SelfAwareness.cpp 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195
  1. /*
  2. * ZeroTier One - Network Virtualization Everywhere
  3. * Copyright (C) 2011-2016 ZeroTier, Inc. https://www.zerotier.com/
  4. *
  5. * This program is free software: you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, either version 3 of the License, or
  8. * (at your option) any later version.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. */
  18. #include <stdio.h>
  19. #include <stdlib.h>
  20. #include <string.h>
  21. #include <set>
  22. #include <vector>
  23. #include "Constants.hpp"
  24. #include "SelfAwareness.hpp"
  25. #include "RuntimeEnvironment.hpp"
  26. #include "Node.hpp"
  27. #include "Topology.hpp"
  28. #include "Packet.hpp"
  29. #include "Peer.hpp"
  30. #include "Switch.hpp"
  31. // Entry timeout -- make it fairly long since this is just to prevent stale buildup
  32. #define ZT_SELFAWARENESS_ENTRY_TIMEOUT 600000
  33. namespace ZeroTier {
  34. class _ResetWithinScope
  35. {
  36. public:
  37. _ResetWithinScope(void *tPtr,uint64_t now,int inetAddressFamily,InetAddress::IpScope scope) :
  38. _now(now),
  39. _tPtr(tPtr),
  40. _family(inetAddressFamily),
  41. _scope(scope) {}
  42. inline void operator()(Topology &t,const SharedPtr<Peer> &p) { p->resetWithinScope(_tPtr,_scope,_family,_now); }
  43. private:
  44. uint64_t _now;
  45. void *_tPtr;
  46. int _family;
  47. InetAddress::IpScope _scope;
  48. };
  49. SelfAwareness::SelfAwareness(const RuntimeEnvironment *renv) :
  50. RR(renv),
  51. _phy(128)
  52. {
  53. }
  54. void SelfAwareness::iam(void *tPtr,const Address &reporter,const InetAddress &receivedOnLocalAddress,const InetAddress &reporterPhysicalAddress,const InetAddress &myPhysicalAddress,bool trusted,uint64_t now)
  55. {
  56. const InetAddress::IpScope scope = myPhysicalAddress.ipScope();
  57. if ((scope != reporterPhysicalAddress.ipScope())||(scope == InetAddress::IP_SCOPE_NONE)||(scope == InetAddress::IP_SCOPE_LOOPBACK)||(scope == InetAddress::IP_SCOPE_MULTICAST))
  58. return;
  59. Mutex::Lock _l(_phy_m);
  60. PhySurfaceEntry &entry = _phy[PhySurfaceKey(reporter,receivedOnLocalAddress,reporterPhysicalAddress,scope)];
  61. if ( (trusted) && ((now - entry.ts) < ZT_SELFAWARENESS_ENTRY_TIMEOUT) && (!entry.mySurface.ipsEqual(myPhysicalAddress)) ) {
  62. // Changes to external surface reported by trusted peers causes path reset in this scope
  63. TRACE("physical address %s for scope %u as seen from %s(%s) differs from %s, resetting paths in scope",myPhysicalAddress.toString().c_str(),(unsigned int)scope,reporter.toString().c_str(),reporterPhysicalAddress.toString().c_str(),entry.mySurface.toString().c_str());
  64. entry.mySurface = myPhysicalAddress;
  65. entry.ts = now;
  66. entry.trusted = trusted;
  67. // Erase all entries in this scope that were not reported from this remote address to prevent 'thrashing'
  68. // due to multiple reports of endpoint change.
  69. // Don't use 'entry' after this since hash table gets modified.
  70. {
  71. Hashtable< PhySurfaceKey,PhySurfaceEntry >::Iterator i(_phy);
  72. PhySurfaceKey *k = (PhySurfaceKey *)0;
  73. PhySurfaceEntry *e = (PhySurfaceEntry *)0;
  74. while (i.next(k,e)) {
  75. if ((k->reporterPhysicalAddress != reporterPhysicalAddress)&&(k->scope == scope))
  76. _phy.erase(*k);
  77. }
  78. }
  79. // Reset all paths within this scope and address family
  80. _ResetWithinScope rset(tPtr,now,myPhysicalAddress.ss_family,(InetAddress::IpScope)scope);
  81. RR->topology->eachPeer<_ResetWithinScope &>(rset);
  82. } else {
  83. // Otherwise just update DB to use to determine external surface info
  84. entry.mySurface = myPhysicalAddress;
  85. entry.ts = now;
  86. entry.trusted = trusted;
  87. }
  88. }
  89. void SelfAwareness::clean(uint64_t now)
  90. {
  91. Mutex::Lock _l(_phy_m);
  92. Hashtable< PhySurfaceKey,PhySurfaceEntry >::Iterator i(_phy);
  93. PhySurfaceKey *k = (PhySurfaceKey *)0;
  94. PhySurfaceEntry *e = (PhySurfaceEntry *)0;
  95. while (i.next(k,e)) {
  96. if ((now - e->ts) >= ZT_SELFAWARENESS_ENTRY_TIMEOUT)
  97. _phy.erase(*k);
  98. }
  99. }
  100. std::vector<InetAddress> SelfAwareness::getSymmetricNatPredictions()
  101. {
  102. /* This is based on ideas and strategies found here:
  103. * https://tools.ietf.org/html/draft-takeda-symmetric-nat-traversal-00
  104. *
  105. * For each IP address reported by a trusted (upstream) peer, we find
  106. * the external port most recently reported by ANY peer for that IP.
  107. *
  108. * We only do any of this for global IPv4 addresses since private IPs
  109. * and IPv6 are not going to have symmetric NAT.
  110. *
  111. * SECURITY NOTE:
  112. *
  113. * We never use IPs reported by non-trusted peers, since this could lead
  114. * to a minor vulnerability whereby a peer could poison our cache with
  115. * bad external surface reports via OK(HELLO) and then possibly coax us
  116. * into suggesting their IP to other peers via PUSH_DIRECT_PATHS. This
  117. * in turn could allow them to MITM flows.
  118. *
  119. * Since flows are encrypted and authenticated they could not actually
  120. * read or modify traffic, but they could gather meta-data for forensics
  121. * purpsoes or use this as a DOS attack vector. */
  122. std::map< uint32_t,std::pair<uint64_t,unsigned int> > maxPortByIp;
  123. InetAddress theOneTrueSurface;
  124. bool symmetric = false;
  125. {
  126. Mutex::Lock _l(_phy_m);
  127. { // First get IPs from only trusted peers, and perform basic NAT type characterization
  128. Hashtable< PhySurfaceKey,PhySurfaceEntry >::Iterator i(_phy);
  129. PhySurfaceKey *k = (PhySurfaceKey *)0;
  130. PhySurfaceEntry *e = (PhySurfaceEntry *)0;
  131. while (i.next(k,e)) {
  132. if ((e->trusted)&&(e->mySurface.ss_family == AF_INET)&&(e->mySurface.ipScope() == InetAddress::IP_SCOPE_GLOBAL)) {
  133. if (!theOneTrueSurface)
  134. theOneTrueSurface = e->mySurface;
  135. else if (theOneTrueSurface != e->mySurface)
  136. symmetric = true;
  137. maxPortByIp[reinterpret_cast<const struct sockaddr_in *>(&(e->mySurface))->sin_addr.s_addr] = std::pair<uint64_t,unsigned int>(e->ts,e->mySurface.port());
  138. }
  139. }
  140. }
  141. { // Then find max port per IP from a trusted peer
  142. Hashtable< PhySurfaceKey,PhySurfaceEntry >::Iterator i(_phy);
  143. PhySurfaceKey *k = (PhySurfaceKey *)0;
  144. PhySurfaceEntry *e = (PhySurfaceEntry *)0;
  145. while (i.next(k,e)) {
  146. if ((e->mySurface.ss_family == AF_INET)&&(e->mySurface.ipScope() == InetAddress::IP_SCOPE_GLOBAL)) {
  147. std::map< uint32_t,std::pair<uint64_t,unsigned int> >::iterator mp(maxPortByIp.find(reinterpret_cast<const struct sockaddr_in *>(&(e->mySurface))->sin_addr.s_addr));
  148. if ((mp != maxPortByIp.end())&&(mp->second.first < e->ts)) {
  149. mp->second.first = e->ts;
  150. mp->second.second = e->mySurface.port();
  151. }
  152. }
  153. }
  154. }
  155. }
  156. if (symmetric) {
  157. std::vector<InetAddress> r;
  158. for(unsigned int k=1;k<=3;++k) {
  159. for(std::map< uint32_t,std::pair<uint64_t,unsigned int> >::iterator i(maxPortByIp.begin());i!=maxPortByIp.end();++i) {
  160. unsigned int p = i->second.second + k;
  161. if (p > 65535) p -= 64511;
  162. InetAddress pred(&(i->first),4,p);
  163. if (std::find(r.begin(),r.end(),pred) == r.end())
  164. r.push_back(pred);
  165. }
  166. }
  167. return r;
  168. }
  169. return std::vector<InetAddress>();
  170. }
  171. } // namespace ZeroTier