Network.cpp 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308
  1. /*
  2. * ZeroTier One - Global Peer to Peer Ethernet
  3. * Copyright (C) 2012-2013 ZeroTier Networks LLC
  4. *
  5. * This program is free software: you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, either version 3 of the License, or
  8. * (at your option) any later version.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. *
  18. * --
  19. *
  20. * ZeroTier may be used and distributed under the terms of the GPLv3, which
  21. * are available at: http://www.gnu.org/licenses/gpl-3.0.html
  22. *
  23. * If you would like to embed ZeroTier into a commercial application or
  24. * redistribute it in a modified binary form, please contact ZeroTier Networks
  25. * LLC. Start here: http://www.zerotier.com/
  26. */
  27. #include <stdio.h>
  28. #include <string.h>
  29. #include <stdlib.h>
  30. #include <math.h>
  31. #include <openssl/sha.h>
  32. #include "RuntimeEnvironment.hpp"
  33. #include "NodeConfig.hpp"
  34. #include "Network.hpp"
  35. #include "Switch.hpp"
  36. #include "Packet.hpp"
  37. #include "Utils.hpp"
  38. namespace ZeroTier {
  39. void Network::Certificate::_shaForSignature(unsigned char *dig) const
  40. {
  41. SHA256_CTX sha;
  42. SHA256_Init(&sha);
  43. unsigned char zero = 0;
  44. for(const_iterator i(begin());i!=end();++i) {
  45. SHA256_Update(&sha,&zero,1);
  46. SHA256_Update(&sha,(const unsigned char *)i->first.data(),i->first.length());
  47. SHA256_Update(&sha,&zero,1);
  48. SHA256_Update(&sha,(const unsigned char *)i->second.data(),i->second.length());
  49. SHA256_Update(&sha,&zero,1);
  50. }
  51. SHA256_Final(dig,&sha);
  52. }
  53. static const std::string _DELTA_PREFIX("~");
  54. bool Network::Certificate::qualifyMembership(const Network::Certificate &mc) const
  55. {
  56. // Note: optimization probably needed here, probably via some kind of
  57. // memoization / dynamic programming. But make it work first, then make
  58. // it fast.
  59. for(const_iterator myField(begin());myField!=end();++myField) {
  60. if (!((myField->first.length() > 1)&&(myField->first[0] == '~'))) { // ~fields are max delta range specs
  61. // If they lack the same field, comparison fails.
  62. const_iterator theirField(mc.find(myField->first));
  63. if (theirField == mc.end())
  64. return false;
  65. const_iterator deltaField(find(_DELTA_PREFIX + myField->first));
  66. if (deltaField == end()) {
  67. // If there is no delta, compare on simple equality
  68. if (myField->second != theirField->second)
  69. return false;
  70. } else {
  71. // Otherwise compare the absolute value of the difference between
  72. // the two values against the max delta.
  73. int64_t my = Utils::hexStrTo64(myField->second.c_str());
  74. int64_t their = Utils::hexStrTo64(theirField->second.c_str());
  75. int64_t delta = Utils::hexStrTo64(deltaField->second.c_str());
  76. if (llabs((long long)(my - their)) > delta)
  77. return false;
  78. }
  79. }
  80. }
  81. return true;
  82. }
  83. // A low default global rate, fast enough for something like ARP
  84. const Network::MulticastRates::Rate Network::MulticastRates::GLOBAL_DEFAULT_RATE(256.0,-32.0,256.0,64.0);
  85. const char *Network::statusString(const Status s)
  86. throw()
  87. {
  88. switch(s) {
  89. case NETWORK_WAITING_FOR_FIRST_AUTOCONF: return "WAITING_FOR_FIRST_AUTOCONF";
  90. case NETWORK_OK: return "OK";
  91. case NETWORK_ACCESS_DENIED: return "ACCESS_DENIED";
  92. }
  93. return "(invalid)";
  94. }
  95. Network::~Network()
  96. {
  97. delete _tap;
  98. if (_destroyOnDelete) {
  99. std::string confPath(_r->homePath + ZT_PATH_SEPARATOR_S + "networks.d" + ZT_PATH_SEPARATOR_S + toString() + ".conf");
  100. std::string mcdbPath(_r->homePath + ZT_PATH_SEPARATOR_S + "networks.d" + ZT_PATH_SEPARATOR_S + toString() + ".mcerts");
  101. Utils::rm(confPath);
  102. Utils::rm(mcdbPath);
  103. } else {
  104. // Causes flush of membership certs to disk
  105. clean();
  106. }
  107. }
  108. SharedPtr<Network> Network::newInstance(const RuntimeEnvironment *renv,uint64_t id)
  109. throw(std::runtime_error)
  110. {
  111. char tag[32];
  112. Utils::snprintf(tag,sizeof(tag),"%.16llx",(unsigned long long)id);
  113. // We construct Network via a static method to ensure that it is immediately
  114. // wrapped in a SharedPtr<>. Otherwise if there is traffic on the Ethernet
  115. // tap device, a SharedPtr<> wrap can occur in the Ethernet frame handler
  116. // that then causes the Network instance to be deleted before it is finished
  117. // being constructed. C++ edge cases, how I love thee.
  118. SharedPtr<Network> nw(new Network());
  119. nw->_ready = false; // disable handling of Ethernet frames during construct
  120. nw->_r = renv;
  121. nw->_tap = new EthernetTap(renv,tag,renv->identity.address().toMAC(),ZT_IF_MTU,&_CBhandleTapData,nw.ptr());
  122. memset(nw->_etWhitelist,0,sizeof(nw->_etWhitelist));
  123. nw->_id = id;
  124. nw->_lastConfigUpdate = 0;
  125. nw->_destroyOnDelete = false;
  126. if (nw->controller() == renv->identity.address()) // sanity check, this isn't supported for now
  127. throw std::runtime_error("cannot add a network for which I am the netconf master");
  128. nw->_restoreState();
  129. nw->_ready = true; // enable handling of Ethernet frames
  130. nw->requestConfiguration();
  131. return nw;
  132. }
  133. void Network::setConfiguration(const Network::Config &conf)
  134. {
  135. Mutex::Lock _l(_lock);
  136. try {
  137. if (conf.networkId() == _id) { // sanity check
  138. //TRACE("network %.16llx got netconf:\n%s",(unsigned long long)_id,conf.toString().c_str());
  139. _configuration = conf;
  140. _myCertificate = conf.certificateOfMembership();
  141. _lastConfigUpdate = Utils::now();
  142. _tap->setIps(conf.staticAddresses());
  143. _tap->setDisplayName((std::string("ZeroTier One [") + conf.name() + "]").c_str());
  144. memset(_etWhitelist,0,sizeof(_etWhitelist));
  145. std::set<unsigned int> wl(conf.etherTypes());
  146. for(std::set<unsigned int>::const_iterator t(wl.begin());t!=wl.end();++t)
  147. _etWhitelist[*t / 8] |= (unsigned char)(1 << (*t % 8));
  148. std::string confPath(_r->homePath + ZT_PATH_SEPARATOR_S + "networks.d" + ZT_PATH_SEPARATOR_S + toString() + ".conf");
  149. if (!Utils::writeFile(confPath.c_str(),conf.toString())) {
  150. LOG("error: unable to write network configuration file at: %s",confPath.c_str());
  151. }
  152. }
  153. } catch ( ... ) {
  154. _configuration = Config();
  155. _myCertificate = Certificate();
  156. _lastConfigUpdate = 0;
  157. LOG("unexpected exception handling config for network %.16llx, retrying fetch...",(unsigned long long)_id);
  158. }
  159. }
  160. void Network::requestConfiguration()
  161. {
  162. if (controller() == _r->identity.address()) {
  163. LOG("unable to request network configuration for network %.16llx: I am the network master, cannot query self",(unsigned long long)_id);
  164. return;
  165. }
  166. TRACE("requesting netconf for network %.16llx from netconf master %s",(unsigned long long)_id,controller().toString().c_str());
  167. Packet outp(controller(),_r->identity.address(),Packet::VERB_NETWORK_CONFIG_REQUEST);
  168. outp.append((uint64_t)_id);
  169. outp.append((uint16_t)0); // no meta-data
  170. _r->sw->send(outp,true);
  171. }
  172. void Network::addMembershipCertificate(const Address &peer,const Certificate &cert)
  173. {
  174. Mutex::Lock _l(_lock);
  175. if (!_configuration.isOpen())
  176. _membershipCertificates[peer] = cert;
  177. }
  178. bool Network::isAllowed(const Address &peer) const
  179. {
  180. // Exceptions can occur if we do not yet have *our* configuration.
  181. try {
  182. Mutex::Lock _l(_lock);
  183. if (_configuration.isOpen())
  184. return true;
  185. std::map<Address,Certificate>::const_iterator pc(_membershipCertificates.find(peer));
  186. if (pc == _membershipCertificates.end())
  187. return false;
  188. return _myCertificate.qualifyMembership(pc->second);
  189. } catch (std::exception &exc) {
  190. TRACE("isAllowed() check failed for peer %s: unexpected exception: %s",peer.toString().c_str(),exc.what());
  191. } catch ( ... ) {
  192. TRACE("isAllowed() check failed for peer %s: unexpected exception: unknown exception",peer.toString().c_str());
  193. }
  194. return false;
  195. }
  196. void Network::clean()
  197. {
  198. std::string mcdbPath(_r->homePath + ZT_PATH_SEPARATOR_S + "networks.d" + ZT_PATH_SEPARATOR_S + toString() + ".mcerts");
  199. Mutex::Lock _l(_lock);
  200. if (_configuration.isOpen()) {
  201. _membershipCertificates.clear();
  202. Utils::rm(mcdbPath);
  203. } else {
  204. FILE *mcdb = fopen(mcdbPath.c_str(),"wb");
  205. bool writeError = false;
  206. if (!mcdb) {
  207. LOG("error: unable to open membership cert database at: %s",mcdbPath.c_str());
  208. } else {
  209. if ((writeError)||(fwrite("MCDB0",5,1,mcdb) != 1)) // version
  210. writeError = true;
  211. }
  212. for(std::map<Address,Certificate>::iterator i=(_membershipCertificates.begin());i!=_membershipCertificates.end();) {
  213. if (_myCertificate.qualifyMembership(i->second)) {
  214. if ((!writeError)&&(mcdb)) {
  215. char tmp[ZT_ADDRESS_LENGTH];
  216. i->first.copyTo(tmp,ZT_ADDRESS_LENGTH);
  217. if ((writeError)||(fwrite(tmp,ZT_ADDRESS_LENGTH,1,mcdb) != 1))
  218. writeError = true;
  219. std::string c(i->second.toString());
  220. uint32_t cl = Utils::hton((uint32_t)c.length());
  221. if ((writeError)||(fwrite(&cl,sizeof(cl),1,mcdb) != 1))
  222. writeError = true;
  223. if ((writeError)||(fwrite(c.data(),c.length(),1,mcdb) != 1))
  224. writeError = true;
  225. }
  226. ++i;
  227. } else _membershipCertificates.erase(i++);
  228. }
  229. if (mcdb)
  230. fclose(mcdb);
  231. if (writeError) {
  232. Utils::rm(mcdbPath);
  233. LOG("error: unable to write to membership cert database at: %s",mcdbPath.c_str());
  234. }
  235. }
  236. }
  237. Network::Status Network::status() const
  238. {
  239. Mutex::Lock _l(_lock);
  240. if (_configuration)
  241. return NETWORK_OK;
  242. return NETWORK_WAITING_FOR_FIRST_AUTOCONF;
  243. }
  244. void Network::_CBhandleTapData(void *arg,const MAC &from,const MAC &to,unsigned int etherType,const Buffer<4096> &data)
  245. {
  246. if (!((Network *)arg)->_ready)
  247. return;
  248. const RuntimeEnvironment *_r = ((Network *)arg)->_r;
  249. if (_r->shutdownInProgress)
  250. return;
  251. try {
  252. _r->sw->onLocalEthernet(SharedPtr<Network>((Network *)arg),from,to,etherType,data);
  253. } catch (std::exception &exc) {
  254. TRACE("unexpected exception handling local packet: %s",exc.what());
  255. } catch ( ... ) {
  256. TRACE("unexpected exception handling local packet");
  257. }
  258. }
  259. void Network::_restoreState()
  260. {
  261. std::string confPath(_r->homePath + ZT_PATH_SEPARATOR_S + "networks.d" + ZT_PATH_SEPARATOR_S + toString() + ".conf");
  262. std::string confs;
  263. if (Utils::readFile(confPath.c_str(),confs)) {
  264. try {
  265. if (confs.length())
  266. setConfiguration(Config(confs));
  267. } catch ( ... ) {} // ignore invalid config on disk, we will re-request
  268. } else {
  269. // If the conf file isn't present, "touch" it so we'll remember
  270. // the existence of this network.
  271. FILE *tmp = fopen(confPath.c_str(),"w");
  272. if (tmp)
  273. fclose(tmp);
  274. }
  275. // TODO: restore membership certs
  276. }
  277. } // namespace ZeroTier