl_socket>
 			void SendResponse (std::shared_ptr<ssl_socket> socket,
 				std::shared_ptr<I2PControlBuffer> buf, std::ostringstream& response, bool isHtml);
-			void HandleResponseSent (const boost::system::error_code& ecode, std::size_t bytes_transferred,
-				std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf);
 
 			void CreateCertificate (const char *crt_path, const char *key_path);
 
@@ -86,10 +86,13 @@ namespace client
 
 			std::string m_Password;
 			bool m_IsRunning;
-			std::thread * m_Thread;
+			std::unique_ptr<std::thread> m_Thread;
 
-			boost::asio::io_service m_Service;
-			boost::asio::ip::tcp::acceptor m_Acceptor;
+			boost::asio::io_context m_Service;
+			std::unique_ptr<boost::asio::ip::tcp::acceptor> m_Acceptor;
+#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
+			std::unique_ptr<boost::asio::local::stream_protocol::acceptor> m_LocalAcceptor;
+#endif		
 			boost::asio::ssl::context m_SSLContext;
 			boost::asio::deadline_timer m_ShutdownTimer;
 			std::set<std::string> m_Tokens;

daemon/I2PControlHandlers.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2022, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -340,7 +340,7 @@ namespace client
 				for (const auto& socket: sam->ListSockets(it.first))
 				{
 					boost::property_tree::ptree stream;
-					stream.put("type", socket->GetSocketType ());
+					stream.put("type", (int)socket->GetSocketType ());
 					stream.put("peer", socket->GetSocket ().remote_endpoint());
 
 					sam_session_sockets.push_back(std::make_pair("", stream));

daemon/UPnP.cpp

@@ -52,7 +52,7 @@ namespace transport
 	{
 		m_IsRunning = true;
 		LogPrint(eLogInfo, "UPnP: Starting");
-		m_Service.post (std::bind (&UPnP::Discover, this));
+		boost::asio::post (m_Service, std::bind (&UPnP::Discover, this));
 		std::unique_lock<std::mutex> l(m_StartedMutex);
 		m_Thread.reset (new std::thread (std::bind (&UPnP::Run, this)));
 		m_Started.wait_for (l, std::chrono::seconds (5)); // 5 seconds maximum
@@ -150,7 +150,7 @@ namespace transport
 
 		// UPnP discovered
 		LogPrint (eLogDebug, "UPnP: ExternalIPAddress is ", m_externalIPAddress);
-		i2p::context.UpdateAddress (boost::asio::ip::address::from_string (m_externalIPAddress));
+		i2p::context.UpdateAddress (boost::asio::ip::make_address (m_externalIPAddress));
 		// port mapping
 		PortMapping ();
 	}

daemon/UPnP.h

@@ -67,7 +67,7 @@ namespace transport
 			std::unique_ptr<std::thread> m_Thread;
 			std::condition_variable m_Started;
 			std::mutex m_StartedMutex;
-			boost::asio::io_service m_Service;
+			boost::asio::io_context m_Service;
 			boost::asio::deadline_timer m_Timer;
 			bool m_upnpUrlsInitialized = false;
 			struct UPNPUrls m_upnpUrls;

daemon/UnixDaemon.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -25,6 +25,7 @@
 #include "RouterContext.h"
 #include "ClientContext.h"
 #include "Transports.h"
+#include "util.h"
 
 void handle_signal(int sig)
 {
@@ -70,7 +71,7 @@ namespace i2p
 {
 	namespace util
 	{
-		bool DaemonLinux::start()
+		bool DaemonUnix::start()
 		{
 			if (isDaemon)
 			{
@@ -212,14 +213,15 @@ namespace i2p
 			return Daemon_Singleton::start();
 		}
 
-		bool DaemonLinux::stop()
+		bool DaemonUnix::stop()
 		{
 			i2p::fs::Remove(pidfile);
 			return Daemon_Singleton::stop();
 		}
 
-		void DaemonLinux::run ()
+		void DaemonUnix::run ()
 		{
+			i2p::util::SetThreadName ("i2pd-daemon");
 			while (running)
 			{
 				std::this_thread::sleep_for (std::chrono::seconds(1));

debian/changelog

@@ -1,3 +1,33 @@
+i2pd (2.58.0-1) unstable; urgency=medium
+
+  * updated to version 2.58.0/0.9.67
+
+ -- orignal <orignal@i2pmail.org>  Mon, 08 Sep 2025 16:00:00 +0000
+
+i2pd (2.57.0-1) unstable; urgency=medium
+
+  * updated to version 2.57.0/0.9.66
+
+ -- orignal <orignal@i2pmail.org>  Mon, 02 Jun 2025 16:00:00 +0000
+
+i2pd (2.56.0-1) unstable; urgency=medium
+
+  * updated to version 2.56.0/0.9.65
+
+ -- orignal <orignal@i2pmail.org>  Tue, 11 Feb 2025 16:00:00 +0000
+
+i2pd (2.55.0-1) unstable; urgency=medium
+
+  * updated to version 2.55.0
+
+ -- orignal <orignal@i2pmail.org>  Mon, 30 Dec 2024 16:00:00 +0000
+
+i2pd (2.54.0-1) unstable; urgency=medium
+
+  * updated to version 2.54.0/0.9.64
+
+ -- orignal <orignal@i2pmail.org>  Sun, 6 Oct 2024 16:00:00 +0000
+
 i2pd (2.53.1-1) unstable; urgency=medium
 
   * updated to version 2.53.1

debian/patches/01-upnp.patch

@@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>
 
 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2022-03-23
+Last-Update: 2024-12-30
 
 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ include filelist.mk
+@@ -31,7 +31,7 @@ # import source files lists
+ include filelist.mk
  
- USE_AESNI       := $(or $(USE_AESNI),yes)
  USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)

i18n/Afrikaans.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace afrikaans // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"failed", "Het misluk"},
 		{"unknown", "onbekend"},
@@ -73,7 +76,7 @@ namespace afrikaans // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Armenian.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace armenian // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f ԿիԲ"},
 		{"%.2f MiB", "%.2f ՄիԲ"},
@@ -196,7 +199,7 @@ namespace armenian // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Chinese.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2024, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace chinese // language namespace
 		return 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -64,7 +67,7 @@ namespace chinese // language namespace
 		{"Full cone NAT", "全锥型NAT"},
 		{"No Descriptors", "无描述符"},
 		{"Uptime", "运行时间"},
-		{"Network status", "IPv4 网络状态"},
+		{"Network status", "网络状态"},
 		{"Network status v6", "IPv6 网络状态"},
 		{"Stopping in", "距停止还有："},
 		{"Family", "家族"},
@@ -215,7 +218,7 @@ namespace chinese // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Czech.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2024, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace czech // language namespace
 		return (n == 1) ? 0 : (n >= 2 && n <= 4) ? 1 : 2;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -215,7 +218,7 @@ namespace czech // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/English.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -30,7 +30,10 @@ namespace english // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"", ""},
 	};
@@ -42,7 +45,7 @@ namespace english // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/French.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2024, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace french // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f Kio"},
 		{"%.2f MiB", "%.2f Mio"},
@@ -44,7 +47,7 @@ namespace french // language namespace
 		{"<b>i2pd</b> webconsole", "Console web <b>i2pd</b>"},
 		{"Main page", "Page principale"},
 		{"Router commands", "Commandes du routeur"},
-		{"Local Destinations", "Destinations locales"},
+		{"Local Destinations", "Destinatioans localeAlger"},
 		{"LeaseSets", "Jeu de baux"},
 		{"Tunnels", "Tunnels"},
 		{"Transit Tunnels", "Tunnels transitoires"},
@@ -215,7 +218,7 @@ namespace french // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/German.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2023, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace german // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -210,7 +213,7 @@ namespace german // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Hebrew.cpp

@@ -0,0 +1,202 @@
+/*
+* Copyright (c) 2025, The PurpleI2P Project
+*
+* This file is part of Purple i2pd project and licensed under BSD3
+*
+* See full license text in LICENSE file at top of project tree
+*/
+
+#include <map>
+#include <vector>
+#include <string>
+#include <memory>
+#include "I18N.h"
+
+// Hebrew localization file
+
+namespace i2p
+{
+namespace i18n
+{
+namespace hebrew // language namespace
+{
+	// language name in lowercase
+	static std::string language = "hebrew";
+
+	// See for language plural forms here:
+	// https://localization-guide.readthedocs.io/en/latest/l10n/pluralforms.html
+	static int plural (int n) {
+		return n % 100 == 1 ? 0 : n % 100 == 2 ? 1 : n % 100 == 3 || n % 100 == 4 ? 2 : 3;
+	}
+
+	// Right to Left language?
+	static bool rtl = true;
+
+	static const LocaleStrings strings
+	{
+		{"%.2f KiB", "%.2f קי״ב"},
+		{"%.2f MiB", "%.2f מי״ב"},
+		{"%.2f GiB", "%.2f קי״ב"},
+		{"Purple I2P Webconsole", "קונסולת Purple I2P"},
+		{"<b>i2pd</b> webconsole", "קונסולת <b>i2pd</b>"},
+		{"Main page", "עמוד ראשי"},
+		{"Router commands", "פקודות נתב"},
+		{"Local Destinations", "יעדים מקומיים"},
+		{"Tunnels", "מנהרות"},
+		{"Transit Tunnels", "מנהרות מעבר"},
+		{"Transports", "מובילים"},
+		{"I2P tunnels", "מנהרות I2P"},
+		{"SAM sessions", "הפעלות SAM"},
+		{"Unknown", "לא מוכר"},
+		{"Proxy", "פרוקסי"},
+		{"Mesh", "סיבוך"},
+		{"Clock skew", "לכסון שעון"},
+		{"Offline", "לא מקוון"},
+		{"Symmetric NAT", "NAT סימטרי"},
+		{"Full cone NAT", "NAT חסום לחלוטין"},
+		{"No Descriptors", "אין מתארים"},
+		{"Uptime", "זמן הפעלה"},
+		{"Network status", "מצב רשת תקשורת"},
+		{"Network status v6", "מצב רשת תקשורת v6"},
+		{"Stopping in", "מפסיק בעוד"},
+		{"Family", "משפחה"},
+		{"Tunnel creation success rate", "שיעור הצלחה של יצירת מנהרות"},
+		{"Total tunnel creation success rate", "שיעור הצלחה כולל של יצירת מנהרות"},
+		{"Received", "נתקבל"},
+		{"%.2f KiB/s", "%.2f קי״ב/ש"},
+		{"Sent", "נשלח"},
+		{"Transit", "מעבר"},
+		{"Data path", "נתיב מידע"},
+		{"Hidden content. Press on text to see.", "תוכן מוסתר. לחץ על הטקסט כדי לראותו."},
+		{"Router Ident", "מזהה נתב"},
+		{"Router Family", "משפחת נתב"},
+		{"Version", "גרסא"},
+		{"Our external address", "הכתובת החיצונית שלנו"},
+		{"supported", "נתמך"},
+		{"Routers", "נתבים"},
+		{"Client Tunnels", "מנהרות לקוח"},
+		{"Services", "שירותים"},
+		{"Enabled", "מאופשר"},
+		{"Disabled", "מנוטרל"},
+		{"Encrypted B33 address", "כתובת B33 מוצפנת"},
+		{"Address registration line", "שורת רישום כתובת"},
+		{"Domain", "תחום"},
+		{"Generate", "צור"},
+		{"<b>Note:</b> result string can be used only for registering 2LD domains (example.i2p). For registering subdomains please use i2pd-tools.", "<b>הערה</b> מחרוזת תוצאה יכולה להיות מועילה רק לצורך רישום תחומים 2LD (example.i2p). לשם רישום תתי-תחום עליך להיוועץ עם i2pd-tools."},
+		{"Address", "כתובת"},
+		{"Type", "טיפוס"},
+		{"Expire LeaseSet", "פקיעת LeaseSet"},
+		{"Inbound tunnels", "מנהרות פנימיות"},
+		{"%dms", "מילישניות %d"},
+		{"Outbound tunnels", "מנהרות חיצוניות"},
+		{"Tags", "תוויות"},
+		{"Incoming", "נכנס"},
+		{"Outgoing", "יוצא"},
+		{"Destination", "יעד"},
+		{"Amount", "כמות"},
+		{"Incoming Tags", "תוויות נכנסות"},
+		{"Tags sessions", "הפעלות תוויות"},
+		{"Status", "מצב"},
+		{"Local Destination", "יעד מקומי"},
+		{"Streams", "זרמים"},
+		{"Close stream", "סגור זרם"},
+		{"Such destination is not found", "יעד כזה לא נמצא"},
+		{"I2CP session not found", "הפעלת I2CP לא נמצאה"},
+		{"I2CP is not enabled", "I2CP לא מאופשר"},
+		{"Invalid", "לא תקין"},
+		{"Store type", "טיפוס אחסון"},
+		{"Expires", "פוקע"},
+		{"Non Expired Leases", "חכירות בלתי פקיעות"},
+		{"Gateway", "שער-דרך"},
+		{"TunnelID", "מזהה מנהרה"},
+		{"EndDate", "תאריך סיום"},
+		{"floodfill mode is disabled", "מצב floodfill הינו מנוטרל"},
+		{"Queue size", "גודל תור"},
+		{"Run peer test", "הרץ בדיקת עמית"},
+		{"Reload tunnels configuration", "טען מחדש תצורת מנהרות"},
+		{"Decline transit tunnels", "דחה מנהרות מעבר"},
+		{"Accept transit tunnels", "קבל מנהרות מעבר"},
+		{"Cancel graceful shutdown", "בטל כיבוי עדין"},
+		{"Start graceful shutdown", "התחל כיבוי עדין"},
+		{"Force shutdown", "כפה כיבוי"},
+		{"Reload external CSS styles", "טען מחדש סגנונות CSS חיצוניים"},
+		{"<b>Note:</b> any action done here are not persistent and not changes your config files.", "<b>הערה</b> כל פעולה אשר מבוצעת כאן אינה המשכית ולא משנה את קובצי התצורה שלך."},
+		{"Logging level", "דרגת רישום יומן"},
+		{"Transit tunnels limit", "מגבלת מנהרות מעבר"},
+		{"Change", "שנה"},
+		{"Change language", "שנה שפה"},
+		{"no transit tunnels currently built", "אין מנהרות מעבר אשר בנויות כעת"},
+		{"SAM disabled", "SAM מנוטרל"},
+		{"no sessions currently running", "אין הפעלה אשר מורצת כעת"},
+		{"SAM session not found", "הפעלת SAM לא נמצאה"},
+		{"SAM Session", "הפעלת SAM"},
+		{"Server Tunnels", "מנהרות שרת"},
+		{"Unknown page", "עמוד לא מוכר"},
+		{"Invalid token", "סימן לא תקין"},
+		{"SUCCESS", "הצלחה"},
+		{"Stream closed", "זרם סגור"},
+		{"Stream not found or already was closed", "זרם לא נמצא או שהוא היה כבר סגור"},
+		{"Destination not found", "יעד לא נמצא"},
+		{"StreamID can't be null", "מזהה זרם (StreamID) לא יכול להיות אפסי"},
+		{"Return to destination page", "חזור לעמוד יעד"},
+		{"You will be redirected in %d seconds", "אתה תכוון מחדש בעוד %d שניות"},
+		{"LeaseSet expiration time updated", "זמן פקיעה של LeaseSet עודכן"},
+		{"LeaseSet is not found or already expired", "LeaseSet אינו נמצא או שהוא כבר פקע"},
+		{"Transit tunnels count must not exceed %d", "אסור לספירת מנהרות מעבר לעלות על %d"},
+		{"Back to commands list", "חזור לרשימת פקודות"},
+		{"Register at reg.i2p", "הירשם באתר reg.i2p"},
+		{"Description", "תיאור"},
+		{"A bit information about service on domain", "מידע אודות שירות על תחום"},
+		{"Submit", "שלח"},
+		{"Domain can't end with .b32.i2p", "תחום לא יכול להסתיים עם &#8206;.b32.i2p"},
+		{"Domain must end with .i2p", "תחום חייב להסתיים עם &#8206;.i2p"},
+		{"Unknown command", "פקודה לא מוכרת"},
+		{"Command accepted", "פקודה נתקבלה"},
+		{"Proxy error", "שגיאת פרוקסי"},
+		{"Proxy info", "מידע פרוקסי"},
+		{"Proxy error: Host not found", "שגיאת פרוקסי: מארח לא נמצא"},
+		{"Remote host not found in router's addressbook", "ארח מרוחק לא נמצא בתוך הפנקס כתובות של הנתב"},
+		{"You may try to find this host on jump services below", "באפשרותך לנסות למצוא את מארח זה דרך שירותי קפיצה להלן"},
+		{"Invalid request", "בקשה לא תקינה"},
+		{"Proxy unable to parse your request", "פרוקסי לא מסוגל לנתח את בקשתך"},
+		{"Addresshelper is not supported", "סייען-כתובות אינו נתמך"},
+		{"Host %s is <font color=red>already in router's addressbook</font>. <b>Be careful: source of this URL may be harmful!</b> Click here to update record: <a href=\"%s%s%s&update=true\">Continue</a>.", "מארח %s is <font color=red>כבר נמצא בפנקס כתובות של הנתב</font>. <b>זהירות: מקור URL זה עלול להזיק!</b> לחץ כאן כדי לעדכן מרשם: <a href=\"%s%s%s&update=true\">המשך</a>."},
+		{"Addresshelper forced update rejected", "אילוץ עדכון של סייען-כתובות נדחה"},
+		{"To add host <b>%s</b> in router's addressbook, click here: <a href=\"%s%s%s\">Continue</a>.", "Tכדי להוסיף את מארח <b>%s</b> לפנקס כתובות של הנתב: <a href=\"%s%s%s\">המשך</a>."},
+		{"Addresshelper request", "בקשת סייען-כתובות"},
+		{"Host %s added to router's addressbook from helper. Click here to proceed: <a href=\"%s\">Continue</a>.", "מארח %s נתווסף לסייען-כתובות של הנתב דרך סייען. לחץ כאן כדי proceed: <a href=\"%s\">המשך</a>."},
+		{"Addresshelper adding", "הוספת סייען-כתובות"},
+		{"Host %s is <font color=red>already in router's addressbook</font>. Click here to update record: <a href=\"%s%s%s&update=true\">Continue</a>.", "מארח %s <font color=red>כבר נמצא בספר כתובות של הנתב</font>. לחץ כאן כדי לעדכן מרשם: <a href=\"%s%s%s&update=true\">המשך</a>."},
+		{"Addresshelper update", "עדכון סייען-כתובות"},
+		{"Invalid request URI", "בקשת URI לא תקינה"},
+		{"Can't detect destination host from request", "לא יכול לאתר יעד מארח מתוך בקשה"},
+		{"Host %s is not inside I2P network, but outproxy is not enabled", "מארח %s לא נמצא בתוך רשת I2P, אולם outproxy אינו מאופשר"},
+		{"Hostname is too long", "שם-מארח הינו ארוך מדי"},
+		{"Cannot negotiate with SOCKS proxy", "לא מסוגל להסדיר פרוקסי SOCKS"},
+		{"CONNECT error", "שגיאת חיבור"},
+		{"Failed to connect", "נכשל להתחבר"},
+		{"SOCKS proxy error", "שגיאת פרוקסי SOCKS"},
+		{"No reply from SOCKS proxy", "אין מענה מתוך פרוקסי SOCKS"},
+		{"Cannot connect", "לא מסוגל להתחבר"},
+		{"Host is down", "מארח הינו מושבת"},
+		{"Can't create connection to requested host, it may be down. Please try again later.", "לא יכול ליצור חיבור למארח מבוקש, המארח עשוי להיות מושבת. אנא נסה שוב מאוחר יותר."},
+		{"", ""},
+	};
+
+	static std::map<std::string, std::vector<std::string>> plurals
+	{
+		{"%d days", {"יום %d", "יומיים", "ימים %d", "ימים %d"}},
+		{"%d hours", {"שעה %d", "שעתיים", "שעות %d", "שעות %d"}},
+		{"%d minutes", {"דקה %d", "שתי דקות", "דקות %d", "דקות %d"}},
+		{"%d seconds", {"שניה %d", "שתי שניות", "שניות %d", "שניות %d"}},
+		{"", {"", "", ""}},
+	};
+
+	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
+	{
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
+	}
+
+} // language
+} // i18n
+} // i2p

i18n/Hindi.cpp

@@ -0,0 +1,226 @@
+/*
+* Copyright (c) 2025, The PurpleI2P Project
+*
+* This file is part of Purple i2pd project and licensed under BSD3
+*
+* See full license text in LICENSE file at top of project tree
+*/
+
+#include <map>
+#include <vector>
+#include <string>
+#include <memory>
+#include "I18N.h"
+
+// Hindi localization file
+
+namespace i2p
+{
+namespace i18n
+{
+namespace hindi // language namespace
+{
+	// language name in lowercase
+	static std::string language = "hindi";
+
+	// See for language plural forms here:
+	// https://localization-guide.readthedocs.io/en/latest/l10n/pluralforms.html
+	static int plural (int n) {
+		return n != 1 ? 1 : 0;
+	}
+
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
+	{
+		{"%.2f KiB", "%.2f कीबी"},
+		{"%.2f MiB", "%.2f मीबी"},
+		{"%.2f GiB", "%.2f जीबी"},
+		{"building", "निर्माण"},
+		{"failed", "विफल"},
+		{"expiring", "समाप्त होना"},
+		{"established", "स्थापित"},
+		{"unknown", "अज्ञात"},
+		{"exploratory", "अन्वेषणात्मक"},
+		{"Purple I2P Webconsole", "पर्पल I2P वेब कंसोल"},
+		{"<b>i2pd</b> webconsole", "<b>i2pd</b> वेब कंसोल"},
+		{"Main page", "मुख्य पृष्ठ"},
+		{"Router commands", "राउटर आदेश"},
+		{"Local Destinations", "स्थानीय गंतव्य"},
+		{"LeaseSets", "पट्ट समुच्चय"},
+		{"Tunnels", "सुरंग"},
+		{"Transit Tunnels", "संचरण सुरंगें"},
+		{"Transports", "परिवहन"},
+		{"I2P tunnels", "I2P सुरंगें"},
+		{"SAM sessions", "SAM सत्र"},
+		{"ERROR", "त्रुटि"},
+		{"OK", "ठीक है"},
+		{"Testing", "परीक्षण"},
+		{"Firewalled", "फायरवॉल"},
+		{"Unknown", "अज्ञात"},
+		{"Proxy", "प्रॉक्सी"},
+		{"Mesh", "जाली"},
+		{"Clock skew", "घड़ी संकेत विचलन"},
+		{"Offline", "ऑफलाइन"},
+		{"Symmetric NAT", "सममितीय NAT"},
+		{"Full cone NAT", "पूर्णकोण NAT"},
+		{"No Descriptors", "कोई वर्णनकर्त्तृ नहीं हैं"},
+		{"Uptime", "संचालन समय"},
+		{"Network status", "संपर्क स्थिति"},
+		{"Network status v6", "संपर्क स्थिति v6"},
+		{"Stopping in", "में अवसान प्रारंभ हो रहा है"},
+		{"Family", "परिवार"},
+		{"Tunnel creation success rate", "सुरंग निर्माण सफलता दर"},
+		{"Total tunnel creation success rate", "कुल सुरंग निर्माण सफलता दर"},
+		{"Received", "प्राप्त हुआ"},
+		{"%.2f KiB/s", "%.2f कीबी/से"},
+		{"Sent", "प्रेषित"},
+		{"Transit", "संचरण"},
+		{"Data path", "डेटा पथ"},
+		{"Hidden content. Press on text to see.", "सामग्री छिपाई गई है। देखने हेतु पाठ पर दबाएँ।"},
+		{"Router Ident", "राउटर परिचय"},
+		{"Router Family", "राउटर परिवार"},
+		{"Router Caps", "राउटर कैप्स"},
+		{"Version", "संस्करण"},
+		{"Our external address", "हमारा बाह्य पता"},
+		{"supported", "समर्थित"},
+		{"Routers", "राउटर"},
+		{"Floodfills", "पूर्णक संवाहक"},
+		{"Client Tunnels", "क्लाइंट सुरंगें"},
+		{"Services", "सेवाएँ"},
+		{"Enabled", "सक्षम है"},
+		{"Disabled", "निष्क्रिय है"},
+		{"Encrypted B33 address", "कूटलिखित B33 पता"},
+		{"Address registration line", "पता पंजीकरण पंक्ति"},
+		{"Domain", "डोमेन"},
+		{"Generate", "सृजित करें"},
+		{"<b>Note:</b> result string can be used only for registering 2LD domains (example.i2p). For registering subdomains please use i2pd-tools.", "<b>नोट:</b> परिणाम स्ट्रिंग का उपयोग केवल 2LD डोमेनों (जैसे example.i2p) को रजिस्टर करने के लिए किया जा सकता है। सबडोमेन रजिस्टर करने के लिए कृपया i2pd-tools का उपयोग करें।"},
+		{"Address", "पता"},
+		{"Type", "प्रकार"},
+		{"EncType", "कूट प्रकार"},
+		{"Expire LeaseSet", "पट्ट समुच्चय का अवसान करें"},
+		{"Inbound tunnels", "आगमनशील सुरंगें"},
+		{"%dms", "%dms"},
+		{"Outbound tunnels", "प्रस्थानशील सुरंगें"},
+		{"Tags", "चिन्हित"},
+		{"Incoming", "आगामी"},
+		{"Outgoing", "निर्गामी"},
+		{"Destination", "गंतव्य"},
+		{"Amount", "मात्रा"},
+		{"Incoming Tags", "आगामी चिन्हित"},
+		{"Tags sessions", "चिन्हित सत्र OR सत्र को चिन्हित करें"},
+		{"Status", "स्थिति"},
+		{"Local Destination", "स्थानीय गंतव्य"},
+		{"Streams", "धाराएँ"},
+		{"Close stream", "प्रवाह समाप्त करें"},
+		{"Such destination is not found", "ऐसा गंतव्य नहीं मिला"},
+		{"I2CP session not found", "I2CP सत्र नहीं मिला"},
+		{"I2CP is not enabled", "I2CP निष्क्रिय है"},
+		{"Invalid", "अमान्य"},
+		{"Store type", "भण्डारगार का प्रकार"},
+		{"Expires", "अवसान होता है"},
+		{"Non Expired Leases", "अनवसित पट्ट"},
+		{"Gateway", "प्रवेशद्वार"},
+		{"TunnelID", "सुरंग ID"},
+		{"EndDate", "समाप्ति तिथि"},
+		{"floodfill mode is disabled", "पूर्णक संवाहक विधि निष्क्रिय है"},
+		{"Queue size", "क्यू आकार"},
+		{"Run peer test", "सहकर्मी परीक्षण चलाएँ"},
+		{"Reload tunnels configuration", "सुरंग विन्यास पुनः लोड करें"},
+		{"Decline transit tunnels", "संचरण सुरंगों को अस्वीकार करें"},
+		{"Accept transit tunnels", "संचरण सुरंगों को स्वीकार करें"},
+		{"Cancel graceful shutdown", "सौम्य अवसान निरस्त करें"},
+		{"Start graceful shutdown", "सौम्य समापन प्रारंभ करें"},
+		{"Force shutdown", "बाध्य अवसान"},
+		{"Reload external CSS styles", "बाह्य CSS शैलियों को पुनः लोड करें"},
+		{"<b>Note:</b> any action done here are not persistent and not changes your config files.", "<b>टिप्पणी:</b> यहाँ किए गए कोई भी क्रियाएँ स्थायी नहीं हैं और आपके विन्यास संचिका में कोई परिवर्तन नहीं करतीं।"},
+		{"Logging level", "लॉगिंग स्तर"},
+		{"Transit tunnels limit", "संचरण सुरंगों की सीमा"},
+		{"Change", "बदलना"},
+		{"Change language", "भाषा बदलें"},
+		{"no transit tunnels currently built", "संचरण सुरंगों का निर्माण नहीं हुआ है"},
+		{"SAM disabled", "SAM निष्क्रिय है"},
+		{"no sessions currently running", "वर्तमान में कोई सत्र सक्रिय नहीं है"},
+		{"SAM session not found", "SAM सत्र नहीं मिला"},
+		{"SAM Session", "SAM सत्र"},
+		{"Server Tunnels", "सर्वर सुरंग"},
+		{"Client Forwards", "क्लाइंट फॉरवर्ड्स"},
+		{"Server Forwards", "सर्वर फॉरवर्ड्स"},
+		{"Unknown page", "अज्ञात पृष्ठ"},
+		{"Invalid token", "अमान्य टोकन"},
+		{"SUCCESS", "सफलता"},
+		{"Stream closed", "प्रवाह समाप्त हो गया है"},
+		{"Stream not found or already was closed", "प्रवाह प्राप्त नहीं हुआ अथवा इसका पूर्व में ही समापन हो चुका है"},
+		{"Destination not found", "गंतव्य नहीं मिला"},
+		{"StreamID can't be null", "प्रवाह ID शून्य नहीं हो सकता है"},
+		{"Return to destination page", "गंतव्य पृष्ठ पर पुनः वापस जाएँ"},
+		{"You will be redirected in %d seconds", "आपको %d सेकंड में पुनर्निर्देशित किया जाएगा"},
+		{"LeaseSet expiration time updated", "पट्ट समुच्चय की अवसान समय को अद्यतित किया गया है"},
+		{"LeaseSet is not found or already expired", "पट्ट समुच्चय प्राप्त नहीं हुआ या इसका पूर्वमेव अवसान हो चुका है"},
+		{"Transit tunnels count must not exceed %d", "संचरण सुरंगों की संख्या %d से अधिक नहीं होनी चाहिए"},
+		{"Back to commands list", "आदेश सूची पर पुनः लौटें"},
+		{"Register at reg.i2p", "reg.i2p पर पंजीकरण करें"},
+		{"Description", "विवरण"},
+		{"A bit information about service on domain", "डोमेन पर सेवा से संबंधित थोड़ी जानकारी"},
+		{"Submit", "प्रस्तुत करें"},
+		{"Domain can't end with .b32.i2p", "डोमेन का अंत .b32.i2p से नहीं हो सकता"},
+		{"Domain must end with .i2p", "डोमेन का अंत .i2p से होना आवश्यक है"},
+		{"Unknown command", "अज्ञात आदेश"},
+		{"Command accepted", "आदेश स्वीकार किया गया"},
+		{"Proxy error", "प्रॉक्सी त्रुटि"},
+		{"Proxy info", "प्रॉक्सी जानकारी"},
+		{"Proxy error: Host not found", "प्रॉक्सी त्रुटि: होस्ट नहीं मिला"},
+		{"Remote host not found in router's addressbook", "राउटर की पता पुस्तक में दूरस्थ होस्ट नहीं मिला"},
+		{"You may try to find this host on jump services below", "आप नीचे दिए गए जंप सेवाओं में इस होस्ट को खोजने की कोशिश कर सकते हैं"},
+		{"Invalid request", "अमान्य अनुरोध"},
+		{"Proxy unable to parse your request", "प्रॉक्सी आपके अनुरोध को विश्लेषित करने में असमर्थ है"},
+		{"Addresshelper is not supported", "Addresshelper समर्थित नहीं है"},
+		{"Host %s is <font color=red>already in router's addressbook</font>. <b>Be careful: source of this URL may be harmful!</b> Click here to update record: <a href=\"%s%s%s&update=true\">Continue</a>.", "होस्ट %s पहले से ही राउटर की पता-पुस्तिका में <font color=red>उपस्थित है</font>। <b>सावधान रहें: इस URL का स्रोत हानिकारक हो सकता है!</b> अभिलेख को अद्यतन करने हेतु यहाँ क्लिक करें: <a href=\"%s%s%s&update=true\">जारी रखें</a>।"},
+		{"Addresshelper forced update rejected", "Addresshelper का जबरन अद्यतन अस्वीकृत किया गया"},
+		{"To add host <b>%s</b> in router's addressbook, click here: <a href=\"%s%s%s\">Continue</a>.", "राउटर की पता-पुस्तिका में होस्ट <b>%s</b> को जोड़ने हेतु, कृपया यहाँ क्लिक करें: <a href=\"%s%s%s\">जारी रखें</a>।"},
+		{"Addresshelper request", "Addresshelper अनुरोध"},
+		{"Host %s added to router's addressbook from helper. Click here to proceed: <a href=\"%s\">Continue</a>.", "सहायक से होस्ट %s राउटर की पता-पुस्तिका में जोड़ दिया गया है। आगे बढ़ने हेतु यहाँ क्लिक करें: <a href=\"%s\">जारी रखें</a>।"},
+		{"Addresshelper adding", "Addresshelper जोड़ना"},
+		{"Host %s is <font color=red>already in router's addressbook</font>. Click here to update record: <a href=\"%s%s%s&update=true\">Continue</a>.", "होस्ट %s पहले से ही राउटर की पता-पुस्तिका में <font color=red>उपस्थित है</font>। अभिलेख को अद्यतन करने हेतु यहाँ क्लिक करें: <a href=\"%s%s%s&update=true\">जारी रखें</a>।"},
+		{"Addresshelper update", "Addresshelper अद्यतन करना"},
+		{"Invalid request URI", "अमान्य अनुरोध URI"},
+		{"Can't detect destination host from request", "अनुरोध से गंतव्य होस्ट का पता नहीं लगा सकते"},
+		{"Outproxy failure", "आउटप्रॉक्सी विफलता"},
+		{"Bad outproxy settings", "गलत आउटप्रॉक्सी सेटिंग्स"},
+		{"Host %s is not inside I2P network, but outproxy is not enabled", "होस्ट %s I2P नेटवर्क के भीतर नहीं है, लेकिन आउटप्रॉक्सी सक्षम नहीं है"},
+		{"Unknown outproxy URL", "अज्ञात आउटप्रॉक्सी URL"},
+		{"Cannot resolve upstream proxy", "ऊर्ध्वधारा प्रॉक्सी का समाधान नहीं किया जा सका"},
+		{"Hostname is too long", "होस्टनाम अत्यधिक लंबा है"},
+		{"Cannot connect to upstream SOCKS proxy", "उर्ध्वधारा SOCKS प्रॉक्सी से संपर्क स्थापित नहीं हो पा रहा है"},
+		{"Cannot negotiate with SOCKS proxy", "SOCKS प्रॉक्सी के साथ समन्वयन स्थापित नहीं किया जा सका"},
+		{"CONNECT error", "संपर्क त्रुटि"},
+		{"Failed to connect", "संपर्क स्थापित करने में विफल"},
+		{"SOCKS proxy error", "SOCKS प्रॉक्सी त्रुटि"},
+		{"Failed to send request to upstream", "ऊर्ध्ववाहिनी को अनुरोध प्रेषित करने में विफलता हुई"},
+		{"No reply from SOCKS proxy", "SOCKS प्रॉक्सी से कोई प्रत्युत्तर प्राप्त नहीं हुआ"},
+		{"Cannot connect", "संपर्क नहीं हो पा रहा है"},
+		{"HTTP out proxy not implemented", "HTTP आउट प्रॉक्सी कार्यान्वित नहीं किया गया है"},
+		{"Cannot connect to upstream HTTP proxy", "उर्ध्वधारा HTTP प्रॉक्सी से संपर्क स्थापित नहीं हो पा रहा है"},
+		{"Host is down", "होस्ट अनुपलब्ध है"},
+		{"Can't create connection to requested host, it may be down. Please try again later.", "अनुरोधित होस्ट से संपर्क स्थापित नहीं किया जा सका। संभवतः वह सक्रिय नहीं है। कृपया बाद में पुनः प्रयास करें।"},
+		{"", ""},
+	};
+
+	static std::map<std::string, std::vector<std::string>> plurals
+	{
+		{"%d days", {"%d दिन", "%d दिन"}},
+		{"%d hours", {"%d घंटा", "%dघंटे"}},
+		{"%d minutes", {"%d मिनट", "%d मिनट"}},
+		{"%d seconds", {"%d सेकंड", "%d सेकंड"}},
+		{"", {"", "", ""}},
+	};
+
+	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
+	{
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
+	}
+
+} // language
+} // i18n
+} // i2p

i18n/I18N.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -30,12 +30,12 @@ namespace i18n
 		}
 	}
 
-	std::string translate (const std::string& arg)
+	std::string_view translate (std::string_view arg)
 	{
 		return i2p::client::context.GetLanguage ()->GetString (arg);
 	}
 
-	std::string translate (const std::string& arg, const std::string& arg2, const int& n)
+	std::string translate (const std::string& arg, const std::string& arg2, const int n)
 	{
 		return i2p::client::context.GetLanguage ()->GetPlural (arg, arg2, n);
 	}

i18n/I18N.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -10,6 +10,7 @@
 #define __I18N_H__
 
 #include <string>
+#include <string_view>
 #include <map>
 #include <utility>
 #include <functional>
@@ -18,15 +19,17 @@ namespace i2p
 {
 namespace i18n
 {
+	typedef std::map<std::string_view, std::string_view> LocaleStrings;
 	class Locale
 	{
 		public:
 			Locale (
 				const std::string& language,
-				const std::map<std::string, std::string>& strings,
+				const bool& rtl,
+				const LocaleStrings& strings,
 				const std::map<std::string, std::vector<std::string>>& plurals,
 				std::function<int(int)> formula
-			): m_Language (language), m_Strings (strings), m_Plurals (plurals), m_Formula (formula) { };
+			): m_Language (language), m_RTL (rtl), m_Strings (strings), m_Plurals (plurals), m_Formula (formula) { };
 
 			// Get activated language name for webconsole
 			std::string GetLanguage() const
@@ -34,7 +37,12 @@ namespace i18n
 				return m_Language;
 			}
 
-			std::string GetString (const std::string& arg) const
+			bool GetRTL() const
+			{
+				return m_RTL;
+			}
+
+			std::string_view GetString (std::string_view arg) const
 			{
 				const auto it = m_Strings.find(arg);
 				if (it == m_Strings.end())
@@ -47,7 +55,7 @@ namespace i18n
 				}
 			}
 
-			std::string GetPlural (const std::string& arg, const std::string& arg2, const int& n) const
+			std::string GetPlural (const std::string& arg, const std::string& arg2, int n) const
 			{
 				const auto it = m_Plurals.find(arg2);
 				if (it == m_Plurals.end()) // not found, fallback to english
@@ -63,14 +71,15 @@ namespace i18n
 
 		private:
 			const std::string m_Language;
-			const std::map<std::string, std::string> m_Strings;
+			const bool m_RTL;
+			const LocaleStrings m_Strings;
 			const std::map<std::string, std::vector<std::string>> m_Plurals;
 			std::function<int(int)> m_Formula;
 	};
 
 	void SetLanguage(const std::string &lang);
-	std::string translate (const std::string& arg);
-	std::string translate (const std::string& arg, const std::string& arg2, const int& n);
+	std::string_view translate (std::string_view arg);
+	std::string translate (const std::string& arg, const std::string& arg2, int n);
 } // i18n
 } // i2p
 
@@ -79,7 +88,7 @@ namespace i18n
  * @param arg String with message
  */
 template<typename TValue>
-std::string tr (TValue&& arg)
+std::string_view tr (TValue&& arg)
 {
 	return i2p::i18n::translate(std::forward<TValue>(arg));
 }
@@ -92,7 +101,7 @@ std::string tr (TValue&& arg)
 template<typename TValue, typename... TArgs>
 std::string tr (TValue&& arg, TArgs&&... args)
 {
-	std::string tr_str = i2p::i18n::translate(std::forward<TValue>(arg));
+	std::string tr_str = std::string (i2p::i18n::translate(std::forward<TValue>(arg))); // TODO:
 
 	size_t size = std::snprintf(NULL, 0, tr_str.c_str(), std::forward<TArgs>(args)...);
 	std::string str(size, 0);
@@ -108,7 +117,7 @@ std::string tr (TValue&& arg, TArgs&&... args)
  * @param n Integer, used for selection of form
  */
 template<typename TValue, typename TValue2>
-std::string ntr (TValue&& arg, TValue2&& arg2, int& n)
+std::string ntr (TValue&& arg, TValue2&& arg2, int n)
 {
 	return i2p::i18n::translate(std::forward<TValue>(arg), std::forward<TValue2>(arg2), std::forward<int>(n));
 }
@@ -121,7 +130,7 @@ std::string ntr (TValue&& arg, TValue2&& arg2, int& n)
  * @param args Array of arguments for string formatting
  */
 template<typename TValue, typename TValue2, typename... TArgs>
-std::string ntr (TValue&& arg, TValue2&& arg2, int& n, TArgs&&... args)
+std::string ntr (TValue&& arg, TValue2&& arg2, int n, TArgs&&... args)
 {
 	std::string tr_str = i2p::i18n::translate(std::forward<TValue>(arg), std::forward<TValue2>(arg2), std::forward<int>(n));
 

i18n/I18N_langs.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -30,6 +30,8 @@ namespace i18n
 	namespace english    { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
 	namespace french     { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
 	namespace german     { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
+	namespace hebrew     { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
+	namespace hindi      { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
 	namespace italian    { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
 	namespace polish     { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
 	namespace portuguese { std::shared_ptr<const i2p::i18n::Locale> GetLocale (); }
@@ -53,6 +55,8 @@ namespace i18n
 		{ "english", {"English", "en", i2p::i18n::english::GetLocale} },
 		{ "french", {"Français", "fr", i2p::i18n::french::GetLocale} },
 		{ "german", {"Deutsch", "de", i2p::i18n::german::GetLocale} },
+		{ "hebrew", {"עִבְרִית‎", "he", i2p::i18n::hebrew::GetLocale} },
+		{ "hindi", {"हिन्दी", "hi", i2p::i18n::hindi::GetLocale} },
 		{ "italian", {"Italiano", "it", i2p::i18n::italian::GetLocale} },
 		{ "polish", {"Polski", "pl", i2p::i18n::polish::GetLocale} },
 		{ "portuguese", {"Português", "pt", i2p::i18n::portuguese::GetLocale} },

i18n/Italian.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2023, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace italian // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -215,7 +218,7 @@ namespace italian // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Polish.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2024, The PurpleI2P Project
+* Copyright (c) 2023-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace polish // language namespace
 		return (n == 1 ? 0 : n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2);
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -215,7 +218,7 @@ namespace polish // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Portuguese.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2024, The PurpleI2P Project
+* Copyright (c) 2023-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace portuguese // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -215,7 +218,7 @@ namespace portuguese // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Russian.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace russian // language namespace
 		return n % 10 == 1 && n % 100 != 11 ? 0 : n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f КиБ"},
 		{"%.2f MiB", "%.2f МиБ"},
@@ -215,7 +218,7 @@ namespace russian // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Spanish.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2023, The PurpleI2P Project
+* Copyright (c) 2022-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace spanish // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -196,7 +199,7 @@ namespace spanish // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Swedish.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023, The PurpleI2P Project
+* Copyright (c) 2023-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace swedish // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -211,7 +214,7 @@ namespace swedish // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Turkish.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023, The PurpleI2P Project
+* Copyright (c) 2023-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace turkish // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -106,7 +109,7 @@ namespace turkish // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Turkmen.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace turkmen // language namespace
 		return n != 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -196,7 +199,7 @@ namespace turkmen // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Ukrainian.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace ukrainian // language namespace
 		return n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f КіБ"},
 		{"%.2f MiB", "%.2f МіБ"},
@@ -215,7 +218,7 @@ namespace ukrainian // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

i18n/Uzbek.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2023, The PurpleI2P Project
+* Copyright (c) 2021-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -29,7 +29,10 @@ namespace uzbek // language namespace
 		return n > 1 ? 1 : 0;
 	}
 
-	static std::map<std::string, std::string> strings
+	// Right to Left language?
+	static bool rtl = false;
+
+	static const LocaleStrings strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@@ -215,7 +218,7 @@ namespace uzbek // language namespace
 
 	std::shared_ptr<const i2p::i18n::Locale> GetLocale()
 	{
-		return std::make_shared<i2p::i18n::Locale>(language, strings, plurals, [] (int n)->int { return plural(n); });
+		return std::make_shared<i2p::i18n::Locale>(language, rtl, strings, plurals, [] (int n)->int { return plural(n); });
 	}
 
 } // language

libi2pd/Base.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -15,7 +15,7 @@ namespace i2p
 {
 namespace data
 {
-	static const char T32[32] =
+	static constexpr char T32[32] =
 	{
 		'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h',
 		'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p',
@@ -27,11 +27,6 @@ namespace data
 	{
 		return T32;
 	}
-
-	bool IsBase32 (char ch)
-	{
-		return (ch >= 'a' && ch <= 'z') || (ch >= '2' && ch <= '7');
-	}	
 	
 	static void iT64Build(void);
 
@@ -43,7 +38,7 @@ namespace data
 	* Direct Substitution Table
 	*/
 
-	static const char T64[64] =
+	static constexpr char T64[64] =
 	{
 		'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
 		'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
@@ -59,24 +54,17 @@ namespace data
 	{
 		return T64;
 	}
-
-	bool IsBase64 (char ch)
-	{
-		return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '~';
-	}	
 	
 	/*
 	* Reverse Substitution Table (built in run time)
 	*/
-
 	static char iT64[256];
 	static int isFirstTime = 1;
 
 	/*
 	* Padding
 	*/
-
-	static char P64 = '=';
+	static constexpr char P64 = '=';
 
 	/*
 	*
@@ -86,134 +74,112 @@ namespace data
 	* Converts binary encoded data to BASE64 format.
 	*
 	*/
-
-	size_t ByteStreamToBase64 (   /* Number of bytes in the encoded buffer */
-		const uint8_t * InBuffer, /* Input buffer, binary data */
-		size_t InCount,           /* Number of bytes in the input buffer */
-		char * OutBuffer,         /* output buffer */
-		size_t len                /* length of output buffer */
+	std::string ByteStreamToBase64 (// base64 encoded string 
+		const uint8_t * InBuffer, 	// Input buffer, binary data 
+	    size_t InCount 				// Number of bytes in the input buffer 
 	)
 	{
 		unsigned char * ps;
-		unsigned char * pd;
 		unsigned char   acc_1;
 		unsigned char   acc_2;
 		int             i;
 		int             n;
 		int             m;
-		size_t          outCount;
 
 		ps = (unsigned char *)InBuffer;
 		n = InCount / 3;
 		m = InCount % 3;
-		if (!m)
-			outCount = 4 * n;
-		else
-			outCount = 4 * (n + 1);
+		size_t outCount = m ? (4 * (n + 1)) : (4 * n);
 
-		if (outCount > len) return 0;
-
-		pd = (unsigned char *)OutBuffer;
+		std::string out;
+		out.reserve (outCount);
 		for ( i = 0; i < n; i++ )
 		{
 			acc_1 = *ps++;
 			acc_2 = (acc_1 << 4) & 0x30;
-			acc_1 >>= 2;                 /* base64 digit #1 */
-			*pd++ = T64[acc_1];
+			acc_1 >>= 2;                 // base64 digit #1 
+			out.push_back (T64[acc_1]);
 			acc_1 = *ps++;
-			acc_2 |= acc_1 >> 4;         /* base64 digit #2 */
-			*pd++ = T64[acc_2];
+			acc_2 |= acc_1 >> 4;         // base64 digit #2
+			out.push_back (T64[acc_2]);
 			acc_1 &= 0x0f;
 			acc_1 <<= 2;
 			acc_2 = *ps++;
-			acc_1 |= acc_2 >> 6;         /* base64 digit #3 */
-			*pd++ = T64[acc_1];
-			acc_2 &= 0x3f;               /* base64 digit #4 */
-			*pd++ = T64[acc_2];
+			acc_1 |= acc_2 >> 6;         // base64 digit #3
+			out.push_back (T64[acc_1]);
+			acc_2 &= 0x3f;               // base64 digit #4
+			out.push_back (T64[acc_2]);
 		}
 		if ( m == 1 )
 		{
 			acc_1 = *ps++;
-			acc_2 = (acc_1 << 4) & 0x3f; /* base64 digit #2 */
-			acc_1 >>= 2;                 /* base64 digit #1 */
-			*pd++ = T64[acc_1];
-			*pd++ = T64[acc_2];
-			*pd++ = P64;
-			*pd++ = P64;
+			acc_2 = (acc_1 << 4) & 0x3f; // base64 digit #2
+			acc_1 >>= 2;                 // base64 digit #1
+			out.push_back (T64[acc_1]);
+			out.push_back (T64[acc_2]);
+			out.push_back (P64);
+			out.push_back (P64);
 
 		}
 		else if ( m == 2 )
 		{
 			acc_1 = *ps++;
 			acc_2 = (acc_1 << 4) & 0x3f;
-			acc_1 >>= 2;                 /* base64 digit #1 */
-			*pd++ = T64[acc_1];
+			acc_1 >>= 2;                 // base64 digit #1
+			out.push_back (T64[acc_1]);
 			acc_1 = *ps++;
-			acc_2 |= acc_1 >> 4;         /* base64 digit #2 */
-			*pd++ = T64[acc_2];
+			acc_2 |= acc_1 >> 4;         // base64 digit #2
+			out.push_back (T64[acc_2]);
 			acc_1 &= 0x0f;
-			acc_1 <<= 2;                 /* base64 digit #3 */
-			*pd++ = T64[acc_1];
-			*pd++ = P64;
+			acc_1 <<= 2;                 // base64 digit #3
+			out.push_back (T64[acc_1]);
+			out.push_back (P64);
 		}
 
-		return outCount;
-	}
-
+		return out;
+	}	
+	
 	/*
 	*
 	* Base64ToByteStream
 	* ------------------
 	*
-	* Converts BASE64 encoded data to binary format. If input buffer is
+	* Converts BASE64 encoded string to binary format. If input buffer is
 	* not properly padded, buffer of negative length is returned
 	*
 	*/
-
-	size_t Base64ToByteStream ( /* Number of output bytes */
-		const char * InBuffer,  /* BASE64 encoded buffer */
-		size_t InCount,         /* Number of input bytes */
-		uint8_t * OutBuffer,    /* output buffer length */
-		size_t len              /* length of output buffer */
+	size_t Base64ToByteStream (		// Number of output bytes 
+		std::string_view base64Str,	// BASE64 encoded string  
+	    uint8_t * OutBuffer, 		// output buffer length 
+	    size_t len					// length of output buffer 
 	)
 	{
-		unsigned char * ps;
 		unsigned char * pd;
 		unsigned char   acc_1;
 		unsigned char   acc_2;
-		int             i;
-		int             n;
-		int             m;
 		size_t          outCount;
 
-		if (isFirstTime)
-			iT64Build();
-
-		n = InCount / 4;
-		m = InCount % 4;
-
-		if (InCount && !m)
-			outCount = 3 * n;
+		if (base64Str.empty () || base64Str[0] == P64) return 0;
+		auto d = std::div (base64Str.length (), 4);
+		if (!d.rem)
+			outCount = 3 * d.quot;
 		else
 			return 0;
 
-		if(*InBuffer == P64)
-			return 0;
-
-		ps = (unsigned char *)(InBuffer + InCount - 1);
-		while ( *ps-- == P64 )
-			outCount--;
-		ps = (unsigned char *)InBuffer;
-
-		if (outCount > len)
-			return 0;
+		if (isFirstTime) iT64Build();
 
+		auto pos = base64Str.find_last_not_of (P64);
+		if (pos == base64Str.npos) return 0;
+		outCount -= (base64Str.length () - pos - 1);
+		if (outCount > len) return 0;
+		
+		auto ps = base64Str.begin ();
 		pd = OutBuffer;
 		auto endOfOutBuffer = OutBuffer + outCount;
-		for ( i = 0; i < n; i++ )
+		for (int i = 0; i < d.quot; i++)
 		{
-			acc_1 = iT64[*ps++];
-			acc_2 = iT64[*ps++];
+			acc_1 = iT64[int(*ps++)];
+			acc_2 = iT64[int(*ps++)];
 			acc_1 <<= 2;
 			acc_1 |= acc_2 >> 4;
 			*pd++ = acc_1;
@@ -221,45 +187,30 @@ namespace data
 				break;
 
 			acc_2 <<= 4;
-			acc_1 = iT64[*ps++];
+			acc_1 = iT64[int(*ps++)];
 			acc_2 |= acc_1 >> 2;
 			*pd++ = acc_2;
 			if (pd >= endOfOutBuffer)
 				break;
 
-			acc_2 = iT64[*ps++];
+			acc_2 = iT64[int(*ps++)];
 			acc_2 |= acc_1 << 6;
 			*pd++ = acc_2;
 		}
 
 		return outCount;
-	}
-
-	size_t Base64EncodingBufferSize (const size_t input_size)
+	}	
+	
+	std::string ToBase64Standard (std::string_view in)
 	{
-		auto d = div (input_size, 3);
-		if (d.rem)
-			d.quot++;
-
-		return 4 * d.quot;
-	}
-
-	std::string ToBase64Standard (const std::string& in)
-	{
-		auto len = Base64EncodingBufferSize (in.length ());
-		char * str = new char[len + 1];
-		auto l = ByteStreamToBase64 ((const uint8_t *)in.c_str (), in.length (), str, len);
-		str[l] = 0;
+		auto str = ByteStreamToBase64 ((const uint8_t *)in.data (), in.length ());
 		// replace '-' by '+' and '~' by '/'
-		for (size_t i = 0; i < l; i++)
-			if (str[i] == '-')
-				str[i] = '+';
-			else if (str[i] == '~')
-				str[i] = '/';
-
-		std::string s(str);
-		delete[] str;
-		return s;
+		for (auto& ch: str)
+			if (ch == '-')
+				ch = '+';
+			else if (ch == '~')
+				ch = '/';
+		return str;
 	}
 
 	/*
@@ -280,13 +231,12 @@ namespace data
 		iT64[(int)P64] = 0;
 	}
 
-	size_t Base32ToByteStream (const char * inBuf, size_t len, uint8_t * outBuf, size_t outLen)
+	size_t Base32ToByteStream (std::string_view base32Str, uint8_t * outBuf, size_t outLen)
 	{
 		unsigned int tmp = 0, bits = 0;
 		size_t ret = 0;
-		for (size_t i = 0; i < len; i++)
+		for (auto ch: base32Str)
 		{
-			char ch = inBuf[i];
 			if (ch >= '2' && ch <= '7') // digit
 				ch = (ch - '2') + 26; // 26 means a-z
 			else if (ch >= 'a' && ch <= 'z')
@@ -306,13 +256,15 @@ namespace data
 			tmp <<= 5;
 		}
 		return ret;
-	}
-
-	size_t ByteStreamToBase32 (const uint8_t * inBuf, size_t len, char * outBuf, size_t outLen)
+	}	
+	
+	std::string ByteStreamToBase32 (const uint8_t * inBuf, size_t len)
 	{
-		size_t ret = 0, pos = 1;
+		std::string out;
+		out.reserve ((len * 8 + 4) / 5);
+		size_t pos = 1;
 		unsigned int bits = 8, tmp = inBuf[0];
-		while (ret < outLen && (bits > 0 || pos < len))
+		while (bits > 0 || pos < len)
 		{
 			if (bits < 5)
 			{
@@ -332,10 +284,9 @@ namespace data
 
 			bits -= 5;
 			int ind = (tmp >> bits) & 0x1F;
-			outBuf[ret] = (ind < 26) ? (ind + 'a') : ((ind - 26) + '2');
-			ret++;
+			out.push_back ((ind < 26) ? (ind + 'a') : ((ind - 26) + '2'));
 		}
-		return ret;
-	}
+		return out;
+	}	
 }
 }

libi2pd/Base.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,27 +11,42 @@
 
 #include <inttypes.h>
 #include <string>
-#include <iostream>
+#include <string_view>
+#include <cstdlib>
+
+namespace i2p 
+{
+namespace data 
+{
+	std::string ByteStreamToBase64 (const uint8_t * InBuffer, size_t InCount);
+	size_t Base64ToByteStream (std::string_view base64Str, uint8_t * OutBuffer, size_t len);
 
-namespace i2p {
-namespace data {
-	size_t ByteStreamToBase64 (const uint8_t * InBuffer, size_t InCount, char * OutBuffer, size_t len);
-	size_t Base64ToByteStream (const char * InBuffer, size_t InCount, uint8_t * OutBuffer, size_t len );
 	const char * GetBase32SubstitutionTable ();
 	const char * GetBase64SubstitutionTable ();
-	bool IsBase64 (char ch);
+	constexpr bool IsBase64 (char ch)
+	{
+		return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '~';
+	}	
 
-	size_t Base32ToByteStream (const char * inBuf, size_t len, uint8_t * outBuf, size_t outLen);
-	size_t ByteStreamToBase32 (const uint8_t * InBuf, size_t len, char * outBuf, size_t outLen);
-	bool IsBase32 (char ch);
+	size_t Base32ToByteStream (std::string_view base32Str, uint8_t * outBuf, size_t outLen);
+	std::string ByteStreamToBase32 (const uint8_t * inBuf, size_t len);	
+	constexpr bool IsBase32 (char ch)
+	{
+		return (ch >= 'a' && ch <= 'z') || (ch >= '2' && ch <= '7');
+	}	
 
 	/**
 	 * Compute the size for a buffer to contain encoded base64 given that the size of the input is input_size bytes
 	 */
-	size_t Base64EncodingBufferSize(const size_t input_size);
-
-	std::string ToBase64Standard (const std::string& in); // using standard table, for Proxy-Authorization
+	inline size_t Base64EncodingBufferSize(size_t input_size)
+	{
+		auto d = std::div (input_size, 3);
+		if (d.rem) d.quot++;
+		return 4 * d.quot;
+	}	
 
+	std::string ToBase64Standard (std::string_view in); // using standard table, for Proxy-Authorization
+	
 } // data
 } // i2p
 

libi2pd/Blinding.cpp

@@ -1,15 +1,17 @@
 /*
-* Copyright (c) 2013-2022, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
 * See full license text in LICENSE file at top of project tree
 */
 
+#include <cstdint>
 #include <zlib.h> // for crc32
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <openssl/ec.h>
+#include <openssl/evp.h>
 #include <openssl/bn.h>
 #include "Base.h"
 #include "Crypto.h"
@@ -65,10 +67,10 @@ namespace data
 		BIGNUM * x = BN_bin2bn (pub, publicKeyLen/2, NULL);
 		BIGNUM * y = BN_bin2bn (pub + publicKeyLen/2, publicKeyLen/2, NULL);
 		EC_POINT * p = EC_POINT_new (group);
-		EC_POINT_set_affine_coordinates_GFp (group, p, x, y, NULL);
+		EC_POINT_set_affine_coordinates (group, p, x, y, NULL);
 		EC_POINT * p1 = BlindPublicKeyECDSA (group, p, seed);
 		EC_POINT_free (p);
-		EC_POINT_get_affine_coordinates_GFp (group, p1, x, y, NULL);
+		EC_POINT_get_affine_coordinates (group, p1, x, y, NULL);
 		EC_POINT_free (p1);
 		i2p::crypto::bn2buf (x, blindedPub, publicKeyLen/2);
 		i2p::crypto::bn2buf (y, blindedPub + publicKeyLen/2, publicKeyLen/2);
@@ -88,7 +90,7 @@ namespace data
 		BN_CTX_free (ctx);
 		BN_free (a1);
 		BIGNUM * x = BN_new(), * y = BN_new();
-		EC_POINT_get_affine_coordinates_GFp (group, p, x, y, NULL);
+		EC_POINT_get_affine_coordinates (group, p, x, y, NULL);
 		EC_POINT_free (p);
 		i2p::crypto::bn2buf (x, blindedPub, publicKeyLen/2);
 		i2p::crypto::bn2buf (y, blindedPub + publicKeyLen/2, publicKeyLen/2);
@@ -152,11 +154,11 @@ namespace data
 			m_BlindedSigType = m_SigType;
 	}
 
-	BlindedPublicKey::BlindedPublicKey (const std::string& b33):
+	BlindedPublicKey::BlindedPublicKey (std::string_view b33):
 		m_SigType (0) // 0 means invalid, we can't blind DSA, set it later
 	{
 		uint8_t addr[40]; // TODO: define length from b33
-		size_t l = i2p::data::Base32ToByteStream (b33.c_str (), b33.length (), addr, 40);
+		size_t l = i2p::data::Base32ToByteStream (b33, addr, 40);
 		if (l < 32)
 		{
 			LogPrint (eLogError, "Blinding: Malformed b33 ", b33);
@@ -198,7 +200,7 @@ namespace data
 	std::string BlindedPublicKey::ToB33 () const
 	{
 		if (m_PublicKey.size () > 32) return ""; // assume 25519
-		uint8_t addr[35]; char str[60]; // TODO: define actual length
+		uint8_t addr[35];
 		uint8_t flags = 0;
 		if (m_IsClientAuth) flags |= B33_PER_CLIENT_AUTH_FLAG;
 		addr[0] = flags; // flags
@@ -208,8 +210,7 @@ namespace data
 		uint32_t checksum = crc32 (0, addr + 3, m_PublicKey.size ());
 		// checksum is Little Endian
 		addr[0] ^= checksum; addr[1] ^= (checksum >> 8); addr[2] ^= (checksum >> 16);
-		auto l = ByteStreamToBase32 (addr, m_PublicKey.size () + 3, str, 60);
-		return std::string (str, str + l);
+		return ByteStreamToBase32 (addr, m_PublicKey.size () + 3);
 	}
 
 	void BlindedPublicKey::GetCredential (uint8_t * credential) const
@@ -296,12 +297,14 @@ namespace data
 
 	void BlindedPublicKey::H (const std::string& p, const std::vector<std::pair<const uint8_t *, size_t> >& bufs, uint8_t * hash) const
 	{
-		SHA256_CTX ctx;
-		SHA256_Init (&ctx);
-		SHA256_Update (&ctx, p.c_str (), p.length ());
+		EVP_MD_CTX *ctx = EVP_MD_CTX_new ();
+
+		EVP_DigestInit_ex(ctx, EVP_sha256 (), NULL);
+		EVP_DigestUpdate (ctx, p.c_str (), p.length ());
 		for (const auto& it: bufs)
-			SHA256_Update (&ctx, it.first, it.second);
-		SHA256_Final (hash, &ctx);
+			EVP_DigestUpdate (ctx, it.first, it.second);
+		EVP_DigestFinal_ex (ctx, (uint8_t * )hash, nullptr);
+		EVP_MD_CTX_free (ctx);
 	}
 
 	i2p::data::IdentHash BlindedPublicKey::GetStoreHash (const char * date) const
@@ -320,11 +323,12 @@ namespace data
 		if (publicKeyLength)
 		{
 			auto stA1 = htobe16 (m_BlindedSigType);
-			SHA256_CTX ctx;
-			SHA256_Init (&ctx);
-			SHA256_Update (&ctx, (const uint8_t *)&stA1, 2);
-			SHA256_Update (&ctx, blinded, publicKeyLength);
-			SHA256_Final ((uint8_t *)hash, &ctx);
+			EVP_MD_CTX *ctx = EVP_MD_CTX_new ();
+			EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+			EVP_DigestUpdate (ctx, (const uint8_t *)&stA1, 2);
+			EVP_DigestUpdate (ctx, blinded, publicKeyLength);
+			EVP_DigestFinal_ex (ctx, (uint8_t * )hash, nullptr);
+			EVP_MD_CTX_free(ctx);
 		}
 		else
 			LogPrint (eLogError, "Blinding: Blinded key type ", (int)m_BlindedSigType, " is not supported");

libi2pd/Blinding.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,6 +11,7 @@
 
 #include <inttypes.h>
 #include <string>
+#include <string_view>
 #include <vector>
 #include "Identity.h"
 
@@ -23,7 +24,7 @@ namespace data
 		public:
 
 			BlindedPublicKey (std::shared_ptr<const IdentityEx> identity, bool clientAuth = false);
-			BlindedPublicKey (const std::string& b33); // from b33 without .b32.i2p
+			BlindedPublicKey (std::string_view b33); // from b33 without .b32.i2p
 			std::string ToB33 () const;
 
 			const uint8_t * GetPublicKey () const { return m_PublicKey.data (); };

libi2pd/CPU.cpp

@@ -1,68 +0,0 @@
-/*
-* Copyright (c) 2013-2023, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
-#include "CPU.h"
-#include "Log.h"
-
-#ifndef bit_AES
-	#define bit_AES (1 << 25)
-#endif
-
-#if defined(__GNUC__) && __GNUC__ < 6 && IS_X86
-	#include <cpuid.h>
-#endif
-
-#ifdef _MSC_VER
-	#include <intrin.h>
-#endif
-
-namespace i2p
-{
-namespace cpu
-{
-	bool aesni = false;
-
-	inline bool cpu_support_aes()
-	{
-#if IS_X86
-#if defined(__clang__)
-#	if (__clang_major__ >= 6)
-		__builtin_cpu_init();
-#	endif
-		return __builtin_cpu_supports("aes");
-#elif (defined(__GNUC__) && __GNUC__ >= 6)
-		__builtin_cpu_init();
-		return __builtin_cpu_supports("aes");
-#elif (defined(__GNUC__) && __GNUC__ < 6)
-		int cpu_info[4];
-		bool flag = false;
-		__cpuid(0, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
-		if (cpu_info[0] >= 0x00000001) {
-			__cpuid(0x00000001, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
-			flag = ((cpu_info[2] & bit_AES) != 0);
-		}
-		return flag;
-#elif defined(_MSC_VER)
-		int cpu_info[4];
-		__cpuid(cpu_info, 1);
-		return ((cpu_info[2] & bit_AES) != 0);
-#endif
-#endif
-		return false;
-	}
-
-	void Detect(bool AesSwitch, bool force)
-	{
-		if ((cpu_support_aes() && AesSwitch) || (AesSwitch && force)) {
-			aesni = true;
-		}
-
-		LogPrint(eLogInfo, "AESNI ", (aesni ? "enabled" : "disabled"));
-	}
-}
-}

libi2pd/CPU.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -21,20 +21,4 @@
 #	define IS_X86_64 0
 #endif
 
-#if defined(__AES__) && !defined(_MSC_VER) && IS_X86
-#	define SUPPORTS_AES 1
-#else
-#	define SUPPORTS_AES 0
-#endif
-
-namespace i2p
-{
-namespace cpu
-{
-	extern bool aesni;
-
-	void Detect(bool AesSwitch, bool force);
-}
-}
-
 #endif

libi2pd/Config.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -76,7 +76,12 @@ namespace config {
 		options_description limits("Limits options");
 		limits.add_options()
 			("limits.coresize", value<uint32_t>()->default_value(0),          "Maximum size of corefile in Kb (0 - use system limit)")
+#if defined(__HAIKU__)
+			// Haiku's system default is 512, so we set 4096 explicitly
+			("limits.openfiles", value<uint16_t>()->default_value(4096),		"Maximum number of open files (4096 by default)")
+#else			
 			("limits.openfiles", value<uint16_t>()->default_value(0),         "Maximum number of open files (0 - use system default)")
+#endif			
 			("limits.transittunnels", value<uint32_t>()->default_value(10000), "Maximum active transit tunnels (default:10000)")
 			("limits.zombies", value<double>()->default_value(0),             "Minimum percentage of successfully created tunnels under which tunnel cleanup is paused (default [%]: 0.00)")
 			("limits.ntcpsoft", value<uint16_t>()->default_value(0),          "Ignored")
@@ -97,6 +102,7 @@ namespace config {
 			("http.webroot", value<std::string>()->default_value("/"),          "WebUI root path (default: / )")
 			("http.lang", value<std::string>()->default_value("english"),       "WebUI language (default: english )")
 			("http.showTotalTCSR", value<bool>()->default_value(false),         "Show additional value with total TCSR since router's start (default: false)")
+			("http.theme", value<std::string>()->default_value("light"), 	    "Theme for http web console")
 		;
 
 		options_description httpproxy("HTTP Proxy options");
@@ -117,9 +123,18 @@ namespace config {
 			("httpproxy.latency.max", value<std::string>()->default_value("0"),       "HTTP proxy max latency for tunnels")
 			("httpproxy.outproxy", value<std::string>()->default_value(""),           "HTTP proxy upstream out proxy url")
 			("httpproxy.addresshelper", value<bool>()->default_value(true),           "Enable or disable addresshelper")
+			("httpproxy.senduseragent", value<bool>()->default_value(false),          "Pass through user's User-Agent if enabled. Disabled by default")
 			("httpproxy.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Local destination's LeaseSet type")
-			("httpproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("0,4"), "Local destination's LeaseSet encryption type")
+#if OPENSSL_PQ
+			("httpproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("6,4,0"), "Local destination's LeaseSet encryption type")
+#else			
+			("httpproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("4,0"), "Local destination's LeaseSet encryption type")
+#endif			
 			("httpproxy.i2cp.leaseSetPrivKey", value<std::string>()->default_value(""), "LeaseSet private key")
+			("httpproxy.i2p.streaming.maxOutboundSpeed", value<std::string>()->default_value("1730000000"), "Max outbound speed of HTTP proxy stream in bytes/sec")
+			("httpproxy.i2p.streaming.maxInboundSpeed", value<std::string>()->default_value("1730000000"), "Max inbound speed of HTTP proxy stream in bytes/sec")
+			("httpproxy.i2p.streaming.profile", value<std::string>()->default_value("1"), "HTTP Proxy bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
+			("httpproxy.i2p.streaming.maxWindowSize", value<std::string>()->default_value("512"), "HTTP Proxy stream max window size. 512 by default")
 		;
 
 		options_description socksproxy("SOCKS Proxy options");
@@ -142,10 +157,33 @@ namespace config {
 			("socksproxy.outproxy", value<std::string>()->default_value("127.0.0.1"),  "Upstream outproxy address for SOCKS Proxy")
 			("socksproxy.outproxyport", value<uint16_t>()->default_value(9050),        "Upstream outproxy port for SOCKS Proxy")
 			("socksproxy.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Local destination's LeaseSet type")
-			("socksproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("0,4"), "Local destination's LeaseSet encryption type")
+#if OPENSSL_PQ
+			("socksproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("6,4,0"), "Local destination's LeaseSet encryption type")
+#else			
+			("socksproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("4,0"), "Local destination's LeaseSet encryption type")
+#endif			
 			("socksproxy.i2cp.leaseSetPrivKey", value<std::string>()->default_value(""), "LeaseSet private key")
+			("socksproxy.i2p.streaming.maxOutboundSpeed", value<std::string>()->default_value("1730000000"), "Max outbound speed of SOCKS proxy stream in bytes/sec")
+			("socksproxy.i2p.streaming.maxInboundSpeed", value<std::string>()->default_value("1730000000"), "Max inbound speed of SOCKS proxy stream in bytes/sec")
+			("socksproxy.i2p.streaming.profile", value<std::string>()->default_value("1"), "SOCKS Proxy bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
+			("socksproxy.i2p.streaming.maxWindowSize", value<std::string>()->default_value("512"), "SOCKS Proxy stream max window size. 512 by default")
 		;
 
+		options_description shareddest("Shared local destination options");
+		shareddest.add_options()
+			("shareddest.inbound.length", value<std::string>()->default_value("3"),    "Shared local destination inbound tunnel length")
+			("shareddest.outbound.length", value<std::string>()->default_value("3"),   "Shared local destination outbound tunnel length")
+			("shareddest.inbound.quantity", value<std::string>()->default_value("3"),  "Shared local destination inbound tunnels quantity")
+			("shareddest.outbound.quantity", value<std::string>()->default_value("3"), "Shared local destination outbound tunnels quantity")
+			("shareddest.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Shared local destination's LeaseSet type")
+#if OPENSSL_PQ
+			("shareddest.i2cp.leaseSetEncType", value<std::string>()->default_value("6,4,0"), "Shared local destination's LeaseSet encryption type")
+#else			
+			("shareddest.i2cp.leaseSetEncType", value<std::string>()->default_value("4,0"), "Shared local destination's LeaseSet encryption type")
+#endif			
+			("shareddest.i2p.streaming.profile", value<std::string>()->default_value("2"), "Shared local destination bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
+		;	
+		
 		options_description sam("SAM bridge options");
 		sam.add_options()
 			("sam.enabled", value<bool>()->default_value(true),               "Enable or disable SAM Application bridge")
@@ -215,22 +253,19 @@ namespace config {
 				"https://reseed2.i2p.net/,"
 				"https://reseed.diva.exchange/,"
 				"https://reseed-fr.i2pd.xyz/,"
-				"https://reseed.memcpy.io/,"
 				"https://reseed.onion.im/,"
 				"https://i2pseed.creativecowpat.net:8443/,"
 				"https://reseed.i2pgit.org/,"
-				"https://banana.incognet.io/,"
+				"https://coconut.incognet.io/,"
 				"https://reseed-pl.i2pd.xyz/,"
 				"https://www2.mk16.de/,"
-			    "https://i2p.ghativega.in/,"
 			    "https://i2p.novg.net/,"
-            	"https://reseed.stormycloud.org/"
+            	"https://reseed.stormycloud.org/"                                              
 			),                                                            "Reseed URLs, separated by comma")
 			("reseed.yggurls", value<std::string>()->default_value(
 				"http://[324:71e:281a:9ed3::ace]:7070/,"
 				"http://[301:65b9:c7cd:9a36::1]:18801/,"
 				"http://[320:8936:ec1a:31f1::216]/,"
-				"http://[306:3834:97b9:a00a::1]/,"
 				"http://[316:f9e0:f22e:a74f::216]/"
 			),                                                            "Reseed URLs through the Yggdrasil, separated by comma")
 		;
@@ -287,6 +322,8 @@ namespace config {
 			("ssu2.mtu4", value<uint16_t>()->default_value(0),            "MTU for ipv4 address (default: detect)")
 			("ssu2.mtu6", value<uint16_t>()->default_value(0),            "MTU for ipv6 address (default: detect)")
 			("ssu2.proxy", value<std::string>()->default_value(""),       "Socks5 proxy URL for SSU2 transport")
+			("ssu2.firewalled4", value<bool>()->default_value(false),     "Set ipv4 network status to Firewalled even if OK (default: disabled)")
+			("ssu2.firewalled6", value<bool>()->default_value(false),     "Set ipv6 network status to Firewalled even if OK (default: disabled)")
 		;
 
 		options_description nettime("Time sync options");
@@ -308,11 +345,11 @@ namespace config {
 			("persist.addressbook", value<bool>()->default_value(true),    "Persist full addresses (default: true)")
 		;
 
-		options_description cpuext("CPU encryption extensions options");
+		options_description cpuext("CPU encryption extensions options. Deprecated");
 		cpuext.add_options()
-			("cpuext.aesni", bool_switch()->default_value(true),                     "Use auto detection for AESNI CPU extensions. If false, AESNI will be not used")
+			("cpuext.aesni", bool_switch()->default_value(true),                     "Deprecated option")
 			("cpuext.avx", bool_switch()->default_value(false),                      "Deprecated option")
-			("cpuext.force", bool_switch()->default_value(false),                    "Force usage of CPU extensions. Useful when cpuinfo is not available on virtual machines")
+			("cpuext.force", bool_switch()->default_value(false),                    "Deprecated option")
 		;
 
 		options_description meshnets("Meshnet transports options");
@@ -334,6 +371,7 @@ namespace config {
 			.add(httpserver)
 			.add(httpproxy)
 			.add(socksproxy)
+			.add(shareddest)
 			.add(sam)
 			.add(bob)
 			.add(i2cp)

libi2pd/Crypto.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,6 +11,7 @@
 
 #include <inttypes.h>
 #include <string>
+#include <string_view>
 #include <vector>
 #include <openssl/bn.h>
 #include <openssl/dh.h>
@@ -25,16 +26,13 @@
 
 #include "Base.h"
 #include "Tag.h"
-#include "CPU.h"
 
 // recognize openssl version and features
-#if (OPENSSL_VERSION_NUMBER >= 0x010101000) // 1.1.1
-#	define OPENSSL_HKDF 1
-#	define OPENSSL_EDDSA 1
-#	define OPENSSL_X25519 1
-#	if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER != 0x030000000)) // 3.0.0, regression in SipHash, not implemented in LibreSSL
-#		define OPENSSL_SIPHASH 1
-#	endif
+#if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER != 0x030000000)) // 3.0.0, regression in SipHash, not implemented in LibreSSL
+#	define OPENSSL_SIPHASH 1
+#endif
+#if (OPENSSL_VERSION_NUMBER >= 0x030500000) // 3.5.0
+#	define OPENSSL_PQ 1
 #endif
 
 namespace i2p
@@ -44,7 +42,11 @@ namespace crypto
 	bool bn2buf (const BIGNUM * bn, uint8_t * buf, size_t len);
 
 	// DSA
+#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
+	EVP_PKEY * CreateDSA (BIGNUM * pubKey = nullptr, BIGNUM * privKey = nullptr);
+#else
 	DSA * CreateDSA ();
+#endif	
 
 	// RSA
 	const BIGNUM * GetRSAE ();
@@ -70,13 +72,8 @@ namespace crypto
 		private:
 
 			uint8_t m_PublicKey[32];
-#if OPENSSL_X25519
 			EVP_PKEY_CTX * m_Ctx;
 			EVP_PKEY * m_Pkey;
-#else
-			BN_CTX * m_Ctx;
-			uint8_t m_PrivateKey[32];
-#endif
 			bool m_IsElligatorIneligible = false; // true if definitely ineligible
 	};
 
@@ -91,142 +88,70 @@ namespace crypto
 	void GenerateECIESKeyPair (const EC_GROUP * curve, BIGNUM *& priv, EC_POINT *& pub);
 
 	// AES
-	struct ChipherBlock
-	{
-		uint8_t buf[16];
-
-		void operator^=(const ChipherBlock& other) // XOR
-		{
-			if (!(((size_t)buf | (size_t)other.buf) & 0x03)) // multiple of 4 ?
-			{
-				for (int i = 0; i < 4; i++)
-					reinterpret_cast<uint32_t *>(buf)[i] ^= reinterpret_cast<const uint32_t *>(other.buf)[i];
-			}
-			else
-			{
-				for (int i = 0; i < 16; i++)
-					buf[i] ^= other.buf[i];
-			}
-		}
-	};
-
 	typedef i2p::data::Tag<32> AESKey;
-
-	template<size_t sz>
-	class AESAlignedBuffer // 16 bytes alignment
-	{
-		public:
-
-			AESAlignedBuffer ()
-			{
-				m_Buf = m_UnalignedBuffer;
-				uint8_t rem = ((size_t)m_Buf) & 0x0f;
-				if (rem)
-					m_Buf += (16 - rem);
-			}
-
-			operator uint8_t * () { return m_Buf; };
-			operator const uint8_t * () const { return m_Buf; };
-			ChipherBlock * GetChipherBlock () { return (ChipherBlock *)m_Buf; };
-			const ChipherBlock * GetChipherBlock () const { return (const ChipherBlock *)m_Buf; };
-
-		private:
-
-			uint8_t m_UnalignedBuffer[sz + 15]; // up to 15 bytes alignment
-			uint8_t * m_Buf;
-	};
-
-
-#if SUPPORTS_AES
-	class ECBCryptoAESNI
-	{
-		public:
-
-			uint8_t * GetKeySchedule () { return m_KeySchedule; };
-
-		protected:
-
-			void ExpandKey (const AESKey& key);
-
-		private:
-
-			AESAlignedBuffer<240> m_KeySchedule;	// 14 rounds for AES-256, 240 bytes
-	};
-#endif
-
-#if SUPPORTS_AES
-	class ECBEncryption: public ECBCryptoAESNI
-#else
+	
 	class ECBEncryption
-#endif
 	{
 		public:
 
-		void SetKey (const AESKey& key);
+			ECBEncryption ();
+			~ECBEncryption ();
+			
+			void SetKey (const uint8_t * key) { m_Key = key; };
+			void Encrypt(const uint8_t * in, uint8_t * out);
 
-		void Encrypt(const ChipherBlock * in, ChipherBlock * out);
+		private:
 
-	private:
-		AES_KEY m_Key;
+			AESKey m_Key;
+			EVP_CIPHER_CTX * m_Ctx;	
 	};
 
-#if SUPPORTS_AES
-	class ECBDecryption: public ECBCryptoAESNI
-#else
 	class ECBDecryption
-#endif
 	{
 		public:
 
-			void SetKey (const AESKey& key);
-			void Decrypt (const ChipherBlock * in, ChipherBlock * out);
+			ECBDecryption ();
+			~ECBDecryption ();
+			
+			void SetKey (const uint8_t * key) { m_Key = key; };
+			void Decrypt (const uint8_t * in, uint8_t * out);
+			
 		private:
-			AES_KEY m_Key;
+			
+			AESKey m_Key;
+			EVP_CIPHER_CTX * m_Ctx;	
 	};
 
 	class CBCEncryption
 	{
 		public:
 
-			CBCEncryption () { memset ((uint8_t *)m_LastBlock, 0, 16); };
-
-			void SetKey (const AESKey& key) { m_ECBEncryption.SetKey (key); }; // 32 bytes
-			void SetIV (const uint8_t * iv) { memcpy ((uint8_t *)m_LastBlock, iv, 16); }; // 16 bytes
-			void GetIV (uint8_t * iv) const { memcpy (iv, (const uint8_t *)m_LastBlock, 16); };
-
-			void Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out);
-			void Encrypt (const uint8_t * in, std::size_t len, uint8_t * out);
-			void Encrypt (const uint8_t * in, uint8_t * out); // one block
-
-			ECBEncryption & ECB() { return m_ECBEncryption; }
+			CBCEncryption ();
+			~CBCEncryption ();
 
+			void SetKey (const uint8_t * key) { m_Key = key; }; // 32 bytes		
+			void Encrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out);
+			
 		private:
 
-			AESAlignedBuffer<16> m_LastBlock;
-
-			ECBEncryption m_ECBEncryption;
+			AESKey m_Key;
+			EVP_CIPHER_CTX * m_Ctx;	
 	};
 
 	class CBCDecryption
 	{
 		public:
 
-			CBCDecryption () { memset ((uint8_t *)m_IV, 0, 16); };
-
-			void SetKey (const AESKey& key) { m_ECBDecryption.SetKey (key); }; // 32 bytes
-			void SetIV (const uint8_t * iv) { memcpy ((uint8_t *)m_IV, iv, 16); }; // 16 bytes
-			void GetIV (uint8_t * iv) const { memcpy (iv, (const uint8_t *)m_IV, 16); };
-
-			void Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out);
-			void Decrypt (const uint8_t * in, std::size_t len, uint8_t * out);
-			void Decrypt (const uint8_t * in, uint8_t * out); // one block
-
-			ECBDecryption & ECB() { return m_ECBDecryption; }
+			CBCDecryption ();
+			~CBCDecryption ();
+			
+			void SetKey (const uint8_t * key) { m_Key = key; }; // 32 bytes
+			void Decrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out);
 
 		private:
 
-			AESAlignedBuffer<16> m_IV;
-			ECBDecryption m_ECBDecryption;
+			AESKey m_Key;
+			EVP_CIPHER_CTX * m_Ctx;	
 	};
 
 	class TunnelEncryption // with double IV encryption
@@ -266,35 +191,86 @@ namespace crypto
 	};
 
 // AEAD/ChaCha20/Poly1305
-	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen, const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt); // msgLen is len without tag
 
-	void AEADChaCha20Poly1305Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, const uint8_t * key, const uint8_t * nonce, uint8_t * mac); // encrypt multiple buffers with zero ad
+	class AEADChaCha20Poly1305Encryptor
+	{
+		public:
 
+			AEADChaCha20Poly1305Encryptor ();
+			~AEADChaCha20Poly1305Encryptor ();
+
+			bool Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); // msgLen is len without tag
+
+			void Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, const uint8_t * key, const uint8_t * nonce, uint8_t * mac); // encrypt multiple buffers with zero ad
+			
+		private:
+
+			EVP_CIPHER_CTX * m_Ctx;	
+	};	
+
+	class AEADChaCha20Poly1305Decryptor
+	{
+		public:
+
+			AEADChaCha20Poly1305Decryptor ();
+			~AEADChaCha20Poly1305Decryptor ();
+
+			bool Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); // msgLen is len without tag
+			
+		private:
+
+			EVP_CIPHER_CTX * m_Ctx;	
+	};	
+	
+	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt); // msgLen is len without tag
+	
 // ChaCha20
 	void ChaCha20 (const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out);
 
+	class ChaCha20Context
+	{
+		public:
+
+			ChaCha20Context ();
+			~ChaCha20Context ();
+			void operator ()(const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out);
+			
+		private:
+
+			EVP_CIPHER_CTX * m_Ctx;	
+	};
+	
 // HKDF
 
-	void HKDF (const uint8_t * salt, const uint8_t * key, size_t keyLen, const std::string& info, uint8_t * out, size_t outLen = 64); // salt - 32, out - 32 or 64, info <= 32
+	void HKDF (const uint8_t * salt, const uint8_t * key, size_t keyLen, std::string_view info, uint8_t * out, size_t outLen = 64); // salt - 32, out - 32 or 64, info <= 32
 
 // Noise
 
 	struct NoiseSymmetricState
 	{
 		uint8_t m_H[32] /*h*/, m_CK[64] /*[ck, k]*/;
+		uint64_t m_N;
 
+		void Init (const uint8_t * ck, const uint8_t * hh, const uint8_t * pub);
+		
 		void MixHash (const uint8_t * buf, size_t len);
 		void MixHash (const std::vector<std::pair<uint8_t *, size_t> >& bufs);
 		void MixKey (const uint8_t * sharedSecret);
+
+		bool Encrypt (const uint8_t * in, uint8_t * out, size_t len); // out length = len + 16
+		bool Decrypt (const uint8_t * in, uint8_t * out, size_t len); // len without 16 bytes tag
 	};
 
 	void InitNoiseNState (NoiseSymmetricState& state, const uint8_t * pub); // Noise_N (tunnels, router)
 	void InitNoiseXKState (NoiseSymmetricState& state, const uint8_t * pub); // Noise_XK (NTCP2)
 	void InitNoiseXKState1 (NoiseSymmetricState& state, const uint8_t * pub); // Noise_XK (SSU2)
 	void InitNoiseIKState (NoiseSymmetricState& state, const uint8_t * pub); // Noise_IK (ratchets)
-
+	
 // init and terminate
-	void InitCrypto (bool precomputation, bool aesni, bool force);
+	void InitCrypto (bool precomputation);
 	void TerminateCrypto ();
 }
 }

libi2pd/CryptoKey.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2021, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -41,7 +41,7 @@ namespace crypto
 		m_PublicKey = EC_POINT_new (m_Curve);
 		BIGNUM * x = BN_bin2bn (pub, 32, nullptr);
 		BIGNUM * y = BN_bin2bn (pub + 32, 32, nullptr);
-		if (!EC_POINT_set_affine_coordinates_GFp (m_Curve, m_PublicKey, x, y, nullptr))
+		if (!EC_POINT_set_affine_coordinates (m_Curve, m_PublicKey, x, y, nullptr))
 			LogPrint (eLogError, "ECICS P256 invalid public key");
 		BN_free (x); BN_free (y);
 	}
@@ -87,7 +87,7 @@ namespace crypto
 		RAND_bytes (priv + 32, 224);
 		BN_free (key);
 		BIGNUM * x = BN_new (), * y = BN_new ();
-		EC_POINT_get_affine_coordinates_GFp (curve, p, x, y, NULL);
+		EC_POINT_get_affine_coordinates (curve, p, x, y, NULL);
 		bn2buf (x, pub, 32);
 		bn2buf (y, pub + 32, 32);
 		RAND_bytes (pub + 64, 192);
@@ -102,7 +102,7 @@ namespace crypto
 		m_PublicKey = EC_POINT_new (curve->GetGroup ());
 		BIGNUM * x = BN_bin2bn (pub, 32, nullptr);
 		BIGNUM * y = BN_bin2bn (pub + 32, 32, nullptr);
-		if (!EC_POINT_set_affine_coordinates_GFp (curve->GetGroup (), m_PublicKey, x, y, nullptr))
+		if (!EC_POINT_set_affine_coordinates (curve->GetGroup (), m_PublicKey, x, y, nullptr))
 			LogPrint (eLogError, "ECICS GOST R 34.10 invalid public key");
 		BN_free (x); BN_free (y);
 	}
@@ -146,7 +146,7 @@ namespace crypto
 		RAND_bytes (priv + 32, 224);
 		BN_free (key);
 		BIGNUM * x = BN_new (), * y = BN_new ();
-		EC_POINT_get_affine_coordinates_GFp (curve->GetGroup (), p, x, y, NULL);
+		EC_POINT_get_affine_coordinates (curve->GetGroup (), p, x, y, NULL);
 		bn2buf (x, pub, 32);
 		bn2buf (y, pub + 32, 32);
 		RAND_bytes (pub + 64, 192);
@@ -181,5 +181,21 @@ namespace crypto
 		k.GetPrivateKey (priv);
 		memcpy (pub, k.GetPublicKey (), 32);
 	}
+
+	LocalEncryptionKey::LocalEncryptionKey (i2p::data::CryptoKeyType t): keyType(t) 
+	{ 
+		pub.resize (GetCryptoPublicKeyLen (keyType)); 
+		priv.resize (GetCryptoPrivateKeyLen (keyType));
+	}
+	
+	void LocalEncryptionKey::GenerateKeys () 
+	{ 
+		i2p::data::PrivateKeys::GenerateCryptoKeyPair (keyType, priv.data (), pub.data ()); 
+	}
+	
+	void LocalEncryptionKey::CreateDecryptor () 
+	{ 
+		decryptor = i2p::data::PrivateKeys::CreateDecryptor (keyType, priv.data ()); 
+	}
 }
 }

libi2pd/CryptoKey.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2021, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,6 +11,7 @@
 
 #include <inttypes.h>
 #include "Crypto.h"
+#include "Identity.h"
 
 namespace i2p
 {
@@ -157,7 +158,50 @@ namespace crypto
 			X25519Keys m_StaticKeys;
 	};
 
-	void CreateECIESX25519AEADRatchetRandomKeys (uint8_t * priv, uint8_t * pub);
+	void CreateECIESX25519AEADRatchetRandomKeys (uint8_t * priv, uint8_t * pub); // including hybrid
+
+	constexpr size_t GetCryptoPrivateKeyLen (i2p::data::CryptoKeyType type)
+	{
+		switch (type)
+		{
+			case i2p::data::CRYPTO_KEY_TYPE_ELGAMAL: return 256;
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC: return 256; // actual size is 32, but we use 256 for compatibility with old keys files 
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD: return 32;
+			// ML-KEM hybrid
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
+				return 32;
+		};	
+		return 0;
+	}
+
+	constexpr size_t GetCryptoPublicKeyLen (i2p::data::CryptoKeyType type)
+	{
+		switch (type)
+		{
+			case i2p::data::CRYPTO_KEY_TYPE_ELGAMAL: return 256;
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC: return 32;
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD: return 32;
+			// ML-KEM hybrid
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
+			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
+				return 32;
+		};	
+		return 0;
+	}
+
+	struct LocalEncryptionKey
+	{
+		std::vector<uint8_t> pub, priv;
+		i2p::data::CryptoKeyType keyType;
+		std::shared_ptr<CryptoKeyDecryptor> decryptor;
+
+		LocalEncryptionKey (i2p::data::CryptoKeyType t);
+		void GenerateKeys ();
+		void CreateDecryptor (); 
+	};
 }
 }
 

libi2pd/Datagram.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -18,8 +18,10 @@ namespace i2p
 {
 namespace datagram
 {
-	DatagramDestination::DatagramDestination (std::shared_ptr<i2p::client::ClientDestination> owner, bool gzip):
-		m_Owner (owner), m_DefaultReceiver (nullptr), m_DefaultRawReceiver (nullptr), m_Gzip (gzip)
+	DatagramDestination::DatagramDestination (std::shared_ptr<i2p::client::ClientDestination> owner, 
+	    bool gzip, DatagramVersion version):
+		m_Owner (owner), m_DefaultReceiver (nullptr), m_DefaultRawReceiver (nullptr),
+		m_Gzip (gzip), m_Version (version)
 	{
 		if (m_Gzip)
 			m_Deflator.reset (new i2p::data::GzipDeflator);
@@ -58,25 +60,56 @@ namespace datagram
 	{
 		if (session)
 		{
-			if (m_Owner->GetIdentity ()->GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+			std::shared_ptr<I2NPMessage>  msg;
+			switch (session->GetVersion ())
 			{
-				uint8_t hash[32];
-				SHA256(payload, len, hash);
-				m_Owner->Sign (hash, 32, m_Signature.data ());
-			}
-			else
-				m_Owner->Sign (payload, len, m_Signature.data ());
+				case eDatagramV3:
+				{
+					constexpr uint8_t flags[] = { 0x00, 0x03 }; // datagram3, no options
+					msg = CreateDataMessage ({{m_Owner->GetIdentity ()->GetIdentHash (), 32}, 
+						{flags, 2}, {payload, len}}, fromPort, toPort, i2p::client::PROTOCOL_TYPE_DATAGRAM3, false); // datagram3
+					break;
+				}
+				case eDatagramV1:
+				{	
+					if (m_Owner->GetIdentity ()->GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+					{
+						uint8_t hash[32];
+						SHA256(payload, len, hash);
+						m_Owner->Sign (hash, 32, m_Signature.data ());
+					}
+					else
+						m_Owner->Sign (payload, len, m_Signature.data ());
+					msg = CreateDataMessage ({{m_From.data (), m_From.size ()}, {m_Signature.data (), m_Signature.size ()}, {payload, len}},
+						fromPort, toPort, i2p::client::PROTOCOL_TYPE_DATAGRAM, !session->IsRatchets ()); // datagram1
+					break;
+				}
+				case eDatagramV2:
+				{
+					constexpr uint8_t flags[] = { 0x00, 0x02 }; // datagram2, no options
+					// signature
+					std::vector<uint8_t> signedData (len + 32 + 2);
+					memcpy (signedData.data (), m_Owner->GetIdentity ()->GetIdentHash (), 32);
+					memcpy (signedData.data () + 32, flags, 2);
+					memcpy (signedData.data () + 34, payload, len);
+					m_Owner->Sign (signedData.data (), signedData.size (), m_Signature.data ());
+					// TODO: offline signatures and options
+					msg = CreateDataMessage ({{m_From.data (), m_From.size ()}, {flags, 2}, {payload, len}, 
+						{m_Signature.data (), m_Signature.size ()}}, fromPort, toPort, i2p::client::PROTOCOL_TYPE_DATAGRAM2, false); // datagram2
 
-			auto msg = CreateDataMessage ({{m_From.data (), m_From.size ()}, {m_Signature.data (), m_Signature.size ()}, {payload, len}},
-				fromPort, toPort, false, !session->IsRatchets ()); // datagram
-			session->SendMsg(msg);
+					break;
+				}	
+				default:
+					LogPrint (eLogError, "Datagram: datagram type ", (int)session->GetVersion (), " is not supported");
+			}
+			if (msg) session->SendMsg(msg);
 		}
 	}
 
 	void DatagramDestination::SendRawDatagram (std::shared_ptr<DatagramSession> session, const uint8_t * payload, size_t len, uint16_t fromPort, uint16_t toPort)
 	{
 		if (session)
-			session->SendMsg(CreateDataMessage ({{payload, len}}, fromPort, toPort, true, !session->IsRatchets ())); // raw
+			session->SendMsg(CreateDataMessage ({{payload, len}}, fromPort, toPort, i2p::client::PROTOCOL_TYPE_RAW, !session->IsRatchets ())); // raw
 	}
 
 	void DatagramDestination::FlushSendQueue (std::shared_ptr<DatagramSession> session)
@@ -85,27 +118,50 @@ namespace datagram
 			session->FlushSendQueue ();
 	}
 
-	void DatagramDestination::HandleDatagram (uint16_t fromPort, uint16_t toPort,uint8_t * const &buf, size_t len)
+	void DatagramDestination::HandleDatagram (uint16_t fromPort, uint16_t toPort,
+		const uint8_t * buf, size_t len, i2p::garlic::ECIESX25519AEADRatchetSession * from)
 	{
 		i2p::data::IdentityEx identity;
 		size_t identityLen = identity.FromBuffer (buf, len);
+		if (!identityLen) return;
 		const uint8_t * signature = buf + identityLen;
 		size_t headerLen = identityLen + identity.GetSignatureLen ();
 
+		std::shared_ptr<i2p::data::LeaseSet> ls;
 		bool verified = false;
-		if (identity.GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+		if (from)
 		{
-			uint8_t hash[32];
-			SHA256(buf + headerLen, len - headerLen, hash);
-			verified = identity.Verify (hash, 32, signature);
-		}
-		else
-			verified = identity.Verify (buf + headerLen, len - headerLen, signature);
+			ls = m_Owner->FindLeaseSet (identity.GetIdentHash ());	
+			if (ls)
+			{	
+				uint8_t staticKey[32];
+				ls->Encrypt (nullptr, staticKey);
+				if (!memcmp (from->GetRemoteStaticKey (), staticKey, 32))
+					verified = true;
+				else
+				{	
+					LogPrint (eLogError, "Datagram: Remote LeaseSet static key mismatch for datagram from ", 
+						identity.GetIdentHash ().ToBase32 ());
+					return;
+				}	
+			}	
+		}	
+		if (!verified)
+		{	
+			if (identity.GetSigningKeyType () == i2p::data::SIGNING_KEY_TYPE_DSA_SHA1)
+			{
+				uint8_t hash[32];
+				SHA256(buf + headerLen, len - headerLen, hash);
+				verified = identity.Verify (hash, 32, signature);
+			}
+			else
+				verified = identity.Verify (buf + headerLen, len - headerLen, signature);
+		}	
 
 		if (verified)
 		{
-			auto h = identity.GetIdentHash();
-			auto session = ObtainSession(h);
+			auto session = ObtainSession (identity.GetIdentHash());
+			if (ls) session->SetRemoteLeaseSet (ls);
 			session->Ack();
 			auto r = FindReceiver(toPort);
 			if(r)
@@ -127,6 +183,133 @@ namespace datagram
 			LogPrint (eLogWarning, "DatagramDestination: no receiver for raw datagram");
 	}
 
+	void DatagramDestination::HandleDatagram2 (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len,
+		i2p::garlic::ECIESX25519AEADRatchetSession * from)
+	{
+		if (len < 433)
+		{
+			LogPrint (eLogWarning, "Datagram: datagram2 is too short ", len);
+			return;
+		}
+		i2p::data::IdentityEx identity;
+		size_t identityLen = identity.FromBuffer (buf, len);
+		if (!identityLen) return;
+		size_t signatureLen = identity.GetSignatureLen ();
+		if (signatureLen + identityLen > len) return;
+		
+		std::shared_ptr<i2p::data::LeaseSet> ls;
+		bool verified = false;
+		if (from)
+		{
+			ls = m_Owner->FindLeaseSet (identity.GetIdentHash ());	
+			if (ls)
+			{	
+				uint8_t staticKey[32];
+				ls->Encrypt (nullptr, staticKey);
+				if (!memcmp (from->GetRemoteStaticKey (), staticKey, 32))
+					verified = true;
+				else
+				{	
+					LogPrint (eLogError, "Datagram: Remote LeaseSet static key mismatch for datagram2 from ", 
+						identity.GetIdentHash ().ToBase32 ());
+					return;
+				}	
+			}	
+		}
+		uint16_t flags = bufbe16toh (buf + identityLen);
+		size_t offset = identityLen + 2;
+		if (flags & DATAGRAM2_FLAG_OPTIONS)
+			offset += bufbe16toh (buf + offset) + 2;
+		if (offset > len)
+		{
+			LogPrint (eLogWarning, "Datagram: datagram2 is too short ", len, " expected ", offset);
+			return;
+		}
+		if (!verified)
+		{
+			std::shared_ptr<i2p::crypto::Verifier> transientVerifier;
+			if (flags & DATAGRAM2_FLAG_OFFLINE_SIGNATURE)
+			{	
+				transientVerifier = i2p::data::ProcessOfflineSignature (&identity, buf, len, offset);
+				if (!transientVerifier)
+				{
+					LogPrint (eLogWarning, "Datagram: datagram2 offline signature failed");
+					return;
+				}	
+				signatureLen = transientVerifier->GetSignatureLen ();
+			}	
+			std::vector<uint8_t> signedData (len + 32 - identityLen - signatureLen);
+			memcpy (signedData.data (), identity.GetIdentHash (), 32);
+			memcpy (signedData.data () + 32, buf + identityLen, signedData.size () - 32);
+			verified = transientVerifier ? transientVerifier->Verify (signedData.data (), signedData.size (), buf + len - signatureLen) :
+				identity.Verify (signedData.data (), signedData.size (), buf + len - signatureLen); 
+			if (!verified)
+			{
+				LogPrint (eLogWarning, "Datagram: datagram2 signature verification failed");
+				return;
+			}	
+		}
+		
+		auto session = ObtainSession (identity.GetIdentHash());
+		session->SetVersion (eDatagramV2);
+		if (ls) session->SetRemoteLeaseSet (ls);
+		session->Ack();
+		auto r = FindReceiver(toPort);
+		if(r)
+			r(identity, fromPort, toPort, buf + offset, len - offset - signatureLen);
+		else
+			LogPrint (eLogWarning, "DatagramDestination: no receiver for port ", toPort);
+	}	
+		
+	void DatagramDestination::HandleDatagram3 (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len,
+		i2p::garlic::ECIESX25519AEADRatchetSession * from)
+	{
+		if (len < 34)
+		{
+			LogPrint (eLogWarning, "Datagram: datagram3 is too short ", len);
+			return;
+		}	
+		if (from)
+		{
+			i2p::data::IdentHash ident(buf);
+			auto ls = m_Owner->FindLeaseSet (ident);	
+			if (ls)
+			{	
+				uint8_t staticKey[32];
+				ls->Encrypt (nullptr, staticKey);
+				if (!memcmp (from->GetRemoteStaticKey (), staticKey, 32))
+				{
+					auto session = ObtainSession (ident);
+					session->SetVersion (eDatagramV3);
+					session->SetRemoteLeaseSet (ls);
+					session->Ack ();
+					auto r = FindReceiver(toPort);
+					if (r)
+					{
+						uint16_t flags = bufbe16toh (buf + 32);
+						size_t offset = 34;
+						if (flags & DATAGRAM3_FLAG_OPTIONS)
+							offset += bufbe16toh (buf + offset) + 2;
+						if (offset > len)
+						{
+							LogPrint (eLogWarning, "Datagram: datagram3 is too short ", len, " expected ", offset);
+							return;
+						}	
+						r(*ls->GetIdentity (), fromPort, toPort, buf + offset, len - offset);
+					}	
+					else
+						LogPrint (eLogWarning, "Datagram: no receiver for port ", toPort);
+				}	
+				else
+					LogPrint (eLogError, "Datagram: Remote LeaseSet static key mismatch for datagram3 from ", ident.ToBase32 ());
+			}
+			else
+				LogPrint (eLogError, "Datagram: No remote LeaseSet for ", ident.ToBase32 ());
+		}
+		else
+			LogPrint (eLogInfo, "Datagram: datagram3 received from non-ratchets session");
+	}	
+		
 	void DatagramDestination::SetReceiver (const Receiver& receiver, uint16_t port)
 	{
 		std::lock_guard<std::mutex> lock(m_ReceiversMutex);
@@ -195,17 +378,31 @@ namespace datagram
 		return r;
 	}
 
-	void DatagramDestination::HandleDataMessagePayload (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len, bool isRaw)
+	void DatagramDestination::HandleDataMessagePayload (uint16_t fromPort, uint16_t toPort, 
+		const uint8_t * buf, size_t len, uint8_t protocolType, i2p::garlic::ECIESX25519AEADRatchetSession * from)
 	{
 		// unzip it
 		uint8_t uncompressed[MAX_DATAGRAM_SIZE];
 		size_t uncompressedLen = m_Inflator.Inflate (buf, len, uncompressed, MAX_DATAGRAM_SIZE);
 		if (uncompressedLen)
 		{
-			if (isRaw)
-				HandleRawDatagram (fromPort, toPort, uncompressed, uncompressedLen);
-			else
-				HandleDatagram (fromPort, toPort, uncompressed, uncompressedLen);
+			switch (protocolType)
+			{	
+			 	case i2p::client::PROTOCOL_TYPE_RAW:
+					HandleRawDatagram (fromPort, toPort, uncompressed, uncompressedLen);
+				break;
+				case i2p::client::PROTOCOL_TYPE_DATAGRAM3:
+					HandleDatagram3 (fromPort, toPort, uncompressed, uncompressedLen, from);	
+				break;
+				case i2p::client::PROTOCOL_TYPE_DATAGRAM:
+					HandleDatagram (fromPort, toPort, uncompressed, uncompressedLen, from);
+				break;
+				case i2p::client::PROTOCOL_TYPE_DATAGRAM2:
+					HandleDatagram2 (fromPort, toPort, uncompressed, uncompressedLen, from);
+				break;
+				default:
+					LogPrint (eLogInfo, "Datagram: unknown protocol type ", protocolType);
+			};
 		}
 		else
 			LogPrint (eLogWarning, "Datagram: decompression failed");
@@ -213,7 +410,7 @@ namespace datagram
 
 	std::shared_ptr<I2NPMessage> DatagramDestination::CreateDataMessage (
 		const std::vector<std::pair<const uint8_t *, size_t> >& payloads,
-		uint16_t fromPort, uint16_t toPort, bool isRaw, bool checksum)
+		uint16_t fromPort, uint16_t toPort, uint8_t protocolType, bool checksum)
 	{
 		size_t size;
 		auto msg = m_I2NPMsgsPool.AcquireShared ();
@@ -229,8 +426,8 @@ namespace datagram
 		{
 			htobe32buf (msg->GetPayload (), size); // length
 			htobe16buf (buf + 4, fromPort); // source port
-			htobe16buf (buf + 6, toPort); // destination port
-			buf[9] = isRaw ? i2p::client::PROTOCOL_TYPE_RAW : i2p::client::PROTOCOL_TYPE_DATAGRAM; // raw or datagram protocol
+			htobe16buf (buf + 6, toPort); // destination port	
+			buf[9] = protocolType; // raw or datagram protocol
 			msg->len += size + 4;
 			msg->FillI2NPMessageHeader (eI2NPData, 0, checksum);
 		}
@@ -265,14 +462,16 @@ namespace datagram
 		std::shared_ptr<DatagramSession> session = nullptr;
 		std::lock_guard<std::mutex> lock(m_SessionsMutex);
 		auto itr = m_Sessions.find(identity);
-		if (itr == m_Sessions.end()) {
+		if (itr == m_Sessions.end()) 
+		{
 			// not found, create new session
 			session = std::make_shared<DatagramSession>(m_Owner, identity);
+			session->SetVersion (m_Version);
 			session->Start ();
-			m_Sessions[identity] = session;
-		} else {
+			m_Sessions.emplace (identity, session);
+		} 
+		else
 			session = itr->second;
-		}
 		return session;
 	}
 
@@ -288,9 +487,8 @@ namespace datagram
 
 	DatagramSession::DatagramSession(std::shared_ptr<i2p::client::ClientDestination> localDestination,
 		const i2p::data::IdentHash & remoteIdent) :
-		m_LocalDestination(localDestination),
-		m_RemoteIdent(remoteIdent),
-		m_RequestingLS(false)
+		m_LocalDestination(localDestination), m_RemoteIdent(remoteIdent),
+		m_LastUse (0), m_LastFlush (0), m_RequestingLS (false), m_Version (eDatagramV1)
 	{
 	}
 
@@ -310,8 +508,12 @@ namespace datagram
 		if (msg || m_SendQueue.empty ())
 			m_SendQueue.push_back(msg);
 		// flush queue right away if full
-		if (!msg || m_SendQueue.size() >= DATAGRAM_SEND_QUEUE_MAX_SIZE)
+		if (!msg || m_SendQueue.size() >= DATAGRAM_SEND_QUEUE_MAX_SIZE || 
+		    m_LastUse > m_LastFlush + DATAGRAM_MAX_FLUSH_INTERVAL)
+		{	
 			FlushSendQueue();
+			m_LastFlush =  m_LastUse;
+		}
 	}
 
 	DatagramSession::Info DatagramSession::GetSessionInfo() const
@@ -344,7 +546,7 @@ namespace datagram
 		if(path)
 			path->updateTime = i2p::util::GetSecondsSinceEpoch ();
 		if (IsRatchets ())
-			SendMsg (nullptr); // send empty message in case if we have some data to send
+			SendMsg (nullptr); // send empty message in case if we don't have some data to send
 	}
 
 	std::shared_ptr<i2p::garlic::GarlicRoutingPath> DatagramSession::GetSharedRoutingPath ()
@@ -377,15 +579,19 @@ namespace datagram
 			if (!found)
 			{
 				m_RoutingSession = m_LocalDestination->GetRoutingSession(m_RemoteLeaseSet, true);
-				if (!m_RoutingSession->GetOwner () || !m_RoutingSession->IsReadyToSend ())
-					m_PendingRoutingSessions.push_back (m_RoutingSession);
+				if (m_RoutingSession)
+				{	
+					m_RoutingSession->SetAckRequestInterval (DATAGRAM_SESSION_ACK_REQUEST_INTERVAL);
+					if (!m_RoutingSession->GetOwner () || !m_RoutingSession->IsReadyToSend ())
+						m_PendingRoutingSessions.push_back (m_RoutingSession);
+				}	
 			}
 		}
 
 		auto path = m_RoutingSession->GetSharedRoutingPath();
-		if (path && m_RoutingSession->IsRatchets () &&
-			m_LastUse > m_RoutingSession->GetLastActivityTimestamp ()*1000 + DATAGRAM_SESSION_PATH_TIMEOUT)
+		if (path && m_RoutingSession->IsRatchets () && m_RoutingSession->CleanupUnconfirmedTags ())
 		{
+			LogPrint (eLogDebug, "Datagram: path reset");
 			m_RoutingSession->SetSharedRoutingPath (nullptr);
 			path = nullptr;
 		}
@@ -413,7 +619,14 @@ namespace datagram
 					auto sz = ls.size();
 					if (sz)
 					{
-						auto idx = rand() % sz;
+						int idx = -1;
+						if (m_LocalDestination)
+						{
+							auto pool = m_LocalDestination->GetTunnelPool ();
+							if (pool)
+								idx = pool->GetRng ()() % sz;
+						}
+						if (idx < 0) idx = rand () % sz;
 						path->remoteLease = ls[idx];
 					}
 					else
@@ -439,7 +652,14 @@ namespace datagram
 				auto sz = ls.size();
 				if (sz)
 				{
-					auto idx = rand() % sz;
+					int idx = -1;
+					if (m_LocalDestination)
+					{
+						auto pool = m_LocalDestination->GetTunnelPool ();
+						if (pool)
+							idx = pool->GetRng ()() % sz;
+					}
+					if (idx < 0) idx = rand () % sz;
 					path->remoteLease = ls[idx];
 				}
 				else

libi2pd/Datagram.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -20,6 +20,7 @@
 #include "LeaseSet.h"
 #include "I2NPProtocol.h"
 #include "Garlic.h"
+#include "ECIESX25519AEADRatchetSession.h"
 
 namespace i2p
 {
@@ -31,8 +32,6 @@ namespace datagram
 {
 	// milliseconds for max session idle time
 	const uint64_t DATAGRAM_SESSION_MAX_IDLE = 10 * 60 * 1000;
-	// milliseconds for how long we try sticking to a dead routing path before trying to switch
-	const uint64_t DATAGRAM_SESSION_PATH_TIMEOUT = 10 * 1000;
 	// milliseconds interval a routing path is used before switching
 	const uint64_t DATAGRAM_SESSION_PATH_SWITCH_INTERVAL = 20 * 60 * 1000;
 	// milliseconds before lease expire should we try switching leases
@@ -43,7 +42,20 @@ namespace datagram
 	const uint64_t DATAGRAM_SESSION_PATH_MIN_LIFETIME = 5 * 1000;
 	// max 64 messages buffered in send queue for each datagram session
 	const size_t DATAGRAM_SEND_QUEUE_MAX_SIZE = 64;
+	const uint64_t DATAGRAM_MAX_FLUSH_INTERVAL = 5; // in milliseconds
+	const int DATAGRAM_SESSION_ACK_REQUEST_INTERVAL = 5500; // in milliseconds
 
+	enum DatagramVersion
+	{
+		eDatagramV1 = 1,
+		eDatagramV2 = 2,
+		eDatagramV3 = 3,
+	};	
+
+	constexpr uint16_t DATAGRAM2_FLAG_OPTIONS = 0x10;
+	constexpr uint16_t DATAGRAM2_FLAG_OFFLINE_SIGNATURE = 0x20;
+	constexpr uint16_t DATAGRAM3_FLAG_OPTIONS = 0x10;
+	
 	class DatagramSession : public std::enable_shared_from_this<DatagramSession>
 	{
 
@@ -64,8 +76,12 @@ namespace datagram
 			/** get the last time in milliseconds for when we used this datagram session */
 			uint64_t LastActivity() const { return m_LastUse; }
 
-		bool IsRatchets () const { return m_RoutingSession && m_RoutingSession->IsRatchets (); }
+			bool IsRatchets () const { return m_RoutingSession && m_RoutingSession->IsRatchets (); }
+			void SetRemoteLeaseSet (std::shared_ptr<const i2p::data::LeaseSet> ls) { m_RemoteLeaseSet = ls; }
 
+			DatagramVersion GetVersion () const { return m_Version; }
+			void SetVersion (DatagramVersion version) { m_Version = version; }
+			
 		struct Info
 		{
 			std::shared_ptr<const i2p::data::IdentHash> IBGW;
@@ -98,8 +114,9 @@ namespace datagram
 			std::shared_ptr<i2p::garlic::GarlicRoutingSession> m_RoutingSession;
 			std::vector<std::shared_ptr<i2p::garlic::GarlicRoutingSession> > m_PendingRoutingSessions;
 			std::vector<std::shared_ptr<I2NPMessage> > m_SendQueue;
-			uint64_t m_LastUse;
+			uint64_t m_LastUse, m_LastFlush; // milliseconds
 			bool m_RequestingLS;
+			DatagramVersion m_Version;
 	};
 
 	typedef std::shared_ptr<DatagramSession> DatagramSession_ptr;
@@ -112,7 +129,7 @@ namespace datagram
 
 		public:
 
-			DatagramDestination (std::shared_ptr<i2p::client::ClientDestination> owner, bool gzip);
+			DatagramDestination (std::shared_ptr<i2p::client::ClientDestination> owner, bool gzip, DatagramVersion version);
 			~DatagramDestination ();
 
 			void SendDatagramTo (const uint8_t * payload, size_t len, const i2p::data::IdentHash & ident, uint16_t fromPort = 0, uint16_t toPort = 0);
@@ -124,8 +141,8 @@ namespace datagram
 			void SendRawDatagram (std::shared_ptr<DatagramSession> session, const uint8_t * payload, size_t len, uint16_t fromPort, uint16_t toPort);
 			void FlushSendQueue (std::shared_ptr<DatagramSession> session);
 
-			void HandleDataMessagePayload (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len, bool isRaw = false);
-
+			void HandleDataMessagePayload (uint16_t fromPort, uint16_t toPort, 
+			 	const uint8_t * buf, size_t len, uint8_t protocolType, i2p::garlic::ECIESX25519AEADRatchetSession * from);
 
 			void SetReceiver (const Receiver& receiver, uint16_t port);
 			void ResetReceiver (uint16_t port);
@@ -143,10 +160,15 @@ namespace datagram
 			std::shared_ptr<DatagramSession> ObtainSession(const i2p::data::IdentHash & ident);
 
 			std::shared_ptr<I2NPMessage> CreateDataMessage (const std::vector<std::pair<const uint8_t *, size_t> >& payloads,
-				uint16_t fromPort, uint16_t toPort, bool isRaw = false, bool checksum = true);
+				uint16_t fromPort, uint16_t toPort, uint8_t protocolType, bool checksum = true);
 
-			void HandleDatagram (uint16_t fromPort, uint16_t toPort, uint8_t *const& buf, size_t len);
+			void HandleDatagram (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len,
+				i2p::garlic::ECIESX25519AEADRatchetSession * from);
 			void HandleRawDatagram (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len);
+			void HandleDatagram2 (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len,
+				i2p::garlic::ECIESX25519AEADRatchetSession * from);
+			void HandleDatagram3 (uint16_t fromPort, uint16_t toPort, const uint8_t * buf, size_t len,
+				i2p::garlic::ECIESX25519AEADRatchetSession * from);
 
 			Receiver FindReceiver(uint16_t port);
 			RawReceiver FindRawReceiver(uint16_t port);
@@ -168,6 +190,7 @@ namespace datagram
 			std::unordered_map<uint16_t, RawReceiver> m_RawReceiversByPorts;
 
 			bool m_Gzip; // gzip compression of data messages
+			DatagramVersion m_Version; // default for destination
 			i2p::data::GzipInflator m_Inflator;
 			std::unique_ptr<i2p::data::GzipDeflator> m_Deflator;
 			std::vector<uint8_t> m_From, m_Signature;

libi2pd/Destination.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,8 +11,10 @@
 #include <string>
 #include <set>
 #include <vector>
+#include <charconv>
 #include <boost/algorithm/string.hpp>
 #include "Crypto.h"
+#include "ECIESX25519AEADRatchetSession.h"
 #include "Log.h"
 #include "FS.h"
 #include "Timestamp.h"
@@ -23,7 +25,7 @@ namespace i2p
 {
 namespace client
 {
-	LeaseSetDestination::LeaseSetDestination (boost::asio::io_service& service,
+	LeaseSetDestination::LeaseSetDestination (boost::asio::io_context& service,
 		bool isPublic, const std::map<std::string, std::string> * params):
 		m_Service (service), m_IsPublic (isPublic), m_PublishReplyToken (0),
 		m_LastSubmissionTime (0), m_PublishConfirmationTimer (m_Service),
@@ -37,6 +39,7 @@ namespace client
 		int inVar   = DEFAULT_INBOUND_TUNNELS_LENGTH_VARIANCE;
 		int outVar  = DEFAULT_OUTBOUND_TUNNELS_LENGTH_VARIANCE;
 		int numTags = DEFAULT_TAGS_TO_SEND;
+		bool isHighBandwidth = true;
 		std::shared_ptr<std::vector<i2p::data::IdentHash> > explicitPeers;
 		try
 		{
@@ -91,10 +94,8 @@ namespace client
 				}
 				it = params->find (I2CP_PARAM_DONT_PUBLISH_LEASESET);
 				if (it != params->end ())
-				{
-					// oveeride isPublic
-					m_IsPublic = (it->second != "true");
-				}
+					// override isPublic
+					m_IsPublic = GetBoolParamValue (it->second);
 				it = params->find (I2CP_PARAM_LEASESET_TYPE);
 				if (it != params->end ())
 					m_LeaseSetType = std::stoi(it->second);
@@ -121,6 +122,9 @@ namespace client
 						m_LeaseSetPrivKey.reset (nullptr);
 					}
 				}
+				it = params->find (I2CP_PARAM_STREAMING_PROFILE);
+				if (it != params->end ())
+					isHighBandwidth = std::stoi (it->second) != STREAMING_PROFILE_INTERACTIVE;
 			}
 		}
 		catch (std::exception & ex)
@@ -128,7 +132,7 @@ namespace client
 			LogPrint(eLogError, "Destination: Unable to parse parameters for destination: ", ex.what());
 		}
 		SetNumTags (numTags);
-		m_Pool = i2p::tunnel::tunnels.CreateTunnelPool (inLen, outLen, inQty, outQty, inVar, outVar);
+		m_Pool = i2p::tunnel::tunnels.CreateTunnelPool (inLen, outLen, inQty, outQty, inVar, outVar, isHighBandwidth);
 		if (explicitPeers)
 			m_Pool->SetExplicitPeers (explicitPeers);
 		if(params)
@@ -164,7 +168,7 @@ namespace client
 		LoadTags ();
 		m_Pool->SetLocalDestination (shared_from_this ());
 		m_Pool->SetActive (true);
-		m_CleanupTimer.expires_from_now (boost::posix_time::minutes (DESTINATION_CLEANUP_TIMEOUT));
+		m_CleanupTimer.expires_from_now (boost::posix_time::seconds (DESTINATION_CLEANUP_TIMEOUT));
 		m_CleanupTimer.async_wait (std::bind (&LeaseSetDestination::HandleCleanupTimer,
 			shared_from_this (), std::placeholders::_1));
 	}
@@ -183,6 +187,24 @@ namespace client
 		CleanUp (); // GarlicDestination
 	}
 
+	bool LeaseSetDestination::GetBoolParamValue (std::string_view value)
+	{
+		bool ret = false;
+		if (value == "true") 
+			ret = true;
+		else if (value == "false") 
+			ret = false;
+		else
+		{
+			int v = 0;
+			auto res = std::from_chars(value.data(), value.data() + value.size(), v);
+			if (res.ec != std::errc())	
+				LogPrint (eLogError, "Destination: Unable to parse bool param value ", value, ": ",  std::make_error_code (res.ec).message ());
+			ret = v;		
+		}	
+		return ret;
+	}	
+		
 	bool LeaseSetDestination::Reconfigure(std::map<std::string, std::string> params)
 	{
 		auto itr = params.find("i2cp.dontPublishLeaseSet");
@@ -191,7 +213,7 @@ namespace client
 			m_IsPublic = itr->second != "true";
 		}
 
-		int inLen, outLen, inQuant, outQuant, numTags, minLatency, maxLatency;
+		int inLen = 0, outLen = 0, inQuant = 0, outQuant = 0, numTags = 0, minLatency = 0, maxLatency = 0;
 		std::map<std::string, int&> intOpts = {
 			{I2CP_PARAM_INBOUND_TUNNEL_LENGTH, inLen},
 			{I2CP_PARAM_OUTBOUND_TUNNEL_LENGTH, outLen},
@@ -290,7 +312,7 @@ namespace client
 		if (m_IsPublic)
 		{
 			auto s = shared_from_this ();
-			m_Service.post ([s](void)
+			boost::asio::post (m_Service, [s](void)
 			{
 				s->m_PublishVerificationTimer.cancel ();
 				s->Publish ();
@@ -318,7 +340,7 @@ namespace client
 		memcpy (data.k, key, 32);
 		memcpy (data.t, tag, 32);
 		auto s = shared_from_this ();
-		m_Service.post ([s,data](void)
+		boost::asio::post (m_Service, [s,data](void)
 			{
 				s->AddSessionKey (data.k, data.t);
 			});
@@ -335,7 +357,7 @@ namespace client
 		memcpy (data.k, key, 32);
 		data.t = tag;
 		auto s = shared_from_this ();
-		m_Service.post ([s,data](void)
+		boost::asio::post (m_Service, [s,data](void)
 			{
 				s->AddECIESx25519Key (data.k, data.t);
 			});
@@ -343,28 +365,47 @@ namespace client
 
 	void LeaseSetDestination::ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg)
 	{
-		m_Service.post (std::bind (&LeaseSetDestination::HandleGarlicMessage, shared_from_this (), msg));
+		if (!msg) return;
+		bool empty = false;
+		{
+			std::lock_guard<std::mutex> l(m_IncomingMsgsQueueMutex);
+			empty = m_IncomingMsgsQueue.empty ();
+			m_IncomingMsgsQueue.push_back (msg);
+		}
+		if (empty)
+			boost::asio::post (m_Service, [s = shared_from_this ()]() 
+			{ 
+				std::list<std::shared_ptr<I2NPMessage> > receivedMsgs;
+				{
+					std::lock_guard<std::mutex> l(s->m_IncomingMsgsQueueMutex);
+					s->m_IncomingMsgsQueue.swap (receivedMsgs);
+				}
+			    for (auto& it: receivedMsgs)
+			    	s->HandleGarlicMessage (it);               
+			});
 	}
 
 	void LeaseSetDestination::ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg)
 	{
 		uint32_t msgID = bufbe32toh (msg->GetPayload () + DELIVERY_STATUS_MSGID_OFFSET);
-		m_Service.post (std::bind (&LeaseSetDestination::HandleDeliveryStatusMessage, shared_from_this (), msgID));
+		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::HandleDeliveryStatusMessage, shared_from_this (), msgID));
 	}
 
 	void LeaseSetDestination::HandleI2NPMessage (const uint8_t * buf, size_t len)
 	{
 		I2NPMessageType typeID = (I2NPMessageType)(buf[I2NP_HEADER_TYPEID_OFFSET]);
 		uint32_t msgID = bufbe32toh (buf + I2NP_HEADER_MSGID_OFFSET);
-		LeaseSetDestination::HandleCloveI2NPMessage (typeID, buf + I2NP_HEADER_SIZE, GetI2NPMessageLength(buf, len) - I2NP_HEADER_SIZE, msgID);
+		LeaseSetDestination::HandleCloveI2NPMessage (typeID, buf + I2NP_HEADER_SIZE, 
+			GetI2NPMessageLength(buf, len) - I2NP_HEADER_SIZE, msgID, nullptr);
 	}
 
-	bool LeaseSetDestination::HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID)
+	bool LeaseSetDestination::HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload,
+		size_t len, uint32_t msgID, i2p::garlic::ECIESX25519AEADRatchetSession * from)
 	{
 		switch (typeID)
 		{
 			case eI2NPData:
-				HandleDataMessage (payload, len);
+				HandleDataMessage (payload, len, from);
 			break;
 			case eI2NPDeliveryStatus:
 				HandleDeliveryStatusMessage (bufbe32toh (payload + DELIVERY_STATUS_MSGID_OFFSET));
@@ -374,7 +415,7 @@ namespace client
 					m_Pool->ProcessTunnelTest (bufbe32toh (payload + TUNNEL_TEST_MSGID_OFFSET), bufbe64toh (payload + TUNNEL_TEST_TIMESTAMP_OFFSET));
 			break;
 			case eI2NPDatabaseStore:
-				HandleDatabaseStoreMessage (payload, len);
+				HandleDatabaseStoreMessage (payload, len, from);
 			break;
 			case eI2NPDatabaseSearchReply:
 				HandleDatabaseSearchReplyMessage (payload, len);
@@ -389,7 +430,8 @@ namespace client
 		return true;
 	}
 
-	void LeaseSetDestination::HandleDatabaseStoreMessage (const uint8_t * buf, size_t len)
+	void LeaseSetDestination::HandleDatabaseStoreMessage (const uint8_t * buf, size_t len,
+		i2p::garlic::ECIESX25519AEADRatchetSession * from)
 	{
 		if (len < DATABASE_STORE_HEADER_SIZE)
 		{
@@ -425,7 +467,7 @@ namespace client
 					leaseSet = it->second;
 					if (leaseSet->IsNewer (buf + offset, len - offset))
 					{
-						leaseSet->Update (buf + offset, len - offset);
+						leaseSet->Update (buf + offset, len - offset, shared_from_this(), true);
 						if (leaseSet->IsValid () && leaseSet->GetIdentHash () == key && !leaseSet->IsExpired ())
 							LogPrint (eLogDebug, "Destination: Remote LeaseSet updated");
 						else
@@ -444,13 +486,29 @@ namespace client
 					if (buf[DATABASE_STORE_TYPE_OFFSET] == i2p::data::NETDB_STORE_TYPE_LEASESET)
 						leaseSet = std::make_shared<i2p::data::LeaseSet> (buf + offset, len - offset); // LeaseSet
 					else
-						leaseSet = std::make_shared<i2p::data::LeaseSet2> (buf[DATABASE_STORE_TYPE_OFFSET], buf + offset, len - offset, true, GetPreferredCryptoType () ); // LeaseSet2
-					if (leaseSet->IsValid () && leaseSet->GetIdentHash () == key && !leaseSet->IsExpired ())
+					{	
+						leaseSet = std::make_shared<i2p::data::LeaseSet2> (buf[DATABASE_STORE_TYPE_OFFSET], 
+							buf + offset, len - offset, true, shared_from_this (), 
+						    from ? from->GetRemoteStaticKeyType () : GetPreferredCryptoType () ); // LeaseSet2
+						if (from)
+						{
+							uint8_t pub[32];
+							leaseSet->Encrypt (nullptr, pub);
+							if (memcmp (from->GetRemoteStaticKey (), pub, 32))
+							{
+								LogPrint (eLogError, "Destination: Remote LeaseSet static key mismatch");
+								leaseSet = nullptr;
+							}	
+						}	
+					}		
+					if (leaseSet && leaseSet->IsValid () && leaseSet->GetIdentHash () == key && !leaseSet->IsExpired ())
 					{
 						if (leaseSet->GetIdentHash () != GetIdentHash ())
 						{
 							LogPrint (eLogDebug, "Destination: New remote LeaseSet added");
-							m_RemoteLeaseSets[key] = leaseSet;
+							m_RemoteLeaseSets.insert_or_assign (key, leaseSet);
+							if (from)
+								from->SetDestination (key);
 						}
 						else
 							LogPrint (eLogDebug, "Destination: Own remote LeaseSet dropped");
@@ -467,13 +525,14 @@ namespace client
 			{
 				auto it2 = m_LeaseSetRequests.find (key);
 				if (it2 != m_LeaseSetRequests.end ())
-				{	
+				{
 					request = it2->second;
 					m_LeaseSetRequests.erase (it2);
 					if (request->requestedBlindedKey)
 					{
 						auto ls2 = std::make_shared<i2p::data::LeaseSet2> (buf + offset, len - offset,
-							request->requestedBlindedKey, m_LeaseSetPrivKey ? ((const uint8_t *)*m_LeaseSetPrivKey) : nullptr , GetPreferredCryptoType ());
+							request->requestedBlindedKey, shared_from_this (), 
+						    m_LeaseSetPrivKey ? ((const uint8_t *)*m_LeaseSetPrivKey) : nullptr, GetPreferredCryptoType ());
 						if (ls2->IsValid () && !ls2->IsExpired ())
 						{
 							leaseSet = ls2;
@@ -489,14 +548,14 @@ namespace client
 						// publishing verification doesn't have requestedBlindedKey
 						auto localLeaseSet = GetLeaseSetMt ();
 						if (localLeaseSet->GetStoreHash () == key)
-						{	
-							auto ls = std::make_shared<i2p::data::LeaseSet2> (i2p::data::NETDB_STORE_TYPE_ENCRYPTED_LEASESET2, 
+						{
+							auto ls = std::make_shared<i2p::data::LeaseSet2> (i2p::data::NETDB_STORE_TYPE_ENCRYPTED_LEASESET2,
 								localLeaseSet->GetBuffer (), localLeaseSet->GetBufferLen (), false);
-							leaseSet = ls;	
-						}	
+							leaseSet = ls;
+						}
 						else
 							LogPrint (eLogWarning, "Destination: Encrypted LeaseSet2 received for request without blinded key");
-					}	
+					}
 				}
 				else
 					LogPrint (eLogWarning, "Destination: Couldn't find request for encrypted LeaseSet2");
@@ -507,14 +566,14 @@ namespace client
 		}
 
 		if (!request)
-		{	
+		{
 			auto it1 = m_LeaseSetRequests.find (key);
 			if (it1 != m_LeaseSetRequests.end ())
-			{	
+			{
 				request = it1->second;
 				m_LeaseSetRequests.erase (it1);
-			}	
-		}	
+			}
+		}
 		if (request)
 		{
 			request->requestTimeoutTimer.cancel ();
@@ -546,7 +605,7 @@ namespace client
 			LogPrint (eLogWarning, "Destination: Request for ", key.ToBase64 (), " not found");
 	}
 
-	void LeaseSetDestination::SendNextLeaseSetRequest (const i2p::data::IdentHash& key, 
+	void LeaseSetDestination::SendNextLeaseSetRequest (const i2p::data::IdentHash& key,
 		std::shared_ptr<LeaseSetRequest> request)
 	{
 		bool found = false;
@@ -566,8 +625,8 @@ namespace client
 			request->Complete (nullptr);
 			m_LeaseSetRequests.erase (key);
 		}
-	}	
-		
+	}
+
 	void LeaseSetDestination::HandleDeliveryStatusMessage (uint32_t msgID)
 	{
 		if (msgID == m_PublishReplyToken)
@@ -576,7 +635,8 @@ namespace client
 			m_ExcludedFloodfills.clear ();
 			m_PublishReplyToken = 0;
 			// schedule verification
-			m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT));
+			m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT +
+				(m_Pool ? m_Pool->GetRng ()() % PUBLISH_VERIFICATION_TIMEOUT_VARIANCE : 0)));
 			m_PublishVerificationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishVerificationTimer,
 			shared_from_this (), std::placeholders::_1));
 		}
@@ -584,9 +644,12 @@ namespace client
 			i2p::garlic::GarlicDestination::HandleDeliveryStatusMessage (msgID);
 	}
 
-	void LeaseSetDestination::SetLeaseSetUpdated ()
+	void LeaseSetDestination::SetLeaseSetUpdated (bool post)
 	{
-		UpdateLeaseSet ();
+		if (post)
+			boost::asio::post (m_Service, [s = shared_from_this ()]() { s->UpdateLeaseSet (); });
+		else
+			UpdateLeaseSet ();
 	}
 
 	void LeaseSetDestination::Publish ()
@@ -624,7 +687,7 @@ namespace client
 		if (!outbound || !inbound)
 		{
 			if (!m_Pool->GetInboundTunnels ().empty () && !m_Pool->GetOutboundTunnels ().empty ())
-			{	
+			{
 				LogPrint (eLogInfo, "Destination: No compatible tunnels with ", floodfill->GetIdentHash ().ToBase64 (), ". Trying another floodfill");
 				m_ExcludedFloodfills.insert (floodfill->GetIdentHash ());
 				floodfill = i2p::data::netdb.GetClosestFloodfill (leaseSet->GetStoreHash (), m_ExcludedFloodfills);
@@ -642,18 +705,18 @@ namespace client
 				}
 				else
 					LogPrint (eLogError, "Destination: Can't publish LeaseSet, no more floodfills found");
-			}	
+			}
 			else
 				LogPrint (eLogDebug, "Destination: No tunnels in pool");
-			
+
 			if (!floodfill || !outbound || !inbound)
 			{
 				// we can't publish now
 				m_ExcludedFloodfills.clear ();
 				m_PublishReplyToken = 1; // dummy non-zero value
 				// try again after a while
-				LogPrint (eLogInfo, "Destination: Can't publish LeasetSet because destination is not ready. Try publishing again after ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds");
-				m_PublishConfirmationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_CONFIRMATION_TIMEOUT));
+				LogPrint (eLogInfo, "Destination: Can't publish LeasetSet because destination is not ready. Try publishing again after ", PUBLISH_CONFIRMATION_TIMEOUT, " milliseconds");
+				m_PublishConfirmationTimer.expires_from_now (boost::posix_time::milliseconds(PUBLISH_CONFIRMATION_TIMEOUT));
 				m_PublishConfirmationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishConfirmationTimer,
 					shared_from_this (), std::placeholders::_1));
 				return;
@@ -666,13 +729,13 @@ namespace client
 		auto s = shared_from_this ();
 		msg->onDrop = [s]()
 			{
-				s->GetService ().post([s]()
+				boost::asio::post (s->GetService (), [s]()
 					{
 						s->m_PublishConfirmationTimer.cancel ();
 						s->HandlePublishConfirmationTimer (boost::system::error_code());
 					});
 			};
-		m_PublishConfirmationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_CONFIRMATION_TIMEOUT));
+		m_PublishConfirmationTimer.expires_from_now (boost::posix_time::milliseconds(PUBLISH_CONFIRMATION_TIMEOUT));
 		m_PublishConfirmationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishConfirmationTimer,
 			shared_from_this (), std::placeholders::_1));
 		outbound->SendTunnelDataMsgTo (floodfill->GetIdentHash (), 0, msg);
@@ -685,22 +748,9 @@ namespace client
 		{
 			if (m_PublishReplyToken)
 			{
+				LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " milliseconds or failed. will try again");
 				m_PublishReplyToken = 0;
-				if (GetIdentity ()->GetCryptoKeyType () == i2p::data::CRYPTO_KEY_TYPE_ELGAMAL)
-				{
-					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds or failed. will try again");
-					Publish ();
-				}
-				else
-				{
-					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds from Java floodfill for crypto type ", (int)GetIdentity ()->GetCryptoKeyType ());
-					// Java floodfill never sends confirmation back for unknown crypto type
-					// assume it successive and try to verify
-					m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT));
-					m_PublishVerificationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishVerificationTimer,
-			shared_from_this (), std::placeholders::_1));
-
-				}
+				Publish ();
 			}
 		}
 	}
@@ -751,10 +801,10 @@ namespace client
 		if (!m_Pool || !IsReady ())
 		{
 			if (requestComplete)
-				m_Service.post ([requestComplete](void){requestComplete (nullptr);});
+				boost::asio::post (m_Service, [requestComplete](void){requestComplete (nullptr);});
 			return false;
 		}
-		m_Service.post (std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), dest, requestComplete, nullptr));
+		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), dest, requestComplete, nullptr));
 		return true;
 	}
 
@@ -763,7 +813,7 @@ namespace client
 		if (!dest || !m_Pool || !IsReady ())
 		{
 			if (requestComplete)
-				m_Service.post ([requestComplete](void){requestComplete (nullptr);});
+				boost::asio::post (m_Service, [requestComplete](void){requestComplete (nullptr);});
 			return false;
 		}
 		auto storeHash = dest->GetStoreHash ();
@@ -771,17 +821,17 @@ namespace client
 		if (leaseSet)
 		{
 			if (requestComplete)
-				m_Service.post ([requestComplete, leaseSet](void){requestComplete (leaseSet);});
+				boost::asio::post (m_Service, [requestComplete, leaseSet](void){requestComplete (leaseSet);});
 			return true;
 		}
-		m_Service.post (std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), storeHash, requestComplete, dest));
+		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), storeHash, requestComplete, dest));
 		return true;
 	}
 
 	void LeaseSetDestination::CancelDestinationRequest (const i2p::data::IdentHash& dest, bool notify)
 	{
 		auto s = shared_from_this ();
-		m_Service.post ([dest, notify, s](void)
+		boost::asio::post (m_Service, [dest, notify, s](void)
 			{
 				auto it = s->m_LeaseSetRequests.find (dest);
 				if (it != s->m_LeaseSetRequests.end ())
@@ -809,7 +859,7 @@ namespace client
 			request->requestedBlindedKey = requestedBlindedKey; // for encrypted LeaseSet2
 			if (requestComplete)
 				request->requestComplete.push_back (requestComplete);
-			auto ts = i2p::util::GetSecondsSinceEpoch ();
+			auto ts = i2p::util::GetMillisecondsSinceEpoch ();
 			auto ret = m_LeaseSetRequests.insert (std::pair<i2p::data::IdentHash, std::shared_ptr<LeaseSetRequest> >(dest,request));
 			if (ret.second) // inserted
 			{
@@ -873,17 +923,17 @@ namespace client
 				AddECIESx25519Key (replyKey, replyTag);
 			else
 				AddSessionKey (replyKey, replyTag);
-			
-			auto msg = WrapMessageForRouter (nextFloodfill, 
+
+			auto msg = WrapMessageForRouter (nextFloodfill,
 				CreateLeaseSetDatabaseLookupMsg (dest, request->excluded, request->replyTunnel, replyKey, replyTag, isECIES));
 			auto s = shared_from_this ();
 			msg->onDrop = [s, dest, request]()
 				{
-					s->GetService ().post([s, dest, request]()
+					boost::asio::post (s->GetService (), [s, dest, request]()
 						{
 							s->SendNextLeaseSetRequest (dest, request);
 						});
-				};	
+				};
 			request->outboundTunnel->SendTunnelDataMsgs (
 				{
 					i2p::tunnel::TunnelMessageBlock
@@ -892,7 +942,7 @@ namespace client
 						nextFloodfill->GetIdentHash (), 0, msg
 					}
 				});
-			request->requestTimeoutTimer.expires_from_now (boost::posix_time::seconds(LEASESET_REQUEST_TIMEOUT));
+			request->requestTimeoutTimer.expires_from_now (boost::posix_time::milliseconds(LEASESET_REQUEST_TIMEOUT));
 			request->requestTimeoutTimer.async_wait (std::bind (&LeaseSetDestination::HandleRequestTimoutTimer,
 				shared_from_this (), std::placeholders::_1, dest));
 		}
@@ -909,7 +959,7 @@ namespace client
 			if (it != m_LeaseSetRequests.end ())
 			{
 				bool done = false;
-				uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
+				uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
 				if (ts < it->second->requestTime + MAX_LEASESET_REQUEST_TIMEOUT)
 				{
 					auto floodfill = i2p::data::netdb.GetClosestFloodfill (dest, it->second->excluded);
@@ -946,7 +996,8 @@ namespace client
 			CleanupExpiredTags ();
 			CleanupRemoteLeaseSets ();
 			CleanupDestination ();
-			m_CleanupTimer.expires_from_now (boost::posix_time::minutes (DESTINATION_CLEANUP_TIMEOUT));
+			m_CleanupTimer.expires_from_now (boost::posix_time::seconds (DESTINATION_CLEANUP_TIMEOUT +
+				(m_Pool ? m_Pool->GetRng ()() % DESTINATION_CLEANUP_TIMEOUT_VARIANCE : 0)));
 			m_CleanupTimer.async_wait (std::bind (&LeaseSetDestination::HandleCleanupTimer,
 				shared_from_this (), std::placeholders::_1));
 		}
@@ -960,7 +1011,7 @@ namespace client
 		{
 			if (it->second->IsEmpty () || ts > it->second->GetExpirationTime ()) // leaseset expired
 			{
-				LogPrint (eLogWarning, "Destination: Remote LeaseSet ", it->second->GetIdentHash ().ToBase64 (), " expired");
+				LogPrint (eLogDebug, "Destination: Remote LeaseSet ", it->second->GetIdentHash ().ToBase64 (), " expired");
 				it = m_RemoteLeaseSets.erase (it);
 			}
 			else
@@ -968,21 +1019,17 @@ namespace client
 		}
 	}
 
-	i2p::data::CryptoKeyType LeaseSetDestination::GetPreferredCryptoType () const
-	{
-		if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
-			return i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD;
-		return i2p::data::CRYPTO_KEY_TYPE_ELGAMAL;
-	}
-
-	ClientDestination::ClientDestination (boost::asio::io_service& service, const i2p::data::PrivateKeys& keys,
+	ClientDestination::ClientDestination (boost::asio::io_context& service, const i2p::data::PrivateKeys& keys,
 		bool isPublic, const std::map<std::string, std::string> * params):
 		LeaseSetDestination (service, isPublic, params),
-		m_Keys (keys), m_StreamingAckDelay (DEFAULT_INITIAL_ACK_DELAY),
+		m_Keys (keys), m_PreferredCryptoType (0), m_StreamingAckDelay (DEFAULT_INITIAL_ACK_DELAY),
 		m_StreamingOutboundSpeed (DEFAULT_MAX_OUTBOUND_SPEED),
-		m_IsStreamingAnswerPings (DEFAULT_ANSWER_PINGS), m_LastPort (0),
-		m_DatagramDestination (nullptr), m_RefCounter (0),
-		m_ReadyChecker(service)
+		m_StreamingInboundSpeed (DEFAULT_MAX_INBOUND_SPEED),
+		m_StreamingMaxConcurrentStreams (DEFAULT_MAX_CONCURRENT_STREAMS),
+		m_StreamingMaxWindowSize (i2p::stream::MAX_WINDOW_SIZE),
+		m_IsStreamingAnswerPings (DEFAULT_ANSWER_PINGS), m_IsStreamingDontSign (DEFAULT_DONT_SIGN), 
+		m_LastPort (0), m_DatagramDestination (nullptr), m_RefCounter (0), 
+		m_LastPublishedTimestamp (0), m_ReadyChecker(service)
 	{
 		if (keys.IsOfflineSignature () && GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
 			SetLeaseSetType (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2); // offline keys can be published with LS2 only
@@ -1001,7 +1048,15 @@ namespace client
 				{
 					try
 					{
-						encryptionKeyTypes.insert (std::stoi(it1));
+						i2p::data::CryptoKeyType cryptoType = std::stoi(it1);
+#if !OPENSSL_PQ
+						if (cryptoType <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) // skip PQ keys if not supported
+#endif					
+						{
+							if (!m_PreferredCryptoType && cryptoType)
+								m_PreferredCryptoType = cryptoType; // first non-zero in the list
+							encryptionKeyTypes.insert (cryptoType);
+						}	
 					}
 					catch (std::exception& ex)
 					{
@@ -1012,29 +1067,24 @@ namespace client
 			}
 		}
 		// if no param or valid crypto type use from identity
-		bool isSingleKey = false;
 		if (encryptionKeyTypes.empty ())
-		{
-			isSingleKey = true;
-			encryptionKeyTypes.insert (GetIdentity ()->GetCryptoKeyType ());
-		}
+			encryptionKeyTypes.insert ( { GetIdentity ()->GetCryptoKeyType (),
+#if OPENSSL_PQ
+				i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD,
+#endif				
+				i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD }); // usually 0,4 or 0,6,4 if post quantum
 
 		for (auto& it: encryptionKeyTypes)
 		{
-			auto encryptionKey = new EncryptionKey (it);
+			auto encryptionKey = std::make_shared<i2p::crypto::LocalEncryptionKey> (it);
 			if (IsPublic ())
-				PersistTemporaryKeys (encryptionKey, isSingleKey);
+				PersistTemporaryKeys (encryptionKey);
 			else
 				encryptionKey->GenerateKeys ();
 			encryptionKey->CreateDecryptor ();
-			if (it == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
-			{
-				m_ECIESx25519EncryptionKey.reset (encryptionKey);
-				if (GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
-					SetLeaseSetType (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2); // Rathets must use LeaseSet2
-			}
-			else
-				m_StandardEncryptionKey.reset (encryptionKey);
+			if (it > i2p::data::CRYPTO_KEY_TYPE_ELGAMAL && GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
+				SetLeaseSetType (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2); // Only DSA can use LeaseSet1
+			m_EncryptionKeys.emplace (it, encryptionKey);
 		}
 
 		if (IsPublic ())
@@ -1051,10 +1101,26 @@ namespace client
 				it = params->find (I2CP_PARAM_STREAMING_MAX_OUTBOUND_SPEED);
 				if (it != params->end ())
 					m_StreamingOutboundSpeed = std::stoi(it->second);
+				it = params->find (I2CP_PARAM_STREAMING_MAX_INBOUND_SPEED);
+				if (it != params->end ())
+					m_StreamingInboundSpeed = std::stoi(it->second);
+				it = params->find (I2CP_PARAM_STREAMING_MAX_CONCURRENT_STREAMS);
+				if (it != params->end ())
+					m_StreamingMaxConcurrentStreams = std::stoi(it->second);
+				it = params->find (I2CP_PARAM_STREAMING_MAX_WINDOW_SIZE);
+				if (it != params->end ())
+				{	
+					m_StreamingMaxWindowSize = std::stoi(it->second);
+					if (m_StreamingMaxWindowSize < i2p::stream::MIN_WINDOW_SIZE) 
+						m_StreamingMaxWindowSize = i2p::stream::MIN_WINDOW_SIZE;
+				}	
 				it = params->find (I2CP_PARAM_STREAMING_ANSWER_PINGS);
 				if (it != params->end ())
-					m_IsStreamingAnswerPings = std::stoi (it->second); // 1 for true
-
+					m_IsStreamingAnswerPings = GetBoolParamValue (it->second);
+				it = params->find (I2CP_PARAM_STREAMING_DONT_SIGN);
+				if (it != params->end ())
+					m_IsStreamingDontSign = GetBoolParamValue (it->second);
+				
 				if (GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_ENCRYPTED_LEASESET2)
 				{
 					// authentication for encrypted LeaseSet
@@ -1101,7 +1167,6 @@ namespace client
 	void ClientDestination::Stop ()
 	{
 		LogPrint(eLogDebug, "Destination: Stopping destination ", GetIdentHash().ToBase32(), ".b32.i2p");
-		LeaseSetDestination::Stop ();
 		m_ReadyChecker.cancel();
 		LogPrint(eLogDebug, "Destination: -> Stopping Streaming Destination");
 		m_StreamingDestination->Stop ();
@@ -1123,10 +1188,12 @@ namespace client
 			delete m_DatagramDestination;
 			m_DatagramDestination = nullptr;
 		}
+		LeaseSetDestination::Stop ();
 		LogPrint(eLogDebug, "Destination: -> Stopping done");
 	}
 
-	void ClientDestination::HandleDataMessage (const uint8_t * buf, size_t len)
+	void ClientDestination::HandleDataMessage (const uint8_t * buf, size_t len,
+		i2p::garlic::ECIESX25519AEADRatchetSession * from)
 	{
 		uint32_t length = bufbe32toh (buf);
 		if(length > len - 4)
@@ -1151,25 +1218,21 @@ namespace client
 					m_LastPort = toPort;
 				}
 				if (m_LastStreamingDestination)
-					m_LastStreamingDestination->HandleDataMessagePayload (buf, length);
+					m_LastStreamingDestination->HandleDataMessagePayload (buf, length, from);
 				else
 					LogPrint (eLogError, "Destination: Missing streaming destination");
 			}
 			break;
 			case PROTOCOL_TYPE_DATAGRAM:
+			case PROTOCOL_TYPE_RAW:	
+			case PROTOCOL_TYPE_DATAGRAM2:
+			case PROTOCOL_TYPE_DATAGRAM3:	
 				// datagram protocol
 				if (m_DatagramDestination)
-					m_DatagramDestination->HandleDataMessagePayload (fromPort, toPort, buf, length);
+					m_DatagramDestination->HandleDataMessagePayload (fromPort, toPort, buf, length, buf[9], from);
 				else
 					LogPrint (eLogError, "Destination: Missing datagram destination");
 			break;
-			case PROTOCOL_TYPE_RAW:
-				// raw datagram
-				if (m_DatagramDestination)
-					m_DatagramDestination->HandleDataMessagePayload (fromPort, toPort, buf, length, true);
-				else
-					LogPrint (eLogError, "Destination: Missing raw datagram destination");
-			break;
 			default:
 				LogPrint (eLogError, "Destination: Data: Unexpected protocol ", buf[9]);
 		}
@@ -1186,7 +1249,7 @@ namespace client
 		if (leaseSet)
 		{
 			auto stream = CreateStream (leaseSet, port);
-			GetService ().post ([streamRequestComplete, stream]()
+			boost::asio::post (GetService (), [streamRequestComplete, stream]()
 				{
 					streamRequestComplete(stream);
 				});
@@ -1358,10 +1421,11 @@ namespace client
 		return nullptr;
 	}
 
-	i2p::datagram::DatagramDestination * ClientDestination::CreateDatagramDestination (bool gzip)
+	i2p::datagram::DatagramDestination * ClientDestination::CreateDatagramDestination (bool gzip, 
+		i2p::datagram::DatagramVersion version)
 	{
-		if (m_DatagramDestination == nullptr)
-			m_DatagramDestination = new i2p::datagram::DatagramDestination (GetSharedFromThis (), gzip);
+		if (!m_DatagramDestination)
+			m_DatagramDestination = new i2p::datagram::DatagramDestination (GetSharedFromThis (), gzip, version);
 		return m_DatagramDestination;
 	}
 
@@ -1379,32 +1443,56 @@ namespace client
 		return ret;
 	}
 
-	void ClientDestination::PersistTemporaryKeys (EncryptionKey * keys, bool isSingleKey)
+	void ClientDestination::PersistTemporaryKeys (std::shared_ptr<i2p::crypto::LocalEncryptionKey> keys)
 	{
 		if (!keys) return;
 		std::string ident = GetIdentHash().ToBase32();
-		std::string path  = i2p::fs::DataDirPath("destinations",
-			isSingleKey ? (ident + ".dat") : (ident + "." + std::to_string (keys->keyType) + ".dat"));
+		std::string path  = i2p::fs::DataDirPath("destinations", ident + "." + std::to_string (keys->keyType) + ".dat");
 		std::ifstream f(path, std::ifstream::binary);
-
-		if (f) {
-			f.read ((char *)keys->pub, 256);
-			f.read ((char *)keys->priv, 256);
-			return;
+		if (f) 
+		{
+			size_t len = 0;
+			if (keys->keyType == i2p::data::CRYPTO_KEY_TYPE_ELGAMAL)
+				len = 512;
+			else if (keys->keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
+			{	
+				f.seekg (0, std::ios::end);
+				len = f.tellg();
+				f.seekg (0, std::ios::beg);
+			}
+				
+			if (len == 512)
+			{    
+				char pub[256], priv[256];
+				f.read (pub, 256);
+				memcpy (keys->pub.data(), pub, keys->pub.size());
+				f.read (priv, 256);
+				memcpy (keys->priv.data (), priv, keys->priv.size ());
+			}
+			else
+			{
+				f.read ((char *)keys->pub.data(), keys->pub.size());
+				f.read ((char *)keys->priv.data(), keys->priv.size());
+			}	
+			if (f) 
+				return;
+			else
+				LogPrint(eLogWarning, "Destination: Can't read keys from ", path);
 		}
 
-		LogPrint (eLogInfo, "Destination: Creating new temporary keys of type for address ", ident, ".b32.i2p");
-		memset (keys->priv, 0, 256);
-		memset (keys->pub, 0, 256);
+		LogPrint (eLogInfo, "Destination: Creating new temporary keys of type ", keys->keyType, " for address ", ident, ".b32.i2p");
+		memset (keys->priv.data (), 0, keys->priv.size ());
+		memset (keys->pub.data (), 0, keys->pub.size ());
 		keys->GenerateKeys ();
-		// TODO:: persist crypto key type
+		
 		std::ofstream f1 (path, std::ofstream::binary | std::ofstream::out);
-		if (f1) {
-			f1.write ((char *)keys->pub, 256);
-			f1.write ((char *)keys->priv, 256);
-			return;
+		if (f1) 
+		{
+			f1.write ((char *)keys->pub.data (), keys->pub.size ());
+			f1.write ((char *)keys->priv.data (), keys->priv.size ());
 		}
-		LogPrint(eLogCritical, "Destinations: Can't save keys to ", path);
+		if (!f1)
+			LogPrint(eLogError, "Destination: Can't save keys to ", path);
 	}
 
 	void ClientDestination::CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels)
@@ -1412,9 +1500,10 @@ namespace client
 		std::shared_ptr<i2p::data::LocalLeaseSet> leaseSet;
 		if (GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
 		{
-			if (m_StandardEncryptionKey)
+			auto it = m_EncryptionKeys.find (i2p::data::CRYPTO_KEY_TYPE_ELGAMAL);
+			if (it != m_EncryptionKeys.end ())
 			{
-				leaseSet = std::make_shared<i2p::data::LocalLeaseSet> (GetIdentity (), m_StandardEncryptionKey->pub, tunnels);
+				leaseSet = std::make_shared<i2p::data::LocalLeaseSet> (GetIdentity (), it->second->pub.data (), tunnels);
 				// sign
 				Sign (leaseSet->GetBuffer (), leaseSet->GetBufferLen () - leaseSet->GetSignatureLen (), leaseSet->GetSignature ());
 			}
@@ -1424,18 +1513,40 @@ namespace client
 		else
 		{
 			// standard LS2 (type 3) first
-			i2p::data::LocalLeaseSet2::KeySections keySections;
-			if (m_ECIESx25519EncryptionKey)
-				keySections.push_back ({m_ECIESx25519EncryptionKey->keyType, 32, m_ECIESx25519EncryptionKey->pub} );
-			if (m_StandardEncryptionKey)
-				keySections.push_back ({m_StandardEncryptionKey->keyType, (uint16_t)m_StandardEncryptionKey->decryptor->GetPublicKeyLen (), m_StandardEncryptionKey->pub} );
-
+			if (m_EncryptionKeys.empty ())
+			{
+				LogPrint (eLogError, "Destinations: No encryption keys");
+				return;
+			}	
+			
+			i2p::data::LocalLeaseSet2::EncryptionKeys keySections;
+			std::shared_ptr<const i2p::crypto::LocalEncryptionKey> preferredSection;
+			if (m_EncryptionKeys.size () == 1)
+				preferredSection = m_EncryptionKeys.begin ()->second; // only key
+			else
+			{	
+				for (const auto& it: m_EncryptionKeys)
+					if (it.first == m_PreferredCryptoType)
+						preferredSection = it.second;
+					else
+						keySections.push_back (it.second);
+			}	
+			if (preferredSection) 
+				keySections.push_front (preferredSection); // make preferred first
+			
+			auto publishedTimestamp = i2p::util::GetSecondsSinceEpoch ();
+			if (publishedTimestamp <= m_LastPublishedTimestamp)
+			{
+				LogPrint (eLogDebug, "Destination: LeaseSet update at the same second");
+				publishedTimestamp++; // force newer timestamp
+			}
 			bool isPublishedEncrypted = GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_ENCRYPTED_LEASESET2;
 			auto ls2 = std::make_shared<i2p::data::LocalLeaseSet2> (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2,
-				m_Keys, keySections, tunnels, IsPublic (), isPublishedEncrypted);
+				m_Keys, keySections, tunnels, IsPublic (), publishedTimestamp, isPublishedEncrypted);
 			if (isPublishedEncrypted) // encrypt if type 5
 				ls2 = std::make_shared<i2p::data::LocalEncryptedLeaseSet2> (ls2, m_Keys, GetAuthType (), m_AuthKeys);
 			leaseSet = ls2;
+			m_LastPublishedTimestamp = publishedTimestamp;
 		}
 		SetLeaseSet (leaseSet);
 	}
@@ -1447,11 +1558,22 @@ namespace client
 
 	bool ClientDestination::Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const
 	{
-		if (preferredCrypto == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
-			if (m_ECIESx25519EncryptionKey && m_ECIESx25519EncryptionKey->decryptor)
-				return m_ECIESx25519EncryptionKey->decryptor->Decrypt (encrypted, data);
-		if (m_StandardEncryptionKey && m_StandardEncryptionKey->decryptor)
-			return m_StandardEncryptionKey->decryptor->Decrypt (encrypted, data);
+		std::shared_ptr<i2p::crypto::LocalEncryptionKey> encryptionKey;
+		if (!m_EncryptionKeys.empty ())
+		{
+			if (m_EncryptionKeys.rbegin ()->first == preferredCrypto)
+				encryptionKey = m_EncryptionKeys.rbegin ()->second;
+			else
+			{
+				auto it = m_EncryptionKeys.find (preferredCrypto);
+				if (it != m_EncryptionKeys.end ())
+					encryptionKey = it->second;
+			}	
+			if (!encryptionKey)
+				encryptionKey = m_EncryptionKeys.rbegin ()->second;
+		}	
+		if (encryptionKey)
+			return encryptionKey->decryptor->Decrypt (encrypted, data);
 		else
 			LogPrint (eLogError, "Destinations: Decryptor is not set");
 		return false;
@@ -1459,14 +1581,26 @@ namespace client
 
 	bool ClientDestination::SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const
 	{
-		return keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? (bool)m_ECIESx25519EncryptionKey : (bool)m_StandardEncryptionKey;
+#if __cplusplus >= 202002L // C++20
+		return m_EncryptionKeys.contains (keyType);
+#else		
+		return m_EncryptionKeys.count (keyType) > 0;
+#endif		
 	}
 
+	i2p::data::CryptoKeyType ClientDestination::GetRatchetsHighestCryptoType () const
+	{
+		if (m_EncryptionKeys.empty ()) return 0;
+		auto cryptoType = m_EncryptionKeys.rbegin ()->first; 
+		return cryptoType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? cryptoType : 0;
+	}
+		
 	const uint8_t * ClientDestination::GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const
 	{
-		if (keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
-			return m_ECIESx25519EncryptionKey ? m_ECIESx25519EncryptionKey->pub : nullptr;
-		return m_StandardEncryptionKey ? m_StandardEncryptionKey->pub : nullptr;
+		auto it = m_EncryptionKeys.find (keyType);
+		if (it != m_EncryptionKeys.end ())
+			return it->second->pub.data ();
+		return nullptr;
 	}
 
 	void ClientDestination::ReadAuthKey (const std::string& group, const std::map<std::string, std::string> * params)
@@ -1500,6 +1634,8 @@ namespace client
 		RunnableService ("Destination"),
 		ClientDestination (GetIOService (), keys, isPublic, params)
 	{
+		if (!GetNickname ().empty ())
+			RunnableService::SetName (GetNickname ());
 	}
 
 	RunnableClientDestination::~RunnableClientDestination ()

libi2pd/Destination.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -22,6 +22,7 @@
 #include "Identity.h"
 #include "TunnelPool.h"
 #include "Crypto.h"
+#include "CryptoKey.h"
 #include "LeaseSet.h"
 #include "Garlic.h"
 #include "NetDb.hpp"
@@ -36,13 +37,17 @@ namespace client
 	const uint8_t PROTOCOL_TYPE_STREAMING = 6;
 	const uint8_t PROTOCOL_TYPE_DATAGRAM = 17;
 	const uint8_t PROTOCOL_TYPE_RAW = 18;
-	const int PUBLISH_CONFIRMATION_TIMEOUT = 5; // in seconds
-	const int PUBLISH_VERIFICATION_TIMEOUT = 10; // in seconds after successful publish
+	const uint8_t PROTOCOL_TYPE_DATAGRAM2 = 19;
+	const uint8_t PROTOCOL_TYPE_DATAGRAM3 = 20;
+	const int PUBLISH_CONFIRMATION_TIMEOUT = 1800; // in milliseconds
+	const int PUBLISH_VERIFICATION_TIMEOUT = 5; // in seconds after successful publish
+	const int PUBLISH_VERIFICATION_TIMEOUT_VARIANCE = 3; // in seconds
 	const int PUBLISH_MIN_INTERVAL = 20; // in seconds
 	const int PUBLISH_REGULAR_VERIFICATION_INTERNAL = 100; // in seconds periodically
-	const int LEASESET_REQUEST_TIMEOUT = 5; // in seconds
-	const int MAX_LEASESET_REQUEST_TIMEOUT = 40; // in seconds
-	const int DESTINATION_CLEANUP_TIMEOUT = 3; // in minutes
+	const int LEASESET_REQUEST_TIMEOUT = 1600; // in milliseconds
+	const int MAX_LEASESET_REQUEST_TIMEOUT = 12000; // in milliseconds
+	const int DESTINATION_CLEANUP_TIMEOUT = 44; // in seconds
+	const int DESTINATION_CLEANUP_TIMEOUT_VARIANCE = 30; // in seconds
 	const unsigned int MAX_NUM_FLOODFILLS_PER_REQUEST = 7;
 
 	// I2CP
@@ -86,9 +91,20 @@ namespace client
 	const int DEFAULT_INITIAL_ACK_DELAY = 200; // milliseconds
 	const char I2CP_PARAM_STREAMING_MAX_OUTBOUND_SPEED[] = "i2p.streaming.maxOutboundSpeed"; // bytes/sec
 	const int DEFAULT_MAX_OUTBOUND_SPEED = 1730000000; // no more than 1.73 Gbytes/s
+	const char I2CP_PARAM_STREAMING_MAX_INBOUND_SPEED[] = "i2p.streaming.maxInboundSpeed"; // bytes/sec
+	const int DEFAULT_MAX_INBOUND_SPEED = 1730000000; // no more than 1.73 Gbytes/s
 	const char I2CP_PARAM_STREAMING_ANSWER_PINGS[] = "i2p.streaming.answerPings";
 	const int DEFAULT_ANSWER_PINGS = true;
-
+	const char I2CP_PARAM_STREAMING_PROFILE[] = "i2p.streaming.profile";
+	const int STREAMING_PROFILE_BULK = 1; // high bandwidth
+	const int STREAMING_PROFILE_INTERACTIVE = 2; // low bandwidth
+	const int DEFAULT_STREAMING_PROFILE = STREAMING_PROFILE_BULK;
+	const char I2CP_PARAM_STREAMING_MAX_CONCURRENT_STREAMS[] = "i2p.streaming.maxConcurrentStreams";
+	const int DEFAULT_MAX_CONCURRENT_STREAMS = 2048;
+	const char I2CP_PARAM_STREAMING_MAX_WINDOW_SIZE[] = "i2p.streaming.maxWindowSize";
+	const char I2CP_PARAM_STREAMING_DONT_SIGN[] = "i2p.streaming.dontSign";
+	const int DEFAULT_DONT_SIGN = false;
+	
 	typedef std::function<void (std::shared_ptr<i2p::stream::Stream> stream)> StreamRequestComplete;
 
 	class LeaseSetDestination: public i2p::garlic::GarlicDestination,
@@ -98,7 +114,7 @@ namespace client
 		// leaseSet = nullptr means not found
 		struct LeaseSetRequest
 		{
-			LeaseSetRequest (boost::asio::io_service& service): requestTime (0), requestTimeoutTimer (service) {};
+			LeaseSetRequest (boost::asio::io_context& service): requestTime (0), requestTimeoutTimer (service) {};
 			std::unordered_set<i2p::data::IdentHash> excluded;
 			uint64_t requestTime;
 			boost::asio::deadline_timer requestTimeoutTimer;
@@ -116,10 +132,10 @@ namespace client
 
 		public:
 
-			LeaseSetDestination (boost::asio::io_service& service, bool isPublic, const std::map<std::string, std::string> * params = nullptr);
+			LeaseSetDestination (boost::asio::io_context& service, bool isPublic, const std::map<std::string, std::string> * params = nullptr);
 			~LeaseSetDestination ();
 			const std::string& GetNickname () const { return m_Nickname; };
-			boost::asio::io_service& GetService () { return m_Service; };
+			auto& GetService () { return m_Service; };
 
 			virtual void Start ();
 			virtual void Stop ();
@@ -136,15 +152,15 @@ namespace client
 			void CancelDestinationRequestWithEncryptedLeaseSet (std::shared_ptr<const i2p::data::BlindedPublicKey> dest, bool notify = true);
 
 			// implements GarlicDestination
-			std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet ();
-			std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const { return m_Pool; }
+			std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet () override;
+			std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const override { return m_Pool; }
 
 			// override GarlicDestination
-			bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag);
-			void SubmitECIESx25519Key (const uint8_t * key, uint64_t tag);
-			void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg);
-			void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg);
-			void SetLeaseSetUpdated ();
+			bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag) override;
+			void SubmitECIESx25519Key (const uint8_t * key, uint64_t tag) override;
+			void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg) override;
+			void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg) override;
+			void SetLeaseSetUpdated (bool post) override;
 
 			bool IsPublic () const { return m_IsPublic; };
 			void SetPublic (bool pub) { m_IsPublic = pub; };
@@ -152,18 +168,21 @@ namespace client
 		protected:
 
 			// implements GarlicDestination
-			void HandleI2NPMessage (const uint8_t * buf, size_t len);
-			bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID);
+			void HandleI2NPMessage (const uint8_t * buf, size_t len) override;
+			bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, 
+				size_t len, uint32_t msgID, i2p::garlic::ECIESX25519AEADRatchetSession * from) override;
 
 			void SetLeaseSet (std::shared_ptr<const i2p::data::LocalLeaseSet> newLeaseSet);
 			int GetLeaseSetType () const { return m_LeaseSetType; };
 			void SetLeaseSetType (int leaseSetType) { m_LeaseSetType = leaseSetType; };
 			int GetAuthType () const { return m_AuthType; };
+			static bool GetBoolParamValue (std::string_view value);
 			virtual void CleanupDestination () {}; // additional clean up in derived classes
+			virtual i2p::data::CryptoKeyType GetPreferredCryptoType () const = 0;
 			// I2CP
-			virtual void HandleDataMessage (const uint8_t * buf, size_t len) = 0;
+			virtual void HandleDataMessage (const uint8_t * buf, size_t len, i2p::garlic::ECIESX25519AEADRatchetSession * from) = 0;
 			virtual void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels) = 0;
-
+			
 		private:
 
 			void UpdateLeaseSet ();
@@ -172,7 +191,7 @@ namespace client
 			void HandlePublishConfirmationTimer (const boost::system::error_code& ecode);
 			void HandlePublishVerificationTimer (const boost::system::error_code& ecode);
 			void HandlePublishDelayTimer (const boost::system::error_code& ecode);
-			void HandleDatabaseStoreMessage (const uint8_t * buf, size_t len);
+			void HandleDatabaseStoreMessage (const uint8_t * buf, size_t len, i2p::garlic::ECIESX25519AEADRatchetSession * from);
 			void HandleDatabaseSearchReplyMessage (const uint8_t * buf, size_t len);
 			void HandleDeliveryStatusMessage (uint32_t msgID);
 
@@ -182,15 +201,17 @@ namespace client
 			void HandleRequestTimoutTimer (const boost::system::error_code& ecode, const i2p::data::IdentHash& dest);
 			void HandleCleanupTimer (const boost::system::error_code& ecode);
 			void CleanupRemoteLeaseSets ();
-			i2p::data::CryptoKeyType GetPreferredCryptoType () const;
 
 		private:
 
-			boost::asio::io_service& m_Service;
+			boost::asio::io_context& m_Service;
 			mutable std::mutex m_RemoteLeaseSetsMutex;
 			std::unordered_map<i2p::data::IdentHash, std::shared_ptr<i2p::data::LeaseSet> > m_RemoteLeaseSets;
 			std::unordered_map<i2p::data::IdentHash, std::shared_ptr<LeaseSetRequest> > m_LeaseSetRequests;
 
+			std::list<std::shared_ptr<I2NPMessage> > m_IncomingMsgsQueue;
+			mutable std::mutex m_IncomingMsgsQueueMutex;
+			
 			std::shared_ptr<i2p::tunnel::TunnelPool> m_Pool;
 			std::mutex m_LeaseSetMutex;
 			std::shared_ptr<const i2p::data::LocalLeaseSet> m_LeaseSet;
@@ -216,25 +237,14 @@ namespace client
 
 	class ClientDestination: public LeaseSetDestination
 	{
-		struct EncryptionKey
-		{
-			uint8_t pub[256], priv[256];
-			i2p::data::CryptoKeyType keyType;
-			std::shared_ptr<i2p::crypto::CryptoKeyDecryptor> decryptor;
-
-			EncryptionKey (i2p::data::CryptoKeyType t):keyType(t) { memset (pub, 0, 256); memset (priv, 0, 256);	};
-			void GenerateKeys () { i2p::data::PrivateKeys::GenerateCryptoKeyPair (keyType, priv, pub); };
-			void CreateDecryptor () { decryptor = i2p::data::PrivateKeys::CreateDecryptor (keyType, priv); };
-		};
-
 		public:
 
-			ClientDestination (boost::asio::io_service& service, const i2p::data::PrivateKeys& keys,
+			ClientDestination (boost::asio::io_context& service, const i2p::data::PrivateKeys& keys,
 				bool isPublic, const std::map<std::string, std::string> * params = nullptr);
 			~ClientDestination ();
 
-			void Start ();
-			void Stop ();
+			void Start () override;
+			void Stop () override;
 
 			const i2p::data::PrivateKeys& GetPrivateKeys () const { return m_Keys; };
 			void Sign (const uint8_t * buf, int len, uint8_t * signature) const { m_Keys.Sign (buf, len, signature); };
@@ -262,31 +272,40 @@ namespace client
 			void AcceptOnce (const i2p::stream::StreamingDestination::Acceptor& acceptor);
 			int GetStreamingAckDelay () const { return m_StreamingAckDelay; }
 			int GetStreamingOutboundSpeed () const { return m_StreamingOutboundSpeed; }
+			int GetStreamingInboundSpeed () const { return m_StreamingInboundSpeed; }
+			int GetStreamingMaxConcurrentStreams () const { return m_StreamingMaxConcurrentStreams; }
 			bool IsStreamingAnswerPings () const { return m_IsStreamingAnswerPings; }
+			bool IsStreamingDontSign () const { return m_IsStreamingDontSign; }
+			int GetStreamingMaxWindowSize () const { return m_StreamingMaxWindowSize; }
 
 			// datagram
 			i2p::datagram::DatagramDestination * GetDatagramDestination () const { return m_DatagramDestination; };
-			i2p::datagram::DatagramDestination * CreateDatagramDestination (bool gzip = true);
+			i2p::datagram::DatagramDestination * CreateDatagramDestination (bool gzip = true,
+				i2p::datagram::DatagramVersion version = i2p::datagram::eDatagramV1);
 
 			// implements LocalDestination
-			bool Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const;
-			std::shared_ptr<const i2p::data::IdentityEx> GetIdentity () const { return m_Keys.GetPublic (); };
-			bool SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const;
-			const uint8_t * GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const;
+			bool Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const override;
+			std::shared_ptr<const i2p::data::IdentityEx> GetIdentity () const override { return m_Keys.GetPublic (); };
+			bool SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const override;
+			const uint8_t * GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const override;
 
 		protected:
 
-			void CleanupDestination ();
+			// GarlicDestionation
+			i2p::data::CryptoKeyType GetRatchetsHighestCryptoType () const override;
+			// LeaseSetDestination
+			void CleanupDestination () override;
+			i2p::data::CryptoKeyType GetPreferredCryptoType () const override { return m_PreferredCryptoType; }
 			// I2CP
-			void HandleDataMessage (const uint8_t * buf, size_t len);
-			void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels);
-
+			void HandleDataMessage (const uint8_t * buf, size_t len, i2p::garlic::ECIESX25519AEADRatchetSession * from) override;
+			void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels) override;
+						
 		private:
 
 			std::shared_ptr<ClientDestination> GetSharedFromThis () {
 				return std::static_pointer_cast<ClientDestination>(shared_from_this ());
 			}
-			void PersistTemporaryKeys (EncryptionKey * keys, bool isSingleKey);
+			void PersistTemporaryKeys (std::shared_ptr<i2p::crypto::LocalEncryptionKey> keys);
 			void ReadAuthKey (const std::string& group, const std::map<std::string, std::string> * params);
 
 			template<typename Dest>
@@ -295,17 +314,17 @@ namespace client
 		private:
 
 			i2p::data::PrivateKeys m_Keys;
-			std::unique_ptr<EncryptionKey> m_StandardEncryptionKey;
-			std::unique_ptr<EncryptionKey> m_ECIESx25519EncryptionKey;
-
-			int m_StreamingAckDelay;
-			int m_StreamingOutboundSpeed;
-			bool m_IsStreamingAnswerPings;
+			std::map<i2p::data::CryptoKeyType, std::shared_ptr<i2p::crypto::LocalEncryptionKey> > m_EncryptionKeys; // last is most preferable
+			i2p::data::CryptoKeyType m_PreferredCryptoType;
+			
+			int m_StreamingAckDelay,m_StreamingOutboundSpeed, m_StreamingInboundSpeed, m_StreamingMaxConcurrentStreams, m_StreamingMaxWindowSize;
+			bool m_IsStreamingAnswerPings, m_IsStreamingDontSign;
 			std::shared_ptr<i2p::stream::StreamingDestination> m_StreamingDestination; // default
 			std::map<uint16_t, std::shared_ptr<i2p::stream::StreamingDestination> > m_StreamingDestinationsByPorts;
 			std::shared_ptr<i2p::stream::StreamingDestination> m_LastStreamingDestination; uint16_t m_LastPort; // for server tunnels
 			i2p::datagram::DatagramDestination * m_DatagramDestination;
 			int m_RefCounter; // how many clients(tunnels) use this destination
+			uint64_t m_LastPublishedTimestamp;
 
 			boost::asio::deadline_timer m_ReadyChecker;
 

libi2pd/ECIESX25519AEADRatchetSession.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,6 +11,7 @@
 #include "Log.h"
 #include "util.h"
 #include "Crypto.h"
+#include "PostQuantum.h"
 #include "Elligator.h"
 #include "Tag.h"
 #include "I2PEndian.h"
@@ -94,6 +95,17 @@ namespace garlic
 		m_ItermediateSymmKeys.erase (index);
 	}
 
+	ReceiveRatchetTagSet::ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS):
+		m_Session (session), m_IsNS (isNS) 
+	{
+	}
+		
+	ReceiveRatchetTagSet::~ReceiveRatchetTagSet ()
+	{
+		if (m_IsNS && m_Session)
+			m_Session->CleanupReceiveNSRKeys ();
+	}	
+	
 	void ReceiveRatchetTagSet::Expire ()
 	{
 		if (!m_ExpirationTimestamp)
@@ -162,12 +174,12 @@ namespace garlic
 			return false;
 		}
 		if (m_Destination)
-			m_Destination->HandleECIESx25519GarlicClove (buf + offset, size);
+			m_Destination->HandleECIESx25519GarlicClove (buf + offset, size, nullptr);
 		return true;
 	}
 
 	ECIESX25519AEADRatchetSession::ECIESX25519AEADRatchetSession (GarlicDestination * owner, bool attachLeaseSetNS):
-		GarlicRoutingSession (owner, true)
+		GarlicRoutingSession (owner, true), m_RemoteStaticKeyType (0)
 	{
 		if (!attachLeaseSetNS) SetLeaseSetUpdateStatus (eLeaseSetUpToDate);
 		RAND_bytes (m_PaddingSizes, 32); m_NextPaddingSize = 0;
@@ -229,33 +241,104 @@ namespace garlic
 		tagsetNsr->NextSessionTagRatchet ();
 	}
 
+	bool ECIESX25519AEADRatchetSession::MessageConfirmed (uint32_t msgID)
+	{
+		auto ret = GarlicRoutingSession::MessageConfirmed (msgID); // LeaseSet
+		if (m_AckRequestMsgID && m_AckRequestMsgID == msgID)
+		{
+			m_AckRequestMsgID = 0;
+			m_AckRequestNumAttempts = 0;
+			ret = true;
+		}	
+		return ret;
+	}	
+
+	bool ECIESX25519AEADRatchetSession::CleanupUnconfirmedTags ()
+	{
+		if (m_AckRequestMsgID && m_AckRequestNumAttempts > ECIESX25519_ACK_REQUEST_MAX_NUM_ATTEMPTS)
+		{
+			m_AckRequestMsgID = 0;
+			m_AckRequestNumAttempts = 0;
+			return true;	
+		}
+		return false;
+	}	
+
+	void ECIESX25519AEADRatchetSession::CleanupReceiveNSRKeys ()
+	{
+		m_EphemeralKeys = nullptr;
+#if OPENSSL_PQ
+		m_PQKeys = nullptr;
+#endif	
+	}	
+		
 	bool ECIESX25519AEADRatchetSession::HandleNewIncomingSession (const uint8_t * buf, size_t len)
 	{
 		if (!GetOwner ()) return false;
 		// we are Bob
 		// KDF1
-		i2p::crypto::InitNoiseIKState (GetNoiseState (), GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)); // bpk
-
+		
 		if (!i2p::crypto::GetElligator ()->Decode (buf, m_Aepk))
 		{
 			LogPrint (eLogError, "Garlic: Can't decode elligator");
 			return false;
 		}
 		buf += 32; len -= 32;
-		MixHash (m_Aepk, 32); // h = SHA256(h || aepk)
 
 		uint8_t sharedSecret[32];
-		if (!GetOwner ()->Decrypt (m_Aepk, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)) // x25519(bsk, aepk)
+		bool decrypted = false;
+		auto cryptoType = GetOwner ()->GetRatchetsHighestCryptoType ();
+#if OPENSSL_PQ
+		if (cryptoType > i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) // we support post quantum
 		{
-			LogPrint (eLogWarning, "Garlic: Incorrect Alice ephemeral key");
-			return false;
-		}
-		MixKey (sharedSecret);
+			i2p::crypto::InitNoiseIKStateMLKEM (GetNoiseState (), cryptoType, GetOwner ()->GetEncryptionPublicKey (cryptoType)); // bpk
+			MixHash (m_Aepk, 32); // h = SHA256(h || aepk)
+
+			if (GetOwner ()->Decrypt (m_Aepk, sharedSecret, cryptoType)) // x25519(bsk, aepk)
+			{
+				MixKey (sharedSecret);
+
+				auto keyLen = i2p::crypto::GetMLKEMPublicKeyLen (cryptoType);
+				std::vector<uint8_t> encapsKey(keyLen);
+				if (Decrypt (buf, encapsKey.data (), keyLen))
+				{
+					decrypted = true; // encaps section has right hash 
+					MixHash (buf, keyLen + 16);
+					buf += keyLen + 16;
+					len -= keyLen + 16;
+					
+					m_PQKeys = i2p::crypto::CreateMLKEMKeys (cryptoType);
+					m_PQKeys->SetPublicKey (encapsKey.data ());
+				}
+			}	
+		}	
+#endif
+		if (!decrypted)
+		{	
+			if (cryptoType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
+			    GetOwner ()->SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
+			{
+				cryptoType = i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD;
+				i2p::crypto::InitNoiseIKState (GetNoiseState (), GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)); // bpk
+				MixHash (m_Aepk, 32); // h = SHA256(h || aepk)
+
+				if (!GetOwner ()->Decrypt (m_Aepk, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)) // x25519(bsk, aepk)
+				{
+					LogPrint (eLogWarning, "Garlic: Incorrect Alice ephemeral key");
+					return false;
+				}
+				MixKey (sharedSecret);	
+			}	
+			else
+			{
+				LogPrint (eLogWarning, "Garlic: No supported encryption type");
+				return false;
+			}	
+		}	
 
 		// decrypt flags/static
-		uint8_t nonce[12], fs[32];
-		CreateNonce (0, nonce);
-		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 32, m_H, 32, m_CK + 32, nonce, fs, 32, false)) // decrypt
+		uint8_t fs[32];
+		if (!Decrypt (buf, fs, 32))
 		{
 			LogPrint (eLogWarning, "Garlic: Flags/static section AEAD verification failed ");
 			return false;
@@ -267,21 +350,19 @@ namespace garlic
 		bool isStatic = !i2p::data::Tag<32> (fs).IsZero ();
 		if (isStatic)
 		{
-			// static key, fs is apk
-			memcpy (m_RemoteStaticKey, fs, 32);
-			if (!GetOwner ()->Decrypt (fs, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)) // x25519(bsk, apk)
+			// static key, fs is apk	
+			SetRemoteStaticKey (cryptoType, fs); 
+			if (!GetOwner ()->Decrypt (fs, sharedSecret, m_RemoteStaticKeyType)) // x25519(bsk, apk)
 			{
 				LogPrint (eLogWarning, "Garlic: Incorrect Alice static key");
 				return false;
 			}
 			MixKey (sharedSecret);
 		}
-		else // all zeros flags
-			CreateNonce (1, nonce);
 
 		// decrypt payload
 		std::vector<uint8_t> payload (len - 16); // we must save original ciphertext
-		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, m_H, 32, m_CK + 32, nonce, payload.data (), len - 16, false)) // decrypt
+		if (!Decrypt (buf, payload.data (), len - 16))
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD verification failed");
 			return false;
@@ -317,7 +398,7 @@ namespace garlic
 			{
 				case eECIESx25519BlkGalicClove:
 					if (GetOwner ())
-						GetOwner ()->HandleECIESx25519GarlicClove (buf + offset, size);
+						GetOwner ()->HandleECIESx25519GarlicClove (buf + offset, size, this);
 				break;
 				case eECIESx25519BlkNextKey:
 					LogPrint (eLogDebug, "Garlic: Next key");
@@ -335,7 +416,7 @@ namespace garlic
 					{
 						uint32_t tagsetid = bufbe16toh (buf + offset1); offset1 += 2; // tagsetid
 						uint16_t n = bufbe16toh (buf + offset1); offset1 += 2; // N
-						MessageConfirmed ((tagsetid << 16) + n); // msgid
+						MessageConfirmed ((tagsetid << 16) + n); // msgid = (tagsetid << 16) + N
 					}
 					break;
 				}
@@ -398,7 +479,6 @@ namespace garlic
 		{
 			uint16_t keyID = bufbe16toh (buf); buf += 2; // keyID
 			bool newKey = flag & ECIESX25519_NEXT_KEY_REQUEST_REVERSE_KEY_FLAG;
-			m_SendReverseKey = true;
 			if (!m_NextReceiveRatchet)
 				m_NextReceiveRatchet.reset (new DHRatchet ());
 			else
@@ -410,15 +490,14 @@ namespace garlic
 				}
 				m_NextReceiveRatchet->keyID = keyID;
 			}
-			int tagsetID = 2*keyID;
 			if (newKey)
 			{
 				m_NextReceiveRatchet->key = i2p::transport::transports.GetNextX25519KeysPair ();
 				m_NextReceiveRatchet->newKey = true;
-				tagsetID++;
 			}
 			else
 				m_NextReceiveRatchet->newKey = false;
+			auto tagsetID = m_NextReceiveRatchet->GetReceiveTagSetID ();
 			if (flag & ECIESX25519_NEXT_KEY_KEY_PRESENT_FLAG)
 				memcpy (m_NextReceiveRatchet->remote, buf, 32);
 
@@ -432,7 +511,9 @@ namespace garlic
 			GenerateMoreReceiveTags (newTagset, (GetOwner () && GetOwner ()->GetNumRatchetInboundTags () > 0) ?
 				GetOwner ()->GetNumRatchetInboundTags () : ECIESX25519_MAX_NUM_GENERATED_TAGS);
 			receiveTagset->Expire ();
+			
 			LogPrint (eLogDebug, "Garlic: Next receive tagset ", tagsetID, " created");
+			m_SendReverseKey = true;
 		}
 	}
 
@@ -469,7 +550,16 @@ namespace garlic
 		offset += 32;
 
 		// KDF1
-		i2p::crypto::InitNoiseIKState (GetNoiseState (), m_RemoteStaticKey); // bpk
+#if OPENSSL_PQ		
+		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+		{
+			i2p::crypto::InitNoiseIKStateMLKEM (GetNoiseState (), m_RemoteStaticKeyType, m_RemoteStaticKey); // bpk
+			m_PQKeys = i2p::crypto::CreateMLKEMKeys (m_RemoteStaticKeyType);
+			m_PQKeys->GenerateKeys ();
+		}	
+		else	
+#endif			
+			i2p::crypto::InitNoiseIKState (GetNoiseState (), m_RemoteStaticKey); // bpk
 		MixHash (m_EphemeralKeys->GetPublicKey (), 32); // h = SHA256(h || aepk)
 		uint8_t sharedSecret[32];
 		if (!m_EphemeralKeys->Agree (m_RemoteStaticKey, sharedSecret)) // x25519(aesk, bpk)
@@ -478,18 +568,32 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
+#if OPENSSL_PQ
+		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+		{
+			auto keyLen = i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType);
+			std::vector<uint8_t> encapsKey(keyLen);
+			m_PQKeys->GetPublicKey (encapsKey.data ());
+			// encrypt encapsKey 
+			if (!Encrypt (encapsKey.data (), out + offset, keyLen))
+			{
+				LogPrint (eLogWarning, "Garlic: ML-KEM encap_key section AEAD encryption failed ");
+				return false;
+			}
+			MixHash (out + offset, keyLen + 16); // h = SHA256(h || ciphertext)
+			offset += keyLen + 16;
+		}	
+#endif		
 		// encrypt flags/static key section
-		uint8_t nonce[12];
-		CreateNonce (0, nonce);
 		const uint8_t * fs;
 		if (isStatic)
-			fs = GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD);
+			fs = GetOwner ()->GetEncryptionPublicKey (m_RemoteStaticKeyType);
 		else
 		{
 			memset (out + offset, 0, 32); // all zeros flags section
 			fs = out + offset;
 		}
-		if (!i2p::crypto::AEADChaCha20Poly1305 (fs, 32, m_H, 32, m_CK + 32, nonce, out + offset, 48, true)) // encrypt
+		if (!Encrypt (fs, out + offset, 32)) 
 		{
 			LogPrint (eLogWarning, "Garlic: Flags/static section AEAD encryption failed ");
 			return false;
@@ -500,13 +604,11 @@ namespace garlic
 		// KDF2
 		if (isStatic)
 		{
-			GetOwner ()->Decrypt (m_RemoteStaticKey, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD); // x25519 (ask, bpk)
-			MixKey (sharedSecret);
+			GetOwner ()->Decrypt (m_RemoteStaticKey, sharedSecret, m_RemoteStaticKeyType); // x25519 (ask, bpk)
+			MixKey (sharedSecret);	
 		}
-		else
-			CreateNonce (1, nonce);
 		// encrypt payload
-		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_CK + 32, nonce, out + offset, len + 16, true)) // encrypt
+		if (!Encrypt (payload, out + offset, len))
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD encryption failed");
 			return false;
@@ -544,7 +646,7 @@ namespace garlic
 		}
 		memcpy (m_NSREncodedKey, out + offset, 32); // for possible next NSR
 		memcpy (m_NSRH, m_H, 32);
-		offset += 32;
+		offset += 32;	
 		// KDF for Reply Key Section
 		MixHash ((const uint8_t *)&tag, 8); // h = SHA256(h || tag)
 		MixHash (m_EphemeralKeys->GetPublicKey (), 32); // h = SHA256(h || bepk)
@@ -555,16 +657,33 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
+#if OPENSSL_PQ
+		if (m_PQKeys)
+		{
+			size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
+			std::vector<uint8_t> kemCiphertext(cipherTextLen);
+			m_PQKeys->Encaps (kemCiphertext.data (), sharedSecret);
+			
+			if (!Encrypt (kemCiphertext.data (), out + offset, cipherTextLen))
+			{
+				LogPrint (eLogWarning, "Garlic: NSR ML-KEM ciphertext section AEAD encryption failed");
+				return false;
+			}
+			m_NSREncodedPQKey = std::make_unique<std::vector<uint8_t> > (cipherTextLen + 16);
+			memcpy (m_NSREncodedPQKey->data (), out + offset, cipherTextLen + 16);
+			MixHash (out + offset, cipherTextLen + 16);
+			MixKey (sharedSecret);
+			offset += cipherTextLen + 16;
+		}	
+#endif		
 		if (!m_EphemeralKeys->Agree (m_RemoteStaticKey, sharedSecret)) // sharedSecret = x25519(besk, apk)
 		{
 			LogPrint (eLogWarning, "Garlic: Incorrect Alice static key");
 			return false;
 		}
 		MixKey (sharedSecret);
-		uint8_t nonce[12];
-		CreateNonce (0, nonce);
 		// calculate hash for zero length
-		if (!i2p::crypto::AEADChaCha20Poly1305 (nonce /* can be anything */, 0, m_H, 32, m_CK + 32, nonce, out + offset, 16, true)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
+		if (!Encrypt (sharedSecret /* can be anything */, out + offset, 0)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD encryption failed");
 			return false;
@@ -585,6 +704,7 @@ namespace garlic
 			GetOwner ()->GetNumRatchetInboundTags () : ECIESX25519_MIN_NUM_GENERATED_TAGS);
 		i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", m_NSRKey, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32)
 		// encrypt payload
+		uint8_t nonce[12]; memset (nonce, 0, 12); // seqn = 0
 		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + offset, len + 16, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: NSR payload section AEAD encryption failed");
@@ -606,16 +726,34 @@ namespace garlic
 		memcpy (m_H, m_NSRH, 32);
 		MixHash ((const uint8_t *)&tag, 8); // h = SHA256(h || tag)
 		MixHash (m_EphemeralKeys->GetPublicKey (), 32); // h = SHA256(h || bepk)
-		uint8_t nonce[12];
-		CreateNonce (0, nonce);
-		if (!i2p::crypto::AEADChaCha20Poly1305 (nonce /* can be anything */, 0, m_H, 32, m_CK + 32, nonce, out + 40, 16, true)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
+		m_N = 0;
+		size_t offset = 40;
+#if OPENSSL_PQ		
+		if (m_PQKeys)
+		{	
+			if (m_NSREncodedPQKey)
+			{	
+				size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
+				memcpy (out + offset, m_NSREncodedPQKey->data (), cipherTextLen + 16);
+				MixHash (out + offset, cipherTextLen + 16);
+				offset += cipherTextLen + 16;
+			}
+			else
+			{
+				LogPrint (eLogWarning, "Garlic: No stored ML-KEM keys");
+				return false;
+			}
+		}
+#endif
+		if (!Encrypt (m_NSRH /* can be anything */, out + offset, 0)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD encryption failed");
 			return false;
 		}
-		MixHash (out + 40, 16); // h = SHA256(h || ciphertext)
+		MixHash (out + offset, 16); // h = SHA256(h || ciphertext)
 		// encrypt payload
-		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + 56, len + 16, true)) // encrypt
+		uint8_t nonce[12]; memset (nonce, 0, 12);
+		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + offset + 16, len + 16, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Next NSR payload section AEAD encryption failed");
 			return false;
@@ -647,13 +785,30 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
-		GetOwner ()->Decrypt (bepk, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD); // x25519 (ask, bepk)
+#if OPENSSL_PQ
+		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+		{
+			// decrypt kem_ciphertext section
+			size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
+			std::vector<uint8_t> kemCiphertext(cipherTextLen);
+			if (!Decrypt (buf, kemCiphertext.data (), cipherTextLen))
+			{
+				LogPrint (eLogWarning, "Garlic: Reply ML-KEM ciphertext section AEAD decryption failed");
+				return false;
+			}
+			MixHash (buf, cipherTextLen + 16);
+			buf += cipherTextLen + 16;
+			len -= cipherTextLen + 16;
+			// decaps
+			m_PQKeys->Decaps (kemCiphertext.data (), sharedSecret);
+			MixKey (sharedSecret);
+		}
+#endif	
+		GetOwner ()->Decrypt (bepk, sharedSecret, m_RemoteStaticKeyType); // x25519 (ask, bepk)
 		MixKey (sharedSecret);
-
-		uint8_t nonce[12];
-		CreateNonce (0, nonce);
+		
 		// calculate hash for zero length
-		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 0, m_H, 32, m_CK + 32, nonce, sharedSecret/* can be anything */, 0, false)) // decrypt, DECRYPT(k, n, ZEROLEN, ad) verification only
+		if (!Decrypt (buf, sharedSecret/* can be anything */, 0)) // decrypt, DECRYPT(k, n, ZEROLEN, ad) verification only
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD decryption failed");
 			return false;
@@ -678,6 +833,7 @@ namespace garlic
 		}
 		i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", keydata, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32)
 		// decrypt payload
+		uint8_t nonce[12]; memset (nonce, 0, 12); // seqn = 0
 		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, m_H, 32, keydata, nonce, buf, len - 16, false)) // decrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD decryption failed");
@@ -687,7 +843,8 @@ namespace garlic
 		if (m_State == eSessionStateNewSessionSent)
 		{
 			m_State = eSessionStateEstablished;
-			//m_EphemeralKeys = nullptr; // TODO: delete after a while
+			// don't delete m_EpehemralKey and m_PQKeys because delayed NSR's might come
+			// done in CleanupReceiveNSRKeys called from NSR tagset destructor		
 			m_SessionCreatedTimestamp = i2p::util::GetSecondsSinceEpoch ();
 			GetOwner ()->AddECIESx25519Session (m_RemoteStaticKey, shared_from_this ());
 		}
@@ -702,6 +859,8 @@ namespace garlic
 
 	bool ECIESX25519AEADRatchetSession::NewExistingSessionMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen)
 	{
+		auto owner = GetOwner ();
+		if (!owner) return false;
 		uint8_t nonce[12];
 		auto index = m_SendTagset->GetNextIndex ();
 		CreateNonce (index, nonce); // tag's index
@@ -709,8 +868,7 @@ namespace garlic
 		if (!tag)
 		{
 			LogPrint (eLogError, "Garlic: Can't create new ECIES-X25519-AEAD-Ratchet tag for send tagset");
-			if (GetOwner ())
-				GetOwner ()->RemoveECIESx25519Session (m_RemoteStaticKey);
+			owner->RemoveECIESx25519Session (m_RemoteStaticKey);
 			return false;
 		}
 		memcpy (out, &tag, 8);
@@ -718,7 +876,7 @@ namespace garlic
 		// ciphertext = ENCRYPT(k, n, payload, ad)
 		uint8_t key[32];
 		m_SendTagset->GetSymmKey (index, key);
-		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, out, 8, key, nonce, out + 8, outLen - 8, true)) // encrypt
+		if (!owner->AEADChaCha20Poly1305Encrypt (payload, len, out, 8, key, nonce, out + 8, outLen - 8))
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD encryption failed");
 			return false;
@@ -737,33 +895,35 @@ namespace garlic
 		uint8_t * payload = buf + 8;
 		uint8_t key[32];
 		receiveTagset->GetSymmKey (index, key);
-		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len - 16, buf, 8, key, nonce, payload, len - 16, false)) // decrypt
+		auto owner = GetOwner ();
+		if (!owner) return true; // drop message
+		
+		if (!owner->AEADChaCha20Poly1305Decrypt (payload, len - 16, buf, 8, key, nonce, payload, len - 16))
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD decryption failed");
 			return false;
 		}
 		HandlePayload (payload, len - 16, receiveTagset, index);
-		if (GetOwner ())
+		
+		int moreTags = 0;
+		if (owner->GetNumRatchetInboundTags () > 0) // override in settings?
 		{
-			int moreTags = 0;
-			if (GetOwner ()->GetNumRatchetInboundTags () > 0) // override in settings?
-			{
-				if (receiveTagset->GetNextIndex () - index < GetOwner ()->GetNumRatchetInboundTags ()/2)
-					moreTags = GetOwner ()->GetNumRatchetInboundTags ();
-				index -= GetOwner ()->GetNumRatchetInboundTags (); // trim behind
-			}
-			else
-			{
-				moreTags = ECIESX25519_MIN_NUM_GENERATED_TAGS + (index >> 2); // N/4
-				if (moreTags > ECIESX25519_MAX_NUM_GENERATED_TAGS) moreTags = ECIESX25519_MAX_NUM_GENERATED_TAGS;
-				moreTags -= (receiveTagset->GetNextIndex () - index);
-				index -= ECIESX25519_MAX_NUM_GENERATED_TAGS; // trim behind
-			}
-			if (moreTags > 0)
-				GenerateMoreReceiveTags (receiveTagset, moreTags);
-			if (index > 0)
-				receiveTagset->SetTrimBehind (index);
+			if (receiveTagset->GetNextIndex () - index < owner->GetNumRatchetInboundTags ()/2)
+				moreTags = owner->GetNumRatchetInboundTags ();
+			index -= owner->GetNumRatchetInboundTags (); // trim behind
 		}
+		else
+		{
+			moreTags = (receiveTagset->GetTagSetID () > 0) ? ECIESX25519_MAX_NUM_GENERATED_TAGS : // for non first tagset
+				(ECIESX25519_MIN_NUM_GENERATED_TAGS + (index >> 1)); // N/2
+			if (moreTags > ECIESX25519_MAX_NUM_GENERATED_TAGS) moreTags = ECIESX25519_MAX_NUM_GENERATED_TAGS;
+			moreTags -= (receiveTagset->GetNextIndex () - index);
+			index -= ECIESX25519_MAX_NUM_GENERATED_TAGS; // trim behind
+		}
+		if (moreTags > 0)
+			GenerateMoreReceiveTags (receiveTagset, moreTags);
+		if (index > 0)
+			receiveTagset->SetTrimBehind (index);
 		return true;
 	}
 
@@ -777,10 +937,14 @@ namespace garlic
 				m_State = eSessionStateEstablished;
 				m_NSRSendTagset = nullptr;
 				m_EphemeralKeys = nullptr;
-#if (__cplusplus >= 201703L) // C++ 17 or higher
+#if OPENSSL_PQ
+				m_PQKeys = nullptr;
+				m_NSREncodedPQKey = nullptr;
+#endif				
 				[[fallthrough]];
-#endif
 			case eSessionStateEstablished:
+				if (m_SendReverseKey && receiveTagset->GetTagSetID () == m_NextReceiveRatchet->GetReceiveTagSetID ())
+					m_SendReverseKey = false; // tag received on new tagset	
 				if (receiveTagset->IsNS ())
 				{
 					// our of sequence NSR
@@ -807,7 +971,12 @@ namespace garlic
 		if (!payload) return nullptr;
 		size_t len = CreatePayload (msg, m_State != eSessionStateEstablished, payload);
 		if (!len) return nullptr;
+#if OPENSSL_PQ
+		auto m = NewI2NPMessage (len + (m_State == eSessionStateEstablished ? 28 :
+			i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType) + 116));
+#else		
 		auto m = NewI2NPMessage (len + 100); // 96 + 4
+#endif		
 		m->Align (12); // in order to get buf aligned to 16 (12 + 4)
 		uint8_t * buf = m->GetPayload () + 4; // 4 bytes for length
 
@@ -822,16 +991,28 @@ namespace garlic
 				if (!NewOutgoingSessionMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 96;
+#if OPENSSL_PQ
+				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+					len += i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType) + 16;
+#endif				
 			break;
 			case eSessionStateNewSessionReceived:
 				if (!NewSessionReplyMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 72;
+#if OPENSSL_PQ
+				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+					len += i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType) + 16;
+#endif				
 			break;
 			case eSessionStateNewSessionReplySent:
 				if (!NextNewSessionReplyMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 72;
+#if OPENSSL_PQ
+				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
+					len += i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType) + 16;
+#endif				
 			break;
 			case eSessionStateOneTime:
 				if (!NewOutgoingSessionMessage (payload, len, buf, m->maxLen, false))
@@ -858,6 +1039,7 @@ namespace garlic
 	{
 		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
 		size_t payloadLen = 0;
+		bool sendAckRequest = false;
 		if (first) payloadLen += 7;// datatime
 		if (msg)
 		{
@@ -876,13 +1058,28 @@ namespace garlic
 			payloadLen += leaseSet->GetBufferLen () + DATABASE_STORE_HEADER_SIZE + 13;
 			if (!first)
 			{
-				// ack request
+				// ack request for LeaseSet
+				m_AckRequestMsgID = m_SendTagset->GetMsgID ();
+				sendAckRequest = true;
+				// update LeaseSet status
 				SetLeaseSetUpdateStatus (eLeaseSetSubmitted);
-				SetLeaseSetUpdateMsgID ((m_SendTagset->GetTagSetID () << 16) + m_SendTagset->GetNextIndex ()); // (tagsetid << 16) + N
+				SetLeaseSetUpdateMsgID (m_AckRequestMsgID);
 				SetLeaseSetSubmissionTime (ts);
-				payloadLen += 4;
 			}
 		}
+		if (!sendAckRequest && !first &&
+		    ((!m_AckRequestMsgID && ts > m_LastAckRequestSendTime + m_AckRequestInterval) || // regular request
+		     (m_AckRequestMsgID && ts > m_LastAckRequestSendTime + LEASESET_CONFIRMATION_TIMEOUT))) // previous request failed. try again
+		{	
+			// not LeaseSet
+			m_AckRequestMsgID = m_SendTagset->GetMsgID ();
+			if (m_AckRequestMsgID)
+			{	
+				m_AckRequestNumAttempts++;
+				sendAckRequest = true;
+			}	
+		}	
+		if (sendAckRequest) payloadLen += 4;
 		if (m_AckRequests.size () > 0)
 			payloadLen += m_AckRequests.size ()*4 + 3;
 		if (m_SendReverseKey)
@@ -934,16 +1131,15 @@ namespace garlic
 			}
 			// LeaseSet
 			if (leaseSet)
-			{
 				offset += CreateLeaseSetClove (leaseSet, ts, payload + offset, payloadLen - offset);
-				if (!first)
-				{
-					// ack request
-					payload[offset] = eECIESx25519BlkAckRequest; offset++;
-					htobe16buf (payload + offset, 1); offset += 2;
-					payload[offset] = 0; offset++; // flags
-				}
-			}
+			// ack request
+			if (sendAckRequest)
+			{
+				payload[offset] = eECIESx25519BlkAckRequest; offset++;
+				htobe16buf (payload + offset, 1); offset += 2;
+				payload[offset] = 0; offset++; // flags
+				m_LastAckRequestSendTime = ts;
+			}	
 			// msg
 			if (msg)
 				offset += CreateGarlicClove (msg, payload + offset, payloadLen - offset);
@@ -978,7 +1174,6 @@ namespace garlic
 					memcpy (payload + offset, m_NextReceiveRatchet->key->GetPublicKey (), 32);
 					offset += 32; // public key
 				}
-				m_SendReverseKey = false;
 			}
 			if (m_SendForwardKey)
 			{
@@ -1074,6 +1269,8 @@ namespace garlic
 	bool ECIESX25519AEADRatchetSession::CheckExpired (uint64_t ts)
 	{
 		CleanupUnconfirmedLeaseSet (ts);
+		if (!m_Destination && ts > m_LastActivityTimestamp + ECIESX25519_SESSION_CREATE_TIMEOUT) return true; // m_LastActivityTimestamp is NS receive time 
+		if (m_State != eSessionStateEstablished && m_SessionCreatedTimestamp && ts > m_SessionCreatedTimestamp + ECIESX25519_SESSION_ESTABLISH_TIMEOUT) return true; 
 		return ts > m_LastActivityTimestamp + ECIESX25519_RECEIVE_EXPIRATION_TIMEOUT && // seconds
 			ts*1000 > m_LastSentTimestamp + ECIESX25519_SEND_EXPIRATION_TIMEOUT*1000; // milliseconds
 	}

libi2pd/ECIESX25519AEADRatchetSession.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -14,10 +14,12 @@
 #include <functional>
 #include <memory>
 #include <vector>
+#include <array>
 #include <list>
 #include <unordered_map>
 #include "Identity.h"
 #include "Crypto.h"
+#include "PostQuantum.h"
 #include "Garlic.h"
 #include "Tag.h"
 
@@ -30,10 +32,14 @@ namespace garlic
 	const int ECIESX25519_SEND_INACTIVITY_TIMEOUT = 5000; // number of milliseconds we can send empty(pyaload only) packet after
 	const int ECIESX25519_SEND_EXPIRATION_TIMEOUT = 480; // in seconds
 	const int ECIESX25519_RECEIVE_EXPIRATION_TIMEOUT = 600; // in seconds
-	const int ECIESX25519_PREVIOUS_TAGSET_EXPIRATION_TIMEOUT = 180; // 180
+	const int ECIESX25519_SESSION_CREATE_TIMEOUT = 3; // in seconds, NSR must be send after NS received
+	const int ECIESX25519_SESSION_ESTABLISH_TIMEOUT = 15; // in seconds 
+	const int ECIESX25519_PREVIOUS_TAGSET_EXPIRATION_TIMEOUT = 180; // in seconds
+	const int ECIESX25519_DEFAULT_ACK_REQUEST_INTERVAL = 33000; // in milliseconds
+	const int ECIESX25519_ACK_REQUEST_MAX_NUM_ATTEMPTS = 3;
 	const int ECIESX25519_TAGSET_MAX_NUM_TAGS = 8192; // number of tags we request new tagset after
 	const int ECIESX25519_MIN_NUM_GENERATED_TAGS = 24;
-	const int ECIESX25519_MAX_NUM_GENERATED_TAGS = 320;
+	const int ECIESX25519_MAX_NUM_GENERATED_TAGS = 800;
 	const int ECIESX25519_NSR_NUM_GENERATED_TAGS = 12;
 
 	const size_t ECIESX25519_OPTIMAL_PAYLOAD_SIZE = 1912; // 1912 = 1956 /* to fit 2 tunnel messages */
@@ -57,6 +63,8 @@ namespace garlic
 			int GetTagSetID () const { return m_TagSetID; };
 			void SetTagSetID (int tagsetID) { m_TagSetID = tagsetID; };
 
+			uint32_t GetMsgID () const { return (m_TagSetID << 16) + m_NextIndex; }; // (tagsetid << 16) + N
+			
 		private:
 
 			i2p::data::Tag<64> m_SessionTagKeyData;
@@ -73,8 +81,8 @@ namespace garlic
 	{
 		public:
 
-			ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS = false):
-				m_Session (session), m_IsNS (isNS) {};
+			ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS = false);
+			~ReceiveRatchetTagSet () override;
 
 			bool IsNS () const { return m_IsNS; };
 			std::shared_ptr<ECIESX25519AEADRatchetSession> GetSession () { return m_Session; };
@@ -149,6 +157,7 @@ namespace garlic
 			std::shared_ptr<i2p::crypto::X25519Keys> key;
 			uint8_t remote[32]; // last remote public key
 			bool newKey = true;
+			int GetReceiveTagSetID () const { return newKey ? (2*keyID + 1) : 2*keyID; }
 		};
 
 		public:
@@ -157,34 +166,42 @@ namespace garlic
 			~ECIESX25519AEADRatchetSession ();
 
 			bool HandleNextMessage (uint8_t * buf, size_t len, std::shared_ptr<ReceiveRatchetTagSet> receiveTagset, int index = 0);
-			std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg);
+			std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg) override;
 			std::shared_ptr<I2NPMessage> WrapOneTimeMessage (std::shared_ptr<const I2NPMessage> msg);
 
 			const uint8_t * GetRemoteStaticKey () const { return m_RemoteStaticKey; }
-			void SetRemoteStaticKey (const uint8_t * key) { memcpy (m_RemoteStaticKey, key, 32); }
-
+			i2p::data::CryptoKeyType GetRemoteStaticKeyType () const { return m_RemoteStaticKeyType; }
+			void SetRemoteStaticKey (i2p::data::CryptoKeyType keyType, const uint8_t * key) 
+			{ 
+				m_RemoteStaticKeyType = keyType;
+				memcpy (m_RemoteStaticKey, key, 32); 
+			}
 			void Terminate () { m_IsTerminated = true; }
-			void SetDestination (const i2p::data::IdentHash& dest) // TODO:
+			void SetDestination (const i2p::data::IdentHash& dest)
 			{
 				if (!m_Destination) m_Destination.reset (new i2p::data::IdentHash (dest));
 			}
-
+			const i2p::data::IdentHash * GetDestinationPtr () const { return m_Destination ? m_Destination.get () : nullptr; }; // for pongs 
 			bool CheckExpired (uint64_t ts); // true is expired
 			bool CanBeRestarted (uint64_t ts) const { return ts > m_SessionCreatedTimestamp + ECIESX25519_RESTART_TIMEOUT; }
 			bool IsInactive (uint64_t ts) const { return ts > m_LastActivityTimestamp + ECIESX25519_INACTIVITY_TIMEOUT && CanBeRestarted (ts); }
-
-			bool IsRatchets () const { return true; };
-			bool IsReadyToSend () const { return m_State != eSessionStateNewSessionSent; };
-			bool IsTerminated () const { return m_IsTerminated; }
-			uint64_t GetLastActivityTimestamp () const { return m_LastActivityTimestamp; };
-
+			void CleanupReceiveNSRKeys (); // called from ReceiveRatchetTagSet at Alice's side
+			
+			bool IsRatchets () const override { return true; };
+			bool IsReadyToSend () const override { return m_State != eSessionStateNewSessionSent; };
+			bool IsTerminated () const override { return m_IsTerminated; }
+			uint64_t GetLastActivityTimestamp () const override { return m_LastActivityTimestamp; };
+			void SetAckRequestInterval (int interval) override { m_AckRequestInterval = interval; };
+			bool CleanupUnconfirmedTags () override; // return true if unaswered Ack requests, called from I2CP
+			
 		protected:
 
 			i2p::crypto::NoiseSymmetricState& GetNoiseState () { return *this; };
 			void SetNoiseState (const i2p::crypto::NoiseSymmetricState& state) { GetNoiseState () = state; };
 			void CreateNonce (uint64_t seqn, uint8_t * nonce);
 			void HandlePayload (const uint8_t * buf, size_t len, const std::shared_ptr<ReceiveRatchetTagSet>& receiveTagset, int index);
-
+			bool MessageConfirmed (uint32_t msgID) override;
+			
 		private:
 
 			bool GenerateEphemeralKeysAndEncode (uint8_t * buf); // buf is 32 bytes
@@ -209,20 +226,30 @@ namespace garlic
 
 		private:
 
+			i2p::data::CryptoKeyType m_RemoteStaticKeyType;
 			uint8_t m_RemoteStaticKey[32];
 			uint8_t m_Aepk[32]; // Alice's ephemeral keys, for incoming only
 			uint8_t m_NSREncodedKey[32], m_NSRH[32], m_NSRKey[32]; // new session reply, for incoming only
 			std::shared_ptr<i2p::crypto::X25519Keys> m_EphemeralKeys;
+#if OPENSSL_PQ	
+			std::unique_ptr<i2p::crypto::MLKEMKeys> m_PQKeys;
+			std::unique_ptr<std::vector<uint8_t> > m_NSREncodedPQKey;
+#endif			
 			SessionState m_State = eSessionStateNew;
 			uint64_t m_SessionCreatedTimestamp = 0, m_LastActivityTimestamp = 0, // incoming (in seconds)
 				m_LastSentTimestamp = 0; // in milliseconds
 			std::shared_ptr<RatchetTagSet> m_SendTagset, m_NSRSendTagset;
-			std::unique_ptr<i2p::data::IdentHash> m_Destination;// TODO: might not need it
-			std::list<std::pair<uint16_t, int> > m_AckRequests; // (tagsetid, index)
+			std::unique_ptr<i2p::data::IdentHash> m_Destination;// must be set for NS if outgoing and NSR if incoming
+			std::list<std::pair<uint16_t, int> > m_AckRequests; // incoming (tagsetid, index)
 			bool m_SendReverseKey = false, m_SendForwardKey = false, m_IsTerminated = false;
 			std::unique_ptr<DHRatchet> m_NextReceiveRatchet, m_NextSendRatchet;
 			uint8_t m_PaddingSizes[32], m_NextPaddingSize;
 
+			uint64_t m_LastAckRequestSendTime = 0; // milliseconds
+			uint32_t m_AckRequestMsgID = 0; 
+			int m_AckRequestNumAttempts = 0;
+			int m_AckRequestInterval = ECIESX25519_DEFAULT_ACK_REQUEST_INTERVAL; // milliseconds
+			
 		public:
 
 			// for HTTP only

libi2pd/Ed25519.cpp

@@ -1,12 +1,12 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
 * See full license text in LICENSE file at top of project tree
 */
 
-#include <openssl/sha.h>
+#include <openssl/evp.h>
 #include "Log.h"
 #include "Crypto.h"
 #include "Ed25519.h"
@@ -134,22 +134,27 @@ namespace crypto
 	{
 		BN_CTX * bnCtx = BN_CTX_new ();
 		// calculate r
-		SHA512_CTX ctx;
-		SHA512_Init (&ctx);
-		SHA512_Update (&ctx, expandedPrivateKey + EDDSA25519_PRIVATE_KEY_LENGTH, EDDSA25519_PRIVATE_KEY_LENGTH); // right half of expanded key
-		SHA512_Update (&ctx, buf, len); // data
+		EVP_MD_CTX * ctx = EVP_MD_CTX_create ();
+		EVP_DigestInit_ex (ctx, EVP_sha512(), NULL);
+		EVP_DigestUpdate (ctx, expandedPrivateKey + EDDSA25519_PRIVATE_KEY_LENGTH, EDDSA25519_PRIVATE_KEY_LENGTH); // right half of expanded key
+		EVP_DigestUpdate (ctx, buf, len); // data
 		uint8_t digest[64];
-		SHA512_Final (digest, &ctx);
+		unsigned int dl = 64;
+		EVP_DigestFinal_ex (ctx, digest, &dl);
+		EVP_MD_CTX_destroy (ctx);
 		BIGNUM * r = DecodeBN<32> (digest); // DecodeBN<64> (digest); // for test vectors
 		// calculate R
 		uint8_t R[EDDSA25519_SIGNATURE_LENGTH/2]; // we must use separate buffer because signature might be inside buf
 		EncodePoint (Normalize (MulB (digest, bnCtx), bnCtx), R); // EncodePoint (Mul (B, r, bnCtx), R); // for test vectors
 		// calculate S
-		SHA512_Init (&ctx);
-		SHA512_Update (&ctx, R, EDDSA25519_SIGNATURE_LENGTH/2); // R
-		SHA512_Update (&ctx, publicKeyEncoded, EDDSA25519_PUBLIC_KEY_LENGTH); // public key
-		SHA512_Update (&ctx, buf, len); // data
-		SHA512_Final (digest, &ctx);
+		ctx = EVP_MD_CTX_create ();
+		EVP_DigestInit_ex (ctx, EVP_sha512(), NULL);
+		EVP_DigestUpdate (ctx, R, EDDSA25519_SIGNATURE_LENGTH/2); // R
+		EVP_DigestUpdate (ctx, publicKeyEncoded, EDDSA25519_PUBLIC_KEY_LENGTH); // public key
+		EVP_DigestUpdate (ctx, buf, len); // data
+		dl = 64;
+		EVP_DigestFinal_ex (ctx, digest, &dl);
+		EVP_MD_CTX_destroy (ctx);
 		BIGNUM * h = DecodeBN<64> (digest);
 		// S = (r + h*a) % l
 		BIGNUM * a = DecodeBN<EDDSA25519_PRIVATE_KEY_LENGTH> (expandedPrivateKey); // left half of expanded key
@@ -169,13 +174,15 @@ namespace crypto
 		uint8_t T[80];
 		RAND_bytes (T, 80);
 		// calculate r = H*(T || publickey || data)
-		SHA512_CTX ctx;
-		SHA512_Init (&ctx);
-		SHA512_Update (&ctx, T, 80);
-		SHA512_Update (&ctx, publicKeyEncoded, 32);
-		SHA512_Update (&ctx, buf, len); // data
+		EVP_MD_CTX * ctx = EVP_MD_CTX_create ();
+		EVP_DigestInit_ex (ctx, EVP_sha512(), NULL);
+		EVP_DigestUpdate (ctx, T, 80);
+		EVP_DigestUpdate (ctx, publicKeyEncoded, 32);
+		EVP_DigestUpdate (ctx, buf, len); // data
 		uint8_t digest[64];
-		SHA512_Final (digest, &ctx);
+		unsigned int dl = 64;
+		EVP_DigestFinal_ex (ctx, digest, &dl);
+		EVP_MD_CTX_destroy (ctx);
 		BIGNUM * r = DecodeBN<64> (digest);
 		BN_mod (r, r, l, bnCtx); // % l
 		EncodeBN (r, digest, 32);
@@ -183,11 +190,14 @@ namespace crypto
 		uint8_t R[EDDSA25519_SIGNATURE_LENGTH/2]; // we must use separate buffer because signature might be inside buf
 		EncodePoint (Normalize (MulB (digest, bnCtx), bnCtx), R);
 		// calculate S
-		SHA512_Init (&ctx);
-		SHA512_Update (&ctx, R, EDDSA25519_SIGNATURE_LENGTH/2); // R
-		SHA512_Update (&ctx, publicKeyEncoded, EDDSA25519_PUBLIC_KEY_LENGTH); // public key
-		SHA512_Update (&ctx, buf, len); // data
-		SHA512_Final (digest, &ctx);
+		ctx = EVP_MD_CTX_create ();
+		EVP_DigestInit_ex (ctx, EVP_sha512(), NULL);
+		EVP_DigestUpdate (ctx, R, EDDSA25519_SIGNATURE_LENGTH/2); // R
+		EVP_DigestUpdate (ctx, publicKeyEncoded, EDDSA25519_PUBLIC_KEY_LENGTH); // public key
+		EVP_DigestUpdate (ctx, buf, len); // data
+		dl = 64;
+		EVP_DigestFinal_ex (ctx, digest, &dl);
+		EVP_MD_CTX_destroy (ctx);
 		BIGNUM * h = DecodeBN<64> (digest);
 		// S = (r + h*a) % l
 		BIGNUM * a = DecodeBN<EDDSA25519_PRIVATE_KEY_LENGTH> (privateKey);
@@ -457,86 +467,6 @@ namespace crypto
 		}
 	}
 
-#if !OPENSSL_X25519
-	BIGNUM * Ed25519::ScalarMul (const BIGNUM * u, const BIGNUM * k, BN_CTX * ctx) const
-	{
-		BN_CTX_start (ctx);
-		auto x1 = BN_CTX_get (ctx); BN_copy (x1, u);
-		auto x2 = BN_CTX_get (ctx); BN_one (x2);
-		auto z2 = BN_CTX_get (ctx); BN_zero (z2);
-		auto x3 = BN_CTX_get (ctx); BN_copy (x3, u);
-		auto z3 = BN_CTX_get (ctx); BN_one (z3);
-		auto c121666 = BN_CTX_get (ctx); BN_set_word (c121666, 121666);
-		auto tmp0 = BN_CTX_get (ctx); auto tmp1 = BN_CTX_get (ctx);
-		unsigned int swap = 0;
-		auto bits = BN_num_bits (k);
-		while(bits)
-		{
-			--bits;
-			auto k_t = BN_is_bit_set(k, bits) ? 1 : 0;
-			swap ^= k_t;
-			if (swap)
-			{
-				std::swap (x2, x3);
-				std::swap (z2, z3);
-			}
-			swap = k_t;
-			BN_mod_sub(tmp0, x3, z3, q, ctx);
-			BN_mod_sub(tmp1, x2, z2, q, ctx);
-			BN_mod_add(x2, x2, z2, q, ctx);
-			BN_mod_add(z2, x3, z3, q, ctx);
-			BN_mod_mul(z3, tmp0, x2, q, ctx);
-			BN_mod_mul(z2, z2, tmp1, q, ctx);
-			BN_mod_sqr(tmp0, tmp1, q, ctx);
-			BN_mod_sqr(tmp1, x2, q, ctx);
-			BN_mod_add(x3, z3, z2, q, ctx);
-			BN_mod_sub(z2, z3, z2, q, ctx);
-			BN_mod_mul(x2, tmp1, tmp0, q, ctx);
-			BN_mod_sub(tmp1, tmp1, tmp0, q, ctx);
-			BN_mod_sqr(z2, z2, q, ctx);
-			BN_mod_mul(z3, tmp1, c121666, q, ctx);
-			BN_mod_sqr(x3, x3, q, ctx);
-			BN_mod_add(tmp0, tmp0, z3, q, ctx);
-			BN_mod_mul(z3, x1, z2, q, ctx);
-			BN_mod_mul(z2, tmp1, tmp0, q, ctx);
-		}
-		if (swap)
-		{
-			std::swap (x2, x3);
-			std::swap (z2, z3);
-		}
-		BN_mod_inverse (z2, z2, q, ctx);
-		BIGNUM * res = BN_new (); // not from ctx
-		BN_mod_mul(res, x2, z2, q, ctx);
-		BN_CTX_end (ctx);
-		return res;
-	}
-
-	void Ed25519::ScalarMul (const uint8_t * p, const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const
-	{
-		BIGNUM * p1 = DecodeBN<32> (p);
-		uint8_t k[32];
-		memcpy (k, e, 32);
-		k[0] &= 248; k[31] &= 127; k[31] |= 64;
-		BIGNUM * n = DecodeBN<32> (k);
-		BIGNUM * q1 = ScalarMul (p1, n, ctx);
-		EncodeBN (q1, buf, 32);
-		BN_free (p1); BN_free (n); BN_free (q1);
-	}
-
-	void Ed25519::ScalarMulB (const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const
-	{
-		BIGNUM *p1 = BN_new (); BN_set_word (p1, 9);
-		uint8_t k[32];
-		memcpy (k, e, 32);
-		k[0] &= 248; k[31] &= 127; k[31] |= 64;
-		BIGNUM * n = DecodeBN<32> (k);
-		BIGNUM * q1 = ScalarMul (p1, n, ctx);
-		EncodeBN (q1, buf, 32);
-		BN_free (p1); BN_free (n); BN_free (q1);
-	}
-#endif
-
 	void Ed25519::BlindPublicKey (const uint8_t * pub, const uint8_t * seed, uint8_t * blinded)
 	{
 		BN_CTX * ctx = BN_CTX_new ();

libi2pd/Ed25519.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -84,10 +84,7 @@ namespace crypto
 			EDDSAPoint GeneratePublicKey (const uint8_t * expandedPrivateKey, BN_CTX * ctx) const;
 			EDDSAPoint DecodePublicKey (const uint8_t * buf, BN_CTX * ctx) const;
 			void EncodePublicKey (const EDDSAPoint& publicKey, uint8_t * buf, BN_CTX * ctx) const;
-#if !OPENSSL_X25519
-			void ScalarMul (const uint8_t * p, const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const; // p is point, e is number for x25519
-			void ScalarMulB (const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const;
-#endif
+
 			void BlindPublicKey (const uint8_t * pub, const uint8_t * seed, uint8_t * blinded); // for encrypted LeaseSet2, pub - 32, seed - 64, blinded - 32
 			void BlindPrivateKey (const uint8_t * priv, const uint8_t * seed, uint8_t * blindedPriv, uint8_t * blindedPub); // for encrypted LeaseSet2, pub - 32, seed - 64, blinded - 32
 
@@ -115,11 +112,6 @@ namespace crypto
 			BIGNUM * DecodeBN (const uint8_t * buf) const;
 			void EncodeBN (const BIGNUM * bn, uint8_t * buf, size_t len) const;
 
-#if !OPENSSL_X25519
-			// for x25519
-			BIGNUM * ScalarMul (const BIGNUM * p, const BIGNUM * e, BN_CTX * ctx) const;
-#endif
-
 		private:
 
 			BIGNUM * q, * l, * d, * I;

libi2pd/FS.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -7,13 +7,18 @@
 */
 
 #include <algorithm>
-#include <boost/filesystem.hpp>
 
 #if defined(MAC_OSX)
+#if !STD_FILESYSTEM
 #include <boost/system/system_error.hpp>
+#endif
 #include <TargetConditionals.h>
 #endif
 
+#if defined(__HAIKU__)
+#include <FindDirectory.h>
+#endif
+
 #ifdef _WIN32
 #include <shlobj.h>
 #include <windows.h>
@@ -25,6 +30,14 @@
 #include "Log.h"
 #include "Garlic.h"
 
+#if STD_FILESYSTEM
+#include <filesystem>
+namespace fs_lib = std::filesystem;
+#else
+#include <boost/filesystem.hpp>
+namespace fs_lib = boost::filesystem;
+#endif
+
 namespace i2p {
 namespace fs {
 	std::string appName = "i2pd";
@@ -54,15 +67,17 @@ namespace fs {
 
 	const std::string GetUTF8DataDir () {
 #ifdef _WIN32
-#if (BOOST_VERSION >= 108500)
-		boost::filesystem::path path (dataDir);
-#else
-		boost::filesystem::wpath path (dataDir);
-#endif
-		auto loc = boost::filesystem::path::imbue(std::locale( std::locale(), new std::codecvt_utf8_utf16<wchar_t>() ) ); // convert path to UTF-8
-		auto dataDirUTF8 = path.string();
-		boost::filesystem::path::imbue(loc); // Return locale settings back
-		return dataDirUTF8;
+		int size = MultiByteToWideChar(CP_ACP, 0,
+			dataDir.c_str(), dataDir.size(), nullptr, 0);
+		std::wstring utf16Str(size, L'\0');
+		MultiByteToWideChar(CP_ACP, 0,
+			dataDir.c_str(), dataDir.size(), &utf16Str[0], size);
+		int utf8Size = WideCharToMultiByte(CP_UTF8, 0,
+			utf16Str.c_str(), utf16Str.size(), nullptr, 0, nullptr, nullptr);
+		std::string utf8Str(utf8Size, '\0');
+		WideCharToMultiByte(CP_UTF8, 0,
+			utf16Str.c_str(), utf16Str.size(), &utf8Str[0], utf8Size, nullptr, nullptr);
+		return utf8Str;
 #else
 		return dataDir; // linux, osx, android uses UTF-8 by default
 #endif
@@ -91,10 +106,10 @@ namespace fs {
 			}
 			else
 			{
-#if (BOOST_VERSION >= 108500)
-				dataDir = boost::filesystem::path(commonAppData).string() + "\\" + appName;
+#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
+				dataDir = fs_lib::path(commonAppData).string() + "\\" + appName;
 #else
-				dataDir = boost::filesystem::wpath(commonAppData).string() + "\\" + appName;
+				dataDir = fs_lib::wpath(commonAppData).string() + "\\" + appName;
 #endif
 			}
 #else
@@ -120,14 +135,14 @@ namespace fs {
 		}
 		else
 		{
-#if (BOOST_VERSION >= 108500)
-			auto execPath = boost::filesystem::path(localAppData).parent_path();
+#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
+			auto execPath = fs_lib::path(localAppData).parent_path();
 #else
-			auto execPath = boost::filesystem::wpath(localAppData).parent_path();
+			auto execPath = fs_lib::wpath(localAppData).parent_path();
 #endif
 
 			// if config file exists in .exe's folder use it
-			if(boost::filesystem::exists(execPath/"i2pd.conf")) // TODO: magic string
+			if(fs_lib::exists(execPath/"i2pd.conf")) // TODO: magic string
 			{
 				dataDir = execPath.string ();
 			} else // otherwise %appdata%
@@ -143,10 +158,10 @@ namespace fs {
 				}
 				else
 				{
-#if (BOOST_VERSION >= 108500)
-					dataDir = boost::filesystem::path(localAppData).string() + "\\" + appName;
+#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
+					dataDir = fs_lib::path(localAppData).string() + "\\" + appName;
 #else
-					dataDir = boost::filesystem::wpath(localAppData).string() + "\\" + appName;
+					dataDir = fs_lib::wpath(localAppData).string() + "\\" + appName;
 #endif
 				}
 			}
@@ -158,18 +173,17 @@ namespace fs {
 		dataDir += "/Library/Application Support/" + appName;
 		return;
 #elif defined(__HAIKU__)
-		char *home = getenv("HOME");
-		if (home != NULL && strlen(home) > 0) {
-			dataDir = std::string(home) + "/config/settings/" + appName;
-		} else {
+		char home[PATH_MAX]; // /boot/home/config/settings
+		if (find_directory(B_USER_SETTINGS_DIRECTORY, -1, false, home, PATH_MAX) == B_OK)	
+			dataDir = std::string(home) + "/" + appName;
+		else
 			dataDir = "/tmp/" + appName;
-		}
 		return;
 #else /* other unix */
 #if defined(ANDROID)
 		const char * ext = getenv("EXTERNAL_STORAGE");
 		if (!ext) ext = "/sdcard";
-		if (boost::filesystem::exists(ext))
+		if (fs_lib::exists(ext))
 		{
 			dataDir = std::string (ext) + "/" + appName;
 			return;
@@ -202,16 +216,16 @@ namespace fs {
 	}
 
 	bool Init() {
-		if (!boost::filesystem::exists(dataDir))
-			boost::filesystem::create_directory(dataDir);
+		if (!fs_lib::exists(dataDir))
+			fs_lib::create_directory(dataDir);
 
 		std::string destinations = DataDirPath("destinations");
-		if (!boost::filesystem::exists(destinations))
-			boost::filesystem::create_directory(destinations);
+		if (!fs_lib::exists(destinations))
+			fs_lib::create_directory(destinations);
 
 		std::string tags = DataDirPath("tags");
-		if (!boost::filesystem::exists(tags))
-			boost::filesystem::create_directory(tags);
+		if (!fs_lib::exists(tags))
+			fs_lib::create_directory(tags);
 		else
 			i2p::garlic::CleanUpTagsFiles ();
 
@@ -219,13 +233,13 @@ namespace fs {
 	}
 
 	bool ReadDir(const std::string & path, std::vector<std::string> & files) {
-		if (!boost::filesystem::exists(path))
+		if (!fs_lib::exists(path))
 			return false;
-		boost::filesystem::directory_iterator it(path);
-		boost::filesystem::directory_iterator end;
+		fs_lib::directory_iterator it(path);
+		fs_lib::directory_iterator end;
 
 		for ( ; it != end; it++) {
-			if (!boost::filesystem::is_regular_file(it->status()))
+			if (!fs_lib::is_regular_file(it->status()))
 				continue;
 			files.push_back(it->path().string());
 		}
@@ -234,29 +248,42 @@ namespace fs {
 	}
 
 	bool Exists(const std::string & path) {
-		return boost::filesystem::exists(path);
+		return fs_lib::exists(path);
 	}
 
 	uint32_t GetLastUpdateTime (const std::string & path)
 	{
-		if (!boost::filesystem::exists(path))
+		if (!fs_lib::exists(path))
 			return 0;
+#if STD_FILESYSTEM
+		std::error_code ec;
+		auto t = std::filesystem::last_write_time (path, ec);
+		if (ec) return 0;
+/*#if __cplusplus >= 202002L // C++ 20 or higher
+		const auto sctp = std::chrono::clock_cast<std::chrono::system_clock>(t);
+#else	*/	// TODO: wait until implemented
+		const auto sctp = std::chrono::time_point_cast<std::chrono::system_clock::duration>(
+		    t - decltype(t)::clock::now() + std::chrono::system_clock::now());
+/*#endif */
+		return std::chrono::system_clock::to_time_t(sctp);
+#else
 		boost::system::error_code ec;
 		auto t = boost::filesystem::last_write_time (path, ec);
 		return ec ? 0 : t;
+#endif
 	}
 
 	bool Remove(const std::string & path) {
-		if (!boost::filesystem::exists(path))
+		if (!fs_lib::exists(path))
 			return false;
-		return boost::filesystem::remove(path);
+		return fs_lib::remove(path);
 	}
 
 	bool CreateDirectory (const std::string& path)
 	{
-		if (boost::filesystem::exists(path) && boost::filesystem::is_directory (boost::filesystem::status (path)))
+		if (fs_lib::exists(path) && fs_lib::is_directory (fs_lib::status (path)))
 			return true;
-		return boost::filesystem::create_directory(path);
+		return fs_lib::create_directory(path);
 	}
 
 	void HashedStorage::SetPlace(const std::string &path) {
@@ -264,18 +291,18 @@ namespace fs {
 	}
 
 	bool HashedStorage::Init(const char * chars, size_t count) {
-		if (!boost::filesystem::exists(root)) {
-			boost::filesystem::create_directories(root);
+		if (!fs_lib::exists(root)) {
+			fs_lib::create_directories(root);
 		}
 
 		for (size_t i = 0; i < count; i++) {
 			auto p = root + i2p::fs::dirSep + prefix1 + chars[i];
-			if (boost::filesystem::exists(p))
+			if (fs_lib::exists(p))
 				continue;
 #if TARGET_OS_SIMULATOR
 			// ios simulator fs says it is case sensitive, but it is not
 			boost::system::error_code ec;
-			if (boost::filesystem::create_directory(p, ec))
+			if (fs_lib::create_directory(p, ec))
 				continue;
 			switch (ec.value()) {
 				case boost::system::errc::file_exists:
@@ -285,7 +312,7 @@ namespace fs {
 					throw boost::system::system_error( ec, __func__ );
 			}
 #else
-			if (boost::filesystem::create_directory(p))
+			if (fs_lib::create_directory(p))
 				continue; /* ^ throws exception on failure */
 #endif
 			return false;
@@ -308,9 +335,9 @@ namespace fs {
 
 	void HashedStorage::Remove(const std::string & ident) {
 		std::string path = Path(ident);
-		if (!boost::filesystem::exists(path))
+		if (!fs_lib::exists(path))
 			return;
-		boost::filesystem::remove(path);
+		fs_lib::remove(path);
 	}
 
 	void HashedStorage::Traverse(std::vector<std::string> & files) {
@@ -321,12 +348,12 @@ namespace fs {
 
 	void HashedStorage::Iterate(FilenameVisitor v)
 	{
-		boost::filesystem::path p(root);
-		boost::filesystem::recursive_directory_iterator it(p);
-		boost::filesystem::recursive_directory_iterator end;
+		fs_lib::path p(root);
+		fs_lib::recursive_directory_iterator it(p);
+		fs_lib::recursive_directory_iterator end;
 
 		for ( ; it != end; it++) {
-			if (!boost::filesystem::is_regular_file( it->status() ))
+			if (!fs_lib::is_regular_file( it->status() ))
 				continue;
 			const std::string & t = it->path().string();
 			v(t);

libi2pd/FS.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -15,6 +15,16 @@
 #include <sstream>
 #include <functional>
 
+#ifndef STD_FILESYSTEM
+#	if (_WIN32 && __GNUG__) // MinGW GCC somehow incorrectly converts paths
+#		define STD_FILESYSTEM 0
+#	elif (!TARGET_OS_SIMULATOR && __has_include(<filesystem>)) // supports std::filesystem
+#		define STD_FILESYSTEM 1
+#	else
+#		define STD_FILESYSTEM 0
+#	endif
+#endif
+
 namespace i2p {
 namespace fs {
 	extern std::string dirSep;

libi2pd/Family.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -7,7 +7,6 @@
 */
 
 #include <string.h>
-#include <openssl/evp.h>
 #include <openssl/ssl.h>
 #include "Crypto.h"
 #include "FS.h"
@@ -25,6 +24,8 @@ namespace data
 
 	Families::~Families ()
 	{
+		for (auto it : m_SigningKeys)
+			if (it.second.first) EVP_PKEY_free (it.second.first);
 	}
 
 	void Families::LoadCertificate (const std::string& filename)
@@ -47,48 +48,29 @@ namespace data
 					cn += 3;
 					char * family = strstr (cn, ".family");
 					if (family) family[0] = 0;
-				}
-				auto pkey = X509_get_pubkey (cert);
-				int keyType = EVP_PKEY_base_id (pkey);
-				switch (keyType)
-				{
-					case EVP_PKEY_DSA:
-						// TODO:
-					break;
-					case EVP_PKEY_EC:
-					{
-						EC_KEY * ecKey = EVP_PKEY_get1_EC_KEY (pkey);
-						if (ecKey)
-						{
-							auto group = EC_KEY_get0_group (ecKey);
-							if (group)
+					auto pkey = X509_get_pubkey (cert);
+					if (pkey)
+					{	
+						int curve = 0;
+#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
+						char groupName[20];
+						if (EVP_PKEY_get_group_name(pkey, groupName, sizeof(groupName), NULL) == 1)
+							curve = OBJ_txt2nid (groupName);
+						else
+							curve = -1;
+#endif						
+						if (!curve || curve == NID_X9_62_prime256v1)
+						{	
+							if (!m_SigningKeys.emplace (cn, std::make_pair(pkey, (int)m_SigningKeys.size () + 1)).second)
 							{
-								int curve = EC_GROUP_get_curve_name (group);
-								if (curve == NID_X9_62_prime256v1)
-								{
-									uint8_t signingKey[64];
-									BIGNUM * x = BN_new(), * y = BN_new();
-									EC_POINT_get_affine_coordinates_GFp (group,
-										EC_KEY_get0_public_key (ecKey), x, y, NULL);
-									i2p::crypto::bn2buf (x, signingKey, 32);
-									i2p::crypto::bn2buf (y, signingKey + 32, 32);
-									BN_free (x); BN_free (y);
-									verifier = std::make_shared<i2p::crypto::ECDSAP256Verifier>();
-									verifier->SetPublicKey (signingKey);
-								}
-								else
-									LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
+								EVP_PKEY_free (pkey);
+								LogPrint (eLogError, "Family: Duplicated family name ", cn);
 							}
-							EC_KEY_free (ecKey);
 						}
-						break;
-					}
-					default:
-						LogPrint (eLogWarning, "Family: Certificate key type ", keyType, " is not supported");
+						else
+							LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
+					}	
 				}
-				EVP_PKEY_free (pkey);
-				if (verifier && cn)
-					m_SigningKeys.emplace (cn, std::make_pair(verifier, (int)m_SigningKeys.size () + 1));
 			}
 			SSL_free (ssl);
 		}
@@ -121,23 +103,37 @@ namespace data
 	}
 
 	bool Families::VerifyFamily (const std::string& family, const IdentHash& ident,
-		const char * signature, const char * key) const
+		std::string_view signature, const char * key) const
 	{
 		uint8_t buf[100], signatureBuf[64];
-		size_t len = family.length (), signatureLen = strlen (signature);
+		size_t len = family.length ();
 		if (len + 32 > 100)
 		{
 			LogPrint (eLogError, "Family: ", family, " is too long");
 			return false;
 		}
-
-		memcpy (buf, family.c_str (), len);
-		memcpy (buf + len, (const uint8_t *)ident, 32);
-		len += 32;
-		Base64ToByteStream (signature, signatureLen, signatureBuf, 64);
 		auto it = m_SigningKeys.find (family);
-		if (it != m_SigningKeys.end ())
-			return it->second.first->Verify (buf, len, signatureBuf);
+		if (it != m_SigningKeys.end () && it->second.first)
+		{	
+			memcpy (buf, family.c_str (), len);
+			memcpy (buf + len, (const uint8_t *)ident, 32);
+			len += 32;
+			auto signatureBufLen = Base64ToByteStream (signature, signatureBuf, 64);
+			if (signatureBufLen == 64)
+			{
+				ECDSA_SIG * sig = ECDSA_SIG_new();
+				ECDSA_SIG_set0 (sig, BN_bin2bn (signatureBuf, 32, NULL), BN_bin2bn (signatureBuf + 32, 32, NULL));
+				uint8_t sign[72];
+				uint8_t * s = sign;
+				auto l = i2d_ECDSA_SIG (sig, &s);
+				ECDSA_SIG_free(sig);
+				EVP_MD_CTX * ctx = EVP_MD_CTX_create ();
+				EVP_DigestVerifyInit (ctx, NULL, EVP_sha256(), NULL, it->second.first);
+				auto ret = EVP_DigestVerify (ctx, sign, l, buf, len) == 1;
+				EVP_MD_CTX_destroy (ctx);
+				return ret;
+			}	
+		}	
 		// TODO: process key
 		return true;
 	}
@@ -160,34 +156,40 @@ namespace data
 		{
 			SSL * ssl = SSL_new (ctx);
 			EVP_PKEY * pkey = SSL_get_privatekey (ssl);
-			EC_KEY * ecKey = EVP_PKEY_get1_EC_KEY (pkey);
-			if (ecKey)
+			int curve = 0;
+#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
+			char groupName[20];
+			if (EVP_PKEY_get_group_name(pkey, groupName, sizeof(groupName), NULL) == 1)
+				curve = OBJ_txt2nid (groupName);
+			else
+				curve = -1;
+#endif	
+			if (!curve || curve == NID_X9_62_prime256v1)
 			{
-				auto group = EC_KEY_get0_group (ecKey);
-				if (group)
-				{
-					int curve = EC_GROUP_get_curve_name (group);
-					if (curve == NID_X9_62_prime256v1)
-					{
-						uint8_t signingPrivateKey[32], buf[50], signature[64];
-						i2p::crypto::bn2buf (EC_KEY_get0_private_key (ecKey), signingPrivateKey, 32);
-						i2p::crypto::ECDSAP256Signer signer (signingPrivateKey);
-						size_t len = family.length ();
-						memcpy (buf, family.c_str (), len);
-						memcpy (buf + len, (const uint8_t *)ident, 32);
-						len += 32;
-						signer.Sign (buf, len, signature);
-						len = Base64EncodingBufferSize (64);
-						char * b64 = new char[len+1];
-						len = ByteStreamToBase64 (signature, 64, b64, len);
-						b64[len] = 0;
-						sig = b64;
-						delete[] b64;
-					}
-					else
-						LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
-				}
-			}
+				uint8_t buf[100], sign[72], signature[64];
+				size_t len = family.length ();
+				memcpy (buf, family.c_str (), len);
+				memcpy (buf + len, (const uint8_t *)ident, 32);
+				len += 32;
+
+				size_t l = 72;
+				EVP_MD_CTX * mdctx = EVP_MD_CTX_create ();
+				EVP_DigestSignInit (mdctx, NULL, EVP_sha256(), NULL, pkey);
+				EVP_DigestSign (mdctx, sign, &l, buf, len);
+				EVP_MD_CTX_destroy (mdctx);
+
+				const uint8_t * s1 = sign;
+				ECDSA_SIG * sig1 = d2i_ECDSA_SIG (NULL, &s1, l);
+				const BIGNUM * r, * s;
+				ECDSA_SIG_get0 (sig1, &r, &s);
+				i2p::crypto::bn2buf (r, signature, 32);
+				i2p::crypto::bn2buf (s, signature + 32, 32);
+				ECDSA_SIG_free(sig1);
+				sig = ByteStreamToBase64 (signature, 64);
+			}	
+			else
+				LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
+
 			SSL_free (ssl);
 		}
 		else

libi2pd/Family.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2022, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -11,8 +11,9 @@
 
 #include <map>
 #include <string>
+#include <string_view>
 #include <memory>
-#include "Signature.h"
+#include <openssl/evp.h>
 #include "Identity.h"
 
 namespace i2p
@@ -28,7 +29,7 @@ namespace data
 			~Families ();
 			void LoadCertificates ();
 			bool VerifyFamily (const std::string& family, const IdentHash& ident,
-				const char * signature, const char * key = nullptr) const;
+				std::string_view signature, const char * key = nullptr) const;
 			FamilyID GetFamilyID (const std::string& family) const;
 
 		private:
@@ -37,7 +38,7 @@ namespace data
 
 		private:
 
-			std::map<std::string, std::pair<std::shared_ptr<i2p::crypto::Verifier>, FamilyID> > m_SigningKeys; // family -> (verifier, id)
+			std::map<std::string, std::pair<EVP_PKEY *, FamilyID> > m_SigningKeys; // family -> (verification pkey, id)
 	};
 
 	std::string CreateFamilySignature (const std::string& family, const IdentHash& ident);

libi2pd/Garlic.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -28,7 +28,7 @@ namespace garlic
 {
 	GarlicRoutingSession::GarlicRoutingSession (GarlicDestination * owner, bool attachLeaseSet):
 		m_Owner (owner), m_LeaseSetUpdateStatus (attachLeaseSet ? eLeaseSetUpdated : eLeaseSetDoNotSend),
-		m_LeaseSetUpdateMsgID (0)
+		m_LeaseSetUpdateMsgID (0), m_IsWithJava (false), m_NumSentPackets (0)
 	{
 	}
 
@@ -160,7 +160,7 @@ namespace garlic
 			uint8_t iv[32]; // IV is first 16 bytes
 			SHA256(elGamal.preIV, 32, iv);
 			m_Destination->Encrypt ((uint8_t *)&elGamal, buf);
-			m_Encryption.SetIV (iv);
+			m_IV = iv;
 			buf += 514;
 			len += 514;
 		}
@@ -170,7 +170,7 @@ namespace garlic
 			memcpy (buf, tag, 32);
 			uint8_t iv[32]; // IV is first 16 bytes
 			SHA256(tag, 32, iv);
-			m_Encryption.SetIV (iv);
+			m_IV = iv;
 			buf += 32;
 			len += 32;
 		}
@@ -210,7 +210,7 @@ namespace garlic
 		size_t rem = blockSize % 16;
 		if (rem)
 			blockSize += (16-rem); //padding
-		m_Encryption.Encrypt(buf, blockSize, buf);
+		m_Encryption.Encrypt(buf, blockSize, m_IV, buf);
 		return blockSize;
 	}
 
@@ -426,7 +426,8 @@ namespace garlic
 	}
 
 	GarlicDestination::GarlicDestination (): m_NumTags (32), // 32 tags by default
-		m_PayloadBuffer (nullptr), m_NumRatchetInboundTags (0) // 0 means standard
+		m_PayloadBuffer (nullptr), m_LastIncomingSessionTimestamp (0), 
+		m_NumRatchetInboundTags (0) // 0 means standard
 	{
 	}
 
@@ -497,7 +498,8 @@ namespace garlic
 		buf += 4; // length
 
 		bool found = false;
-		if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
+		bool supportsRatchets = SupportsRatchets ();
+		if (supportsRatchets)
 			// try ECIESx25519 tag
 			found = HandleECIESx25519TagMessage (buf, length);
 		if (!found)
@@ -513,8 +515,7 @@ namespace garlic
 				{
 					uint8_t iv[32]; // IV is first 16 bytes
 					SHA256(buf, 32, iv);
-					decryption->SetIV (iv);
-					decryption->Decrypt (buf + 32, length - 32, buf + 32);
+					decryption->Decrypt (buf + 32, length - 32, iv, buf + 32);
 					HandleAESBlock (buf + 32, length - 32, decryption, msg->from);
 					found = true;
 				}
@@ -532,43 +533,23 @@ namespace garlic
 					auto decryption = std::make_shared<AESDecryption>(elGamal.sessionKey);
 					uint8_t iv[32]; // IV is first 16 bytes
 					SHA256(elGamal.preIV, 32, iv);
-					decryption->SetIV (iv);
-					decryption->Decrypt(buf + 514, length - 514, buf + 514);
+					decryption->Decrypt(buf + 514, length - 514, iv, buf + 514);
 					HandleAESBlock (buf + 514, length - 514, decryption, msg->from);
 				}
-				else if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
+				else if (supportsRatchets)
 				{
 					// otherwise ECIESx25519
-					auto session = std::make_shared<ECIESX25519AEADRatchetSession> (this, false); // incoming
-					if (!session->HandleNextMessage (buf, length, nullptr, 0))
-					{
-						// try to generate more tags for last tagset
-						if (m_LastTagset && (m_LastTagset->GetNextIndex () - m_LastTagset->GetTrimBehind () < 3*ECIESX25519_MAX_NUM_GENERATED_TAGS))
-						{
-							uint64_t missingTag; memcpy (&missingTag, buf, 8);
-							auto maxTags = std::max (m_NumRatchetInboundTags, ECIESX25519_MAX_NUM_GENERATED_TAGS);
-							LogPrint (eLogWarning, "Garlic: Trying to generate more ECIES-X25519-AEAD-Ratchet tags");
-							for (int i = 0; i < maxTags; i++)
-							{
-								auto nextTag = AddECIESx25519SessionNextTag (m_LastTagset);
-								if (!nextTag)
-								{
-									LogPrint (eLogError, "Garlic: Can't create new ECIES-X25519-AEAD-Ratchet tag for last tagset");
-									break;
-								}
-								if (nextTag == missingTag)
-								{
-									LogPrint (eLogDebug, "Garlic: Missing ECIES-X25519-AEAD-Ratchet tag was generated");
-									if (m_LastTagset->HandleNextMessage (buf, length, m_ECIESx25519Tags[nextTag].index))
-										found = true;
-									break;
-								}
-							}
-							if (!found) m_LastTagset = nullptr;
-						}
-						if (!found)
+					auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+					if (ts > m_LastIncomingSessionTimestamp + INCOMING_SESSIONS_MINIMAL_INTERVAL) 
+					{	
+						auto session = std::make_shared<ECIESX25519AEADRatchetSession> (this, false); // incoming
+						if (session->HandleNextMessage (buf, length, nullptr, 0))
+							m_LastIncomingSessionTimestamp = ts;
+						else
 							LogPrint (eLogError, "Garlic: Can't handle ECIES-X25519-AEAD-Ratchet message");
 					}
+					else
+						LogPrint (eLogWarning, "Garlic: Incoming sessions come too often");
 				}
 				else
 					LogPrint (eLogError, "Garlic: Failed to decrypt message");
@@ -583,9 +564,7 @@ namespace garlic
 		auto it = m_ECIESx25519Tags.find (tag);
 		if (it != m_ECIESx25519Tags.end ())
 		{
-			if (it->second.tagset && it->second.tagset->HandleNextMessage (buf, len, it->second.index))
-				m_LastTagset = it->second.tagset;
-			else
+			if (!it->second.tagset || !it->second.tagset->HandleNextMessage (buf, len, it->second.index))
 				LogPrint (eLogError, "Garlic: Can't handle ECIES-X25519-AEAD-Ratchet message");
 			m_ECIESx25519Tags.erase (it);
 			return true;
@@ -766,32 +745,38 @@ namespace garlic
 	}
 
 	std::shared_ptr<GarlicRoutingSession> GarlicDestination::GetRoutingSession (
-		std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet)
+		std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet,
+	    bool requestNewIfNotFound)
 	{
-		if (destination->GetEncryptionType () == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD &&
-			SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
+		if (destination->GetEncryptionType () >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
 		{
-			ECIESX25519AEADRatchetSessionPtr session;
-			uint8_t staticKey[32];
-			destination->Encrypt (nullptr, staticKey); // we are supposed to get static key
-			auto it = m_ECIESx25519Sessions.find (staticKey);
-			if (it != m_ECIESx25519Sessions.end ())
-			{
-				session = it->second;
-				if (session->IsInactive (i2p::util::GetSecondsSinceEpoch ()))
+			if (SupportsEncryptionType (destination->GetEncryptionType ()))
+			{	
+				ECIESX25519AEADRatchetSessionPtr session;
+				uint8_t staticKey[32];
+				destination->Encrypt (nullptr, staticKey); // we are supposed to get static key
+				auto it = m_ECIESx25519Sessions.find (staticKey);
+				if (it != m_ECIESx25519Sessions.end ())
 				{
-					LogPrint (eLogDebug, "Garlic: Session restarted");
-					session = nullptr;
+					session = it->second;
+					if (session->IsInactive (i2p::util::GetSecondsSinceEpoch ()))
+					{
+						LogPrint (eLogDebug, "Garlic: Session restarted");
+						requestNewIfNotFound = true; // it's not a new session
+						session = nullptr;
+					}
 				}
+				if (!session && requestNewIfNotFound)
+				{
+					session = std::make_shared<ECIESX25519AEADRatchetSession> (this, true);
+					session->SetRemoteStaticKey (destination->GetEncryptionType (), staticKey);
+				}
+				if (session && destination->IsDestination ())
+					session->SetDestination (destination->GetIdentHash ()); // NS or NSR
+				return session;
 			}
-			if (!session)
-			{
-				session = std::make_shared<ECIESX25519AEADRatchetSession> (this, true);
-				session->SetRemoteStaticKey (staticKey);
-			}
-			if (destination->IsDestination ())
-				session->SetDestination (destination->GetIdentHash ()); // TODO: remove
-			return session;
+			else
+				LogPrint (eLogError, "Garlic: Non-supported encryption type ", destination->GetEncryptionType ());
 		}
 		else
 		{
@@ -893,8 +878,6 @@ namespace garlic
 		}
 		if (numExpiredTags > 0)
 			LogPrint (eLogDebug, "Garlic: ", numExpiredTags, " ECIESx25519 tags expired for ", GetIdentHash().ToBase64 ());
-		if (m_LastTagset && m_LastTagset->IsExpired (ts))
-			m_LastTagset = nullptr;
 	}
 
 	void GarlicDestination::RemoveDeliveryStatusSession (uint32_t msgID)
@@ -928,7 +911,7 @@ namespace garlic
 		}
 	}
 
-	void GarlicDestination::SetLeaseSetUpdated ()
+	void GarlicDestination::SetLeaseSetUpdated (bool post)
 	{
 		{
 			std::unique_lock<std::mutex> l(m_SessionsMutex);
@@ -1021,7 +1004,8 @@ namespace garlic
 				i2p::fs::Remove (it);
 	}
 
-	void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len)
+	void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len,
+		ECIESX25519AEADRatchetSession * from)
 	{
 		const uint8_t * buf1 = buf;
 		uint8_t flag = buf[0]; buf++; // flag
@@ -1031,9 +1015,7 @@ namespace garlic
 			case eGarlicDeliveryTypeDestination:
 				LogPrint (eLogDebug, "Garlic: Type destination");
 				buf += 32; // TODO: check destination
-#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
-#endif
 				// no break here
 			case eGarlicDeliveryTypeLocal:
 			{
@@ -1043,7 +1025,7 @@ namespace garlic
 				buf += 4; // expiration
 				ptrdiff_t offset = buf - buf1;
 				if (offset <= (int)len)
-					HandleCloveI2NPMessage (typeID, buf, len - offset, msgID);
+					HandleCloveI2NPMessage (typeID, buf, len - offset, msgID, from);
 				else
 					LogPrint (eLogError, "Garlic: Clove is too long");
 				break;
@@ -1127,5 +1109,17 @@ namespace garlic
 			m_PayloadBuffer = new uint8_t[I2NP_MAX_MESSAGE_SIZE];
 		return m_PayloadBuffer;
 	}
+
+	bool GarlicDestination::AEADChaCha20Poly1305Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
+	{
+		return m_Encryptor.Encrypt (msg, msgLen, ad, adLen, key, nonce, buf, len);
+	}
+		
+	bool GarlicDestination::AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
+	{
+		return m_Decryptor.Decrypt (msg, msgLen, ad, adLen, key, nonce, buf, len);
+	}	
 }
 }

libi2pd/Garlic.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -52,6 +52,7 @@ namespace garlic
 	const int OUTGOING_TAGS_CONFIRMATION_TIMEOUT = 10; // 10 seconds
 	const int LEASESET_CONFIRMATION_TIMEOUT = 4000; // in milliseconds
 	const int ROUTING_PATH_EXPIRATION_TIMEOUT = 120; // in seconds
+	const int INCOMING_SESSIONS_MINIMAL_INTERVAL = 200; // in milliseconds
 
 	struct SessionTag: public i2p::data::Tag<32>
 	{
@@ -86,6 +87,7 @@ namespace garlic
 	{
 		std::shared_ptr<i2p::tunnel::OutboundTunnel> outboundTunnel;
 		std::shared_ptr<const i2p::data::Lease> remoteLease;
+		// for streaming only
 		int rtt; // RTT
 		uint32_t updateTime; // seconds since epoch
 	};
@@ -109,13 +111,14 @@ namespace garlic
 			GarlicRoutingSession ();
 			virtual ~GarlicRoutingSession ();
 			virtual std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg) = 0;
-			virtual bool CleanupUnconfirmedTags () { return false; }; // for I2CP, override in ElGamalAESSession
+			virtual bool CleanupUnconfirmedTags () { return false; }; // for I2CP, override in ElGamalAESSession and ECIESX25519AEADRatchetSession
 			virtual bool MessageConfirmed (uint32_t msgID);
 			virtual bool IsRatchets () const { return false; };
 			virtual bool IsReadyToSend () const { return true; };
 			virtual bool IsTerminated () const { return !GetOwner (); };
 			virtual uint64_t GetLastActivityTimestamp () const { return 0; }; // non-zero for rathets only
-
+			virtual void SetAckRequestInterval (int interval) {}; // in milliseconds, override in ECIESX25519AEADRatchetSession
+			
 			void SetLeaseSetUpdated ()
 			{
 				if (m_LeaseSetUpdateStatus != eLeaseSetDoNotSend) m_LeaseSetUpdateStatus = eLeaseSetUpdated;
@@ -128,6 +131,12 @@ namespace garlic
 			std::shared_ptr<GarlicRoutingPath> GetSharedRoutingPath ();
 			void SetSharedRoutingPath (std::shared_ptr<GarlicRoutingPath> path);
 
+			bool IsWithJava () const { return m_IsWithJava; }
+			void SetIsWithJava (bool isWithJava) { m_IsWithJava = isWithJava; }
+
+			int NumSentPackets () const { return m_NumSentPackets; }
+			void SetNumSentPackets (int numSentPackets) { m_NumSentPackets = numSentPackets; }
+			
 			GarlicDestination * GetOwner () const { return m_Owner; }
 			void SetOwner (GarlicDestination * owner) { m_Owner = owner; }
 
@@ -150,6 +159,8 @@ namespace garlic
 			uint64_t m_LeaseSetSubmissionTime; // in milliseconds
 
 			std::shared_ptr<GarlicRoutingPath> m_SharedRoutingPath;
+			bool m_IsWithJava; // based on choked value from streaming
+			int m_NumSentPackets; // for limit number of sent messages in streaming
 
 		public:
 
@@ -204,6 +215,7 @@ namespace garlic
 			std::map<uint32_t, std::unique_ptr<UnconfirmedTags> > m_UnconfirmedTagsMsgs; // msgID->tags
 
 			i2p::crypto::CBCEncryption m_Encryption;
+			i2p::data::Tag<16> m_IV;
 
 		public:
 
@@ -234,11 +246,17 @@ namespace garlic
 			int GetNumTags () const { return m_NumTags; };
 			void SetNumRatchetInboundTags (int numTags) { m_NumRatchetInboundTags = numTags; };
 			int GetNumRatchetInboundTags () const { return m_NumRatchetInboundTags; };
-			std::shared_ptr<GarlicRoutingSession> GetRoutingSession (std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet);
+			std::shared_ptr<GarlicRoutingSession> GetRoutingSession (std::shared_ptr<const i2p::data::RoutingDestination> destination,
+				bool attachLeaseSet, bool requestNewIfNotFound = true);
 			void CleanupExpiredTags ();
 			void RemoveDeliveryStatusSession (uint32_t msgID);
 			std::shared_ptr<I2NPMessage> WrapMessageForRouter (std::shared_ptr<const i2p::data::RouterInfo> router,
 				std::shared_ptr<I2NPMessage> msg);
+			
+			bool AEADChaCha20Poly1305Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); 
+			bool AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
+				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); 
 
 			void AddSessionKey (const uint8_t * key, const uint8_t * tag); // one tag
 			void AddECIESx25519Key (const uint8_t * key, uint64_t tag); // one tag
@@ -248,30 +266,36 @@ namespace garlic
 			uint64_t AddECIESx25519SessionNextTag (ReceiveRatchetTagSetPtr tagset);
 			void AddECIESx25519Session (const uint8_t * staticKey, ECIESX25519AEADRatchetSessionPtr session);
 			void RemoveECIESx25519Session (const uint8_t * staticKey);
-			void HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len);
+			void HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len, ECIESX25519AEADRatchetSession * from);
 			uint8_t * GetPayloadBuffer ();
 
 			virtual void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg);
 			virtual void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg);
-			virtual void SetLeaseSetUpdated ();
+			virtual void SetLeaseSetUpdated (bool post = false);
 
 			virtual std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet () = 0; // TODO
 			virtual std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const = 0;
+			virtual i2p::data::CryptoKeyType GetRatchetsHighestCryptoType () const 
+			{
+				return GetIdentity ()->GetCryptoKeyType () >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? GetIdentity ()->GetCryptoKeyType () : 0;
+			}	
 
 		protected:
 
 			void AddECIESx25519Key (const uint8_t * key, const uint8_t * tag); // one tag
 			bool HandleECIESx25519TagMessage (uint8_t * buf, size_t len); // return true if found
 			virtual void HandleI2NPMessage (const uint8_t * buf, size_t len) = 0; // called from clove only
-			virtual bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID) = 0;
+			virtual bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, 
+				size_t len, uint32_t msgID, ECIESX25519AEADRatchetSession * from) = 0;
 			void HandleGarlicMessage (std::shared_ptr<I2NPMessage> msg);
 			void HandleDeliveryStatusMessage (uint32_t msgID);
 
 			void SaveTags ();
 			void LoadTags ();
-
+			
 		private:
 
+			bool SupportsRatchets () const { return GetRatchetsHighestCryptoType () > 0; }
 			void HandleAESBlock (uint8_t * buf, size_t len, std::shared_ptr<AESDecryption> decryption,
 				std::shared_ptr<i2p::tunnel::InboundTunnel> from);
 			void HandleGarlicPayload (uint8_t * buf, size_t len, std::shared_ptr<i2p::tunnel::InboundTunnel> from);
@@ -284,15 +308,18 @@ namespace garlic
 			std::unordered_map<i2p::data::IdentHash, ElGamalAESSessionPtr> m_Sessions;
 			std::unordered_map<i2p::data::Tag<32>, ECIESX25519AEADRatchetSessionPtr> m_ECIESx25519Sessions; // static key -> session
 			uint8_t * m_PayloadBuffer; // for ECIESX25519AEADRatchet
+			uint64_t m_LastIncomingSessionTimestamp; // in milliseconds
 			// incoming
 			int m_NumRatchetInboundTags;
 			std::unordered_map<SessionTag, std::shared_ptr<AESDecryption>, std::hash<i2p::data::Tag<32> > > m_Tags;
 			std::unordered_map<uint64_t, ECIESX25519AEADRatchetIndexTagset> m_ECIESx25519Tags; // session tag -> session
-			ReceiveRatchetTagSetPtr m_LastTagset; // tagset last message came for
 			// DeliveryStatus
 			std::mutex m_DeliveryStatusSessionsMutex;
 			std::unordered_map<uint32_t, GarlicRoutingSessionPtr> m_DeliveryStatusSessions; // msgID -> session
-
+			// encryption
+			i2p::crypto::AEADChaCha20Poly1305Encryptor m_Encryptor;
+			i2p::crypto::AEADChaCha20Poly1305Decryptor m_Decryptor;
+			
 		public:
 
 			// for HTTP only

libi2pd/Gost.cpp

@@ -27,7 +27,7 @@ namespace crypto
 		BN_CTX * ctx = BN_CTX_new ();
 		m_Group = EC_GROUP_new_curve_GFp (p, a, b, ctx);
 		EC_POINT * P = EC_POINT_new (m_Group);
-		EC_POINT_set_affine_coordinates_GFp (m_Group, P, x, y, ctx);
+		EC_POINT_set_affine_coordinates (m_Group, P, x, y, ctx);
 		EC_GROUP_set_generator (m_Group, P, q, nullptr);
 		EC_GROUP_set_curve_name (m_Group, NID_id_GostR3410_2001);
 		EC_POINT_free(P);
@@ -50,13 +50,13 @@ namespace crypto
 
 	bool GOSTR3410Curve::GetXY (const EC_POINT * p, BIGNUM * x, BIGNUM * y) const
 	{
-		return EC_POINT_get_affine_coordinates_GFp (m_Group, p, x, y, nullptr);
+		return EC_POINT_get_affine_coordinates (m_Group, p, x, y, nullptr);
 	}
 
 	EC_POINT * GOSTR3410Curve::CreatePoint (const BIGNUM * x, const BIGNUM * y) const
 	{
 		EC_POINT * p = EC_POINT_new (m_Group);
-		EC_POINT_set_affine_coordinates_GFp (m_Group, p, x, y, nullptr);
+		EC_POINT_set_affine_coordinates (m_Group, p, x, y, nullptr);
 		return p;
 	}
 
@@ -112,7 +112,7 @@ namespace crypto
 		BN_CTX_start (ctx);
 		EC_POINT * C = EC_POINT_new (m_Group); // C = k*P = (rx, ry)
 		EC_POINT * Q = nullptr;
-		if (EC_POINT_set_compressed_coordinates_GFp (m_Group, C, r, isNegativeY ? 1 : 0, ctx))
+		if (EC_POINT_set_compressed_coordinates (m_Group, C, r, isNegativeY ? 1 : 0, ctx))
 		{
 			EC_POINT * S = EC_POINT_new (m_Group); // S = s*P
 			EC_POINT_mul (m_Group, S, s, nullptr, nullptr, ctx);

libi2pd/HTTP.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -10,6 +10,7 @@
 #include <utility>
 #include <stdio.h>
 #include <ctime>
+#include <charconv>
 #include "util.h"
 #include "Base.h"
 #include "HTTP.h"
@@ -18,58 +19,68 @@ namespace i2p
 {
 namespace http
 {
-	const std::vector<std::string> HTTP_METHODS = {
+	// list of valid HTTP methods
+	static constexpr std::array<std::string_view, 16> HTTP_METHODS = 
+	{
 		"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "CONNECT", // HTTP basic methods
 		"COPY", "LOCK", "MKCOL", "MOVE", "PROPFIND", "PROPPATCH", "UNLOCK", "SEARCH" // WebDAV methods, for SEARCH see rfc5323
 	};
-	const std::vector<std::string> HTTP_VERSIONS = {
+
+	// list of valid HTTP versions
+	static constexpr std::array<std::string_view, 2> HTTP_VERSIONS = 
+	{
 		"HTTP/1.0", "HTTP/1.1"
 	};
-	const std::vector<const char *> weekdays = {
+	
+	static constexpr std::array<const char *, 7> weekdays = 
+	{
 		"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
 	};
-	const std::vector<const char *> months = {
+	
+	static constexpr std::array<const char *, 12> months = 
+	{
 		"Jan", "Feb", "Mar", "Apr", "May", "Jun",
 		"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
 	};
 
-	inline bool is_http_version(const std::string & str) {
+	static inline bool is_http_version(std::string_view str) 
+	{
 		return std::find(HTTP_VERSIONS.begin(), HTTP_VERSIONS.end(), str) != std::end(HTTP_VERSIONS);
 	}
 
-	inline bool is_http_method(const std::string & str) {
+	static inline bool is_http_method(std::string_view str) 
+	{
 		return std::find(HTTP_METHODS.begin(), HTTP_METHODS.end(), str) != std::end(HTTP_METHODS);
 	}
-
-	void strsplit(const std::string & line, std::vector<std::string> &tokens, char delim, std::size_t limit = 0) {
-		std::size_t count = 0;
-		std::stringstream ss(line);
-		std::string token;
-		while (1) {
+	
+	static void strsplit(std::string_view line, std::vector<std::string_view> &tokens, char delim, std::size_t limit = 0) 
+	{	
+		size_t count = 1, pos;
+		while ((pos = line.find (delim)) != line.npos)
+		{
 			count++;
-			if (limit > 0 && count >= limit)
-				delim = '\n'; /* reset delimiter */
-			if (!std::getline(ss, token, delim))
-				break;
-			tokens.push_back(token);
+			if (limit > 0 && count >= limit) delim = '\n'; // reset delimiter
+			tokens.push_back (line.substr (0, pos));
+			line = line.substr (pos + 1);	
 		}
+		if (!line.empty ()) tokens.push_back (line);
 	}
-
-	static std::pair<std::string, std::string> parse_header_line(const std::string& line)
+	
+	static std::pair<std::string, std::string> parse_header_line(std::string_view line)
 	{
 		std::size_t pos = 0;
 		std::size_t len = 1; /*: */
 		std::size_t max = line.length();
 		if ((pos = line.find(':', pos)) == std::string::npos)
-			return std::make_pair("", ""); // no ':' found
+			return std::pair{"", ""}; // no ':' found
 		if (pos + 1 < max) // ':' at the end of header is valid
 		{
 			while ((pos + len) < max && isspace(line.at(pos + len)))
 				len++;
 			if (len == 1)
-				return std::make_pair("", ""); // no following space, but something else
+				return std::pair{"", ""}; // no following space, but something else
 		}
-		return std::make_pair(line.substr(0, pos), line.substr(pos + len));
+		return std::pair{std::string (line.substr(0, pos)), std::string (line.substr(pos + len))};
 	}
 
 	void gen_rfc7231_date(std::string & out) {
@@ -83,15 +94,18 @@ namespace http
 		out = buf;
 	}
 
-	bool URL::parse(const char *str, std::size_t len) {
-		std::string url(str, len ? len : strlen(str));
-		return parse(url);
+	bool URL::parse(const char *str, std::size_t len) 
+	{
+		return parse({str, len ? len : strlen(str)});
 	}
 
-	bool URL::parse(const std::string& url) {
+	bool URL::parse(std::string_view url) 
+	{
+		if (url.empty ()) return false;
 		std::size_t pos_p = 0; /* < current parse position */
 		std::size_t pos_c = 0; /* < work position */
-		if(url.at(0) != '/' || pos_p > 0) {
+		if(url.at(0) != '/' || pos_p > 0) 
+		{
 			std::size_t pos_s = 0;
 
 			/* schema */
@@ -141,7 +155,7 @@ namespace http
 				/* port[/path] */
 				pos_p = pos_c + 1;
 				pos_c = url.find('/', pos_p);
-				std::string port_str = (pos_c == std::string::npos)
+				std::string_view port_str = (pos_c == std::string::npos)
 					? url.substr(pos_p, std::string::npos)
 					: url.substr(pos_p, pos_c - pos_p);
 				/* stoi throws exception on failure, we don't need it */
@@ -195,8 +209,9 @@ namespace http
 		return true;
 	}
 
-	bool URL::parse_query(std::map<std::string, std::string> & params) {
-		std::vector<std::string> tokens;
+	bool URL::parse_query(std::map<std::string, std::string> & params) 
+	{
+		std::vector<std::string_view> tokens;
 		strsplit(query, tokens, '&');
 
 		params.clear();
@@ -253,7 +268,7 @@ namespace http
 		return host.rfind(".i2p") == ( host.size() - 4 );
 	}
 
-	void HTTPMsg::add_header(const char *name, std::string & value, bool replace) {
+	void HTTPMsg::add_header(const char *name, const std::string & value, bool replace) {
 		add_header(name, value.c_str(), replace);
 	}
 
@@ -272,12 +287,13 @@ namespace http
 		headers.erase(name);
 	}
 
-	int HTTPReq::parse(const char *buf, size_t len) {
-		std::string str(buf, len);
-		return parse(str);
+	int HTTPReq::parse(const char *buf, size_t len) 
+	{
+		return parse({buf, len});
 	}
 
-	int HTTPReq::parse(const std::string& str) {
+	int HTTPReq::parse(std::string_view str) 
+	{
 		enum { REQ_LINE, HEADER_LINE } expect = REQ_LINE;
 		std::size_t eoh = str.find(HTTP_EOH); /* request head size */
 		std::size_t eol = 0, pos = 0;
@@ -286,11 +302,14 @@ namespace http
 		if (eoh == std::string::npos)
 			return 0; /* str not contains complete request */
 
-		while ((eol = str.find(CRLF, pos)) != std::string::npos) {
-			if (expect == REQ_LINE) {
-				std::string line = str.substr(pos, eol - pos);
-				std::vector<std::string> tokens;
+		while ((eol = str.find(CRLF, pos)) != std::string::npos) 
+		{
+			if (expect == REQ_LINE) 
+			{
+				std::string_view line = str.substr(pos, eol - pos);
+				std::vector<std::string_view> tokens;
 				strsplit(line, tokens, ' ');
+				
 				if (tokens.size() != 3)
 					return -1;
 				if (!is_http_method(tokens[0]))
@@ -307,18 +326,18 @@ namespace http
 			}
 			else
 			{
-				std::string line = str.substr(pos, eol - pos);
+				std::string_view line = str.substr(pos, eol - pos);
 				auto p = parse_header_line(line);
 				if (p.first.length () > 0)
 					headers.push_back (p);
 				else
 					return -1;
 			}
-			pos = eol + strlen(CRLF);
+			pos = eol + CRLF.length();
 			if (pos >= eoh)
 				break;
 		}
-		return eoh + strlen(HTTP_EOH);
+		return eoh + HTTP_EOH.length();
 	}
 
 	void HTTPReq::write(std::ostream & o)
@@ -362,7 +381,7 @@ namespace http
 		}
 	}
 
-	std::string HTTPReq::GetHeader (const std::string& name) const
+	std::string HTTPReq::GetHeader (std::string_view name) const
 	{
 		for (auto& it : headers)
 			if (it.first == name)
@@ -370,7 +389,7 @@ namespace http
 		return "";
 	}
 
-	size_t HTTPReq::GetNumHeaders (const std::string& name) const
+	size_t HTTPReq::GetNumHeaders (std::string_view name) const
 	{
 		size_t num = 0;
 		for (auto& it : headers)
@@ -413,12 +432,13 @@ namespace http
 		return length;
 	}
 
-	int HTTPRes::parse(const char *buf, size_t len) {
-		std::string str(buf, len);
-		return parse(str);
+	int HTTPRes::parse(const char *buf, size_t len) 
+	{
+		return parse({buf,len});
 	}
 
-	int HTTPRes::parse(const std::string& str) {
+	int HTTPRes::parse(std::string_view str) 
+	{
 		enum { RES_LINE, HEADER_LINE } expect = RES_LINE;
 		std::size_t eoh = str.find(HTTP_EOH); /* request head size */
 		std::size_t eol = 0, pos = 0;
@@ -426,35 +446,41 @@ namespace http
 		if (eoh == std::string::npos)
 			return 0; /* str not contains complete request */
 
-		while ((eol = str.find(CRLF, pos)) != std::string::npos) {
-			if (expect == RES_LINE) {
-				std::string line = str.substr(pos, eol - pos);
-				std::vector<std::string> tokens;
+		while ((eol = str.find(CRLF, pos)) != std::string::npos) 
+		{
+			if (expect == RES_LINE) 
+			{
+				std::string_view line = str.substr(pos, eol - pos);
+				std::vector<std::string_view> tokens;
 				strsplit(line, tokens, ' ', 3);
 				if (tokens.size() != 3)
 					return -1;
 				if (!is_http_version(tokens[0]))
 					return -1;
-				code = atoi(tokens[1].c_str());
+				auto res = std::from_chars(tokens[1].data (), tokens[1].data() + tokens[1].size(), code);
+				if (res.ec != std::errc())
+					return -1;
 				if (code < 100 || code >= 600)
 					return -1;
 				/* all ok */
 				version = tokens[0];
 				status  = tokens[2];
 				expect  = HEADER_LINE;
-			} else {
-				std::string line = str.substr(pos, eol - pos);
+			} 
+			else 
+			{
+				std::string_view line = str.substr(pos, eol - pos);
 				auto p = parse_header_line(line);
 				if (p.first.length () > 0)
 					headers.insert (p);
 				else
 					return -1;
 			}
-			pos = eol + strlen(CRLF);
+			pos = eol + CRLF.length();
 			if (pos >= eoh)
 				break;
 		}
-		return eoh + strlen(HTTP_EOH);
+		return eoh + HTTP_EOH.length();
 	}
 
 	std::string HTTPRes::to_string() {
@@ -479,9 +505,11 @@ namespace http
 		return ss.str();
 	}
 
-	const char * HTTPCodeToStatus(int code) {
-		const char *ptr;
-		switch (code) {
+	std::string_view HTTPCodeToStatus(int code) 
+	{
+		std::string_view ptr;
+		switch (code) 
+		{
 			case 105: ptr = "Name Not Resolved"; break;
 			/* success */
 			case 200: ptr = "OK"; break;
@@ -508,14 +536,14 @@ namespace http
 		return ptr;
 	}
 
-	std::string UrlDecode(const std::string& data, bool allow_null)
+	std::string UrlDecode(std::string_view data, bool allow_null)
 	{
 		std::string decoded(data);
 		size_t pos = 0;
 		while ((pos = decoded.find('%', pos)) != std::string::npos)
 		{
-			char c = strtol(decoded.substr(pos + 1, 2).c_str(), NULL, 16);
-			if (c == '\0' && !allow_null)
+			char c = std::stol(decoded.substr(pos + 1, 2), nullptr, 16);
+			if (!c && !allow_null)
 			{
 				pos += 3;
 				continue;

libi2pd/HTTP.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2023, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -14,16 +14,15 @@
 #include <list>
 #include <sstream>
 #include <string>
+#include <string_view>
 #include <vector>
 
 namespace i2p
 {
 namespace http
 {
-	const char CRLF[] = "\r\n";         /**< HTTP line terminator */
-	const char HTTP_EOH[] = "\r\n\r\n"; /**< HTTP end-of-headers mark */
-	extern const std::vector<std::string> HTTP_METHODS;  /**< list of valid HTTP methods */
-	extern const std::vector<std::string> HTTP_VERSIONS; /**< list of valid HTTP versions */
+	constexpr std::string_view CRLF = "\r\n";         /**< HTTP line terminator */
+	constexpr std::string_view HTTP_EOH = "\r\n\r\n"; /**< HTTP end-of-headers mark */
 
 	struct URL
 	{
@@ -45,7 +44,7 @@ namespace http
 		 * @return true on success, false on invalid url
 		 */
 		bool parse (const char *str, std::size_t len = 0);
-		bool parse (const std::string& url);
+		bool parse (std::string_view url);
 
 		/**
 		 * @brief Parse query part of url to key/value map
@@ -69,7 +68,7 @@ namespace http
 	{
 		std::map<std::string, std::string> headers;
 
-		void add_header(const char *name, std::string & value, bool replace = false);
+		void add_header(const char *name, const std::string & value, bool replace = false);
 		void add_header(const char *name, const char *value, bool replace = false);
 		void del_header(const char *name);
 
@@ -92,7 +91,7 @@ namespace http
 		 * @note Positive return value is a size of header
 		 */
 		int parse(const char *buf, size_t len);
-		int parse(const std::string& buf);
+		int parse(std::string_view buf);
 
 		/** @brief Serialize HTTP request to string */
 		std::string to_string();
@@ -102,8 +101,8 @@ namespace http
 		void UpdateHeader (const std::string& name, const std::string& value);
 		void RemoveHeader (const std::string& name, const std::string& exempt); // remove all headers starting with name, but exempt
 		void RemoveHeader (const std::string& name) { RemoveHeader (name, ""); };
-		std::string GetHeader (const std::string& name) const;
-		size_t GetNumHeaders (const std::string& name) const;
+		std::string GetHeader (std::string_view name) const;
+		size_t GetNumHeaders (std::string_view name) const;
 		size_t GetNumHeaders () const { return headers.size (); };
 	};
 
@@ -128,7 +127,7 @@ namespace http
 		 * @note Positive return value is a size of header
 		 */
 		int parse(const char *buf, size_t len);
-		int parse(const std::string& buf);
+		int parse(const std::string_view buf);
 
 		/**
 		 * @brief Serialize HTTP response to string
@@ -153,7 +152,7 @@ namespace http
 	 * @param code HTTP code [100, 599]
 	 * @return Immutable string with status
 	 */
-	const char * HTTPCodeToStatus(int code);
+	std::string_view HTTPCodeToStatus(int code);
 
 	/**
 	 * @brief Replaces %-encoded characters in string with their values
@@ -161,7 +160,7 @@ namespace http
 	 * @param null If set to true - decode also %00 sequence, otherwise - skip
 	 * @return Decoded string
 	 */
-	std::string UrlDecode(const std::string& data, bool null = false);
+	std::string UrlDecode(std::string_view data, bool null = false);
 
 	/**
 	 * @brief Merge HTTP response content with Transfer-Encoding: chunked

libi2pd/I2NPProtocol.cpp

@@ -10,20 +10,15 @@
 #include <atomic>
 #include "Base.h"
 #include "Log.h"
-#include "Crypto.h"
 #include "I2PEndian.h"
 #include "Timestamp.h"
 #include "RouterContext.h"
 #include "NetDb.hpp"
 #include "Tunnel.h"
-#include "Transports.h"
-#include "Garlic.h"
-#include "ECIESX25519AEADRatchetSession.h"
+#include "TransitTunnel.h"
 #include "I2NPProtocol.h"
 #include "version.h"
 
-using namespace i2p::transport;
-
 namespace i2p
 {
 	std::shared_ptr<I2NPMessage> NewI2NPMessage ()
@@ -376,337 +371,6 @@ namespace i2p
 		return !msg->GetPayload ()[DATABASE_STORE_TYPE_OFFSET]; // 0- RouterInfo
 	}
 
-	static bool HandleBuildRequestRecords (int num, uint8_t * records, uint8_t * clearText)
-	{
-		for (int i = 0; i < num; i++)
-		{
-			uint8_t * record = records + i*TUNNEL_BUILD_RECORD_SIZE;
-			if (!memcmp (record + BUILD_REQUEST_RECORD_TO_PEER_OFFSET, (const uint8_t *)i2p::context.GetRouterInfo ().GetIdentHash (), 16))
-			{
-				LogPrint (eLogDebug, "I2NP: Build request record ", i, " is ours");
-				if (!i2p::context.DecryptTunnelBuildRecord (record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText)) 
-				{
-					LogPrint (eLogWarning, "I2NP: Failed to decrypt tunnel build record");
-					return false;
-				}	
-				if (!memcmp ((const uint8_t *)i2p::context.GetIdentHash (), clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32) && // if next ident is now ours
-				    !(clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG)) // and not endpoint
-				{
-					LogPrint (eLogWarning, "I2NP: Next ident is ours in tunnel build record");
-					return false;
-				}	
-				uint8_t retCode = 0;
-				// replace record to reply
-				if (i2p::context.AcceptsTunnels () && i2p::context.GetCongestionLevel (false) < CONGESTION_LEVEL_FULL)
-				{
-					auto transitTunnel = i2p::tunnel::CreateTransitTunnel (
-							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET),
-							clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
-							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
-							clearText + ECIES_BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET,
-							clearText + ECIES_BUILD_REQUEST_RECORD_IV_KEY_OFFSET,
-							clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_GATEWAY_FLAG,
-							clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG);
-					if (!i2p::tunnel::tunnels.AddTransitTunnel (transitTunnel))
-						retCode = 30;
-				}
-				else
-					retCode = 30; // always reject with bandwidth reason (30)
-
-				memset (record + ECIES_BUILD_RESPONSE_RECORD_OPTIONS_OFFSET, 0, 2); // no options
-				record[ECIES_BUILD_RESPONSE_RECORD_RET_OFFSET] = retCode;
-				// encrypt reply
-				i2p::crypto::CBCEncryption encryption;
-				for (int j = 0; j < num; j++)
-				{
-					uint8_t * reply = records + j*TUNNEL_BUILD_RECORD_SIZE;
-					if (j == i)
-					{
-						uint8_t nonce[12];
-						memset (nonce, 0, 12);
-						auto& noiseState = i2p::context.GetCurrentNoiseState ();
-						if (!i2p::crypto::AEADChaCha20Poly1305 (reply, TUNNEL_BUILD_RECORD_SIZE - 16,
-							noiseState.m_H, 32, noiseState.m_CK, nonce, reply, TUNNEL_BUILD_RECORD_SIZE, true)) // encrypt
-						{
-							LogPrint (eLogWarning, "I2NP: Reply AEAD encryption failed");
-							return false;
-						}
-					}
-					else
-					{
-						encryption.SetKey (clearText + ECIES_BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET);
-						encryption.SetIV (clearText + ECIES_BUILD_REQUEST_RECORD_REPLY_IV_OFFSET);
-						encryption.Encrypt(reply, TUNNEL_BUILD_RECORD_SIZE, reply);
-					}
-				}
-				return true;
-			}
-		}
-		return false;
-	}
-
-	static void HandleVariableTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
-	{
-		int num = buf[0];
-		LogPrint (eLogDebug, "I2NP: VariableTunnelBuild ", num, " records");
-		if (num > i2p::tunnel::MAX_NUM_RECORDS)
-		{
-			LogPrint (eLogError, "I2NP: Too many records in VaribleTunnelBuild message ", num);
-			return;
-		}
-		if (len < num*TUNNEL_BUILD_RECORD_SIZE + 1)
-		{
-			LogPrint (eLogError, "I2NP: VaribleTunnelBuild message of ", num, " records is too short ", len);
-			return;
-		}
-
-		auto tunnel = i2p::tunnel::tunnels.GetPendingInboundTunnel (replyMsgID);
-		if (tunnel)
-		{
-			// endpoint of inbound tunnel
-			LogPrint (eLogDebug, "I2NP: VariableTunnelBuild reply for tunnel ", tunnel->GetTunnelID ());
-			if (tunnel->HandleTunnelBuildResponse (buf, len))
-			{
-				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been created");
-				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
-				i2p::tunnel::tunnels.AddInboundTunnel (tunnel);
-			}
-			else
-			{
-				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been declined");
-				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
-			}
-		}
-		else
-		{
-			uint8_t clearText[ECIES_BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE];
-			if (HandleBuildRequestRecords (num, buf + 1, clearText))
-			{
-				if (clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG) // we are endpoint of outboud tunnel
-				{
-					// so we send it to reply tunnel
-					transports.SendMessage (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
-						CreateTunnelGatewayMsg (bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
-							eI2NPVariableTunnelBuildReply, buf, len,
-							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
-				}
-				else
-					transports.SendMessage (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
-						CreateI2NPMessage (eI2NPVariableTunnelBuild, buf, len,
-							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
-			}
-		}
-	}
-
-	static void HandleTunnelBuildMsg (uint8_t * buf, size_t len)
-	{
-		LogPrint (eLogWarning, "I2NP: TunnelBuild is too old for ECIES router");
-	}
-
-	static void HandleTunnelBuildReplyMsg (uint32_t replyMsgID, uint8_t * buf, size_t len, bool isShort)
-	{
-		int num = buf[0];
-		LogPrint (eLogDebug, "I2NP: TunnelBuildReplyMsg of ", num, " records replyMsgID=", replyMsgID);
-		if (num > i2p::tunnel::MAX_NUM_RECORDS)
-		{
-			LogPrint (eLogError, "I2NP: Too many records in TunnelBuildReply message ", num);
-			return;
-		}
-		size_t recordSize = isShort ? SHORT_TUNNEL_BUILD_RECORD_SIZE : TUNNEL_BUILD_RECORD_SIZE;
-		if (len < num*recordSize + 1)
-		{
-			LogPrint (eLogError, "I2NP: TunnelBuildReply message of ", num, " records is too short ", len);
-			return;
-		}
-
-		auto tunnel = i2p::tunnel::tunnels.GetPendingOutboundTunnel (replyMsgID);
-		if (tunnel)
-		{
-			// reply for outbound tunnel
-			if (tunnel->HandleTunnelBuildResponse (buf, len))
-			{
-				LogPrint (eLogInfo, "I2NP: Outbound tunnel ", tunnel->GetTunnelID (), " has been created");
-				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
-				i2p::tunnel::tunnels.AddOutboundTunnel (tunnel);
-			}
-			else
-			{
-				LogPrint (eLogInfo, "I2NP: Outbound tunnel ", tunnel->GetTunnelID (), " has been declined");
-				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
-			}
-		}
-		else
-			LogPrint (eLogWarning, "I2NP: Pending tunnel for message ", replyMsgID, " not found");
-	}
-
-	static void HandleShortTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
-	{
-		int num = buf[0];
-		LogPrint (eLogDebug, "I2NP: ShortTunnelBuild ", num, " records");
-		if (num > i2p::tunnel::MAX_NUM_RECORDS)
-		{
-			LogPrint (eLogError, "I2NP: Too many records in ShortTunnelBuild message ", num);
-			return;
-		}
-		if (len < num*SHORT_TUNNEL_BUILD_RECORD_SIZE + 1)
-		{
-			LogPrint (eLogError, "I2NP: ShortTunnelBuild message of ", num, " records is too short ", len);
-			return;
-		}
-		auto tunnel = i2p::tunnel::tunnels.GetPendingInboundTunnel (replyMsgID);
-		if (tunnel)
-		{
-			// endpoint of inbound tunnel
-			LogPrint (eLogDebug, "I2NP: ShortTunnelBuild reply for tunnel ", tunnel->GetTunnelID ());
-			if (tunnel->HandleTunnelBuildResponse (buf, len))
-			{
-				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been created");
-				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
-				i2p::tunnel::tunnels.AddInboundTunnel (tunnel);
-			}
-			else
-			{
-				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been declined");
-				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
-			}
-			return;
-		}
-		const uint8_t * record = buf + 1;
-		for (int i = 0; i < num; i++)
-		{
-			if (!memcmp (record, (const uint8_t *)i2p::context.GetRouterInfo ().GetIdentHash (), 16))
-			{
-				LogPrint (eLogDebug, "I2NP: Short request record ", i, " is ours");
-				uint8_t clearText[SHORT_REQUEST_RECORD_CLEAR_TEXT_SIZE];
-				if (!i2p::context.DecryptTunnelShortRequestRecord (record + SHORT_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText))
-				{
-					LogPrint (eLogWarning, "I2NP: Can't decrypt short request record ", i);
-					return;
-				}
-				if (clearText[SHORT_REQUEST_RECORD_LAYER_ENCRYPTION_TYPE]) // not AES
-				{
-					LogPrint (eLogWarning, "I2NP: Unknown layer encryption type ", clearText[SHORT_REQUEST_RECORD_LAYER_ENCRYPTION_TYPE], " in short request record");
-					return;
-				}
-				auto& noiseState = i2p::context.GetCurrentNoiseState ();
-				uint8_t replyKey[32]; // AEAD/Chacha20/Poly1305
-				i2p::crypto::AESKey layerKey, ivKey; // AES
-				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelReplyKey", noiseState.m_CK);
-				memcpy (replyKey, noiseState.m_CK + 32, 32);
-				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelLayerKey", noiseState.m_CK);
-				memcpy (layerKey, noiseState.m_CK + 32, 32);
-				bool isEndpoint = clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG;
-				if (isEndpoint)
-				{
-					i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "TunnelLayerIVKey", noiseState.m_CK);
-					memcpy (ivKey, noiseState.m_CK + 32, 32);
-				}
-				else
-				{	
-					if (!memcmp ((const uint8_t *)i2p::context.GetIdentHash (), clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32)) // if next ident is now ours
-					{
-						LogPrint (eLogWarning, "I2NP: Next ident is ours in short request record");
-						return;
-					}	
-					memcpy (ivKey, noiseState.m_CK , 32);
-				}	
-
-				// check if we accept this tunnel
-				std::shared_ptr<i2p::tunnel::TransitTunnel> transitTunnel;
-				uint8_t retCode = 0;
-				if (!i2p::context.AcceptsTunnels () || i2p::context.GetCongestionLevel (false) >= CONGESTION_LEVEL_FULL)
-					retCode = 30;
-				if (!retCode)
-				{
-					// create new transit tunnel
-					transitTunnel = i2p::tunnel::CreateTransitTunnel (
-						bufbe32toh (clearText + SHORT_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET),
-						clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET,
-						bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
-						layerKey, ivKey,
-						clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_GATEWAY_FLAG,
-						clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG);
-					if (!i2p::tunnel::tunnels.AddTransitTunnel (transitTunnel))
-						retCode = 30;
-				}
-
-				// encrypt reply
-				uint8_t nonce[12];
-				memset (nonce, 0, 12);
-				uint8_t * reply = buf + 1;
-				for (int j = 0; j < num; j++)
-				{
-					nonce[4] = j; // nonce is record #
-					if (j == i)
-					{
-						memset (reply + SHORT_RESPONSE_RECORD_OPTIONS_OFFSET, 0, 2); // no options
-						reply[SHORT_RESPONSE_RECORD_RET_OFFSET] = retCode;
-						if (!i2p::crypto::AEADChaCha20Poly1305 (reply, SHORT_TUNNEL_BUILD_RECORD_SIZE - 16,
-							noiseState.m_H, 32, replyKey, nonce, reply, SHORT_TUNNEL_BUILD_RECORD_SIZE, true)) // encrypt
-						{
-							LogPrint (eLogWarning, "I2NP: Short reply AEAD encryption failed");
-							return;
-						}
-					}
-					else
-						i2p::crypto::ChaCha20 (reply, SHORT_TUNNEL_BUILD_RECORD_SIZE, replyKey, nonce, reply);
-					reply += SHORT_TUNNEL_BUILD_RECORD_SIZE;
-				}
-				// send reply
-				auto onDrop = [transitTunnel]()
-					{
-						if (transitTunnel)
-						{
-							auto t = transitTunnel->GetCreationTime ();
-							if (t > i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT)
-								// make transit tunnel expired 
-								transitTunnel->SetCreationTime (t - i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT);
-						}	
-					};
-				if (isEndpoint)
-				{
-					auto replyMsg = NewI2NPShortMessage ();
-					replyMsg->Concat (buf, len);
-					replyMsg->FillI2NPMessageHeader (eI2NPShortTunnelBuildReply, bufbe32toh (clearText + SHORT_REQUEST_RECORD_SEND_MSG_ID_OFFSET));
-					if (transitTunnel) replyMsg->onDrop = onDrop;
-					if (memcmp ((const uint8_t *)i2p::context.GetIdentHash (),
-						clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32)) // reply IBGW is not local?
-					{
-						i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "RGarlicKeyAndTag", noiseState.m_CK);
-						uint64_t tag;
-						memcpy (&tag, noiseState.m_CK, 8);
-						// we send it to reply tunnel
-						transports.SendMessage (clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET,
-						CreateTunnelGatewayMsg (bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
-							i2p::garlic::WrapECIESX25519Message (replyMsg, noiseState.m_CK + 32, tag)));
-					}
-					else
-					{
-						// IBGW is local
-						uint32_t tunnelID = bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET);
-						auto tunnel = i2p::tunnel::tunnels.GetTunnel (tunnelID);
-						if (tunnel)
-						{	
-							tunnel->SendTunnelDataMsg (replyMsg);
-							tunnel->FlushTunnelDataMsgs ();
-						}	
-						else
-							LogPrint (eLogWarning, "I2NP: Tunnel ", tunnelID, " not found for short tunnel build reply");
-					}
-				}
-				else
-				{
-					auto msg = CreateI2NPMessage (eI2NPShortTunnelBuild, buf, len,
-							bufbe32toh (clearText + SHORT_REQUEST_RECORD_SEND_MSG_ID_OFFSET));
-					if (transitTunnel) msg->onDrop = onDrop;
-					transports.SendMessage (clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, msg);
-				}	
-				return;
-			}
-			record += SHORT_TUNNEL_BUILD_RECORD_SIZE;
-		}
-	}
-
 	std::shared_ptr<I2NPMessage> CreateTunnelDataMsg (const uint8_t * buf)
 	{
 		auto msg = NewI2NPTunnelMessage (false);
@@ -802,41 +466,6 @@ namespace i2p
 		return l;
 	}
 
-	void HandleTunnelBuildI2NPMessage (std::shared_ptr<I2NPMessage> msg)
-	{
-		if (msg)
-		{
-			uint8_t typeID = msg->GetTypeID();
-			uint32_t msgID = msg->GetMsgID();
-			LogPrint (eLogDebug, "I2NP: Handling tunnel build message with len=", msg->GetLength(),", type=", (int)typeID, ", msgID=", (unsigned int)msgID);
-			uint8_t * payload = msg->GetPayload();
-			auto size = msg->GetPayloadLength();
-			switch (typeID)
-			{
-				case eI2NPVariableTunnelBuild:
-					HandleVariableTunnelBuildMsg (msgID, payload, size);
-					break;
-				case eI2NPShortTunnelBuild:
-					HandleShortTunnelBuildMsg (msgID, payload, size);
-					break;
-				case eI2NPVariableTunnelBuildReply:
-					HandleTunnelBuildReplyMsg (msgID, payload, size, false);
-					break;
-				case eI2NPShortTunnelBuildReply:
-					HandleTunnelBuildReplyMsg (msgID, payload, size, true);
-					break;
-				case eI2NPTunnelBuild:
-					HandleTunnelBuildMsg (payload, size);
-					break;
-				case eI2NPTunnelBuildReply:
-					// TODO:
-					break;
-				default:
-					LogPrint (eLogError, "I2NP: Unexpected message with type", (int)typeID, " during handling TBM; skipping");
-			}
-		}
-	}
-
 	void HandleI2NPMessage (std::shared_ptr<I2NPMessage> msg)
 	{
 		if (msg)
@@ -932,14 +561,8 @@ namespace i2p
 	void I2NPMessagesHandler::Flush ()
 	{
 		if (!m_TunnelMsgs.empty ())
-		{
 			i2p::tunnel::tunnels.PostTunnelData (m_TunnelMsgs);
-			m_TunnelMsgs.clear ();
-		}
 		if (!m_TunnelGatewayMsgs.empty ())
-		{
 			i2p::tunnel::tunnels.PostTunnelData (m_TunnelGatewayMsgs);
-			m_TunnelGatewayMsgs.clear ();
-		}
 	}
 }

libi2pd/I2NPProtocol.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -13,6 +13,7 @@
 #include <string.h>
 #include <unordered_set>
 #include <memory>
+#include <list>
 #include <functional>
 #include "Crypto.h"
 #include "I2PEndian.h"
@@ -107,7 +108,6 @@ namespace i2p
 
 	enum I2NPMessageType
 	{
-		eI2NPDummyMsg = 0,
 		eI2NPDatabaseStore = 1,
 		eI2NPDatabaseLookup = 2,
 		eI2NPDatabaseSearchReply = 3,
@@ -155,6 +155,7 @@ namespace tunnel
 	const unsigned int I2NP_MESSAGE_LOCAL_EXPIRATION_TIMEOUT_FACTOR = 3; // multiples of RTT
 	const unsigned int I2NP_MESSAGE_LOCAL_EXPIRATION_TIMEOUT_MIN = 200000; // in microseconds
 	const unsigned int I2NP_MESSAGE_LOCAL_EXPIRATION_TIMEOUT_MAX = 2000000; // in microseconds
+	const unsigned int I2NP_MESSAGE_LOCAL_EXPIRATION_TIMEOUT_TRANSIT = 4000000; // in microseconds
 	const unsigned int I2NP_MESSAGE_EXPIRATION_TIMEOUT = 8000; // in milliseconds (as initial RTT)
 	const unsigned int I2NP_MESSAGE_CLOCK_SKEW = 60*1000; // 1 minute in milliseconds
 
@@ -316,7 +317,6 @@ namespace tunnel
 	std::shared_ptr<I2NPMessage> CreateTunnelGatewayMsg (uint32_t tunnelID, std::shared_ptr<I2NPMessage> msg);
 
 	size_t GetI2NPMessageLength (const uint8_t * msg, size_t len);
-	void HandleTunnelBuildI2NPMessage (std::shared_ptr<I2NPMessage> msg);
 	void HandleI2NPMessage (std::shared_ptr<I2NPMessage> msg);
 
 	class I2NPMessagesHandler
@@ -329,7 +329,7 @@ namespace tunnel
 
 		private:
 
-			std::vector<std::shared_ptr<I2NPMessage> > m_TunnelMsgs, m_TunnelGatewayMsgs;
+			std::list<std::shared_ptr<I2NPMessage> > m_TunnelMsgs, m_TunnelGatewayMsgs;
 	};
 }
 

libi2pd/Identity.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -10,6 +10,7 @@
 #include "I2PEndian.h"
 #include "Log.h"
 #include "Timestamp.h"
+#include "CryptoKey.h"
 #include "Identity.h"
 
 namespace i2p
@@ -27,18 +28,15 @@ namespace data
 
 	size_t Identity::FromBuffer (const uint8_t * buf, size_t len)
 	{
-		if ( len < DEFAULT_IDENTITY_SIZE ) {
-			// buffer too small, don't overflow
-			return 0;
-		}
-		memcpy (publicKey, buf, DEFAULT_IDENTITY_SIZE);
+		if (len < DEFAULT_IDENTITY_SIZE) return 0; // buffer too small, don't overflow
+		memcpy (this, buf, DEFAULT_IDENTITY_SIZE);
 		return DEFAULT_IDENTITY_SIZE;
 	}
 
 	IdentHash Identity::Hash () const
 	{
 		IdentHash hash;
-		SHA256(publicKey, DEFAULT_IDENTITY_SIZE, hash);
+		SHA256((const uint8_t *)this, DEFAULT_IDENTITY_SIZE, hash);
 		return hash;
 	}
 
@@ -122,6 +120,17 @@ namespace data
 					memcpy (m_StandardIdentity.signingKey, signingKey, i2p::crypto::GOSTR3410_512_PUBLIC_KEY_LENGTH);
 					break;
 				}
+#if OPENSSL_PQ
+				case SIGNING_KEY_TYPE_MLDSA44:
+				{
+					memcpy (m_StandardIdentity, signingKey, 384);
+					excessLen = i2p::crypto::MLDSA44_PUBLIC_KEY_LENGTH - 384;
+					excessBuf = new uint8_t[excessLen];
+					memcpy (excessBuf, signingKey + 384, excessLen);
+					cryptoType = 0xFF; // crypto key is not used
+					break;
+				}	
+#endif					
 				default:
 					LogPrint (eLogError, "Identity: Signing key type ", (int)type, " is not supported");
 			}
@@ -134,12 +143,15 @@ namespace data
 			htobe16buf (m_ExtendedBuffer + 2, cryptoType);
 			if (excessLen && excessBuf)
 			{
-				if (excessLen > MAX_EXTENDED_BUFFER_SIZE - 4)
+				if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE)
 				{
-					LogPrint (eLogError, "Identity: Unexpected excessive signing key len ", excessLen);
-					excessLen = MAX_EXTENDED_BUFFER_SIZE - 4;
+					auto newBuf = new uint8_t[m_ExtendedLen];
+					memcpy (newBuf, m_ExtendedBuffer, 4);
+					memcpy (newBuf + 4, excessBuf, excessLen);
+					m_ExtendedBufferPtr = newBuf;
 				}
-				memcpy (m_ExtendedBuffer + 4, excessBuf, excessLen);
+				else
+					memcpy (m_ExtendedBuffer + 4, excessBuf, excessLen);
 				delete[] excessBuf;
 			}
 			// calculate ident hash
@@ -187,6 +199,8 @@ namespace data
 
 	IdentityEx::~IdentityEx ()
 	{
+		if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE)
+			delete[] m_ExtendedBufferPtr;
 	}
 
 	IdentityEx& IdentityEx::operator=(const IdentityEx& other)
@@ -194,11 +208,29 @@ namespace data
 		memcpy (&m_StandardIdentity, &other.m_StandardIdentity, DEFAULT_IDENTITY_SIZE);
 		m_IdentHash = other.m_IdentHash;
 
+		size_t oldLen = m_ExtendedLen;
 		m_ExtendedLen = other.m_ExtendedLen;
 		if (m_ExtendedLen > 0)
 		{
-			if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE) m_ExtendedLen = MAX_EXTENDED_BUFFER_SIZE;
-			memcpy (m_ExtendedBuffer, other.m_ExtendedBuffer, m_ExtendedLen);
+			if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE) 
+			{
+				if (oldLen > MAX_EXTENDED_BUFFER_SIZE) 
+				{
+					if (m_ExtendedLen > oldLen)
+					{	
+						delete[] m_ExtendedBufferPtr;
+						m_ExtendedBufferPtr = new uint8_t[m_ExtendedLen];
+					}	
+				}
+				else
+					m_ExtendedBufferPtr = new uint8_t[m_ExtendedLen];
+				memcpy (m_ExtendedBufferPtr, other.m_ExtendedBufferPtr, m_ExtendedLen);	
+			}	
+			else
+			{
+				if (oldLen > MAX_EXTENDED_BUFFER_SIZE) delete[] m_ExtendedBufferPtr;
+				memcpy (m_ExtendedBuffer, other.m_ExtendedBuffer, m_ExtendedLen);
+			}	
 		}
 		m_Verifier = nullptr;
 		CreateVerifier ();
@@ -227,13 +259,28 @@ namespace data
 		}
 		memcpy (&m_StandardIdentity, buf, DEFAULT_IDENTITY_SIZE);
 
+		size_t oldLen = m_ExtendedLen;
 		m_ExtendedLen = bufbe16toh (m_StandardIdentity.certificate + 1);
 		if (m_ExtendedLen)
 		{
 			if (m_ExtendedLen + DEFAULT_IDENTITY_SIZE <= len)
 			{
-				if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE) m_ExtendedLen = MAX_EXTENDED_BUFFER_SIZE;
-				memcpy (m_ExtendedBuffer, buf + DEFAULT_IDENTITY_SIZE, m_ExtendedLen);
+				if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE)
+				{
+					if (oldLen > MAX_EXTENDED_BUFFER_SIZE) 
+					{
+						if (m_ExtendedLen > oldLen)
+						{	
+							delete[] m_ExtendedBufferPtr;
+							m_ExtendedBufferPtr = new uint8_t[m_ExtendedLen];
+						}	
+					}
+					else
+						m_ExtendedBufferPtr = new uint8_t[m_ExtendedLen];
+					memcpy (m_ExtendedBufferPtr, buf + DEFAULT_IDENTITY_SIZE, m_ExtendedLen);
+				}	
+				else	
+					memcpy (m_ExtendedBuffer, buf + DEFAULT_IDENTITY_SIZE, m_ExtendedLen);
 			}
 			else
 			{
@@ -258,27 +305,28 @@ namespace data
 		if (fullLen > len) return 0; // buffer is too small and may overflow somewhere else
 		memcpy (buf, &m_StandardIdentity, DEFAULT_IDENTITY_SIZE);
 		if (m_ExtendedLen > 0)
-			memcpy (buf + DEFAULT_IDENTITY_SIZE, m_ExtendedBuffer, m_ExtendedLen);
+		{	
+			if (m_ExtendedLen > MAX_EXTENDED_BUFFER_SIZE)
+				memcpy (buf + DEFAULT_IDENTITY_SIZE, m_ExtendedBufferPtr, m_ExtendedLen);
+			else	
+				memcpy (buf + DEFAULT_IDENTITY_SIZE, m_ExtendedBuffer, m_ExtendedLen);
+		}	
 		return fullLen;
 	}
 
-	size_t IdentityEx::FromBase64(const std::string& s)
+	size_t IdentityEx::FromBase64(std::string_view s)
 	{
-		const size_t slen = s.length();
-		std::vector<uint8_t> buf(slen); // binary data can't exceed base64
-		const size_t len = Base64ToByteStream (s.c_str(), slen, buf.data(), slen);
+		std::vector<uint8_t> buf(s.length ()); // binary data can't exceed base64
+		auto len = Base64ToByteStream (s, buf.data(), buf.size ());
 		return FromBuffer (buf.data(), len);
 	}
 
 	std::string IdentityEx::ToBase64 () const
 	{
 		const size_t bufLen = GetFullLen();
-		const size_t strLen = Base64EncodingBufferSize(bufLen);
 		std::vector<uint8_t> buf(bufLen);
-		std::vector<char> str(strLen);
 		size_t l = ToBuffer (buf.data(), bufLen);
-		size_t l1 = i2p::data::ByteStreamToBase64 (buf.data(), l, str.data(), strLen);
-		return std::string (str.data(), l1);
+		return i2p::data::ByteStreamToBase64 (buf.data(), l);
 	}
 
 	size_t IdentityEx::GetSigningPublicKeyLen () const
@@ -291,7 +339,7 @@ namespace data
 	const uint8_t * IdentityEx::GetSigningPublicKeyBuffer () const
 	{
 		auto keyLen = GetSigningPublicKeyLen ();
-		if (keyLen > 128) return nullptr; // P521
+		if (keyLen > 128) return nullptr; // P521 or PQ
 		return m_StandardIdentity.signingKey + 128 - keyLen;
 	}
 
@@ -318,7 +366,7 @@ namespace data
 	SigningKeyType IdentityEx::GetSigningKeyType () const
 	{
 		if (m_StandardIdentity.certificate[0] == CERTIFICATE_TYPE_KEY && m_ExtendedLen >= 2)
-			return bufbe16toh (m_ExtendedBuffer); // signing key
+			return bufbe16toh (m_ExtendedLen <= MAX_EXTENDED_BUFFER_SIZE ? m_ExtendedBuffer : m_ExtendedBufferPtr); // signing key
 		return SIGNING_KEY_TYPE_DSA_SHA1;
 	}
 
@@ -331,7 +379,7 @@ namespace data
 	CryptoKeyType IdentityEx::GetCryptoKeyType () const
 	{
 		if (m_StandardIdentity.certificate[0] == CERTIFICATE_TYPE_KEY && m_ExtendedLen >= 4)
-			return bufbe16toh (m_ExtendedBuffer + 2); // crypto key
+			return bufbe16toh (m_ExtendedLen <= MAX_EXTENDED_BUFFER_SIZE ? m_ExtendedBuffer + 2 : m_ExtendedBufferPtr + 2); // crypto key
 		return CRYPTO_KEY_TYPE_ELGAMAL;
 	}
 
@@ -355,6 +403,10 @@ namespace data
 				return new i2p::crypto::GOSTR3410_512_Verifier (i2p::crypto::eGOSTR3410TC26A512);
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				return new i2p::crypto::RedDSA25519Verifier ();
+#if OPENSSL_PQ
+			case SIGNING_KEY_TYPE_MLDSA44:
+				return new i2p::crypto::MLDSA44Verifier ();
+#endif				
 			case SIGNING_KEY_TYPE_RSA_SHA256_2048:
 			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
 			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
@@ -376,6 +428,18 @@ namespace data
 				auto keyLen = verifier->GetPublicKeyLen ();
 				if (keyLen <= 128)
 					verifier->SetPublicKey (m_StandardIdentity.signingKey + 128 - keyLen);
+#if OPENSSL_PQ
+				else if (keyLen > 384)
+				{
+					// for post-quantum
+					uint8_t * signingKey = new uint8_t[keyLen];
+					memcpy (signingKey, m_StandardIdentity, 384);
+					size_t excessLen = keyLen - 384;
+					memcpy (signingKey + 384, m_ExtendedBufferPtr + 4, excessLen); // right after signing and crypto key types
+					verifier->SetPublicKey (signingKey);
+					delete[] signingKey;
+				}	
+#endif				
 				else
 				{
 					// for P521
@@ -399,15 +463,14 @@ namespace data
 				return std::make_shared<i2p::crypto::ElGamalEncryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				return std::make_shared<i2p::crypto::ECIESX25519AEADRatchetEncryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
-			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				return std::make_shared<i2p::crypto::ECIESP256Encryptor>(key);
 			break;
-			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
-				return std::make_shared<i2p::crypto::ECIESGOSTR3410Encryptor>(key);
-			break;
 			default:
 				LogPrint (eLogError, "Identity: Unknown crypto key type ", (int)keyType);
 		};
@@ -432,7 +495,9 @@ namespace data
 	{
 		m_Public = std::make_shared<IdentityEx>(Identity (keys));
 		memcpy (m_PrivateKey, keys.privateKey, 256); // 256
-		memcpy (m_SigningPrivateKey, keys.signingPrivateKey, m_Public->GetSigningPrivateKeyLen ());
+		size_t keyLen = m_Public->GetSigningPrivateKeyLen ();
+		m_SigningPrivateKey.resize (keyLen);
+		memcpy (m_SigningPrivateKey.data (), keys.signingPrivateKey, keyLen);
 		m_OfflineSignature.resize (0);
 		m_TransientSignatureLen = 0;
 		m_TransientSigningPrivateKeyLen = 0;
@@ -448,7 +513,7 @@ namespace data
 		m_OfflineSignature = other.m_OfflineSignature;
 		m_TransientSignatureLen = other.m_TransientSignatureLen;
 		m_TransientSigningPrivateKeyLen = other.m_TransientSigningPrivateKeyLen;
-		memcpy (m_SigningPrivateKey, other.m_SigningPrivateKey, m_TransientSigningPrivateKeyLen > 0 ? m_TransientSigningPrivateKeyLen : m_Public->GetSigningPrivateKeyLen ());
+		m_SigningPrivateKey = other.m_SigningPrivateKey;
 		m_Signer = nullptr;
 		CreateSigner ();
 		return *this;
@@ -471,8 +536,9 @@ namespace data
 		memcpy (m_PrivateKey, buf + ret, cryptoKeyLen);
 		ret += cryptoKeyLen;
 		size_t signingPrivateKeySize = m_Public->GetSigningPrivateKeyLen ();
-		if(signingPrivateKeySize + ret > len || signingPrivateKeySize > 128) return 0; // overflow
-		memcpy (m_SigningPrivateKey, buf + ret, signingPrivateKeySize);
+		if (signingPrivateKeySize + ret > len) return 0; // overflow
+		m_SigningPrivateKey.resize (signingPrivateKeySize);
+		memcpy (m_SigningPrivateKey.data (), buf + ret, signingPrivateKeySize);
 		ret += signingPrivateKeySize;
 		m_Signer = nullptr;
 		// check if signing private key is all zeros
@@ -513,8 +579,9 @@ namespace data
 			memcpy (m_OfflineSignature.data (), offlineInfo, offlineInfoLen);
 			// override signing private key
 			m_TransientSigningPrivateKeyLen = transientVerifier->GetPrivateKeyLen ();
-			if (m_TransientSigningPrivateKeyLen + ret > len || m_TransientSigningPrivateKeyLen > 128) return 0;
-			memcpy (m_SigningPrivateKey, buf + ret, m_TransientSigningPrivateKeyLen);
+			if (m_TransientSigningPrivateKeyLen + ret > len) return 0;
+			if (m_TransientSigningPrivateKeyLen > 128) m_SigningPrivateKey.resize (m_TransientSigningPrivateKeyLen);
+			memcpy (m_SigningPrivateKey.data (), buf + ret, m_TransientSigningPrivateKeyLen);
 			ret += m_TransientSigningPrivateKeyLen;
 			CreateSigner (keyType);
 		}
@@ -534,7 +601,7 @@ namespace data
 		if (IsOfflineSignature ())
 			memset (buf + ret, 0, signingPrivateKeySize);
 		else
-			memcpy (buf + ret, m_SigningPrivateKey, signingPrivateKeySize);
+			memcpy (buf + ret, m_SigningPrivateKey.data (), signingPrivateKeySize);
 		ret += signingPrivateKeySize;
 		if (IsOfflineSignature ())
 		{
@@ -545,32 +612,24 @@ namespace data
 			ret += offlineSignatureLen;
 			// transient private key
 			if (ret + m_TransientSigningPrivateKeyLen > len) return 0;
-			memcpy (buf + ret, m_SigningPrivateKey, m_TransientSigningPrivateKeyLen);
+			memcpy (buf + ret, m_SigningPrivateKey.data (), m_TransientSigningPrivateKeyLen);
 			ret += m_TransientSigningPrivateKeyLen;
 		}
 		return ret;
 	}
 
-	size_t PrivateKeys::FromBase64(const std::string& s)
+	size_t PrivateKeys::FromBase64(std::string_view s)
 	{
-		uint8_t * buf = new uint8_t[s.length ()];
-		size_t l = i2p::data::Base64ToByteStream (s.c_str (), s.length (), buf, s.length ());
-		size_t ret = FromBuffer (buf, l);
-		delete[] buf;
-		return ret;
+		std::vector<uint8_t> buf(s.length ());
+		size_t l = i2p::data::Base64ToByteStream (s, buf.data (), buf.size ());
+		return FromBuffer (buf.data (), l);
 	}
 
 	std::string PrivateKeys::ToBase64 () const
 	{
-		uint8_t * buf = new uint8_t[GetFullLen ()];
-		char * str = new char[GetFullLen ()*2];
-		size_t l = ToBuffer (buf, GetFullLen ());
-		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, GetFullLen ()*2);
-		str[l1] = 0;
-		delete[] buf;
-		std::string ret(str);
-		delete[] str;
-		return ret;
+		std::vector<uint8_t> buf(GetFullLen ());
+		size_t l = ToBuffer (buf.data (), buf.size ());
+		return i2p::data::ByteStreamToBase64 (buf.data (), l);
 	}
 
 	void PrivateKeys::Sign (const uint8_t * buf, int len, uint8_t * signature) const
@@ -592,13 +651,13 @@ namespace data
 	{
 		if (m_Signer) return;
 		if (keyType == SIGNING_KEY_TYPE_DSA_SHA1)
-			m_Signer.reset (new i2p::crypto::DSASigner (m_SigningPrivateKey, m_Public->GetStandardIdentity ().signingKey));
+			m_Signer.reset (new i2p::crypto::DSASigner (m_SigningPrivateKey.data (), m_Public->GetStandardIdentity ().signingKey));
 		else if (keyType == SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519 && !IsOfflineSignature ())
-			m_Signer.reset (new i2p::crypto::EDDSA25519Signer (m_SigningPrivateKey, m_Public->GetStandardIdentity ().signingKey + (sizeof(Identity::signingKey) - i2p::crypto::EDDSA25519_PUBLIC_KEY_LENGTH))); // TODO: remove public key check
+			m_Signer.reset (new i2p::crypto::EDDSA25519Signer (m_SigningPrivateKey.data (), m_Public->GetStandardIdentity ().signingKey + (sizeof(Identity::signingKey) - i2p::crypto::EDDSA25519_PUBLIC_KEY_LENGTH))); // TODO: remove public key check
 		else
 		{
 			// public key is not required
-			auto signer = CreateSigner (keyType, m_SigningPrivateKey);
+			auto signer = CreateSigner (keyType, m_SigningPrivateKey.data ());
 			if (signer) m_Signer.reset (signer);
 		}
 	}
@@ -633,6 +692,11 @@ namespace data
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				return new i2p::crypto::RedDSA25519Signer (priv);
 			break;
+#if OPENSSL_PQ
+			case SIGNING_KEY_TYPE_MLDSA44:
+				return new i2p::crypto::MLDSA44Signer (priv);
+			break;	
+#endif				
 			default:
 				LogPrint (eLogError, "Identity: Signing key type ", (int)keyType, " is not supported");
 		}
@@ -646,8 +710,7 @@ namespace data
 
 	size_t PrivateKeys::GetPrivateKeyLen () const
 	{
-		// private key length always 256, but type 4
-		return (m_Public->GetCryptoKeyType () == CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) ? 32 : 256;
+		return i2p::crypto::GetCryptoPrivateKeyLen (m_Public->GetCryptoKeyType ());
 	}
 
 	uint8_t * PrivateKeys::GetPadding()
@@ -673,15 +736,14 @@ namespace data
 				return std::make_shared<i2p::crypto::ElGamalDecryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				return std::make_shared<i2p::crypto::ECIESX25519AEADRatchetDecryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
-			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				return std::make_shared<i2p::crypto::ECIESP256Decryptor>(key);
 			break;
-			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
-				return std::make_shared<i2p::crypto::ECIESGOSTR3410Decryptor>(key);
-			break;
 			default:
 				LogPrint (eLogError, "Identity: Unknown crypto key type ", (int)cryptoType);
 		};
@@ -694,8 +756,10 @@ namespace data
 		{
 			PrivateKeys keys;
 			// signature
-			uint8_t signingPublicKey[512]; // signing public key is 512 bytes max
-			GenerateSigningKeyPair (type, keys.m_SigningPrivateKey, signingPublicKey);
+			std::unique_ptr<i2p::crypto::Verifier> verifier (IdentityEx::CreateVerifier (type));
+			std::vector<uint8_t> signingPublicKey(verifier->GetPublicKeyLen ()); 
+			keys.m_SigningPrivateKey.resize (verifier->GetPrivateKeyLen ());
+			GenerateSigningKeyPair (type, keys.m_SigningPrivateKey.data (), signingPublicKey.data ());
 			// encryption
 			uint8_t publicKey[256];
 			if (isDestination)
@@ -703,7 +767,7 @@ namespace data
 			else
 				GenerateCryptoKeyPair (cryptoType, keys.m_PrivateKey, publicKey);
 			// identity
-			keys.m_Public = std::make_shared<IdentityEx> (isDestination ? nullptr : publicKey, signingPublicKey, type, cryptoType);
+			keys.m_Public = std::make_shared<IdentityEx> (isDestination ? nullptr : publicKey, signingPublicKey.data (), type, cryptoType);
 
 			keys.CreateSigner ();
 			return keys;
@@ -728,9 +792,7 @@ namespace data
 			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
 			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
 				LogPrint (eLogWarning, "Identity: RSA signature type is not supported. Creating EdDSA");
-#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
-#endif
 				// no break here
 			case SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519:
 				i2p::crypto::CreateEDDSA25519RandomKeys (priv, pub);
@@ -744,6 +806,11 @@ namespace data
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				i2p::crypto::CreateRedDSA25519RandomKeys (priv, pub);
 			break;
+#if OPENSSL_PQ				
+			case SIGNING_KEY_TYPE_MLDSA44:
+				i2p::crypto::CreateMLDSA44RandomKeys (priv, pub);
+			break;	
+#endif				
 			default:
 				LogPrint (eLogWarning, "Identity: Signing key type ", (int)type, " is not supported. Create DSA-SHA1");
 				i2p::crypto::CreateDSARandomKeys (priv, pub); // DSA-SHA1
@@ -758,13 +825,12 @@ namespace data
 				i2p::crypto::GenerateElGamalKeyPair(priv, pub);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
-			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				i2p::crypto::CreateECIESP256RandomKeys (priv, pub);
 			break;
-			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
-				i2p::crypto::CreateECIESGOSTR3410RandomKeys (priv, pub);
-			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
+			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				i2p::crypto::CreateECIESX25519AEADRatchetRandomKeys (priv, pub);
 			break;
 			default:
@@ -782,9 +848,10 @@ namespace data
 			keys.m_TransientSigningPrivateKeyLen = verifier->GetPrivateKeyLen ();
 			keys.m_TransientSignatureLen = verifier->GetSignatureLen ();
 			keys.m_OfflineSignature.resize (pubKeyLen + m_Public->GetSignatureLen () + 6);
+			keys.m_SigningPrivateKey.resize (verifier->GetPrivateKeyLen ());
 			htobe32buf (keys.m_OfflineSignature.data (), expires); // expires
 			htobe16buf (keys.m_OfflineSignature.data () + 4, type); // type
-			GenerateSigningKeyPair (type, keys.m_SigningPrivateKey, keys.m_OfflineSignature.data () + 6); // public key
+			GenerateSigningKeyPair (type, keys.m_SigningPrivateKey.data (), keys.m_OfflineSignature.data () + 6); // public key
 			Sign (keys.m_OfflineSignature.data (), pubKeyLen + 6, keys.m_OfflineSignature.data () + 6 + pubKeyLen); // signature
 			// recreate signer
 			keys.m_Signer = nullptr;

libi2pd/Identity.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2025, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -12,14 +12,19 @@
 #include <inttypes.h>
 #include <string.h>
 #include <string>
+#include <string_view>
 #include <memory>
 #include <vector>
 #include "Base.h"
 #include "Signature.h"
-#include "CryptoKey.h"
 
 namespace i2p
 {
+namespace crypto
+{
+	class CryptoKeyEncryptor;
+	class CryptoKeyDecryptor;
+}	
 namespace data
 {
 	typedef Tag<32> IdentHash;
@@ -54,6 +59,8 @@ namespace data
 		Identity& operator=(const Keys& keys);
 		size_t FromBuffer (const uint8_t * buf, size_t len);
 		IdentHash Hash () const;
+		operator uint8_t * () { return reinterpret_cast<uint8_t *>(this); }
+		operator const uint8_t * () const { return reinterpret_cast<const uint8_t *>(this); }
 	};
 
 	Keys CreateRandomKeys ();
@@ -63,9 +70,10 @@ namespace data
 	const uint16_t CRYPTO_KEY_TYPE_ELGAMAL = 0;
 	const uint16_t CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC = 1;
 	const uint16_t CRYPTO_KEY_TYPE_ECIES_X25519_AEAD = 4;
-	const uint16_t CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST = 65280; // TODO: remove later
-	const uint16_t CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC = 65281; // TODO: use GOST R 34.11 instead SHA256 and GOST 28147-89 instead AES
-
+	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD = 5;
+	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD = 6;
+	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD = 7;
+	
 	const uint16_t SIGNING_KEY_TYPE_DSA_SHA1 = 0;
 	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA256_P256 = 1;
 	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA384_P384 = 2;
@@ -74,11 +82,12 @@ namespace data
 	const uint16_t SIGNING_KEY_TYPE_RSA_SHA384_3072 = 5;
 	const uint16_t SIGNING_KEY_TYPE_RSA_SHA512_4096 = 6;
 	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519 = 7;
-	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519ph = 8; // not implemented
+	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519ph = 8; // since openssl 3.0.0
 	const uint16_t SIGNING_KEY_TYPE_GOSTR3410_CRYPTO_PRO_A_GOSTR3411_256 = 9;
 	const uint16_t SIGNING_KEY_TYPE_GOSTR3410_TC26_A_512_GOSTR3411_512 = 10; // approved by FSB
 	const uint16_t SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519 = 11; // for LeaseSet2 only
-
+	const uint16_t SIGNING_KEY_TYPE_MLDSA44 = 12;
+	
 	typedef uint16_t SigningKeyType;
 	typedef uint16_t CryptoKeyType;
 
@@ -99,7 +108,7 @@ namespace data
 
 			size_t FromBuffer (const uint8_t * buf, size_t len);
 			size_t ToBuffer (uint8_t * buf, size_t len) const;
-			size_t FromBase64(const std::string& s);
+			size_t FromBase64(std::string_view s);
 			std::string ToBase64 () const;
 			const Identity& GetStandardIdentity () const { return m_StandardIdentity; };
 
@@ -133,7 +142,11 @@ namespace data
 			IdentHash m_IdentHash;
 			std::unique_ptr<i2p::crypto::Verifier> m_Verifier;
 			size_t m_ExtendedLen;
-			uint8_t m_ExtendedBuffer[MAX_EXTENDED_BUFFER_SIZE];
+			union
+			{	
+				uint8_t m_ExtendedBuffer[MAX_EXTENDED_BUFFER_SIZE]; 
+				uint8_t * m_ExtendedBufferPtr;
+			};	
 	};
 
 	size_t GetIdentityBufferLen (const uint8_t * buf, size_t len); // return actual identity length in buffer
@@ -151,7 +164,7 @@ namespace data
 
 			std::shared_ptr<const IdentityEx> GetPublic () const { return m_Public; };
 			const uint8_t * GetPrivateKey () const { return m_PrivateKey; };
-			const uint8_t * GetSigningPrivateKey () const { return m_SigningPrivateKey; };
+			const uint8_t * GetSigningPrivateKey () const { return m_SigningPrivateKey.data (); };
 			size_t GetSignatureLen () const; // might not match identity
 			bool IsOfflineSignature () const { return m_TransientSignatureLen > 0; };
 			uint8_t * GetPadding();
@@ -162,7 +175,7 @@ namespace data
 			size_t FromBuffer (const uint8_t * buf, size_t len);
 			size_t ToBuffer (uint8_t * buf, size_t len) const;
 
-			size_t FromBase64(const std::string& s);
+			size_t FromBase64(std::string_view s);
 			std::string ToBase64 () const;
 
 			std::shared_ptr<i2p::crypto::CryptoKeyDecryptor> CreateDecryptor (const uint8_t * key) const;
@@ -187,7 +200,7 @@ namespace data
 
 			std::shared_ptr<IdentityEx> m_Public;
 			uint8_t m_PrivateKey[256];
-			uint8_t m_SigningPrivateKey[128]; // assume private key doesn't exceed 128 bytes
+			std::vector<uint8_t> m_SigningPrivateKey;
 			mutable std::unique_ptr<i2p::crypto::Signer> m_Signer;
 			std::vector<uint8_t> m_OfflineSignature; // non zero length, if applicable
 			size_t m_TransientSignatureLen = 0;