Delete something that turns out not to be useful. This will be handled differently.

node/CertificateOfRepresentation.hpp

@@ -1,188 +0,0 @@
-/*
- * ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2017  ZeroTier, Inc.  https://www.zerotier.com/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * --
- *
- * You can be released from the requirements of the license by purchasing
- * a commercial license. Buying such a license is mandatory as soon as you
- * develop commercial closed-source software that incorporates or links
- * directly against ZeroTier software without disclosing the source code
- * of your own application.
- */
-
-#ifndef ZT_CERTIFICATEOFREPRESENTATION_HPP
-#define ZT_CERTIFICATEOFREPRESENTATION_HPP
-
-#include "Constants.hpp"
-#include "Credential.hpp"
-#include "Address.hpp"
-#include "C25519.hpp"
-#include "Identity.hpp"
-#include "Buffer.hpp"
-
-/**
- * Maximum number of addresses allowed in a COR
- */
-#define ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES ZT_MAX_UPSTREAMS
-
-namespace ZeroTier {
-
-/**
- * A signed enumeration of a node's roots (planet and moons)
- *
- * This is sent as part of HELLO and attests to which roots a node trusts
- * to represent it on the network. Federated roots (moons) can send these
- * further upstream to tell global roots which nodes they represent, making
- * them reachable via federated roots if they are not reachable directly.
- *
- * As of 1.2.0 this is sent but not used. Right now nodes still always
- * announce to planetary roots no matter what. In the future this can be
- * used to implement even better fault tolerance for federation for the
- * no roots are reachable case as well as a "privacy mode" where federated
- * roots can shield nodes entirely and p2p connectivity behind them can
- * be disabled. This will be desirable for a number of use cases.
- */
-class CertificateOfRepresentation : public Credential
-{
-public:
-	static inline Credential::Type credentialType() { return Credential::CREDENTIAL_TYPE_COR; }
-
-	CertificateOfRepresentation()
-	{
-		memset(this,0,sizeof(CertificateOfRepresentation));
-	}
-
-	inline uint32_t id() const { return 0; }
-	inline uint64_t timestamp() const { return _timestamp; }
-	inline const Address &representative(const unsigned int i) const { return _reps[i]; }
-	inline unsigned int repCount() const { return _repCount; }
-
-	inline void clear()
-	{
-		memset(this,0,sizeof(CertificateOfRepresentation));
-	}
-
-	/**
-	 * Add a representative if space remains
-	 *
-	 * @param r Representative to add
-	 * @return True if representative was added
-	 */
-	inline bool addRepresentative(const Address &r)
-	{
-		if (_repCount < ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES) {
-			_reps[_repCount++] = r;
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Sign this COR with my identity
-	 *
-	 * @param myIdentity This node's identity
-	 * @param ts COR timestamp for establishing new vs. old
-	 */
-	inline void sign(const Identity &myIdentity,const uint64_t ts)
-	{
-		_timestamp = ts;
-		Buffer<sizeof(CertificateOfRepresentation) + 32> tmp;
-		this->serialize(tmp,true);
-		_signature = myIdentity.sign(tmp.data(),tmp.size());
-	}
-
-	/**
-	 * Verify this COR's signature
-	 *
-	 * @param senderIdentity Identity of sender of COR
-	 * @return True if COR is valid
-	 */
-	inline bool verify(const Identity &senderIdentity)
-	{
-		try {
-			Buffer<sizeof(CertificateOfRepresentation) + 32> tmp;
-			this->serialize(tmp,true);
-			return senderIdentity.verify(tmp.data(),tmp.size(),_signature.data,ZT_C25519_SIGNATURE_LEN);
-		} catch ( ... ) {
-			return false;
-		}
-	}
-
-	template<unsigned int C>
-	inline void serialize(Buffer<C> &b,const bool forSign = false) const
-	{
-		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
-
-		b.append((uint64_t)_timestamp);
-		b.append((uint16_t)_repCount);
-		for(unsigned int i=0;i<_repCount;++i)
-			_reps[i].appendTo(b);
-
-		if (!forSign) {
-			b.append((uint8_t)1); // 1 == Ed25519 signature
-			b.append((uint16_t)ZT_C25519_SIGNATURE_LEN);
-			b.append(_signature.data,ZT_C25519_SIGNATURE_LEN);
-		}
-
-		b.append((uint16_t)0); // size of any additional fields, currently 0
-
-		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
-	}
-
-	template<unsigned int C>
-	inline unsigned int deserialize(const Buffer<C> &b,unsigned int startAt = 0)
-	{
-		clear();
-
-		unsigned int p = startAt;
-
-		_timestamp = b.template at<uint64_t>(p); p += 8;
-		const unsigned int rc = b.template at<uint16_t>(p); p += 2;
-		for(unsigned int i=0;i<rc;++i) {
-			if (i < ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES)
-				_reps[i].setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH);
-			p += ZT_ADDRESS_LENGTH;
-		}
-		_repCount = (rc > ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES) ? ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES : rc;
-
-		if (b[p++] == 1) {
-			if (b.template at<uint16_t>(p) == ZT_C25519_SIGNATURE_LEN) {
-				p += 2;
-				memcpy(_signature.data,b.field(p,ZT_C25519_SIGNATURE_LEN),ZT_C25519_SIGNATURE_LEN);
-				p += ZT_C25519_SIGNATURE_LEN;
-			} else throw ZT_EXCEPTION_INVALID_SERIALIZED_DATA_INVALID_CRYPTOGRAPHIC_TOKEN;
-		} else {
-			p += 2 + b.template at<uint16_t>(p);
-		}
-
-		p += 2 + b.template at<uint16_t>(p);
-		if (p > b.size())
-			throw ZT_EXCEPTION_INVALID_SERIALIZED_DATA_OVERFLOW;
-
-		return (p - startAt);
-	}
-
-private:
-	uint64_t _timestamp;
-	Address _reps[ZT_CERTIFICATEOFREPRESENTATION_MAX_ADDRESSES];
-	unsigned int _repCount;
-	C25519::Signature _signature;
-};
-
-} // namespace ZeroTier
-
-#endif

node/Credential.hpp

@@ -56,7 +56,6 @@ public:
 		CREDENTIAL_TYPE_CAPABILITY = 2,
 		CREDENTIAL_TYPE_TAG = 3,
 		CREDENTIAL_TYPE_COO = 4,        // CertificateOfOwnership
-		CREDENTIAL_TYPE_COR = 5,        // CertificateOfRepresentation
 		CREDENTIAL_TYPE_REVOCATION = 6
 	};
 };

node/IncomingPacket.cpp

@@ -44,7 +44,6 @@
 #include "World.hpp"
 #include "Node.hpp"
 #include "CertificateOfMembership.hpp"
-#include "CertificateOfRepresentation.hpp"
 #include "Capability.hpp"
 #include "Tag.hpp"
 #include "Revocation.hpp"
@@ -328,15 +327,6 @@ bool IncomingPacket::_doHELLO(const RuntimeEnvironment *RR,void *tPtr,const bool
 				ptr += 16;
 			}
 		}
-
-		// Certificates of representation (if present)
-		if ((ptr + 2) <= size()) {
-			if (at<uint16_t>(ptr) > 0) {
-				CertificateOfRepresentation cor;
-				ptr += 2;
-				ptr += cor.deserialize(*this,ptr);
-			} else ptr += 2;
-		}
 	}
 
 	// Send OK(HELLO) with an echo of the packet's timestamp and some of the same
@@ -401,11 +391,6 @@ bool IncomingPacket::_doHELLO(const RuntimeEnvironment *RR,void *tPtr,const bool
 	}
 	outp.setAt<uint16_t>(worldUpdateSizeAt,(uint16_t)(outp.size() - (worldUpdateSizeAt + 2)));
 
-	const unsigned int corSizeAt = outp.size();
-	outp.addSize(2);
-	RR->topology->appendCertificateOfRepresentation(outp);
-	outp.setAt(corSizeAt,(uint16_t)(outp.size() - (corSizeAt + 2)));
-
 	outp.armor(peer->key(),true,_path->nextOutgoingCounter());
 	_path->send(RR,tPtr,outp.data(),outp.size(),now);
 
@@ -460,15 +445,6 @@ bool IncomingPacket::_doOK(const RuntimeEnvironment *RR,void *tPtr,const SharedP
 				}
 			}
 
-			// Handle certificate of representation if present
-			if ((ptr + 2) <= size()) {
-				if (at<uint16_t>(ptr) > 0) {
-					CertificateOfRepresentation cor;
-					ptr += 2;
-					ptr += cor.deserialize(*this,ptr);
-				} else ptr += 2;
-			}
-
 			if (!hops())
 				peer->addDirectLatencyMeasurment((unsigned int)latency);
 			peer->setRemoteVersion(vProto,vMajor,vMinor,vRevision);

node/Peer.cpp

@@ -343,11 +343,6 @@ void Peer::sendHELLO(void *tPtr,const int64_t localSocket,const InetAddress &atA
 		outp.append((uint64_t)0);
 	}
 
-	const unsigned int corSizeAt = outp.size();
-	outp.addSize(2);
-	RR->topology->appendCertificateOfRepresentation(outp);
-	outp.setAt(corSizeAt,(uint16_t)(outp.size() - (corSizeAt + 2)));
-
 	outp.cryptField(_key,startCryptedPortionAt,outp.size() - startCryptedPortionAt);
 
 	RR->node->expectReplyTo(outp.packetId());

node/Topology.cpp

@@ -425,13 +425,6 @@ void Topology::_memoizeUpstreams(void *tPtr)
 	}
 
 	std::sort(_upstreamAddresses.begin(),_upstreamAddresses.end());
-
-	_cor.clear();
-	for(std::vector<Address>::const_iterator a(_upstreamAddresses.begin());a!=_upstreamAddresses.end();++a) {
-		if (!_cor.addRepresentative(*a))
-			break;
-	}
-	_cor.sign(RR->identity,RR->node->now());
 }
 
 void Topology::_savePeer(void *tPtr,const SharedPtr<Peer> &peer)

node/Topology.hpp

@@ -46,7 +46,6 @@
 #include "InetAddress.hpp"
 #include "Hashtable.hpp"
 #include "World.hpp"
-#include "CertificateOfRepresentation.hpp"
 
 namespace ZeroTier {
 
@@ -441,25 +440,6 @@ public:
 		}
 	}
 
-	/**
-	 * @return Current certificate of representation (copy)
-	 */
-	inline CertificateOfRepresentation certificateOfRepresentation() const
-	{
-		Mutex::Lock _l(_upstreams_m);
-		return _cor;
-	}
-
-	/**
-	 * @param buf Buffer to receive COR
-	 */
-	template<unsigned int C>
-	void appendCertificateOfRepresentation(Buffer<C> &buf)
-	{
-		Mutex::Lock _l(_upstreams_m);
-		_cor.serialize(buf);
-	}
-
 private:
 	Identity _getIdentity(void *tPtr,const Address &zta);
 	void _memoizeUpstreams(void *tPtr);
@@ -480,7 +460,6 @@ private:
 	std::vector<World> _moons;
 	std::vector< std::pair<uint64_t,Address> > _moonSeeds;
 	std::vector<Address> _upstreamAddresses;
-	CertificateOfRepresentation _cor;
 	bool _amRoot;
 	Mutex _upstreams_m; // locks worlds, upstream info, moon info, etc.
 };

node/Trace.cpp

@@ -32,7 +32,6 @@
 #include "Dictionary.hpp"
 #include "CertificateOfMembership.hpp"
 #include "CertificateOfOwnership.hpp"
-#include "CertificateOfRepresentation.hpp"
 #include "Tag.hpp"
 #include "Capability.hpp"
 #include "Revocation.hpp"
@@ -287,18 +286,6 @@ void Trace::credentialRejected(void *const tPtr,const CertificateOfOwnership &c,
 	_send(tPtr,d,c.networkId());
 }
 
-void Trace::credentialRejected(void *const tPtr,const CertificateOfRepresentation &c,const char *reason)
-{
-	Dictionary<ZT_MAX_REMOTE_TRACE_SIZE> d;
-	d.add(ZT_REMOTE_TRACE_FIELD__EVENT,ZT_REMOTE_TRACE_EVENT__CREDENTIAL_REJECTED_S);
-	d.add(ZT_REMOTE_TRACE_FIELD__CREDENTIAL_TYPE,(uint64_t)c.credentialType());
-	d.add(ZT_REMOTE_TRACE_FIELD__CREDENTIAL_ID,(uint64_t)c.id());
-	d.add(ZT_REMOTE_TRACE_FIELD__CREDENTIAL_TIMESTAMP,c.timestamp());
-	if (reason)
-		d.add(ZT_REMOTE_TRACE_FIELD__REASON,reason);
-	_send(tPtr,d,0);
-}
-
 void Trace::credentialRejected(void *const tPtr,const Capability &c,const char *reason)
 {
 	Dictionary<ZT_MAX_REMOTE_TRACE_SIZE> d;

node/Trace.hpp

@@ -53,7 +53,6 @@ class NetworkConfig;
 class MAC;
 class CertificateOfMembership;
 class CertificateOfOwnership;
-class CertificateOfRepresentation;
 class Revocation;
 class Tag;
 class Capability;
@@ -137,7 +136,6 @@ public:
 
 	void credentialRejected(void *const tPtr,const CertificateOfMembership &c,const char *reason);
 	void credentialRejected(void *const tPtr,const CertificateOfOwnership &c,const char *reason);
-	void credentialRejected(void *const tPtr,const CertificateOfRepresentation &c,const char *reason);
 	void credentialRejected(void *const tPtr,const Capability &c,const char *reason);
 	void credentialRejected(void *const tPtr,const Tag &c,const char *reason);
 	void credentialRejected(void *const tPtr,const Revocation &c,const char *reason);