OneService.cpp 125 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699
  1. /*
  2. * Copyright (c)2013-2020 ZeroTier, Inc.
  3. *
  4. * Use of this software is governed by the Business Source License included
  5. * in the LICENSE.TXT file in the project's root directory.
  6. *
  7. * Change Date: 2025-01-01
  8. *
  9. * On the date above, in accordance with the Business Source License, use
  10. * of this software will be governed by version 2.0 of the Apache License.
  11. */
  12. /****/
  13. #include <exception>
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <string.h>
  17. #include <stdint.h>
  18. #include <string>
  19. #include <map>
  20. #include <vector>
  21. #include <algorithm>
  22. #include <list>
  23. #include <thread>
  24. #include <mutex>
  25. #include <condition_variable>
  26. #include "../version.h"
  27. #include "../include/ZeroTierOne.h"
  28. #include "../node/Constants.hpp"
  29. #include "../node/Mutex.hpp"
  30. #include "../node/Node.hpp"
  31. #include "../node/Utils.hpp"
  32. #include "../node/InetAddress.hpp"
  33. #include "../node/MAC.hpp"
  34. #include "../node/Identity.hpp"
  35. #include "../node/World.hpp"
  36. #include "../node/Salsa20.hpp"
  37. #include "../node/Poly1305.hpp"
  38. #include "../node/SHA512.hpp"
  39. #include "../node/Bond.hpp"
  40. #include "../node/Peer.hpp"
  41. #include "../osdep/Phy.hpp"
  42. #include "../osdep/OSUtils.hpp"
  43. #include "../osdep/Http.hpp"
  44. #include "../osdep/PortMapper.hpp"
  45. #include "../osdep/Binder.hpp"
  46. #include "../osdep/ManagedRoute.hpp"
  47. #include "../osdep/BlockingQueue.hpp"
  48. #include "OneService.hpp"
  49. #include "SoftwareUpdater.hpp"
  50. #include <cpp-httplib/httplib.h>
  51. #if ZT_SSO_ENABLED
  52. #include <zeroidc.h>
  53. #endif
  54. #ifdef __WINDOWS__
  55. #include <winsock2.h>
  56. #include <windows.h>
  57. #include <shlobj.h>
  58. #include <netioapi.h>
  59. #include <iphlpapi.h>
  60. //#include <unistd.h>
  61. #define stat _stat
  62. #else
  63. #include <sys/types.h>
  64. #include <sys/socket.h>
  65. #include <sys/stat.h>
  66. #include <sys/wait.h>
  67. #include <unistd.h>
  68. #include <ifaddrs.h>
  69. #endif
  70. #ifdef __APPLE__
  71. #include "../osdep/MacDNSHelper.hpp"
  72. #elif defined(__WINDOWS__)
  73. #include "../osdep/WinDNSHelper.hpp"
  74. #include "../osdep/WinFWHelper.hpp"
  75. #endif
  76. #ifdef ZT_USE_SYSTEM_HTTP_PARSER
  77. #include <http_parser.h>
  78. #else
  79. #include "../ext/http-parser/http_parser.h"
  80. #endif
  81. #include "../node/Metrics.hpp"
  82. #if ZT_VAULT_SUPPORT
  83. extern "C" {
  84. #include <curl/curl.h>
  85. }
  86. #endif
  87. #include <nlohmann/json.hpp>
  88. #include <inja/inja.hpp>
  89. using json = nlohmann::json;
  90. #include "../controller/EmbeddedNetworkController.hpp"
  91. #include "../controller/PostgreSQL.hpp"
  92. #include "../controller/Redis.hpp"
  93. #include "../osdep/EthernetTap.hpp"
  94. #ifdef __WINDOWS__
  95. #include "../osdep/WindowsEthernetTap.hpp"
  96. #endif
  97. #ifndef ZT_SOFTWARE_UPDATE_DEFAULT
  98. #define ZT_SOFTWARE_UPDATE_DEFAULT "disable"
  99. #endif
  100. // Sanity limits for HTTP
  101. #define ZT_MAX_HTTP_MESSAGE_SIZE (1024 * 1024 * 64)
  102. #define ZT_MAX_HTTP_CONNECTIONS 65536
  103. // Interface metric for ZeroTier taps -- this ensures that if we are on WiFi and also
  104. // bridged via ZeroTier to the same LAN traffic will (if the OS is sane) prefer WiFi.
  105. #define ZT_IF_METRIC 5000
  106. // How often to check for new multicast subscriptions on a tap device
  107. #define ZT_TAP_CHECK_MULTICAST_INTERVAL 5000
  108. // TCP fallback relay (run by ZeroTier, Inc. -- this will eventually go away)
  109. #ifndef ZT_SDK
  110. #define ZT_TCP_FALLBACK_RELAY "204.80.128.1/443"
  111. #endif
  112. // Frequency at which we re-resolve the TCP fallback relay
  113. #define ZT_TCP_FALLBACK_RERESOLVE_DELAY 86400000
  114. // Attempt to engage TCP fallback after this many ms of no reply to packets sent to global-scope IPs
  115. #define ZT_TCP_FALLBACK_AFTER 60000
  116. // How often to check for local interface addresses
  117. #define ZT_LOCAL_INTERFACE_CHECK_INTERVAL 60000
  118. // Maximum write buffer size for outgoing TCP connections (sanity limit)
  119. #define ZT_TCP_MAX_WRITEQ_SIZE 33554432
  120. // TCP activity timeout
  121. #define ZT_TCP_ACTIVITY_TIMEOUT 60000
  122. #if ZT_VAULT_SUPPORT
  123. size_t curlResponseWrite(void *ptr, size_t size, size_t nmemb, std::string *data)
  124. {
  125. data->append((char*)ptr, size * nmemb);
  126. return size * nmemb;
  127. }
  128. #endif
  129. namespace ZeroTier {
  130. std::string ssoResponseTemplate = R"""(
  131. <!doctype html>
  132. <html class="no-js" lang="">
  133. <head>
  134. <meta charset="utf-8">
  135. <meta http-equiv="x-ua-compatible" content="ie=edge">
  136. <title>Network SSO Login {{ networkId }}</title>
  137. <meta name="description" content="">
  138. <meta name="viewport" content="width=device-width, initial-scale=1">
  139. <style type="text/css">
  140. html,body {
  141. background: #eeeeee;
  142. margin: 0;
  143. padding: 0;
  144. font-family: "System Sans Serif";
  145. font-weight: normal;
  146. font-size: 12pt;
  147. height: 100%;
  148. width: 100%;
  149. }
  150. .container {
  151. position: absolute;
  152. left: 50%;
  153. top: 50%;
  154. -webkit-transform: translate(-50%, -50%);
  155. transform: translate(-50%, -50%);
  156. }
  157. .iconwrapper {
  158. margin: 10px 10px 10px 10px;
  159. }
  160. </style>
  161. </head>
  162. <body>
  163. <div class="container">
  164. <div class="iconwrapper">
  165. <svg id="Layer_1" width="225px" height="225px" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 225 225"><defs><style>.cls-1{fill:#fdb25d;}.cls-2{fill:none;stroke:#000;stroke-miterlimit:10;stroke-width:6.99px;}</style></defs><rect class="cls-1" width="225" height="225" rx="35.74"/><line class="cls-2" x1="25.65" y1="32.64" x2="199.35" y2="32.64"/><line class="cls-2" x1="112.5" y1="201.02" x2="112.5" y2="32.64"/><circle class="cls-2" cx="112.5" cy="115.22" r="56.54"/></svg>
  166. </div>
  167. <div class="text">{{ messageText }}</div>
  168. </div>
  169. </body>
  170. </html>
  171. )""";
  172. bool bearerTokenValid(const std::string authHeader, const std::string &checkToken) {
  173. std::vector<std::string> tokens = OSUtils::split(authHeader.c_str(), " ", NULL, NULL);
  174. if (tokens.size() != 2) {
  175. return false;
  176. }
  177. std::string bearer = tokens[0];
  178. std::string token = tokens[1];
  179. std::transform(bearer.begin(), bearer.end(), bearer.begin(), [](unsigned char c){return std::tolower(c);});
  180. if (bearer != "bearer") {
  181. return false;
  182. }
  183. if (token != checkToken) {
  184. return false;
  185. }
  186. return true;
  187. }
  188. #if ZT_DEBUG==1
  189. std::string dump_headers(const httplib::Headers &headers) {
  190. std::string s;
  191. char buf[BUFSIZ];
  192. for (auto it = headers.begin(); it != headers.end(); ++it) {
  193. const auto &x = *it;
  194. snprintf(buf, sizeof(buf), "%s: %s\n", x.first.c_str(), x.second.c_str());
  195. s += buf;
  196. }
  197. return s;
  198. }
  199. std::string http_log(const httplib::Request &req, const httplib::Response &res) {
  200. std::string s;
  201. char buf[BUFSIZ];
  202. s += "================================\n";
  203. snprintf(buf, sizeof(buf), "%s %s %s", req.method.c_str(),
  204. req.version.c_str(), req.path.c_str());
  205. s += buf;
  206. std::string query;
  207. for (auto it = req.params.begin(); it != req.params.end(); ++it) {
  208. const auto &x = *it;
  209. snprintf(buf, sizeof(buf), "%c%s=%s",
  210. (it == req.params.begin()) ? '?' : '&', x.first.c_str(),
  211. x.second.c_str());
  212. query += buf;
  213. }
  214. snprintf(buf, sizeof(buf), "%s\n", query.c_str());
  215. s += buf;
  216. s += dump_headers(req.headers);
  217. s += "--------------------------------\n";
  218. snprintf(buf, sizeof(buf), "%d %s\n", res.status, res.version.c_str());
  219. s += buf;
  220. s += dump_headers(res.headers);
  221. s += "\n";
  222. if (!res.body.empty()) { s += res.body; }
  223. s += "\n";
  224. return s;
  225. }
  226. #endif
  227. // Configured networks
  228. class NetworkState
  229. {
  230. public:
  231. NetworkState()
  232. : _webPort(9993)
  233. , _tap((EthernetTap *)0)
  234. #if ZT_SSO_ENABLED
  235. , _idc(nullptr)
  236. #endif
  237. {
  238. // Real defaults are in network 'up' code in network event handler
  239. _settings.allowManaged = true;
  240. _settings.allowGlobal = false;
  241. _settings.allowDefault = false;
  242. _settings.allowDNS = false;
  243. memset(&_config, 0, sizeof(ZT_VirtualNetworkConfig));
  244. }
  245. ~NetworkState()
  246. {
  247. this->_managedRoutes.clear();
  248. this->_tap.reset();
  249. #if ZT_SSO_ENABLED
  250. if (_idc) {
  251. zeroidc::zeroidc_stop(_idc);
  252. zeroidc::zeroidc_delete(_idc);
  253. _idc = nullptr;
  254. }
  255. #endif
  256. }
  257. void setWebPort(unsigned int port) {
  258. _webPort = port;
  259. }
  260. void setTap(std::shared_ptr<EthernetTap> tap) {
  261. this->_tap = tap;
  262. }
  263. std::shared_ptr<EthernetTap> tap() const {
  264. return _tap;
  265. }
  266. OneService::NetworkSettings settings() const {
  267. return _settings;
  268. }
  269. void setSettings(const OneService::NetworkSettings &settings) {
  270. _settings = settings;
  271. }
  272. void setAllowManaged(bool allow) {
  273. _settings.allowManaged = allow;
  274. }
  275. bool allowManaged() const {
  276. return _settings.allowManaged;
  277. }
  278. void setAllowGlobal(bool allow) {
  279. _settings.allowGlobal = allow;
  280. }
  281. bool allowGlobal() const {
  282. return _settings.allowGlobal;
  283. }
  284. void setAllowDefault(bool allow) {
  285. _settings.allowDefault = allow;
  286. }
  287. bool allowDefault() const {
  288. return _settings.allowDefault;
  289. }
  290. void setAllowDNS(bool allow) {
  291. _settings.allowDNS = allow;
  292. }
  293. bool allowDNS() const {
  294. return _settings.allowDNS;
  295. }
  296. std::vector<InetAddress> allowManagedWhitelist() const {
  297. return _settings.allowManagedWhitelist;
  298. }
  299. void addToAllowManagedWhiteList(const InetAddress& addr) {
  300. _settings.allowManagedWhitelist.push_back(addr);
  301. }
  302. const ZT_VirtualNetworkConfig& config() {
  303. return _config;
  304. }
  305. void setConfig(const ZT_VirtualNetworkConfig *nwc) {
  306. memcpy(&_config, nwc, sizeof(ZT_VirtualNetworkConfig));
  307. if (_config.ssoEnabled && _config.ssoVersion == 1) {
  308. #if ZT_SSO_ENABLED
  309. if (_idc == nullptr)
  310. {
  311. assert(_config.issuerURL != nullptr);
  312. assert(_config.ssoClientID != nullptr);
  313. assert(_config.centralAuthURL != nullptr);
  314. assert(_config.ssoProvider != nullptr);
  315. _idc = zeroidc::zeroidc_new(
  316. _config.issuerURL,
  317. _config.ssoClientID,
  318. _config.centralAuthURL,
  319. _config.ssoProvider,
  320. _webPort
  321. );
  322. if (_idc == nullptr) {
  323. fprintf(stderr, "idc is null\n");
  324. return;
  325. }
  326. }
  327. zeroidc::zeroidc_set_nonce_and_csrf(
  328. _idc,
  329. _config.ssoState,
  330. _config.ssoNonce
  331. );
  332. char* url = zeroidc::zeroidc_get_auth_url(_idc);
  333. memcpy(_config.authenticationURL, url, strlen(url));
  334. _config.authenticationURL[strlen(url)] = 0;
  335. zeroidc::free_cstr(url);
  336. if (zeroidc::zeroidc_is_running(_idc) && nwc->status == ZT_NETWORK_STATUS_AUTHENTICATION_REQUIRED) {
  337. zeroidc::zeroidc_kick_refresh_thread(_idc);
  338. }
  339. #endif
  340. }
  341. }
  342. std::vector<InetAddress>& managedIps() {
  343. return _managedIps;
  344. }
  345. void setManagedIps(const std::vector<InetAddress> &managedIps) {
  346. _managedIps = managedIps;
  347. }
  348. std::map< InetAddress, SharedPtr<ManagedRoute> >& managedRoutes() {
  349. return _managedRoutes;
  350. }
  351. char* doTokenExchange(const char *code) {
  352. char *ret = nullptr;
  353. #if ZT_SSO_ENABLED
  354. if (_idc == nullptr) {
  355. fprintf(stderr, "ainfo or idc null\n");
  356. return ret;
  357. }
  358. ret = zeroidc::zeroidc_token_exchange(_idc, code);
  359. zeroidc::zeroidc_set_nonce_and_csrf(
  360. _idc,
  361. _config.ssoState,
  362. _config.ssoNonce
  363. );
  364. char* url = zeroidc::zeroidc_get_auth_url(_idc);
  365. memcpy(_config.authenticationURL, url, strlen(url));
  366. _config.authenticationURL[strlen(url)] = 0;
  367. zeroidc::free_cstr(url);
  368. #endif
  369. return ret;
  370. }
  371. uint64_t getExpiryTime() {
  372. #if ZT_SSO_ENABLED
  373. if (_idc == nullptr) {
  374. fprintf(stderr, "idc is null\n");
  375. return 0;
  376. }
  377. return zeroidc::zeroidc_get_exp_time(_idc);
  378. #else
  379. return 0;
  380. #endif
  381. }
  382. private:
  383. unsigned int _webPort;
  384. std::shared_ptr<EthernetTap> _tap;
  385. ZT_VirtualNetworkConfig _config; // memcpy() of raw config from core
  386. std::vector<InetAddress> _managedIps;
  387. std::map< InetAddress, SharedPtr<ManagedRoute> > _managedRoutes;
  388. OneService::NetworkSettings _settings;
  389. #if ZT_SSO_ENABLED
  390. zeroidc::ZeroIDC *_idc;
  391. #endif
  392. };
  393. namespace {
  394. static const InetAddress NULL_INET_ADDR;
  395. // Fake TLS hello for TCP tunnel outgoing connections (TUNNELED mode)
  396. static const char ZT_TCP_TUNNEL_HELLO[9] = { 0x17,0x03,0x03,0x00,0x04,(char)ZEROTIER_ONE_VERSION_MAJOR,(char)ZEROTIER_ONE_VERSION_MINOR,(char)((ZEROTIER_ONE_VERSION_REVISION >> 8) & 0xff),(char)(ZEROTIER_ONE_VERSION_REVISION & 0xff) };
  397. static std::string _trimString(const std::string &s)
  398. {
  399. unsigned long end = (unsigned long)s.length();
  400. while (end) {
  401. char c = s[end - 1];
  402. if ((c == ' ')||(c == '\r')||(c == '\n')||(!c)||(c == '\t'))
  403. --end;
  404. else break;
  405. }
  406. unsigned long start = 0;
  407. while (start < end) {
  408. char c = s[start];
  409. if ((c == ' ')||(c == '\r')||(c == '\n')||(!c)||(c == '\t'))
  410. ++start;
  411. else break;
  412. }
  413. return s.substr(start,end - start);
  414. }
  415. static void _networkToJson(nlohmann::json &nj,NetworkState &ns)
  416. {
  417. char tmp[256];
  418. const char *nstatus = "",*ntype = "";
  419. switch(ns.config().status) {
  420. case ZT_NETWORK_STATUS_REQUESTING_CONFIGURATION: nstatus = "REQUESTING_CONFIGURATION"; break;
  421. case ZT_NETWORK_STATUS_OK: nstatus = "OK"; break;
  422. case ZT_NETWORK_STATUS_ACCESS_DENIED: nstatus = "ACCESS_DENIED"; break;
  423. case ZT_NETWORK_STATUS_NOT_FOUND: nstatus = "NOT_FOUND"; break;
  424. case ZT_NETWORK_STATUS_PORT_ERROR: nstatus = "PORT_ERROR"; break;
  425. case ZT_NETWORK_STATUS_CLIENT_TOO_OLD: nstatus = "CLIENT_TOO_OLD"; break;
  426. case ZT_NETWORK_STATUS_AUTHENTICATION_REQUIRED: nstatus = "AUTHENTICATION_REQUIRED"; break;
  427. }
  428. switch(ns.config().type) {
  429. case ZT_NETWORK_TYPE_PRIVATE: ntype = "PRIVATE"; break;
  430. case ZT_NETWORK_TYPE_PUBLIC: ntype = "PUBLIC"; break;
  431. }
  432. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",ns.config().nwid);
  433. nj["id"] = tmp;
  434. nj["nwid"] = tmp;
  435. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)((ns.config().mac >> 40) & 0xff),(unsigned int)((ns.config().mac >> 32) & 0xff),(unsigned int)((ns.config().mac >> 24) & 0xff),(unsigned int)((ns.config().mac >> 16) & 0xff),(unsigned int)((ns.config().mac >> 8) & 0xff),(unsigned int)(ns.config().mac & 0xff));
  436. nj["mac"] = tmp;
  437. nj["name"] = ns.config().name;
  438. nj["status"] = nstatus;
  439. nj["type"] = ntype;
  440. nj["mtu"] = ns.config().mtu;
  441. nj["dhcp"] = (bool)(ns.config().dhcp != 0);
  442. nj["bridge"] = (bool)(ns.config().bridge != 0);
  443. nj["broadcastEnabled"] = (bool)(ns.config().broadcastEnabled != 0);
  444. nj["portError"] = ns.config().portError;
  445. nj["netconfRevision"] = ns.config().netconfRevision;
  446. nj["portDeviceName"] = ns.tap()->deviceName();
  447. OneService::NetworkSettings localSettings = ns.settings();
  448. nj["allowManaged"] = localSettings.allowManaged;
  449. nj["allowGlobal"] = localSettings.allowGlobal;
  450. nj["allowDefault"] = localSettings.allowDefault;
  451. nj["allowDNS"] = localSettings.allowDNS;
  452. nlohmann::json aa = nlohmann::json::array();
  453. for(unsigned int i=0;i<ns.config().assignedAddressCount;++i) {
  454. aa.push_back(reinterpret_cast<const InetAddress *>(&(ns.config().assignedAddresses[i]))->toString(tmp));
  455. }
  456. nj["assignedAddresses"] = aa;
  457. nlohmann::json ra = nlohmann::json::array();
  458. for(unsigned int i=0;i<ns.config().routeCount;++i) {
  459. nlohmann::json rj;
  460. rj["target"] = reinterpret_cast<const InetAddress *>(&(ns.config().routes[i].target))->toString(tmp);
  461. if (ns.config().routes[i].via.ss_family == ns.config().routes[i].target.ss_family)
  462. rj["via"] = reinterpret_cast<const InetAddress *>(&(ns.config().routes[i].via))->toIpString(tmp);
  463. else rj["via"] = nlohmann::json();
  464. rj["flags"] = (int)ns.config().routes[i].flags;
  465. rj["metric"] = (int)ns.config().routes[i].metric;
  466. ra.push_back(rj);
  467. }
  468. nj["routes"] = ra;
  469. nlohmann::json mca = nlohmann::json::array();
  470. for(unsigned int i=0;i<ns.config().multicastSubscriptionCount;++i) {
  471. nlohmann::json m;
  472. m["mac"] = MAC(ns.config().multicastSubscriptions[i].mac).toString(tmp);
  473. m["adi"] = ns.config().multicastSubscriptions[i].adi;
  474. mca.push_back(m);
  475. }
  476. nj["multicastSubscriptions"] = mca;
  477. nlohmann::json m;
  478. m["domain"] = ns.config().dns.domain;
  479. m["servers"] = nlohmann::json::array();
  480. for(int j=0;j<ZT_MAX_DNS_SERVERS;++j) {
  481. InetAddress a(ns.config().dns.server_addr[j]);
  482. if (a.isV4() || a.isV6()) {
  483. char buf[256];
  484. m["servers"].push_back(a.toIpString(buf));
  485. }
  486. }
  487. nj["dns"] = m;
  488. if (ns.config().ssoEnabled) {
  489. const char* authURL = ns.config().authenticationURL;
  490. //fprintf(stderr, "Auth URL: %s\n", authURL);
  491. nj["authenticationURL"] = authURL;
  492. nj["authenticationExpiryTime"] = (ns.getExpiryTime()*1000);
  493. nj["ssoEnabled"] = ns.config().ssoEnabled;
  494. }
  495. }
  496. static void _peerToJson(nlohmann::json &pj,const ZT_Peer *peer, SharedPtr<Bond> &bond, bool isTunneled)
  497. {
  498. char tmp[256];
  499. const char *prole = "";
  500. switch(peer->role) {
  501. case ZT_PEER_ROLE_LEAF: prole = "LEAF"; break;
  502. case ZT_PEER_ROLE_MOON: prole = "MOON"; break;
  503. case ZT_PEER_ROLE_PLANET: prole = "PLANET"; break;
  504. }
  505. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.10llx",peer->address);
  506. pj["address"] = tmp;
  507. pj["versionMajor"] = peer->versionMajor;
  508. pj["versionMinor"] = peer->versionMinor;
  509. pj["versionRev"] = peer->versionRev;
  510. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%d.%d.%d",peer->versionMajor,peer->versionMinor,peer->versionRev);
  511. pj["version"] = tmp;
  512. pj["latency"] = peer->latency;
  513. pj["role"] = prole;
  514. pj["isBonded"] = peer->isBonded;
  515. pj["tunneled"] = isTunneled;
  516. if (bond && peer->isBonded) {
  517. pj["bondingPolicyCode"] = peer->bondingPolicy;
  518. pj["bondingPolicyStr"] = Bond::getPolicyStrByCode(peer->bondingPolicy);
  519. pj["numAliveLinks"] = peer->numAliveLinks;
  520. pj["numTotalLinks"] = peer->numTotalLinks;
  521. pj["failoverInterval"] = bond->getFailoverInterval();
  522. pj["downDelay"] = bond->getDownDelay();
  523. pj["upDelay"] = bond->getUpDelay();
  524. pj["packetsPerLink"] = bond->getPacketsPerLink();
  525. }
  526. nlohmann::json pa = nlohmann::json::array();
  527. for(unsigned int i=0;i<peer->pathCount;++i) {
  528. int64_t lastSend = peer->paths[i].lastSend;
  529. int64_t lastReceive = peer->paths[i].lastReceive;
  530. nlohmann::json j;
  531. j["address"] = reinterpret_cast<const InetAddress *>(&(peer->paths[i].address))->toString(tmp);
  532. j["lastSend"] = (lastSend < 0) ? 0 : lastSend;
  533. j["lastReceive"] = (lastReceive < 0) ? 0 : lastReceive;
  534. j["trustedPathId"] = peer->paths[i].trustedPathId;
  535. j["active"] = (bool)(peer->paths[i].expired == 0);
  536. j["expired"] = (bool)(peer->paths[i].expired != 0);
  537. j["preferred"] = (bool)(peer->paths[i].preferred != 0);
  538. j["localSocket"] = peer->paths[i].localSocket;
  539. if (bond && peer->isBonded) {
  540. uint64_t now = OSUtils::now();
  541. j["ifname"] = std::string(peer->paths[i].ifname);
  542. j["latencyMean"] = peer->paths[i].latencyMean;
  543. j["latencyVariance"] = peer->paths[i].latencyVariance;
  544. j["packetLossRatio"] = peer->paths[i].packetLossRatio;
  545. j["packetErrorRatio"] = peer->paths[i].packetErrorRatio;
  546. j["lastInAge"] = (now - lastReceive);
  547. j["lastOutAge"] = (now - lastSend);
  548. j["bonded"] = peer->paths[i].bonded;
  549. j["eligible"] = peer->paths[i].eligible;
  550. j["givenLinkSpeed"] = peer->paths[i].linkSpeed;
  551. j["relativeQuality"] = peer->paths[i].relativeQuality;
  552. }
  553. pa.push_back(j);
  554. }
  555. pj["paths"] = pa;
  556. }
  557. static void _moonToJson(nlohmann::json &mj,const World &world)
  558. {
  559. char tmp[4096];
  560. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",world.id());
  561. mj["id"] = tmp;
  562. mj["timestamp"] = world.timestamp();
  563. mj["signature"] = Utils::hex(world.signature().data,ZT_C25519_SIGNATURE_LEN,tmp);
  564. mj["updatesMustBeSignedBy"] = Utils::hex(world.updatesMustBeSignedBy().data,ZT_C25519_PUBLIC_KEY_LEN,tmp);
  565. nlohmann::json ra = nlohmann::json::array();
  566. for(std::vector<World::Root>::const_iterator r(world.roots().begin());r!=world.roots().end();++r) {
  567. nlohmann::json rj;
  568. rj["identity"] = r->identity.toString(false,tmp);
  569. nlohmann::json eps = nlohmann::json::array();
  570. for(std::vector<InetAddress>::const_iterator a(r->stableEndpoints.begin());a!=r->stableEndpoints.end();++a)
  571. eps.push_back(a->toString(tmp));
  572. rj["stableEndpoints"] = eps;
  573. ra.push_back(rj);
  574. }
  575. mj["roots"] = ra;
  576. mj["waiting"] = false;
  577. }
  578. class OneServiceImpl;
  579. static int SnodeVirtualNetworkConfigFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t nwid,void **nuptr,enum ZT_VirtualNetworkConfigOperation op,const ZT_VirtualNetworkConfig *nwconf);
  580. static void SnodeEventCallback(ZT_Node *node,void *uptr,void *tptr,enum ZT_Event event,const void *metaData);
  581. static void SnodeStatePutFunction(ZT_Node *node,void *uptr,void *tptr,enum ZT_StateObjectType type,const uint64_t id[2],const void *data,int len);
  582. static int SnodeStateGetFunction(ZT_Node *node,void *uptr,void *tptr,enum ZT_StateObjectType type,const uint64_t id[2],void *data,unsigned int maxlen);
  583. static int SnodeWirePacketSendFunction(ZT_Node *node,void *uptr,void *tptr,int64_t localSocket,const struct sockaddr_storage *addr,const void *data,unsigned int len,unsigned int ttl);
  584. static void SnodeVirtualNetworkFrameFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t nwid,void **nuptr,uint64_t sourceMac,uint64_t destMac,unsigned int etherType,unsigned int vlanId,const void *data,unsigned int len);
  585. static int SnodePathCheckFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t ztaddr,int64_t localSocket,const struct sockaddr_storage *remoteAddr);
  586. static int SnodePathLookupFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t ztaddr,int family,struct sockaddr_storage *result);
  587. static void StapFrameHandler(void *uptr,void *tptr,uint64_t nwid,const MAC &from,const MAC &to,unsigned int etherType,unsigned int vlanId,const void *data,unsigned int len);
  588. static int ShttpOnMessageBegin(http_parser *parser);
  589. static int ShttpOnUrl(http_parser *parser,const char *ptr,size_t length);
  590. #if (HTTP_PARSER_VERSION_MAJOR >= 2) && (HTTP_PARSER_VERSION_MINOR >= 2)
  591. static int ShttpOnStatus(http_parser *parser,const char *ptr,size_t length);
  592. #else
  593. static int ShttpOnStatus(http_parser *parser);
  594. #endif
  595. static int ShttpOnHeaderField(http_parser *parser,const char *ptr,size_t length);
  596. static int ShttpOnValue(http_parser *parser,const char *ptr,size_t length);
  597. static int ShttpOnHeadersComplete(http_parser *parser);
  598. static int ShttpOnBody(http_parser *parser,const char *ptr,size_t length);
  599. static int ShttpOnMessageComplete(http_parser *parser);
  600. #if (HTTP_PARSER_VERSION_MAJOR >= 2) && (HTTP_PARSER_VERSION_MINOR >= 1)
  601. static const struct http_parser_settings HTTP_PARSER_SETTINGS = {
  602. ShttpOnMessageBegin,
  603. ShttpOnUrl,
  604. ShttpOnStatus,
  605. ShttpOnHeaderField,
  606. ShttpOnValue,
  607. ShttpOnHeadersComplete,
  608. ShttpOnBody,
  609. ShttpOnMessageComplete
  610. };
  611. #else
  612. static const struct http_parser_settings HTTP_PARSER_SETTINGS = {
  613. ShttpOnMessageBegin,
  614. ShttpOnUrl,
  615. ShttpOnHeaderField,
  616. ShttpOnValue,
  617. ShttpOnHeadersComplete,
  618. ShttpOnBody,
  619. ShttpOnMessageComplete
  620. };
  621. #endif
  622. /**
  623. * A TCP connection and related state and buffers
  624. */
  625. struct TcpConnection
  626. {
  627. enum {
  628. TCP_UNCATEGORIZED_INCOMING, // uncategorized incoming connection
  629. TCP_HTTP_INCOMING,
  630. TCP_HTTP_OUTGOING,
  631. TCP_TUNNEL_OUTGOING // TUNNELED mode proxy outbound connection
  632. } type;
  633. OneServiceImpl *parent;
  634. PhySocket *sock;
  635. InetAddress remoteAddr;
  636. uint64_t lastReceive;
  637. // Used for inbound HTTP connections
  638. http_parser parser;
  639. unsigned long messageSize;
  640. std::string currentHeaderField;
  641. std::string currentHeaderValue;
  642. std::string url;
  643. std::string status;
  644. std::map< std::string,std::string > headers;
  645. std::string readq;
  646. std::string writeq;
  647. Mutex writeq_m;
  648. };
  649. struct OneServiceIncomingPacket
  650. {
  651. uint64_t now;
  652. int64_t sock;
  653. struct sockaddr_storage from;
  654. unsigned int size;
  655. uint8_t data[ZT_MAX_MTU];
  656. };
  657. class OneServiceImpl : public OneService
  658. {
  659. public:
  660. // begin member variables --------------------------------------------------
  661. const std::string _homePath;
  662. std::string _authToken;
  663. std::string _metricsToken;
  664. std::string _controllerDbPath;
  665. const std::string _networksPath;
  666. const std::string _moonsPath;
  667. EmbeddedNetworkController *_controller;
  668. Phy<OneServiceImpl *> _phy;
  669. Node *_node;
  670. SoftwareUpdater *_updater;
  671. bool _updateAutoApply;
  672. httplib::Server _controlPlane;
  673. std::thread _serverThread;
  674. bool _allowTcpFallbackRelay;
  675. bool _forceTcpRelay;
  676. bool _allowSecondaryPort;
  677. unsigned int _primaryPort;
  678. unsigned int _secondaryPort;
  679. unsigned int _tertiaryPort;
  680. volatile unsigned int _udpPortPickerCounter;
  681. // Local configuration and memo-ized information from it
  682. json _localConfig;
  683. Hashtable< uint64_t,std::vector<InetAddress> > _v4Hints;
  684. Hashtable< uint64_t,std::vector<InetAddress> > _v6Hints;
  685. Hashtable< uint64_t,std::vector<InetAddress> > _v4Blacklists;
  686. Hashtable< uint64_t,std::vector<InetAddress> > _v6Blacklists;
  687. std::vector< InetAddress > _globalV4Blacklist;
  688. std::vector< InetAddress > _globalV6Blacklist;
  689. std::vector< InetAddress > _allowManagementFrom;
  690. std::vector< std::string > _interfacePrefixBlacklist;
  691. Mutex _localConfig_m;
  692. std::vector<InetAddress> explicitBind;
  693. /*
  694. * To attempt to handle NAT/gateway craziness we use three local UDP ports:
  695. *
  696. * [0] is the normal/default port, usually 9993
  697. * [1] is a port derived from our ZeroTier address
  698. * [2] is a port computed from the normal/default for use with uPnP/NAT-PMP mappings
  699. *
  700. * [2] exists because on some gateways trying to do regular NAT-t interferes
  701. * destructively with uPnP port mapping behavior in very weird buggy ways.
  702. * It's only used if uPnP/NAT-PMP is enabled in this build.
  703. */
  704. unsigned int _ports[3];
  705. Binder _binder;
  706. // Time we last received a packet from a global address
  707. uint64_t _lastDirectReceiveFromGlobal;
  708. #ifdef ZT_TCP_FALLBACK_RELAY
  709. InetAddress _fallbackRelayAddress;
  710. uint64_t _lastSendToGlobalV4;
  711. #endif
  712. // Last potential sleep/wake event
  713. uint64_t _lastRestart;
  714. // Deadline for the next background task service function
  715. volatile int64_t _nextBackgroundTaskDeadline;
  716. std::map<uint64_t,NetworkState> _nets;
  717. Mutex _nets_m;
  718. // Active TCP/IP connections
  719. std::vector< TcpConnection * > _tcpConnections;
  720. Mutex _tcpConnections_m;
  721. TcpConnection *_tcpFallbackTunnel;
  722. // Termination status information
  723. ReasonForTermination _termReason;
  724. std::string _fatalErrorMessage;
  725. Mutex _termReason_m;
  726. // uPnP/NAT-PMP port mapper if enabled
  727. bool _portMappingEnabled; // local.conf settings
  728. #ifdef ZT_USE_MINIUPNPC
  729. PortMapper *_portMapper;
  730. #endif
  731. // HashiCorp Vault Settings
  732. #if ZT_VAULT_SUPPORT
  733. bool _vaultEnabled;
  734. std::string _vaultURL;
  735. std::string _vaultToken;
  736. std::string _vaultPath; // defaults to cubbyhole/zerotier/identity.secret for per-access key storage
  737. #endif
  738. // Set to false to force service to stop
  739. volatile bool _run;
  740. Mutex _run_m;
  741. RedisConfig *_rc;
  742. std::string _ssoRedirectURL;
  743. // end member variables ----------------------------------------------------
  744. OneServiceImpl(const char *hp,unsigned int port) :
  745. _homePath((hp) ? hp : ".")
  746. ,_controllerDbPath(_homePath + ZT_PATH_SEPARATOR_S "controller.d")
  747. ,_networksPath(_homePath + ZT_PATH_SEPARATOR_S "networks.d")
  748. ,_moonsPath(_homePath + ZT_PATH_SEPARATOR_S "moons.d")
  749. ,_controller((EmbeddedNetworkController *)0)
  750. ,_phy(this,false,true)
  751. ,_node((Node *)0)
  752. ,_updater((SoftwareUpdater *)0)
  753. ,_updateAutoApply(false)
  754. ,_controlPlane()
  755. ,_serverThread()
  756. ,_forceTcpRelay(false)
  757. ,_primaryPort(port)
  758. ,_udpPortPickerCounter(0)
  759. ,_lastDirectReceiveFromGlobal(0)
  760. #ifdef ZT_TCP_FALLBACK_RELAY
  761. , _fallbackRelayAddress(ZT_TCP_FALLBACK_RELAY)
  762. ,_lastSendToGlobalV4(0)
  763. #endif
  764. ,_lastRestart(0)
  765. ,_nextBackgroundTaskDeadline(0)
  766. ,_tcpFallbackTunnel((TcpConnection *)0)
  767. ,_termReason(ONE_STILL_RUNNING)
  768. ,_portMappingEnabled(true)
  769. #ifdef ZT_USE_MINIUPNPC
  770. ,_portMapper((PortMapper *)0)
  771. #endif
  772. #ifdef ZT_VAULT_SUPPORT
  773. ,_vaultEnabled(false)
  774. ,_vaultURL()
  775. ,_vaultToken()
  776. ,_vaultPath("cubbyhole/zerotier")
  777. #endif
  778. ,_run(true)
  779. ,_rc(NULL)
  780. ,_ssoRedirectURL()
  781. {
  782. _ports[0] = 0;
  783. _ports[1] = 0;
  784. _ports[2] = 0;
  785. prometheus::simpleapi::saver.set_registry(prometheus::simpleapi::registry_ptr);
  786. prometheus::simpleapi::saver.set_delay(std::chrono::seconds(5));
  787. prometheus::simpleapi::saver.set_out_file(_homePath + ZT_PATH_SEPARATOR + "metrics.prom");
  788. #if ZT_VAULT_SUPPORT
  789. curl_global_init(CURL_GLOBAL_DEFAULT);
  790. #endif
  791. }
  792. virtual ~OneServiceImpl()
  793. {
  794. #ifdef __WINDOWS__
  795. WinFWHelper::removeICMPRules();
  796. #endif
  797. _binder.closeAll(_phy);
  798. #if ZT_VAULT_SUPPORT
  799. curl_global_cleanup();
  800. #endif
  801. _controlPlane.stop();
  802. _serverThread.join();
  803. #ifdef ZT_USE_MINIUPNPC
  804. delete _portMapper;
  805. #endif
  806. delete _controller;
  807. delete _rc;
  808. }
  809. virtual ReasonForTermination run()
  810. {
  811. try {
  812. {
  813. const std::string authTokenPath(_homePath + ZT_PATH_SEPARATOR_S "authtoken.secret");
  814. if (!OSUtils::readFile(authTokenPath.c_str(),_authToken)) {
  815. unsigned char foo[24];
  816. Utils::getSecureRandom(foo,sizeof(foo));
  817. _authToken = "";
  818. for(unsigned int i=0;i<sizeof(foo);++i)
  819. _authToken.push_back("abcdefghijklmnopqrstuvwxyz0123456789"[(unsigned long)foo[i] % 36]);
  820. if (!OSUtils::writeFile(authTokenPath.c_str(),_authToken)) {
  821. Mutex::Lock _l(_termReason_m);
  822. _termReason = ONE_UNRECOVERABLE_ERROR;
  823. _fatalErrorMessage = "authtoken.secret could not be written";
  824. return _termReason;
  825. } else {
  826. OSUtils::lockDownFile(authTokenPath.c_str(),false);
  827. }
  828. }
  829. _authToken = _trimString(_authToken);
  830. }
  831. {
  832. const std::string metricsTokenPath(_homePath + ZT_PATH_SEPARATOR_S "metricstoken.secret");
  833. if (!OSUtils::readFile(metricsTokenPath.c_str(),_metricsToken)) {
  834. unsigned char foo[24];
  835. Utils::getSecureRandom(foo,sizeof(foo));
  836. _metricsToken = "";
  837. for(unsigned int i=0;i<sizeof(foo);++i)
  838. _metricsToken.push_back("abcdefghijklmnopqrstuvwxyz0123456789"[(unsigned long)foo[i] % 36]);
  839. if (!OSUtils::writeFile(metricsTokenPath.c_str(),_metricsToken)) {
  840. Mutex::Lock _l(_termReason_m);
  841. _termReason = ONE_UNRECOVERABLE_ERROR;
  842. _fatalErrorMessage = "metricstoken.secret could not be written";
  843. return _termReason;
  844. } else {
  845. OSUtils::lockDownFile(metricsTokenPath.c_str(),false);
  846. }
  847. }
  848. _metricsToken = _trimString(_metricsToken);
  849. }
  850. {
  851. struct ZT_Node_Callbacks cb;
  852. cb.version = 0;
  853. cb.stateGetFunction = SnodeStateGetFunction;
  854. cb.statePutFunction = SnodeStatePutFunction;
  855. cb.wirePacketSendFunction = SnodeWirePacketSendFunction;
  856. cb.virtualNetworkFrameFunction = SnodeVirtualNetworkFrameFunction;
  857. cb.virtualNetworkConfigFunction = SnodeVirtualNetworkConfigFunction;
  858. cb.eventCallback = SnodeEventCallback;
  859. cb.pathCheckFunction = SnodePathCheckFunction;
  860. cb.pathLookupFunction = SnodePathLookupFunction;
  861. _node = new Node(this,(void *)0,&cb,OSUtils::now());
  862. }
  863. // local.conf
  864. readLocalSettings();
  865. applyLocalConfig();
  866. // Save original port number to show it if bind error
  867. const int _configuredPort = _primaryPort;
  868. // Make sure we can use the primary port, and hunt for one if configured to do so
  869. const int portTrials = (_primaryPort == 0) ? 256 : 1; // if port is 0, pick random
  870. for(int k=0;k<portTrials;++k) {
  871. if (_primaryPort == 0) {
  872. unsigned int randp = 0;
  873. Utils::getSecureRandom(&randp,sizeof(randp));
  874. _primaryPort = 20000 + (randp % 45500);
  875. }
  876. if (_trialBind(_primaryPort)) {
  877. _ports[0] = _primaryPort;
  878. } else {
  879. _primaryPort = 0;
  880. }
  881. }
  882. if (_ports[0] == 0) {
  883. Mutex::Lock _l(_termReason_m);
  884. _termReason = ONE_UNRECOVERABLE_ERROR;
  885. _fatalErrorMessage = std::string("cannot bind to local control interface port ")+std::to_string(_configuredPort);
  886. return _termReason;
  887. }
  888. // Save primary port to a file so CLIs and GUIs can learn it easily
  889. char portstr[64];
  890. OSUtils::ztsnprintf(portstr,sizeof(portstr),"%u",_ports[0]);
  891. OSUtils::writeFile((_homePath + ZT_PATH_SEPARATOR_S "zerotier-one.port").c_str(),std::string(portstr));
  892. // Attempt to bind to a secondary port.
  893. // This exists because there are buggy NATs out there that fail if more
  894. // than one device behind the same NAT tries to use the same internal
  895. // private address port number. Buggy NATs are a running theme.
  896. //
  897. // This used to pick the secondary port based on the node ID until we
  898. // discovered another problem: buggy routers and malicious traffic
  899. // "detection". A lot of routers have such things built in these days
  900. // and mis-detect ZeroTier traffic as malicious and block it resulting
  901. // in a node that appears to be in a coma. Secondary ports are now
  902. // randomized on startup.
  903. if (_allowSecondaryPort) {
  904. if (_secondaryPort) {
  905. _ports[1] = _secondaryPort;
  906. } else {
  907. _ports[1] = _getRandomPort();
  908. }
  909. }
  910. #ifdef ZT_USE_MINIUPNPC
  911. if (_portMappingEnabled) {
  912. // If we're running uPnP/NAT-PMP, bind a *third* port for that. We can't
  913. // use the other two ports for that because some NATs do really funky
  914. // stuff with ports that are explicitly mapped that breaks things.
  915. if (_tertiaryPort) {
  916. _ports[2] = _tertiaryPort;
  917. } else {
  918. _ports[2] = _getRandomPort();
  919. }
  920. if (_ports[2]) {
  921. char uniqueName[64];
  922. OSUtils::ztsnprintf(uniqueName,sizeof(uniqueName),"ZeroTier/%.10llx@%u",_node->address(),_ports[2]);
  923. _portMapper = new PortMapper(_ports[2],uniqueName);
  924. }
  925. }
  926. #endif
  927. // Delete legacy iddb.d if present (cleanup)
  928. OSUtils::rmDashRf((_homePath + ZT_PATH_SEPARATOR_S "iddb.d").c_str());
  929. // Network controller is now enabled by default for desktop and server
  930. _controller = new EmbeddedNetworkController(_node,_homePath.c_str(),_controllerDbPath.c_str(),_ports[0], _rc);
  931. if (!_ssoRedirectURL.empty()) {
  932. _controller->setSSORedirectURL(_ssoRedirectURL);
  933. }
  934. _node->setNetconfMaster((void *)_controller);
  935. startHTTPControlPlane();
  936. // Join existing networks in networks.d
  937. {
  938. std::vector<std::string> networksDotD(OSUtils::listDirectory((_homePath + ZT_PATH_SEPARATOR_S "networks.d").c_str()));
  939. for(std::vector<std::string>::iterator f(networksDotD.begin());f!=networksDotD.end();++f) {
  940. std::size_t dot = f->find_last_of('.');
  941. if ((dot == 16)&&(f->substr(16) == ".conf"))
  942. _node->join(Utils::hexStrToU64(f->substr(0,dot).c_str()),(void *)0,(void *)0);
  943. }
  944. }
  945. // Orbit existing moons in moons.d
  946. {
  947. std::vector<std::string> moonsDotD(OSUtils::listDirectory((_homePath + ZT_PATH_SEPARATOR_S "moons.d").c_str()));
  948. for(std::vector<std::string>::iterator f(moonsDotD.begin());f!=moonsDotD.end();++f) {
  949. std::size_t dot = f->find_last_of('.');
  950. if ((dot == 16)&&(f->substr(16) == ".moon"))
  951. _node->orbit((void *)0,Utils::hexStrToU64(f->substr(0,dot).c_str()),0);
  952. }
  953. }
  954. // Main I/O loop
  955. _nextBackgroundTaskDeadline = 0;
  956. int64_t clockShouldBe = OSUtils::now();
  957. _lastRestart = clockShouldBe;
  958. int64_t lastTapMulticastGroupCheck = 0;
  959. int64_t lastBindRefresh = 0;
  960. int64_t lastUpdateCheck = clockShouldBe;
  961. int64_t lastCleanedPeersDb = 0;
  962. int64_t lastLocalInterfaceAddressCheck = (clockShouldBe - ZT_LOCAL_INTERFACE_CHECK_INTERVAL) + 15000; // do this in 15s to give portmapper time to configure and other things time to settle
  963. int64_t lastLocalConfFileCheck = OSUtils::now();
  964. int64_t lastOnline = lastLocalConfFileCheck;
  965. for(;;) {
  966. _run_m.lock();
  967. if (!_run) {
  968. _run_m.unlock();
  969. _termReason_m.lock();
  970. _termReason = ONE_NORMAL_TERMINATION;
  971. _termReason_m.unlock();
  972. break;
  973. } else {
  974. _run_m.unlock();
  975. }
  976. const int64_t now = OSUtils::now();
  977. // Attempt to detect sleep/wake events by detecting delay overruns
  978. bool restarted = false;
  979. if ((now > clockShouldBe)&&((now - clockShouldBe) > 10000)) {
  980. _lastRestart = now;
  981. restarted = true;
  982. }
  983. // Check for updates (if enabled)
  984. if ((_updater)&&((now - lastUpdateCheck) > 10000)) {
  985. lastUpdateCheck = now;
  986. if (_updater->check(now) && _updateAutoApply)
  987. _updater->apply();
  988. }
  989. // Reload local.conf if anything changed recently
  990. if ((now - lastLocalConfFileCheck) >= ZT_LOCAL_CONF_FILE_CHECK_INTERVAL) {
  991. lastLocalConfFileCheck = now;
  992. struct stat result;
  993. if(stat((_homePath + ZT_PATH_SEPARATOR_S "local.conf").c_str(), &result)==0) {
  994. int64_t mod_time = result.st_mtime * 1000;
  995. if ((now - mod_time) <= ZT_LOCAL_CONF_FILE_CHECK_INTERVAL) {
  996. readLocalSettings();
  997. applyLocalConfig();
  998. }
  999. }
  1000. }
  1001. // If secondary port is not configured to a constant value and we've been offline for a while,
  1002. // bind a new secondary port. This is a workaround for a "coma" issue caused by buggy NATs that stop
  1003. // working on one port after a while.
  1004. if (_node->online()) {
  1005. lastOnline = now;
  1006. } else if ((_secondaryPort == 0)&&((now - lastOnline) > ZT_PATH_HEARTBEAT_PERIOD)) {
  1007. _secondaryPort = _getRandomPort();
  1008. lastBindRefresh = 0;
  1009. }
  1010. // Refresh bindings in case device's interfaces have changed, and also sync routes to update any shadow routes (e.g. shadow default)
  1011. if (((now - lastBindRefresh) >= (_node->bondController()->inUse() ? ZT_BINDER_REFRESH_PERIOD / 4 : ZT_BINDER_REFRESH_PERIOD))||(restarted)) {
  1012. lastBindRefresh = now;
  1013. unsigned int p[3];
  1014. unsigned int pc = 0;
  1015. for(int i=0;i<3;++i) {
  1016. if (_ports[i])
  1017. p[pc++] = _ports[i];
  1018. }
  1019. if (!_forceTcpRelay) {
  1020. // Only bother binding UDP ports if we aren't forcing TCP-relay mode
  1021. _binder.refresh(_phy,p,pc,explicitBind,*this);
  1022. }
  1023. {
  1024. Mutex::Lock _l(_nets_m);
  1025. for(std::map<uint64_t,NetworkState>::iterator n(_nets.begin());n!=_nets.end();++n) {
  1026. if (n->second.tap())
  1027. syncManagedStuff(n->second,false,true,false);
  1028. }
  1029. }
  1030. }
  1031. // Run background task processor in core if it's time to do so
  1032. int64_t dl = _nextBackgroundTaskDeadline;
  1033. if (dl <= now) {
  1034. _node->processBackgroundTasks((void *)0,now,&_nextBackgroundTaskDeadline);
  1035. dl = _nextBackgroundTaskDeadline;
  1036. }
  1037. // Close TCP fallback tunnel if we have direct UDP
  1038. if (!_forceTcpRelay && (_tcpFallbackTunnel) && ((now - _lastDirectReceiveFromGlobal) < (ZT_TCP_FALLBACK_AFTER / 2))) {
  1039. _phy.close(_tcpFallbackTunnel->sock);
  1040. }
  1041. // Sync multicast group memberships
  1042. if ((now - lastTapMulticastGroupCheck) >= ZT_TAP_CHECK_MULTICAST_INTERVAL) {
  1043. lastTapMulticastGroupCheck = now;
  1044. std::vector< std::pair< uint64_t,std::pair< std::vector<MulticastGroup>,std::vector<MulticastGroup> > > > mgChanges;
  1045. {
  1046. Mutex::Lock _l(_nets_m);
  1047. mgChanges.reserve(_nets.size() + 1);
  1048. for(std::map<uint64_t,NetworkState>::const_iterator n(_nets.begin());n!=_nets.end();++n) {
  1049. if (n->second.tap()) {
  1050. mgChanges.push_back(std::pair< uint64_t,std::pair< std::vector<MulticastGroup>,std::vector<MulticastGroup> > >(n->first,std::pair< std::vector<MulticastGroup>,std::vector<MulticastGroup> >()));
  1051. n->second.tap()->scanMulticastGroups(mgChanges.back().second.first,mgChanges.back().second.second);
  1052. }
  1053. }
  1054. }
  1055. for(std::vector< std::pair< uint64_t,std::pair< std::vector<MulticastGroup>,std::vector<MulticastGroup> > > >::iterator c(mgChanges.begin());c!=mgChanges.end();++c) {
  1056. for(std::vector<MulticastGroup>::iterator m(c->second.first.begin());m!=c->second.first.end();++m)
  1057. _node->multicastSubscribe((void *)0,c->first,m->mac().toInt(),m->adi());
  1058. for(std::vector<MulticastGroup>::iterator m(c->second.second.begin());m!=c->second.second.end();++m)
  1059. _node->multicastUnsubscribe(c->first,m->mac().toInt(),m->adi());
  1060. }
  1061. }
  1062. // Sync information about physical network interfaces
  1063. if ((now - lastLocalInterfaceAddressCheck) >= (_node->bondController()->inUse() ? ZT_LOCAL_INTERFACE_CHECK_INTERVAL / 8 : ZT_LOCAL_INTERFACE_CHECK_INTERVAL)) {
  1064. lastLocalInterfaceAddressCheck = now;
  1065. _node->clearLocalInterfaceAddresses();
  1066. #ifdef ZT_USE_MINIUPNPC
  1067. if (_portMapper) {
  1068. std::vector<InetAddress> mappedAddresses(_portMapper->get());
  1069. for(std::vector<InetAddress>::const_iterator ext(mappedAddresses.begin());ext!=mappedAddresses.end();++ext)
  1070. _node->addLocalInterfaceAddress(reinterpret_cast<const struct sockaddr_storage *>(&(*ext)));
  1071. }
  1072. #endif
  1073. std::vector<InetAddress> boundAddrs(_binder.allBoundLocalInterfaceAddresses());
  1074. for(std::vector<InetAddress>::const_iterator i(boundAddrs.begin());i!=boundAddrs.end();++i) {
  1075. _node->addLocalInterfaceAddress(reinterpret_cast<const struct sockaddr_storage *>(&(*i)));
  1076. }
  1077. }
  1078. // Clean peers.d periodically
  1079. if ((now - lastCleanedPeersDb) >= 3600000) {
  1080. lastCleanedPeersDb = now;
  1081. OSUtils::cleanDirectory((_homePath + ZT_PATH_SEPARATOR_S "peers.d").c_str(),now - 2592000000LL); // delete older than 30 days
  1082. }
  1083. const unsigned long delay = (dl > now) ? (unsigned long)(dl - now) : 500;
  1084. clockShouldBe = now + (int64_t)delay;
  1085. _phy.poll(delay);
  1086. }
  1087. } catch (std::exception &e) {
  1088. Mutex::Lock _l(_termReason_m);
  1089. _termReason = ONE_UNRECOVERABLE_ERROR;
  1090. _fatalErrorMessage = std::string("unexpected exception in main thread: ")+e.what();
  1091. } catch ( ... ) {
  1092. Mutex::Lock _l(_termReason_m);
  1093. _termReason = ONE_UNRECOVERABLE_ERROR;
  1094. _fatalErrorMessage = "unexpected exception in main thread: unknown exception";
  1095. }
  1096. try {
  1097. Mutex::Lock _l(_tcpConnections_m);
  1098. while (!_tcpConnections.empty())
  1099. _phy.close((*_tcpConnections.begin())->sock);
  1100. } catch ( ... ) {}
  1101. {
  1102. Mutex::Lock _l(_nets_m);
  1103. _nets.clear();
  1104. }
  1105. delete _updater;
  1106. _updater = (SoftwareUpdater *)0;
  1107. delete _node;
  1108. _node = (Node *)0;
  1109. return _termReason;
  1110. }
  1111. void readLocalSettings()
  1112. {
  1113. // Read local configuration
  1114. std::map<InetAddress,ZT_PhysicalPathConfiguration> ppc;
  1115. // LEGACY: support old "trustedpaths" flat file
  1116. FILE *trustpaths = fopen((_homePath + ZT_PATH_SEPARATOR_S "trustedpaths").c_str(),"r");
  1117. if (trustpaths) {
  1118. fprintf(stderr,"WARNING: 'trustedpaths' flat file format is deprecated in favor of path definitions in local.conf" ZT_EOL_S);
  1119. char buf[1024];
  1120. while (fgets(buf,sizeof(buf),trustpaths)) {
  1121. int fno = 0;
  1122. char *saveptr = (char *)0;
  1123. uint64_t trustedPathId = 0;
  1124. InetAddress trustedPathNetwork;
  1125. for(char *f=Utils::stok(buf,"=\r\n \t",&saveptr);(f);f=Utils::stok((char *)0,"=\r\n \t",&saveptr)) {
  1126. if (fno == 0) {
  1127. trustedPathId = Utils::hexStrToU64(f);
  1128. } else if (fno == 1) {
  1129. trustedPathNetwork = InetAddress(f);
  1130. } else break;
  1131. ++fno;
  1132. }
  1133. if ( (trustedPathId != 0) && ((trustedPathNetwork.ss_family == AF_INET)||(trustedPathNetwork.ss_family == AF_INET6)) && (trustedPathNetwork.netmaskBits() > 0) ) {
  1134. ppc[trustedPathNetwork].trustedPathId = trustedPathId;
  1135. ppc[trustedPathNetwork].mtu = 0; // use default
  1136. }
  1137. }
  1138. fclose(trustpaths);
  1139. }
  1140. // Read local config file
  1141. Mutex::Lock _l2(_localConfig_m);
  1142. std::string lcbuf;
  1143. if (OSUtils::readFile((_homePath + ZT_PATH_SEPARATOR_S "local.conf").c_str(),lcbuf)) {
  1144. if (lcbuf.length() > 0) {
  1145. try {
  1146. _localConfig = OSUtils::jsonParse(lcbuf);
  1147. if (!_localConfig.is_object()) {
  1148. fprintf(stderr,"ERROR: unable to parse local.conf (root element is not a JSON object)" ZT_EOL_S);
  1149. exit(1);
  1150. }
  1151. } catch ( ... ) {
  1152. fprintf(stderr,"ERROR: unable to parse local.conf (invalid JSON)" ZT_EOL_S);
  1153. exit(1);
  1154. }
  1155. }
  1156. }
  1157. // Make a copy so lookups don't modify in place;
  1158. json lc(_localConfig);
  1159. // Get any trusted paths in local.conf (we'll parse the rest of physical[] elsewhere)
  1160. json &physical = lc["physical"];
  1161. if (physical.is_object()) {
  1162. for(json::iterator phy(physical.begin());phy!=physical.end();++phy) {
  1163. InetAddress net(OSUtils::jsonString(phy.key(),"").c_str());
  1164. if (net) {
  1165. if (phy.value().is_object()) {
  1166. uint64_t tpid;
  1167. if ((tpid = OSUtils::jsonInt(phy.value()["trustedPathId"],0ULL)) != 0ULL) {
  1168. if ((net.ss_family == AF_INET)||(net.ss_family == AF_INET6))
  1169. ppc[net].trustedPathId = tpid;
  1170. }
  1171. ppc[net].mtu = (int)OSUtils::jsonInt(phy.value()["mtu"],0ULL); // 0 means use default
  1172. }
  1173. }
  1174. }
  1175. }
  1176. json &settings = lc["settings"];
  1177. if (settings.is_object()) {
  1178. // Allow controller DB path to be put somewhere else
  1179. const std::string cdbp(OSUtils::jsonString(settings["controllerDbPath"],""));
  1180. if (cdbp.length() > 0)
  1181. _controllerDbPath = cdbp;
  1182. _ssoRedirectURL = OSUtils::jsonString(settings["ssoRedirectURL"], "");
  1183. #ifdef ZT_CONTROLLER_USE_LIBPQ
  1184. // TODO: Redis config
  1185. json &redis = settings["redis"];
  1186. if (redis.is_object() && _rc == NULL) {
  1187. _rc = new RedisConfig;
  1188. _rc->hostname = OSUtils::jsonString(redis["hostname"],"");
  1189. _rc->port = OSUtils::jsonInt(redis["port"],0);
  1190. _rc->password = OSUtils::jsonString(redis["password"],"");
  1191. _rc->clusterMode = OSUtils::jsonBool(redis["clusterMode"], false);
  1192. }
  1193. #endif
  1194. // Bind to wildcard instead of to specific interfaces (disables full tunnel capability)
  1195. json &bind = settings["bind"];
  1196. if (bind.is_array()) {
  1197. for(unsigned long i=0;i<bind.size();++i) {
  1198. const std::string ips(OSUtils::jsonString(bind[i],""));
  1199. if (ips.length() > 0) {
  1200. InetAddress ip(ips.c_str());
  1201. if ((ip.ss_family == AF_INET)||(ip.ss_family == AF_INET6))
  1202. explicitBind.push_back(ip);
  1203. }
  1204. }
  1205. }
  1206. }
  1207. // Set trusted paths if there are any
  1208. if (!ppc.empty()) {
  1209. for(std::map<InetAddress,ZT_PhysicalPathConfiguration>::iterator i(ppc.begin());i!=ppc.end();++i)
  1210. _node->setPhysicalPathConfiguration(reinterpret_cast<const struct sockaddr_storage *>(&(i->first)),&(i->second));
  1211. }
  1212. }
  1213. virtual ReasonForTermination reasonForTermination() const
  1214. {
  1215. Mutex::Lock _l(_termReason_m);
  1216. return _termReason;
  1217. }
  1218. virtual std::string fatalErrorMessage() const
  1219. {
  1220. Mutex::Lock _l(_termReason_m);
  1221. return _fatalErrorMessage;
  1222. }
  1223. virtual std::string portDeviceName(uint64_t nwid) const
  1224. {
  1225. Mutex::Lock _l(_nets_m);
  1226. std::map<uint64_t,NetworkState>::const_iterator n(_nets.find(nwid));
  1227. if ((n != _nets.end())&&(n->second.tap()))
  1228. return n->second.tap()->deviceName();
  1229. else return std::string();
  1230. }
  1231. #ifdef ZT_SDK
  1232. virtual std::string givenHomePath()
  1233. {
  1234. return _homePath;
  1235. }
  1236. void getRoutes(uint64_t nwid, void *routeArray, unsigned int *numRoutes)
  1237. {
  1238. Mutex::Lock _l(_nets_m);
  1239. NetworkState &n = _nets[nwid];
  1240. *numRoutes = *numRoutes < n.config().routeCount ? *numRoutes : n.config().routeCount;
  1241. for(unsigned int i=0; i<*numRoutes; i++) {
  1242. ZT_VirtualNetworkRoute *vnr = (ZT_VirtualNetworkRoute*)routeArray;
  1243. memcpy(&vnr[i], &(n.config().routes[i]), sizeof(ZT_VirtualNetworkRoute));
  1244. }
  1245. }
  1246. virtual Node *getNode()
  1247. {
  1248. return _node;
  1249. }
  1250. #endif // ZT_SDK
  1251. virtual void terminate()
  1252. {
  1253. _run_m.lock();
  1254. _run = false;
  1255. _run_m.unlock();
  1256. _phy.whack();
  1257. }
  1258. virtual bool getNetworkSettings(const uint64_t nwid,NetworkSettings &settings) const
  1259. {
  1260. Mutex::Lock _l(_nets_m);
  1261. std::map<uint64_t,NetworkState>::const_iterator n(_nets.find(nwid));
  1262. if (n == _nets.end())
  1263. return false;
  1264. settings = n->second.settings();
  1265. return true;
  1266. }
  1267. virtual bool setNetworkSettings(const uint64_t nwid,const NetworkSettings &settings)
  1268. {
  1269. char nlcpath[4096];
  1270. OSUtils::ztsnprintf(nlcpath,sizeof(nlcpath),"%s" ZT_PATH_SEPARATOR_S "%.16llx.local.conf",_networksPath.c_str(),nwid);
  1271. FILE *out = fopen(nlcpath,"w");
  1272. if (out) {
  1273. fprintf(out,"allowManaged=%d\n",(int)settings.allowManaged);
  1274. fprintf(out,"allowGlobal=%d\n",(int)settings.allowGlobal);
  1275. fprintf(out,"allowDefault=%d\n",(int)settings.allowDefault);
  1276. fprintf(out,"allowDNS=%d\n",(int)settings.allowDNS);
  1277. fclose(out);
  1278. }
  1279. return true;
  1280. }
  1281. // Internal HTTP Control Plane
  1282. void startHTTPControlPlane() {
  1283. std::vector<std::string> noAuthEndpoints { "/sso", "/health" };
  1284. auto setContent = [=] (const httplib::Request &req, httplib::Response &res, std::string content) {
  1285. if (req.has_param("jsonp")) {
  1286. if (content.length() > 0) {
  1287. res.set_content(req.get_param_value("jsonp") + "(" + content + ");", "application/javascript");
  1288. } else {
  1289. res.set_content(req.get_param_value("jsonp") + "(null);", "application/javascript");
  1290. }
  1291. } else {
  1292. if (content.length() > 0) {
  1293. res.set_content(content, "application/json");
  1294. } else {
  1295. res.set_content("{}", "application/json");
  1296. }
  1297. }
  1298. };
  1299. auto authCheck = [=] (const httplib::Request &req, httplib::Response &res) {
  1300. if (req.path == "/metrics") {
  1301. if (req.has_header("x-zt1-auth")) {
  1302. std::string token = req.get_header_value("x-zt1-auth");
  1303. if (token == _metricsToken || token == _authToken) {
  1304. return httplib::Server::HandlerResponse::Unhandled;
  1305. }
  1306. } else if (req.has_param("auth")) {
  1307. std::string token = req.get_param_value("auth");
  1308. if (token == _metricsToken || token == _authToken) {
  1309. return httplib::Server::HandlerResponse::Unhandled;
  1310. }
  1311. } else if (req.has_header("authorization")) {
  1312. std::string auth = req.get_header_value("authorization");
  1313. if (bearerTokenValid(auth, _metricsToken) || bearerTokenValid(auth, _authToken)) {
  1314. return httplib::Server::HandlerResponse::Unhandled;
  1315. }
  1316. }
  1317. setContent(req, res, "{}");
  1318. res.status = 401;
  1319. return httplib::Server::HandlerResponse::Handled;
  1320. } else {
  1321. std::string r = req.remote_addr;
  1322. InetAddress remoteAddr(r.c_str());
  1323. bool ipAllowed = false;
  1324. bool isAuth = false;
  1325. // If localhost, allow
  1326. if (remoteAddr.ipScope() == InetAddress::IP_SCOPE_LOOPBACK) {
  1327. ipAllowed = true;
  1328. }
  1329. if (!ipAllowed) {
  1330. for (auto i = _allowManagementFrom.begin(); i != _allowManagementFrom.end(); ++i) {
  1331. if (i->containsAddress(remoteAddr)) {
  1332. ipAllowed = true;
  1333. break;
  1334. }
  1335. }
  1336. }
  1337. if (ipAllowed) {
  1338. // auto-pass endpoints in `noAuthEndpoints`. No auth token required
  1339. if (std::find(noAuthEndpoints.begin(), noAuthEndpoints.end(), req.path) != noAuthEndpoints.end()) {
  1340. isAuth = true;
  1341. }
  1342. if (!isAuth) {
  1343. // check auth token
  1344. if (req.has_header("x-zt1-auth")) {
  1345. std::string token = req.get_header_value("x-zt1-auth");
  1346. if (token == _authToken) {
  1347. isAuth = true;
  1348. }
  1349. } else if (req.has_param("auth")) {
  1350. std::string token = req.get_param_value("auth");
  1351. if (token == _authToken) {
  1352. isAuth = true;
  1353. }
  1354. } else if (req.has_header("authorization")) {
  1355. std::string auth = req.get_header_value("authorization");
  1356. isAuth = bearerTokenValid(auth, _authToken);
  1357. }
  1358. }
  1359. }
  1360. if (ipAllowed && isAuth) {
  1361. return httplib::Server::HandlerResponse::Unhandled;
  1362. }
  1363. setContent(req, res, "{}");
  1364. res.status = 401;
  1365. return httplib::Server::HandlerResponse::Handled;
  1366. }
  1367. };
  1368. _controlPlane.Get("/bond/show/([0-9a-fA-F]{10})", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1369. if (!_node->bondController()->inUse()) {
  1370. setContent(req, res, "");
  1371. res.status = 400;
  1372. return;
  1373. }
  1374. ZT_PeerList *pl = _node->peers();
  1375. if (pl) {
  1376. auto id = req.matches[1];
  1377. auto out = json::object();
  1378. uint64_t wantp = Utils::hexStrToU64(id.str().c_str());
  1379. for(unsigned long i=0;i<pl->peerCount;++i) {
  1380. if (pl->peers[i].address == wantp) {
  1381. SharedPtr<Bond> bond = _node->bondController()->getBondByPeerId(wantp);
  1382. if (bond) {
  1383. _peerToJson(out,&(pl->peers[i]),bond,(_tcpFallbackTunnel != (TcpConnection *)0));
  1384. setContent(req, res, out.dump());
  1385. } else {
  1386. setContent(req, res, "");
  1387. res.status = 400;
  1388. }
  1389. }
  1390. }
  1391. }
  1392. _node->freeQueryResult((void *)pl);
  1393. });
  1394. auto bondRotate = [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1395. if (!_node->bondController()->inUse()) {
  1396. setContent(req, res, "");
  1397. res.status = 400;
  1398. return;
  1399. }
  1400. auto bondID = req.matches[1];
  1401. uint64_t id = Utils::hexStrToU64(bondID.str().c_str());
  1402. exit(0);
  1403. SharedPtr<Bond> bond = _node->bondController()->getBondByPeerId(id);
  1404. if (bond) {
  1405. if (bond->abForciblyRotateLink()) {
  1406. res.status = 200;
  1407. } else {
  1408. res.status = 400;
  1409. }
  1410. } else {
  1411. fprintf(stderr, "unable to find bond to peer %llx\n", (unsigned long long)id);
  1412. res.status = 400;
  1413. }
  1414. setContent(req, res, "{}");
  1415. };
  1416. _controlPlane.Post("/bond/rotate/([0-9a-fA-F]{10})", bondRotate);
  1417. _controlPlane.Put("/bond/rotate/([0-9a-fA-F]{10})", bondRotate);
  1418. _controlPlane.Get("/config", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1419. std::string config;
  1420. {
  1421. Mutex::Lock lc(_localConfig_m);
  1422. config = _localConfig.dump();
  1423. }
  1424. if (config == "null") {
  1425. config = "{}";
  1426. }
  1427. setContent(req, res, config);
  1428. });
  1429. auto configPost = [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1430. json j(OSUtils::jsonParse(req.body));
  1431. if (j.is_object()) {
  1432. Mutex::Lock lcl(_localConfig_m);
  1433. json lc(_localConfig);
  1434. for(json::const_iterator s(j.begin()); s != j.end(); ++s) {
  1435. lc["settings"][s.key()] = s.value();
  1436. }
  1437. std::string lcStr = OSUtils::jsonDump(lc, 4);
  1438. if (OSUtils::writeFile((_homePath + ZT_PATH_SEPARATOR_S "local.conf").c_str(), lcStr)) {
  1439. _localConfig = lc;
  1440. }
  1441. }
  1442. setContent(req, res, "{}");
  1443. };
  1444. _controlPlane.Post("/config/settings", configPost);
  1445. _controlPlane.Put("/config/settings", configPost);
  1446. _controlPlane.Get("/health", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1447. json out = json::object();
  1448. char tmp[256];
  1449. ZT_NodeStatus status;
  1450. _node->status(&status);
  1451. out["online"] = (bool)(status.online != 0);
  1452. out["versionMajor"] = ZEROTIER_ONE_VERSION_MAJOR;
  1453. out["versionMinor"] = ZEROTIER_ONE_VERSION_MINOR;
  1454. out["versionRev"] = ZEROTIER_ONE_VERSION_REVISION;
  1455. out["versionBuild"] = ZEROTIER_ONE_VERSION_BUILD;
  1456. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%d.%d.%d",ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION);
  1457. out["version"] = tmp;
  1458. out["clock"] = OSUtils::now();
  1459. setContent(req, res, out.dump());
  1460. });
  1461. _controlPlane.Get("/moon", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1462. std::vector<World> moons(_node->moons());
  1463. auto out = json::array();
  1464. for (auto i = moons.begin(); i != moons.end(); ++i) {
  1465. json mj;
  1466. _moonToJson(mj, *i);
  1467. out.push_back(mj);
  1468. }
  1469. setContent(req, res, out.dump());
  1470. });
  1471. _controlPlane.Get("/moon/([0-9a-fA-F]{10})", [&, setContent](const httplib::Request &req, httplib::Response &res){
  1472. std::vector<World> moons(_node->moons());
  1473. auto input = req.matches[1];
  1474. auto out = json::object();
  1475. const uint64_t id = Utils::hexStrToU64(input.str().c_str());
  1476. for (auto i = moons.begin(); i != moons.end(); ++i) {
  1477. if (i->id() == id) {
  1478. _moonToJson(out, *i);
  1479. break;
  1480. }
  1481. }
  1482. setContent(req, res, out.dump());
  1483. });
  1484. auto moonPost = [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1485. auto input = req.matches[1];
  1486. uint64_t seed = 0;
  1487. try {
  1488. json j(OSUtils::jsonParse(req.body));
  1489. if (j.is_object()) {
  1490. seed = Utils::hexStrToU64(OSUtils::jsonString(j["seed"],"0").c_str());
  1491. }
  1492. } catch ( ... ) {
  1493. // discard invalid JSON
  1494. }
  1495. std::vector<World> moons(_node->moons());
  1496. const uint64_t id = Utils::hexStrToU64(input.str().c_str());
  1497. bool found = false;
  1498. auto out = json::object();
  1499. for(std::vector<World>::const_iterator m(moons.begin());m!=moons.end();++m) {
  1500. if (m->id() == id) {
  1501. _moonToJson(out,*m);
  1502. found = true;
  1503. break;
  1504. }
  1505. }
  1506. if (!found && seed != 0) {
  1507. char tmp[64];
  1508. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",id);
  1509. out["id"] = tmp;
  1510. out["roots"] = json::array();
  1511. out["timestamp"] = 0;
  1512. out["signature"] = json();
  1513. out["updatesMustBeSignedBy"] = json();
  1514. out["waiting"] = true;
  1515. _node->orbit((void *)0,id,seed);
  1516. }
  1517. setContent(req, res, out.dump());
  1518. };
  1519. _controlPlane.Post("/moon/([0-9a-fA-F]{10})", moonPost);
  1520. _controlPlane.Put("/moon/([0-9a-fA-F]{10})", moonPost);
  1521. _controlPlane.Delete("/moon/([0-9a-fA-F]{10})", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1522. auto input = req.matches[1];
  1523. uint64_t id = Utils::hexStrToU64(input.str().c_str());
  1524. auto out = json::object();
  1525. _node->deorbit((void*)0,id);
  1526. out["result"] = true;
  1527. setContent(req, res, out.dump());
  1528. });
  1529. _controlPlane.Get("/network", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1530. Mutex::Lock _l(_nets_m);
  1531. auto out = json::array();
  1532. for (auto it = _nets.begin(); it != _nets.end(); ++it) {
  1533. NetworkState &ns = it->second;
  1534. json nj;
  1535. _networkToJson(nj, ns);
  1536. out.push_back(nj);
  1537. }
  1538. setContent(req, res, out.dump());
  1539. });
  1540. _controlPlane.Get("/network/([0-9a-fA-F]{16})", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1541. Mutex::Lock _l(_nets_m);
  1542. auto input = req.matches[1];
  1543. const uint64_t nwid = Utils::hexStrToU64(input.str().c_str());
  1544. if (_nets.find(nwid) != _nets.end()) {
  1545. auto out = json::object();
  1546. NetworkState &ns = _nets[nwid];
  1547. _networkToJson(out, ns);
  1548. setContent(req, res, out.dump());
  1549. return;
  1550. }
  1551. setContent(req, res, "");
  1552. res.status = 404;
  1553. });
  1554. auto networkPost = [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1555. auto input = req.matches[1];
  1556. uint64_t wantnw = Utils::hexStrToU64(input.str().c_str());
  1557. _node->join(wantnw, (void*)0, (void*)0);
  1558. auto out = json::object();
  1559. Mutex::Lock l(_nets_m);
  1560. bool allowDefault = false;
  1561. if (!_nets.empty()) {
  1562. NetworkState &ns = _nets[wantnw];
  1563. try {
  1564. json j(OSUtils::jsonParse(req.body));
  1565. json &allowManaged = j["allowManaged"];
  1566. if (allowManaged.is_boolean()) {
  1567. ns.setAllowManaged((bool)allowManaged);
  1568. }
  1569. json& allowGlobal = j["allowGlobal"];
  1570. if (allowGlobal.is_boolean()) {
  1571. ns.setAllowGlobal((bool)allowGlobal);
  1572. }
  1573. json& _allowDefault = j["allowDefault"];
  1574. if (_allowDefault.is_boolean()) {
  1575. allowDefault = _allowDefault;
  1576. ns.setAllowDefault((bool)allowDefault);
  1577. }
  1578. json& allowDNS = j["allowDNS"];
  1579. if (allowDNS.is_boolean()) {
  1580. ns.setAllowDNS((bool)allowDNS);
  1581. }
  1582. } catch (...) {
  1583. // discard invalid JSON
  1584. }
  1585. setNetworkSettings(wantnw, ns.settings());
  1586. if (ns.tap()) {
  1587. syncManagedStuff(ns,true,true,true);
  1588. }
  1589. _networkToJson(out, ns);
  1590. }
  1591. #ifdef __FreeBSD__
  1592. if(!!allowDefault){
  1593. res.status = 400;
  1594. setContent(req, res, "Allow Default does not work properly on FreeBSD. See #580");
  1595. } else {
  1596. setContent(req, res, out.dump());
  1597. }
  1598. #else
  1599. setContent(req, res, out.dump());
  1600. #endif
  1601. };
  1602. _controlPlane.Post("/network/([0-9a-fA-F]{16})", networkPost);
  1603. _controlPlane.Put("/network/([0-9a-fA-F]){16}", networkPost);
  1604. _controlPlane.Delete("/network/([0-9a-fA-F]{16})", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1605. auto input = req.matches[1];
  1606. auto out = json::object();
  1607. ZT_VirtualNetworkList *nws = _node->networks();
  1608. uint64_t wantnw = Utils::hexStrToU64(input.str().c_str());
  1609. for(unsigned long i=0; i < nws->networkCount; ++i) {
  1610. if (nws->networks[i].nwid == wantnw) {
  1611. _node->leave(wantnw, (void**)0, (void*)0);
  1612. out["result"] = true;
  1613. }
  1614. }
  1615. _node->freeQueryResult((void*)nws);
  1616. setContent(req, res, out.dump());
  1617. });
  1618. _controlPlane.Get("/peer", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1619. ZT_PeerList *pl = _node->peers();
  1620. auto out = nlohmann::json::array();
  1621. for(unsigned long i=0;i<pl->peerCount;++i) {
  1622. nlohmann::json pj;
  1623. SharedPtr<Bond> bond = SharedPtr<Bond>();
  1624. if (pl->peers[i].isBonded) {
  1625. const uint64_t id = pl->peers[i].address;
  1626. bond = _node->bondController()->getBondByPeerId(id);
  1627. }
  1628. _peerToJson(pj,&(pl->peers[i]),bond,(_tcpFallbackTunnel != (TcpConnection *)0));
  1629. out.push_back(pj);
  1630. }
  1631. _node->freeQueryResult((void*)pl);
  1632. setContent(req, res, out.dump());
  1633. });
  1634. _controlPlane.Get("/peer/([0-9a-fA-F]{10})", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1635. ZT_PeerList *pl = _node->peers();
  1636. auto input = req.matches[1];
  1637. uint64_t wantp = Utils::hexStrToU64(input.str().c_str());
  1638. auto out = json::object();
  1639. for(unsigned long i=0;i<pl->peerCount;++i) {
  1640. if (pl->peers[i].address == wantp) {
  1641. SharedPtr<Bond> bond = SharedPtr<Bond>();
  1642. if (pl->peers[i].isBonded) {
  1643. bond = _node->bondController()->getBondByPeerId(wantp);
  1644. }
  1645. _peerToJson(out,&(pl->peers[i]),bond,(_tcpFallbackTunnel != (TcpConnection *)0));
  1646. break;
  1647. }
  1648. }
  1649. _node->freeQueryResult((void*)pl);
  1650. setContent(req, res, out.dump());
  1651. });
  1652. _controlPlane.Get("/status", [&, setContent](const httplib::Request &req, httplib::Response &res) {
  1653. ZT_NodeStatus status;
  1654. _node->status(&status);
  1655. auto out = json::object();
  1656. char tmp[256] = {};
  1657. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.10llx",status.address);
  1658. out["address"] = tmp;
  1659. out["publicIdentity"] = status.publicIdentity;
  1660. out["online"] = (bool)(status.online != 0);
  1661. out["tcpFallbackActive"] = (_tcpFallbackTunnel != (TcpConnection *)0);
  1662. out["versionMajor"] = ZEROTIER_ONE_VERSION_MAJOR;
  1663. out["versionMinor"] = ZEROTIER_ONE_VERSION_MINOR;
  1664. out["versionRev"] = ZEROTIER_ONE_VERSION_REVISION;
  1665. out["versionBuild"] = ZEROTIER_ONE_VERSION_BUILD;
  1666. OSUtils::ztsnprintf(tmp,sizeof(tmp),"%d.%d.%d",ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION);
  1667. out["version"] = tmp;
  1668. out["clock"] = OSUtils::now();
  1669. {
  1670. Mutex::Lock _l(_localConfig_m);
  1671. out["config"] = _localConfig;
  1672. }
  1673. json &settings = out["config"]["settings"];
  1674. settings["allowTcpFallbackRelay"] = OSUtils::jsonBool(settings["allowTcpFallbackRelay"],_allowTcpFallbackRelay);
  1675. settings["forceTcpRelay"] = OSUtils::jsonBool(settings["forceTcpRelay"],_forceTcpRelay);
  1676. settings["primaryPort"] = OSUtils::jsonInt(settings["primaryPort"],(uint64_t)_primaryPort) & 0xffff;
  1677. settings["secondaryPort"] = OSUtils::jsonInt(settings["secondaryPort"],(uint64_t)_secondaryPort) & 0xffff;
  1678. settings["tertiaryPort"] = OSUtils::jsonInt(settings["tertiaryPort"],(uint64_t)_tertiaryPort) & 0xffff;
  1679. // Enumerate all local address/port pairs that this node is listening on
  1680. std::vector<InetAddress> boundAddrs(_binder.allBoundLocalInterfaceAddresses());
  1681. auto boundAddrArray = json::array();
  1682. for (int i = 0; i < boundAddrs.size(); i++) {
  1683. char ipBuf[64] = { 0 };
  1684. boundAddrs[i].toString(ipBuf);
  1685. boundAddrArray.push_back(ipBuf);
  1686. }
  1687. settings["listeningOn"] = boundAddrArray;
  1688. // Enumerate all external address/port pairs that are reported for this node
  1689. std::vector<InetAddress> surfaceAddrs = _node->SurfaceAddresses();
  1690. auto surfaceAddrArray = json::array();
  1691. for (int i = 0; i < surfaceAddrs.size(); i++) {
  1692. char ipBuf[64] = { 0 };
  1693. surfaceAddrs[i].toString(ipBuf);
  1694. surfaceAddrArray.push_back(ipBuf);
  1695. }
  1696. settings["surfaceAddresses"] = surfaceAddrArray;
  1697. #ifdef ZT_USE_MINIUPNPC
  1698. settings["portMappingEnabled"] = OSUtils::jsonBool(settings["portMappingEnabled"],true);
  1699. #else
  1700. settings["portMappingEnabled"] = false; // not supported in build
  1701. #endif
  1702. #ifndef ZT_SDK
  1703. settings["softwareUpdate"] = OSUtils::jsonString(settings["softwareUpdate"],ZT_SOFTWARE_UPDATE_DEFAULT);
  1704. settings["softwareUpdateChannel"] = OSUtils::jsonString(settings["softwareUpdateChannel"],ZT_SOFTWARE_UPDATE_DEFAULT_CHANNEL);
  1705. #endif
  1706. const World planet(_node->planet());
  1707. out["planetWorldId"] = planet.id();
  1708. out["planetWorldTimestamp"] = planet.timestamp();
  1709. setContent(req, res, out.dump());
  1710. });
  1711. #if ZT_SSO_ENABLED
  1712. _controlPlane.Get("/sso", [this](const httplib::Request &req, httplib::Response &res) {
  1713. std::string htmlTemplatePath = _homePath + ZT_PATH_SEPARATOR + "sso-auth.template.html";
  1714. std::string htmlTemplate;
  1715. if (!OSUtils::readFile(htmlTemplatePath.c_str(), htmlTemplate)) {
  1716. htmlTemplate = ssoResponseTemplate;
  1717. }
  1718. std::string responseContentType = "text/html";
  1719. std::string responseBody = "";
  1720. json outData;
  1721. if (req.has_param("error")) {
  1722. std::string error = req.get_param_value("error");
  1723. std::string desc = req.get_param_value("error_description");
  1724. json data;
  1725. outData["isError"] = true;
  1726. outData["messageText"] = (std::string("ERROR ") + error + std::string(": ") + desc);
  1727. responseBody = inja::render(htmlTemplate, outData);
  1728. res.set_content(responseBody, responseContentType);
  1729. res.status = 500;
  1730. return;
  1731. }
  1732. // SSO redirect handling
  1733. std::string state = req.get_param_value("state");
  1734. char* nwid = zeroidc::zeroidc_network_id_from_state(state.c_str());
  1735. outData["networkId"] = std::string(nwid);
  1736. const uint64_t id = Utils::hexStrToU64(nwid);
  1737. zeroidc::free_cstr(nwid);
  1738. Mutex::Lock l(_nets_m);
  1739. if (_nets.find(id) != _nets.end()) {
  1740. NetworkState& ns = _nets[id];
  1741. std::string code = req.get_param_value("code");
  1742. char *ret = ns.doTokenExchange(code.c_str());
  1743. json ssoResult = json::parse(ret);
  1744. if (ssoResult.is_object()) {
  1745. if (ssoResult.contains("errorMessage")) {
  1746. outData["isError"] = true;
  1747. outData["messageText"] = ssoResult["errorMessage"];
  1748. responseBody = inja::render(htmlTemplate, outData);
  1749. res.set_content(responseBody, responseContentType);
  1750. res.status = 500;
  1751. } else {
  1752. outData["isError"] = false;
  1753. outData["messageText"] = "Authentication Successful. You may now access the network.";
  1754. responseBody = inja::render(htmlTemplate, outData);
  1755. res.set_content(responseBody, responseContentType);
  1756. }
  1757. } else {
  1758. // not an object? We got a problem
  1759. outData["isError"] = true;
  1760. outData["messageText"] = "ERROR: Unkown SSO response. Please contact your administrator.";
  1761. responseBody = inja::render(htmlTemplate, outData);
  1762. res.set_content(responseBody, responseContentType);
  1763. res.status = 500;
  1764. }
  1765. zeroidc::free_cstr(ret);
  1766. }
  1767. });
  1768. #endif
  1769. _controlPlane.Get("/metrics", [this](const httplib::Request &req, httplib::Response &res) {
  1770. std::string statspath = _homePath + ZT_PATH_SEPARATOR + "metrics.prom";
  1771. std::string metrics;
  1772. if (OSUtils::readFile(statspath.c_str(), metrics)) {
  1773. res.set_content(metrics, "text/plain");
  1774. } else {
  1775. res.set_content("{}", "application/json");
  1776. res.status = 500;
  1777. }
  1778. });
  1779. _controlPlane.set_exception_handler([&, setContent](const httplib::Request &req, httplib::Response &res, std::exception_ptr ep) {
  1780. char buf[1024];
  1781. auto fmt = "{\"error\": %d, \"description\": \"%s\"}";
  1782. try {
  1783. std::rethrow_exception(ep);
  1784. } catch (std::exception &e) {
  1785. snprintf(buf, sizeof(buf), fmt, 500, e.what());
  1786. } catch (...) {
  1787. snprintf(buf, sizeof(buf), fmt, 500, "Unknown Exception");
  1788. }
  1789. setContent(req, res, buf);
  1790. res.status = 500;
  1791. });
  1792. if (_controller) {
  1793. _controller->configureHTTPControlPlane(_controlPlane, setContent);
  1794. }
  1795. _controlPlane.set_pre_routing_handler(authCheck);
  1796. #if ZT_DEBUG==1
  1797. _controlPlane.set_logger([](const httplib::Request &req, const httplib::Response &res) {
  1798. fprintf(stderr, "%s", http_log(req, res).c_str());
  1799. });
  1800. #endif
  1801. if (_primaryPort==0) {
  1802. fprintf(stderr, "unable to determine local control port");
  1803. exit(-1);
  1804. }
  1805. if(!_controlPlane.bind_to_port("0.0.0.0", _primaryPort)) {
  1806. fprintf(stderr, "Error binding control plane to port %d\n", _primaryPort);
  1807. exit(-1);
  1808. }
  1809. _serverThread = std::thread([&] {
  1810. fprintf(stderr, "Starting Control Plane...\n");
  1811. if(!_controlPlane.listen_after_bind()) {
  1812. fprintf(stderr, "Error on listen_after_bind()\n");
  1813. }
  1814. fprintf(stderr, "Control Plane Stopped\n");
  1815. });
  1816. }
  1817. // Must be called after _localConfig is read or modified
  1818. void applyLocalConfig()
  1819. {
  1820. Mutex::Lock _l(_localConfig_m);
  1821. json lc(_localConfig);
  1822. _v4Hints.clear();
  1823. _v6Hints.clear();
  1824. _v4Blacklists.clear();
  1825. _v6Blacklists.clear();
  1826. json &virt = lc["virtual"];
  1827. if (virt.is_object()) {
  1828. for(json::iterator v(virt.begin());v!=virt.end();++v) {
  1829. const std::string nstr = v.key();
  1830. if ((nstr.length() == ZT_ADDRESS_LENGTH_HEX)&&(v.value().is_object())) {
  1831. const Address ztaddr(Utils::hexStrToU64(nstr.c_str()));
  1832. if (ztaddr) {
  1833. const uint64_t ztaddr2 = ztaddr.toInt();
  1834. std::vector<InetAddress> &v4h = _v4Hints[ztaddr2];
  1835. std::vector<InetAddress> &v6h = _v6Hints[ztaddr2];
  1836. std::vector<InetAddress> &v4b = _v4Blacklists[ztaddr2];
  1837. std::vector<InetAddress> &v6b = _v6Blacklists[ztaddr2];
  1838. json &tryAddrs = v.value()["try"];
  1839. if (tryAddrs.is_array()) {
  1840. for(unsigned long i=0;i<tryAddrs.size();++i) {
  1841. const InetAddress ip(OSUtils::jsonString(tryAddrs[i],"").c_str());
  1842. if (ip.ss_family == AF_INET)
  1843. v4h.push_back(ip);
  1844. else if (ip.ss_family == AF_INET6)
  1845. v6h.push_back(ip);
  1846. }
  1847. }
  1848. json &blAddrs = v.value()["blacklist"];
  1849. if (blAddrs.is_array()) {
  1850. for(unsigned long i=0;i<blAddrs.size();++i) {
  1851. const InetAddress ip(OSUtils::jsonString(blAddrs[i],"").c_str());
  1852. if (ip.ss_family == AF_INET)
  1853. v4b.push_back(ip);
  1854. else if (ip.ss_family == AF_INET6)
  1855. v6b.push_back(ip);
  1856. }
  1857. }
  1858. if (v4h.empty()) _v4Hints.erase(ztaddr2);
  1859. if (v6h.empty()) _v6Hints.erase(ztaddr2);
  1860. if (v4b.empty()) _v4Blacklists.erase(ztaddr2);
  1861. if (v6b.empty()) _v6Blacklists.erase(ztaddr2);
  1862. }
  1863. }
  1864. }
  1865. }
  1866. _globalV4Blacklist.clear();
  1867. _globalV6Blacklist.clear();
  1868. json &physical = lc["physical"];
  1869. if (physical.is_object()) {
  1870. for(json::iterator phy(physical.begin());phy!=physical.end();++phy) {
  1871. const InetAddress net(OSUtils::jsonString(phy.key(),"").c_str());
  1872. if ((net)&&(net.netmaskBits() > 0)) {
  1873. if (phy.value().is_object()) {
  1874. if (OSUtils::jsonBool(phy.value()["blacklist"],false)) {
  1875. if (net.ss_family == AF_INET)
  1876. _globalV4Blacklist.push_back(net);
  1877. else if (net.ss_family == AF_INET6)
  1878. _globalV6Blacklist.push_back(net);
  1879. }
  1880. }
  1881. }
  1882. }
  1883. }
  1884. _allowManagementFrom.clear();
  1885. _interfacePrefixBlacklist.clear();
  1886. json &settings = lc["settings"];
  1887. if (!_node->bondController()->inUse()) {
  1888. _node->bondController()->setBinder(&_binder);
  1889. // defaultBondingPolicy
  1890. std::string defaultBondingPolicyStr(OSUtils::jsonString(settings["defaultBondingPolicy"],""));
  1891. int defaultBondingPolicy = _node->bondController()->getPolicyCodeByStr(defaultBondingPolicyStr);
  1892. _node->bondController()->setBondingLayerDefaultPolicy(defaultBondingPolicy);
  1893. _node->bondController()->setBondingLayerDefaultPolicyStr(defaultBondingPolicyStr); // Used if custom policy
  1894. // Custom Policies
  1895. json &customBondingPolicies = settings["policies"];
  1896. for (json::iterator policyItr = customBondingPolicies.begin(); policyItr != customBondingPolicies.end();++policyItr) {
  1897. // Custom Policy
  1898. std::string customPolicyStr(policyItr.key());
  1899. json &customPolicy = policyItr.value();
  1900. std::string basePolicyStr(OSUtils::jsonString(customPolicy["basePolicy"],""));
  1901. if (basePolicyStr.empty()) {
  1902. fprintf(stderr, "error: no base policy was specified for custom policy (%s)\n", customPolicyStr.c_str());
  1903. }
  1904. int basePolicyCode = _node->bondController()->getPolicyCodeByStr(basePolicyStr);
  1905. if (basePolicyCode == ZT_BOND_POLICY_NONE) {
  1906. fprintf(stderr, "error: custom policy (%s) is invalid, unknown base policy (%s).\n",
  1907. customPolicyStr.c_str(), basePolicyStr.c_str());
  1908. continue;
  1909. } if (_node->bondController()->getPolicyCodeByStr(customPolicyStr) != ZT_BOND_POLICY_NONE) {
  1910. fprintf(stderr, "error: custom policy (%s) will be ignored, cannot use standard policy names for custom policies.\n",
  1911. customPolicyStr.c_str());
  1912. continue;
  1913. }
  1914. // New bond, used as a copy template for new instances
  1915. SharedPtr<Bond> newTemplateBond = new Bond(NULL, basePolicyStr, customPolicyStr, SharedPtr<Peer>());
  1916. newTemplateBond->setPolicy(basePolicyCode);
  1917. // Custom link quality spec
  1918. json &linkQualitySpec = customPolicy["linkQuality"];
  1919. if (linkQualitySpec.size() == ZT_QOS_PARAMETER_SIZE) {
  1920. float weights[ZT_QOS_PARAMETER_SIZE] = {};
  1921. weights[ZT_QOS_LAT_MAX_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["lat_max"],0.0);
  1922. weights[ZT_QOS_PDV_MAX_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["pdv_max"],0.0);
  1923. weights[ZT_QOS_PLR_MAX_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["plr_max"],0.0);
  1924. weights[ZT_QOS_PER_MAX_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["per_max"],0.0);
  1925. weights[ZT_QOS_LAT_WEIGHT_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["lat_weight"],0.0);
  1926. weights[ZT_QOS_PDV_WEIGHT_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["pdv_weight"],0.0);
  1927. weights[ZT_QOS_PLR_WEIGHT_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["plr_weight"],0.0);
  1928. weights[ZT_QOS_PER_WEIGHT_IDX] = (float)OSUtils::jsonDouble(linkQualitySpec["per_weight"],0.0);
  1929. newTemplateBond->setUserLinkQualitySpec(weights,ZT_QOS_PARAMETER_SIZE);
  1930. }
  1931. // Bond-specific properties
  1932. newTemplateBond->setUpDelay(OSUtils::jsonInt(customPolicy["upDelay"],-1));
  1933. newTemplateBond->setDownDelay(OSUtils::jsonInt(customPolicy["downDelay"],-1));
  1934. newTemplateBond->setFailoverInterval(OSUtils::jsonInt(customPolicy["failoverInterval"],ZT_BOND_FAILOVER_DEFAULT_INTERVAL));
  1935. newTemplateBond->setPacketsPerLink(OSUtils::jsonInt(customPolicy["packetsPerLink"],-1));
  1936. // Policy-Specific link set
  1937. json &links = customPolicy["links"];
  1938. for (json::iterator linkItr = links.begin(); linkItr != links.end();++linkItr) {
  1939. std::string linkNameStr(linkItr.key());
  1940. json &link = linkItr.value();
  1941. bool enabled = OSUtils::jsonInt(link["enabled"],true);
  1942. uint32_t capacity = OSUtils::jsonInt(link["capacity"],0);
  1943. uint8_t ipvPref = OSUtils::jsonInt(link["ipvPref"],0);
  1944. uint16_t mtu = OSUtils::jsonInt(link["mtu"],0);
  1945. std::string failoverToStr(OSUtils::jsonString(link["failoverTo"],""));
  1946. // Mode
  1947. std::string linkModeStr(OSUtils::jsonString(link["mode"],"spare"));
  1948. uint8_t linkMode = ZT_BOND_SLAVE_MODE_SPARE;
  1949. if (linkModeStr == "primary") { linkMode = ZT_BOND_SLAVE_MODE_PRIMARY; }
  1950. if (linkModeStr == "spare") { linkMode = ZT_BOND_SLAVE_MODE_SPARE; }
  1951. // ipvPref
  1952. if ((ipvPref != 0) && (ipvPref != 4) && (ipvPref != 6) && (ipvPref != 46) && (ipvPref != 64)) {
  1953. fprintf(stderr, "error: invalid ipvPref value (%d), link disabled.\n", ipvPref);
  1954. enabled = false;
  1955. }
  1956. if (linkMode == ZT_BOND_SLAVE_MODE_SPARE && failoverToStr.length()) {
  1957. fprintf(stderr, "error: cannot specify failover links for spares, link disabled.\n");
  1958. failoverToStr = "";
  1959. enabled = false;
  1960. }
  1961. _node->bondController()->addCustomLink(customPolicyStr, new Link(linkNameStr,ipvPref,mtu,capacity,enabled,linkMode,failoverToStr));
  1962. }
  1963. std::string linkSelectMethodStr(OSUtils::jsonString(customPolicy["activeReselect"],"optimize"));
  1964. if (linkSelectMethodStr == "always") {
  1965. newTemplateBond->setLinkSelectMethod(ZT_BOND_RESELECTION_POLICY_ALWAYS);
  1966. }
  1967. if (linkSelectMethodStr == "better") {
  1968. newTemplateBond->setLinkSelectMethod(ZT_BOND_RESELECTION_POLICY_BETTER);
  1969. }
  1970. if (linkSelectMethodStr == "failure") {
  1971. newTemplateBond->setLinkSelectMethod(ZT_BOND_RESELECTION_POLICY_FAILURE);
  1972. }
  1973. if (linkSelectMethodStr == "optimize") {
  1974. newTemplateBond->setLinkSelectMethod(ZT_BOND_RESELECTION_POLICY_OPTIMIZE);
  1975. }
  1976. if (newTemplateBond->getLinkSelectMethod() < 0 || newTemplateBond->getLinkSelectMethod() > 3) {
  1977. fprintf(stderr, "warning: invalid value (%s) for linkSelectMethod, assuming mode: always\n", linkSelectMethodStr.c_str());
  1978. }
  1979. if (!_node->bondController()->addCustomPolicy(newTemplateBond)) {
  1980. fprintf(stderr, "error: a custom policy of this name (%s) already exists.\n", customPolicyStr.c_str());
  1981. }
  1982. }
  1983. // Peer-specific bonding
  1984. json &peerSpecificBonds = settings["peerSpecificBonds"];
  1985. for (json::iterator peerItr = peerSpecificBonds.begin(); peerItr != peerSpecificBonds.end();++peerItr) {
  1986. _node->bondController()->assignBondingPolicyToPeer(std::stoull(peerItr.key(),0,16), peerItr.value());
  1987. }
  1988. // Check settings
  1989. if (defaultBondingPolicyStr.length() && !defaultBondingPolicy && !_node->bondController()->inUse()) {
  1990. fprintf(stderr, "error: unknown policy (%s) specified by defaultBondingPolicy, bond disabled.\n", defaultBondingPolicyStr.c_str());
  1991. }
  1992. }
  1993. // bondingPolicy cannot be used with allowTcpFallbackRelay
  1994. _allowTcpFallbackRelay = OSUtils::jsonBool(settings["allowTcpFallbackRelay"],true);
  1995. _forceTcpRelay = OSUtils::jsonBool(settings["forceTcpRelay"],false);
  1996. #ifdef ZT_TCP_FALLBACK_RELAY
  1997. _fallbackRelayAddress = InetAddress(OSUtils::jsonString(settings["tcpFallbackRelay"], ZT_TCP_FALLBACK_RELAY).c_str());
  1998. #endif
  1999. _primaryPort = (unsigned int)OSUtils::jsonInt(settings["primaryPort"],(uint64_t)_primaryPort) & 0xffff;
  2000. _allowSecondaryPort = OSUtils::jsonBool(settings["allowSecondaryPort"],true);
  2001. _secondaryPort = (unsigned int)OSUtils::jsonInt(settings["secondaryPort"],0);
  2002. _tertiaryPort = (unsigned int)OSUtils::jsonInt(settings["tertiaryPort"],0);
  2003. if (_secondaryPort != 0 || _tertiaryPort != 0) {
  2004. fprintf(stderr,"WARNING: using manually-specified secondary and/or tertiary ports. This can cause NAT issues." ZT_EOL_S);
  2005. }
  2006. _portMappingEnabled = OSUtils::jsonBool(settings["portMappingEnabled"],true);
  2007. _node->setLowBandwidthMode(OSUtils::jsonBool(settings["lowBandwidthMode"],false));
  2008. #ifndef ZT_SDK
  2009. const std::string up(OSUtils::jsonString(settings["softwareUpdate"],ZT_SOFTWARE_UPDATE_DEFAULT));
  2010. const bool udist = OSUtils::jsonBool(settings["softwareUpdateDist"],false);
  2011. if (((up == "apply")||(up == "download"))||(udist)) {
  2012. if (!_updater)
  2013. _updater = new SoftwareUpdater(*_node,_homePath);
  2014. _updateAutoApply = (up == "apply");
  2015. _updater->setUpdateDistribution(udist);
  2016. _updater->setChannel(OSUtils::jsonString(settings["softwareUpdateChannel"],ZT_SOFTWARE_UPDATE_DEFAULT_CHANNEL));
  2017. } else {
  2018. delete _updater;
  2019. _updater = (SoftwareUpdater *)0;
  2020. _updateAutoApply = false;
  2021. }
  2022. #endif
  2023. json &ignoreIfs = settings["interfacePrefixBlacklist"];
  2024. if (ignoreIfs.is_array()) {
  2025. for(unsigned long i=0;i<ignoreIfs.size();++i) {
  2026. const std::string tmp(OSUtils::jsonString(ignoreIfs[i],""));
  2027. if (tmp.length() > 0)
  2028. _interfacePrefixBlacklist.push_back(tmp);
  2029. }
  2030. }
  2031. json &amf = settings["allowManagementFrom"];
  2032. if (amf.is_array()) {
  2033. for(unsigned long i=0;i<amf.size();++i) {
  2034. const InetAddress nw(OSUtils::jsonString(amf[i],"").c_str());
  2035. if (nw)
  2036. _allowManagementFrom.push_back(nw);
  2037. }
  2038. }
  2039. }
  2040. #if ZT_VAULT_SUPPORT
  2041. json &vault = settings["vault"];
  2042. if (vault.is_object()) {
  2043. const std::string url(OSUtils::jsonString(vault["vaultURL"], "").c_str());
  2044. if (!url.empty()) {
  2045. _vaultURL = url;
  2046. }
  2047. const std::string token(OSUtils::jsonString(vault["vaultToken"], "").c_str());
  2048. if (!token.empty()) {
  2049. _vaultToken = token;
  2050. }
  2051. const std::string path(OSUtils::jsonString(vault["vaultPath"], "").c_str());
  2052. if (!path.empty()) {
  2053. _vaultPath = path;
  2054. }
  2055. }
  2056. // also check environment variables for values. Environment variables
  2057. // will override local.conf variables
  2058. const std::string envURL(getenv("VAULT_ADDR"));
  2059. if (!envURL.empty()) {
  2060. _vaultURL = envURL;
  2061. }
  2062. const std::string envToken(getenv("VAULT_TOKEN"));
  2063. if (!envToken.empty()) {
  2064. _vaultToken = envToken;
  2065. }
  2066. const std::string envPath(getenv("VAULT_PATH"));
  2067. if (!envPath.empty()) {
  2068. _vaultPath = envPath;
  2069. }
  2070. if (!_vaultURL.empty() && !_vaultToken.empty()) {
  2071. _vaultEnabled = true;
  2072. }
  2073. #endif
  2074. // Checks if a managed IP or route target is allowed
  2075. bool checkIfManagedIsAllowed(const NetworkState &n,const InetAddress &target)
  2076. {
  2077. if (!n.allowManaged())
  2078. return false;
  2079. if (!n.allowManagedWhitelist().empty()) {
  2080. bool allowed = false;
  2081. for (InetAddress addr : n.allowManagedWhitelist()) {
  2082. if (addr.containsAddress(target) && addr.netmaskBits() <= target.netmaskBits()) {
  2083. allowed = true;
  2084. break;
  2085. }
  2086. }
  2087. if (!allowed) return false;
  2088. }
  2089. if (target.isDefaultRoute())
  2090. return n.allowDefault();
  2091. switch(target.ipScope()) {
  2092. case InetAddress::IP_SCOPE_NONE:
  2093. case InetAddress::IP_SCOPE_MULTICAST:
  2094. case InetAddress::IP_SCOPE_LOOPBACK:
  2095. case InetAddress::IP_SCOPE_LINK_LOCAL:
  2096. return false;
  2097. case InetAddress::IP_SCOPE_GLOBAL:
  2098. return n.allowGlobal();
  2099. default:
  2100. return true;
  2101. }
  2102. }
  2103. // Match only an IP from a vector of IPs -- used in syncManagedStuff()
  2104. inline bool matchIpOnly(const std::set<InetAddress> &ips,const InetAddress &ip) const
  2105. {
  2106. for(std::set<InetAddress>::const_iterator i(ips.begin());i!=ips.end();++i) {
  2107. if (i->ipsEqual(ip))
  2108. return true;
  2109. }
  2110. return false;
  2111. }
  2112. // Apply or update managed IPs for a configured network (be sure n.tap exists)
  2113. void syncManagedStuff(NetworkState &n,bool syncIps,bool syncRoutes, bool syncDns)
  2114. {
  2115. char ipbuf[64];
  2116. // assumes _nets_m is locked
  2117. if (syncIps) {
  2118. std::vector<InetAddress> newManagedIps;
  2119. newManagedIps.reserve(n.config().assignedAddressCount);
  2120. #ifdef __APPLE__
  2121. std::vector<InetAddress> newManagedIps2;
  2122. newManagedIps2.reserve(n.config().assignedAddressCount);
  2123. #endif
  2124. for(unsigned int i=0;i<n.config().assignedAddressCount;++i) {
  2125. const InetAddress *ii = reinterpret_cast<const InetAddress *>(&(n.config().assignedAddresses[i]));
  2126. if (checkIfManagedIsAllowed(n,*ii))
  2127. newManagedIps.push_back(*ii);
  2128. }
  2129. std::sort(newManagedIps.begin(),newManagedIps.end());
  2130. newManagedIps.erase(std::unique(newManagedIps.begin(),newManagedIps.end()),newManagedIps.end());
  2131. for(std::vector<InetAddress>::iterator ip(n.managedIps().begin());ip!=n.managedIps().end();++ip) {
  2132. if (std::find(newManagedIps.begin(),newManagedIps.end(),*ip) == newManagedIps.end()) {
  2133. if (!n.tap()->removeIp(*ip))
  2134. fprintf(stderr,"ERROR: unable to remove ip address %s" ZT_EOL_S, ip->toString(ipbuf));
  2135. #ifdef __WINDOWS__
  2136. WinFWHelper::removeICMPRule(*ip, n.config().nwid);
  2137. #endif
  2138. }
  2139. }
  2140. for(std::vector<InetAddress>::iterator ip(newManagedIps.begin());ip!=newManagedIps.end();++ip) {
  2141. #ifdef __APPLE__
  2142. // We can't add multiple addresses to an interface on macOs unless we futz with the netmask.
  2143. // see `man ifconfig`, alias section
  2144. // "If the address is on the same subnet as the first network address for this interface, a non-conflicting netmask must be given. Usually 0xffffffff is most appropriate."
  2145. auto same_subnet = [ip](InetAddress i){
  2146. return ip->network() == i.network();
  2147. };
  2148. #endif
  2149. if (std::find(n.managedIps().begin(),n.managedIps().end(),*ip) == n.managedIps().end()) {
  2150. #ifdef __APPLE__
  2151. // if same subnet as a previously added address
  2152. if (
  2153. std::find_if(n.managedIps().begin(),n.managedIps().end(), same_subnet) != n.managedIps().end() ||
  2154. std::find_if(newManagedIps2.begin(),newManagedIps2.end(), same_subnet) != newManagedIps2.end()
  2155. ) {
  2156. if (ip->isV4()) {
  2157. ip->setPort(32);
  2158. } else {
  2159. ip->setPort(128);
  2160. }
  2161. } else {
  2162. newManagedIps2.push_back(*ip);
  2163. }
  2164. #endif
  2165. if (! n.tap()->addIp(*ip)) {
  2166. fprintf(stderr, "ERROR: unable to add ip address %s" ZT_EOL_S, ip->toString(ipbuf));
  2167. }
  2168. else {
  2169. #ifdef __WINDOWS__
  2170. WinFWHelper::newICMPRule(*ip, n.config().nwid);
  2171. #endif
  2172. }
  2173. }
  2174. }
  2175. #ifdef __APPLE__
  2176. if (!MacDNSHelper::addIps(n.config().nwid, n.config().mac, n.tap()->deviceName().c_str(), newManagedIps))
  2177. fprintf(stderr, "ERROR: unable to add v6 addresses to system configuration" ZT_EOL_S);
  2178. #endif
  2179. n.setManagedIps(newManagedIps);
  2180. }
  2181. if (syncRoutes) {
  2182. // Get tap device name (use LUID in hex on Windows) and IP addresses.
  2183. #if defined(__WINDOWS__) && !defined(ZT_SDK)
  2184. char tapdevbuf[64];
  2185. OSUtils::ztsnprintf(tapdevbuf,sizeof(tapdevbuf),"%.16llx",(unsigned long long)((WindowsEthernetTap *)(n.tap().get()))->luid().Value);
  2186. std::string tapdev(tapdevbuf);
  2187. #else
  2188. std::string tapdev(n.tap()->deviceName());
  2189. #endif
  2190. std::vector<InetAddress> tapIps(n.tap()->ips());
  2191. std::set<InetAddress> myIps(tapIps.begin(), tapIps.end());
  2192. for(unsigned int i=0;i<n.config().assignedAddressCount;++i)
  2193. myIps.insert(InetAddress(n.config().assignedAddresses[i]));
  2194. std::set<InetAddress> haveRouteTargets;
  2195. for(unsigned int i=0;i<n.config().routeCount;++i) {
  2196. const InetAddress *const target = reinterpret_cast<const InetAddress *>(&(n.config().routes[i].target));
  2197. const InetAddress *const via = reinterpret_cast<const InetAddress *>(&(n.config().routes[i].via));
  2198. // Make sure we are allowed to set this managed route, and that 'via' is not our IP. The latter
  2199. // avoids setting routes via the router on the router.
  2200. if ( (!checkIfManagedIsAllowed(n,*target)) || ((via->ss_family == target->ss_family)&&(matchIpOnly(myIps,*via))) )
  2201. continue;
  2202. // Find an IP on the interface that can be a source IP, abort if no IPs assigned.
  2203. const InetAddress *src = nullptr;
  2204. unsigned int mostMatchingPrefixBits = 0;
  2205. for(std::set<InetAddress>::const_iterator i(myIps.begin());i!=myIps.end();++i) {
  2206. const unsigned int matchingPrefixBits = i->matchingPrefixBits(*target);
  2207. if (matchingPrefixBits >= mostMatchingPrefixBits && ((target->isV4() && i->isV4()) || (target->isV6() && i->isV6()))) {
  2208. mostMatchingPrefixBits = matchingPrefixBits;
  2209. src = &(*i);
  2210. }
  2211. }
  2212. if (!src)
  2213. continue;
  2214. // Ignore routes implied by local managed IPs since adding the IP adds the route.
  2215. // Apple on the other hand seems to need this at least on some versions.
  2216. #ifndef __APPLE__
  2217. bool haveRoute = false;
  2218. for(std::vector<InetAddress>::iterator ip(n.managedIps().begin());ip!=n.managedIps().end();++ip) {
  2219. if ((target->netmaskBits() == ip->netmaskBits())&&(target->containsAddress(*ip))) {
  2220. haveRoute = true;
  2221. break;
  2222. }
  2223. }
  2224. if (haveRoute)
  2225. continue;
  2226. #endif
  2227. haveRouteTargets.insert(*target);
  2228. #ifndef ZT_SDK
  2229. SharedPtr<ManagedRoute> &mr = n.managedRoutes()[*target];
  2230. if (!mr)
  2231. mr.set(new ManagedRoute(*target, *via, *src, tapdev.c_str()));
  2232. #endif
  2233. }
  2234. for(std::map< InetAddress, SharedPtr<ManagedRoute> >::iterator r(n.managedRoutes().begin());r!=n.managedRoutes().end();) {
  2235. if (haveRouteTargets.find(r->first) == haveRouteTargets.end())
  2236. n.managedRoutes().erase(r++);
  2237. else ++r;
  2238. }
  2239. // Sync device-local managed routes first, then indirect results. That way
  2240. // we don't get destination unreachable for routes that are via things
  2241. // that do not yet have routes in the system.
  2242. for(std::map< InetAddress, SharedPtr<ManagedRoute> >::iterator r(n.managedRoutes().begin());r!=n.managedRoutes().end();++r) {
  2243. if (!r->second->via())
  2244. r->second->sync();
  2245. }
  2246. for(std::map< InetAddress, SharedPtr<ManagedRoute> >::iterator r(n.managedRoutes().begin());r!=n.managedRoutes().end();++r) {
  2247. if (r->second->via())
  2248. r->second->sync();
  2249. }
  2250. }
  2251. if (syncDns) {
  2252. if (n.allowDNS()) {
  2253. if (strlen(n.config().dns.domain) != 0) {
  2254. std::vector<InetAddress> servers;
  2255. for (int j = 0; j < ZT_MAX_DNS_SERVERS; ++j) {
  2256. InetAddress a(n.config().dns.server_addr[j]);
  2257. if (a.isV4() || a.isV6()) {
  2258. servers.push_back(a);
  2259. }
  2260. }
  2261. n.tap()->setDns(n.config().dns.domain, servers);
  2262. }
  2263. } else {
  2264. #ifdef __APPLE__
  2265. MacDNSHelper::removeDNS(n.config().nwid);
  2266. #elif defined(__WINDOWS__)
  2267. WinDNSHelper::removeDNS(n.config().nwid);
  2268. #endif
  2269. }
  2270. }
  2271. }
  2272. // =========================================================================
  2273. // Handlers for Node and Phy<> callbacks
  2274. // =========================================================================
  2275. inline void phyOnDatagram(PhySocket *sock,void **uptr,const struct sockaddr *localAddr,const struct sockaddr *from,void *data,unsigned long len)
  2276. {
  2277. if (_forceTcpRelay) {
  2278. return;
  2279. }
  2280. Metrics::udp_recv += len;
  2281. const uint64_t now = OSUtils::now();
  2282. if ((len >= 16)&&(reinterpret_cast<const InetAddress *>(from)->ipScope() == InetAddress::IP_SCOPE_GLOBAL)) {
  2283. _lastDirectReceiveFromGlobal = now;
  2284. }
  2285. const ZT_ResultCode rc = _node->processWirePacket(nullptr,now,reinterpret_cast<int64_t>(sock),reinterpret_cast<const struct sockaddr_storage *>(from),data,len,&_nextBackgroundTaskDeadline);
  2286. if (ZT_ResultCode_isFatal(rc)) {
  2287. char tmp[256];
  2288. OSUtils::ztsnprintf(tmp,sizeof(tmp),"fatal error code from processWirePacket: %d",(int)rc);
  2289. Mutex::Lock _l(_termReason_m);
  2290. _termReason = ONE_UNRECOVERABLE_ERROR;
  2291. _fatalErrorMessage = tmp;
  2292. this->terminate();
  2293. }
  2294. }
  2295. inline void phyOnTcpConnect(PhySocket *sock,void **uptr,bool success)
  2296. {
  2297. if (!success) {
  2298. phyOnTcpClose(sock,uptr);
  2299. return;
  2300. }
  2301. TcpConnection *const tc = reinterpret_cast<TcpConnection *>(*uptr);
  2302. if (!tc) { // sanity check
  2303. _phy.close(sock,true);
  2304. return;
  2305. }
  2306. tc->sock = sock;
  2307. if (tc->type == TcpConnection::TCP_TUNNEL_OUTGOING) {
  2308. if (_tcpFallbackTunnel)
  2309. _phy.close(_tcpFallbackTunnel->sock);
  2310. _tcpFallbackTunnel = tc;
  2311. _phy.streamSend(sock,ZT_TCP_TUNNEL_HELLO,sizeof(ZT_TCP_TUNNEL_HELLO));
  2312. } else {
  2313. _phy.close(sock,true);
  2314. }
  2315. }
  2316. inline void phyOnTcpAccept(PhySocket *sockL,PhySocket *sockN,void **uptrL,void **uptrN,const struct sockaddr *from)
  2317. {
  2318. if (!from) {
  2319. _phy.close(sockN,false);
  2320. return;
  2321. } else {
  2322. #ifdef ZT_SDK
  2323. // Immediately close new local connections. The intention is to prevent the backplane from being accessed when operating as libzt
  2324. if (!allowHttpBackplaneManagement && ((InetAddress*)from)->ipScope() == InetAddress::IP_SCOPE_LOOPBACK) {
  2325. _phy.close(sockN,false);
  2326. return;
  2327. }
  2328. #endif
  2329. TcpConnection *tc = new TcpConnection();
  2330. {
  2331. Mutex::Lock _l(_tcpConnections_m);
  2332. _tcpConnections.push_back(tc);
  2333. }
  2334. tc->type = TcpConnection::TCP_UNCATEGORIZED_INCOMING;
  2335. tc->parent = this;
  2336. tc->sock = sockN;
  2337. tc->remoteAddr = from;
  2338. tc->lastReceive = OSUtils::now();
  2339. http_parser_init(&(tc->parser),HTTP_REQUEST);
  2340. tc->parser.data = (void *)tc;
  2341. tc->messageSize = 0;
  2342. *uptrN = (void *)tc;
  2343. }
  2344. }
  2345. void phyOnTcpClose(PhySocket *sock,void **uptr)
  2346. {
  2347. TcpConnection *tc = (TcpConnection *)*uptr;
  2348. if (tc) {
  2349. if (tc == _tcpFallbackTunnel) {
  2350. _tcpFallbackTunnel = (TcpConnection *)0;
  2351. }
  2352. {
  2353. Mutex::Lock _l(_tcpConnections_m);
  2354. _tcpConnections.erase(std::remove(_tcpConnections.begin(),_tcpConnections.end(),tc),_tcpConnections.end());
  2355. }
  2356. delete tc;
  2357. }
  2358. }
  2359. void phyOnTcpData(PhySocket *sock,void **uptr,void *data,unsigned long len)
  2360. {
  2361. try {
  2362. if (!len) return; // sanity check, should never happen
  2363. Metrics::tcp_recv += len;
  2364. TcpConnection *tc = reinterpret_cast<TcpConnection *>(*uptr);
  2365. tc->lastReceive = OSUtils::now();
  2366. switch(tc->type) {
  2367. // TODO: Remove Me
  2368. // case TcpConnection::TCP_UNCATEGORIZED_INCOMING:
  2369. // switch(reinterpret_cast<uint8_t *>(data)[0]) {
  2370. // // HTTP: GET, PUT, POST, HEAD, DELETE
  2371. // case 'G':
  2372. // case 'P':
  2373. // case 'D':
  2374. // case 'H': {
  2375. // // This is only allowed from IPs permitted to access the management
  2376. // // backplane, which is just 127.0.0.1/::1 unless otherwise configured.
  2377. // bool allow;
  2378. // {
  2379. // Mutex::Lock _l(_localConfig_m);
  2380. // if (_allowManagementFrom.empty()) {
  2381. // allow = (tc->remoteAddr.ipScope() == InetAddress::IP_SCOPE_LOOPBACK);
  2382. // } else {
  2383. // allow = false;
  2384. // for(std::vector<InetAddress>::const_iterator i(_allowManagementFrom.begin());i!=_allowManagementFrom.end();++i) {
  2385. // if (i->containsAddress(tc->remoteAddr)) {
  2386. // allow = true;
  2387. // break;
  2388. // }
  2389. // }
  2390. // }
  2391. // }
  2392. // if (allow) {
  2393. // tc->type = TcpConnection::TCP_HTTP_INCOMING;
  2394. // phyOnTcpData(sock,uptr,data,len);
  2395. // } else {
  2396. // _phy.close(sock);
  2397. // }
  2398. // } break;
  2399. // // Drop unknown protocols
  2400. // default:
  2401. // _phy.close(sock);
  2402. // break;
  2403. // }
  2404. // return;
  2405. case TcpConnection::TCP_HTTP_INCOMING:
  2406. case TcpConnection::TCP_HTTP_OUTGOING:
  2407. http_parser_execute(&(tc->parser),&HTTP_PARSER_SETTINGS,(const char *)data,len);
  2408. if ((tc->parser.upgrade)||(tc->parser.http_errno != HPE_OK))
  2409. _phy.close(sock);
  2410. return;
  2411. case TcpConnection::TCP_TUNNEL_OUTGOING:
  2412. tc->readq.append((const char *)data,len);
  2413. while (tc->readq.length() >= 5) {
  2414. const char *data = tc->readq.data();
  2415. const unsigned long mlen = ( ((((unsigned long)data[3]) & 0xff) << 8) | (((unsigned long)data[4]) & 0xff) );
  2416. if (tc->readq.length() >= (mlen + 5)) {
  2417. InetAddress from;
  2418. unsigned long plen = mlen; // payload length, modified if there's an IP header
  2419. data += 5; // skip forward past pseudo-TLS junk and mlen
  2420. if (plen == 4) {
  2421. // Hello message, which isn't sent by proxy and would be ignored by client
  2422. } else if (plen) {
  2423. // Messages should contain IPv4 or IPv6 source IP address data
  2424. switch(data[0]) {
  2425. case 4: // IPv4
  2426. if (plen >= 7) {
  2427. from.set((const void *)(data + 1),4,((((unsigned int)data[5]) & 0xff) << 8) | (((unsigned int)data[6]) & 0xff));
  2428. data += 7; // type + 4 byte IP + 2 byte port
  2429. plen -= 7;
  2430. } else {
  2431. _phy.close(sock);
  2432. return;
  2433. }
  2434. break;
  2435. case 6: // IPv6
  2436. if (plen >= 19) {
  2437. from.set((const void *)(data + 1),16,((((unsigned int)data[17]) & 0xff) << 8) | (((unsigned int)data[18]) & 0xff));
  2438. data += 19; // type + 16 byte IP + 2 byte port
  2439. plen -= 19;
  2440. } else {
  2441. _phy.close(sock);
  2442. return;
  2443. }
  2444. break;
  2445. case 0: // none/omitted
  2446. ++data;
  2447. --plen;
  2448. break;
  2449. default: // invalid address type
  2450. _phy.close(sock);
  2451. return;
  2452. }
  2453. if (from) {
  2454. InetAddress fakeTcpLocalInterfaceAddress((uint32_t)0xffffffff,0xffff);
  2455. const ZT_ResultCode rc = _node->processWirePacket(
  2456. (void *)0,
  2457. OSUtils::now(),
  2458. -1,
  2459. reinterpret_cast<struct sockaddr_storage *>(&from),
  2460. data,
  2461. plen,
  2462. &_nextBackgroundTaskDeadline);
  2463. if (ZT_ResultCode_isFatal(rc)) {
  2464. char tmp[256];
  2465. OSUtils::ztsnprintf(tmp,sizeof(tmp),"fatal error code from processWirePacket: %d",(int)rc);
  2466. Mutex::Lock _l(_termReason_m);
  2467. _termReason = ONE_UNRECOVERABLE_ERROR;
  2468. _fatalErrorMessage = tmp;
  2469. this->terminate();
  2470. _phy.close(sock);
  2471. return;
  2472. }
  2473. }
  2474. }
  2475. if (tc->readq.length() > (mlen + 5))
  2476. tc->readq.erase(tc->readq.begin(),tc->readq.begin() + (mlen + 5));
  2477. else tc->readq.clear();
  2478. } else break;
  2479. }
  2480. return;
  2481. }
  2482. } catch ( ... ) {
  2483. _phy.close(sock);
  2484. }
  2485. }
  2486. inline void phyOnTcpWritable(PhySocket *sock,void **uptr)
  2487. {
  2488. TcpConnection *tc = reinterpret_cast<TcpConnection *>(*uptr);
  2489. bool closeit = false;
  2490. {
  2491. Mutex::Lock _l(tc->writeq_m);
  2492. if (tc->writeq.length() > 0) {
  2493. long sent = (long)_phy.streamSend(sock,tc->writeq.data(),(unsigned long)tc->writeq.length(),true);
  2494. Metrics::tcp_send += sent;
  2495. if (sent > 0) {
  2496. if ((unsigned long)sent >= (unsigned long)tc->writeq.length()) {
  2497. tc->writeq.clear();
  2498. _phy.setNotifyWritable(sock,false);
  2499. if (tc->type == TcpConnection::TCP_HTTP_INCOMING)
  2500. closeit = true; // HTTP keep alive not supported
  2501. } else {
  2502. tc->writeq.erase(tc->writeq.begin(),tc->writeq.begin() + sent);
  2503. }
  2504. }
  2505. } else {
  2506. _phy.setNotifyWritable(sock,false);
  2507. }
  2508. }
  2509. if (closeit)
  2510. _phy.close(sock);
  2511. }
  2512. inline void phyOnFileDescriptorActivity(PhySocket *sock,void **uptr,bool readable,bool writable) {}
  2513. inline void phyOnUnixAccept(PhySocket *sockL,PhySocket *sockN,void **uptrL,void **uptrN) {}
  2514. inline void phyOnUnixClose(PhySocket *sock,void **uptr) {}
  2515. inline void phyOnUnixData(PhySocket *sock,void **uptr,void *data,unsigned long len) {}
  2516. inline void phyOnUnixWritable(PhySocket *sock,void **uptr) {}
  2517. inline int nodeVirtualNetworkConfigFunction(uint64_t nwid,void **nuptr,enum ZT_VirtualNetworkConfigOperation op,const ZT_VirtualNetworkConfig *nwc)
  2518. {
  2519. Mutex::Lock _l(_nets_m);
  2520. NetworkState &n = _nets[nwid];
  2521. n.setWebPort(_primaryPort);
  2522. switch (op) {
  2523. case ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP:
  2524. if (!n.tap()) {
  2525. try {
  2526. char friendlyName[128];
  2527. OSUtils::ztsnprintf(friendlyName,sizeof(friendlyName),"ZeroTier One [%.16llx]",nwid);
  2528. n.setTap(EthernetTap::newInstance(
  2529. nullptr,
  2530. _homePath.c_str(),
  2531. MAC(nwc->mac),
  2532. nwc->mtu,
  2533. (unsigned int)ZT_IF_METRIC,
  2534. nwid,
  2535. friendlyName,
  2536. StapFrameHandler,
  2537. (void *)this));
  2538. *nuptr = (void *)&n;
  2539. char nlcpath[256];
  2540. OSUtils::ztsnprintf(nlcpath,sizeof(nlcpath),"%s" ZT_PATH_SEPARATOR_S "networks.d" ZT_PATH_SEPARATOR_S "%.16llx.local.conf",_homePath.c_str(),nwid);
  2541. std::string nlcbuf;
  2542. if (OSUtils::readFile(nlcpath,nlcbuf)) {
  2543. Dictionary<4096> nc;
  2544. nc.load(nlcbuf.c_str());
  2545. Buffer<1024> allowManaged;
  2546. if (nc.get("allowManaged", allowManaged) && allowManaged.size() > 0) {
  2547. std::string addresses (allowManaged.begin(), allowManaged.size());
  2548. if (allowManaged.size() <= 5) { // untidy parsing for backward compatibility
  2549. if (allowManaged[0] == '1' || allowManaged[0] == 't' || allowManaged[0] == 'T') {
  2550. n.setAllowManaged(true);
  2551. } else {
  2552. n.setAllowManaged(false);
  2553. }
  2554. } else {
  2555. // this should be a list of IP addresses
  2556. n.setAllowManaged(true);
  2557. size_t pos = 0;
  2558. while (true) {
  2559. size_t nextPos = addresses.find(',', pos);
  2560. std::string address = addresses.substr(pos, (nextPos == std::string::npos ? addresses.size() : nextPos) - pos);
  2561. n.addToAllowManagedWhiteList(InetAddress(address.c_str()));
  2562. if (nextPos == std::string::npos) break;
  2563. pos = nextPos + 1;
  2564. }
  2565. }
  2566. } else {
  2567. n.setAllowManaged(true);
  2568. }
  2569. n.setAllowGlobal(nc.getB("allowGlobal", false));
  2570. n.setAllowDefault(nc.getB("allowDefault", false));
  2571. n.setAllowDNS(nc.getB("allowDNS", false));
  2572. }
  2573. } catch (std::exception &exc) {
  2574. #ifdef __WINDOWS__
  2575. FILE *tapFailLog = fopen((_homePath + ZT_PATH_SEPARATOR_S"port_error_log.txt").c_str(),"a");
  2576. if (tapFailLog) {
  2577. fprintf(tapFailLog,"%.16llx: %s" ZT_EOL_S,(unsigned long long)nwid,exc.what());
  2578. fclose(tapFailLog);
  2579. }
  2580. #else
  2581. fprintf(stderr,"ERROR: unable to configure virtual network port: %s" ZT_EOL_S,exc.what());
  2582. #endif
  2583. _nets.erase(nwid);
  2584. return -999;
  2585. } catch ( ... ) {
  2586. return -999; // tap init failed
  2587. }
  2588. }
  2589. // After setting up tap, fall through to CONFIG_UPDATE since we also want to do this...
  2590. case ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE:
  2591. n.setConfig(nwc);
  2592. if (n.tap()) { // sanity check
  2593. #if defined(__WINDOWS__) && !defined(ZT_SDK)
  2594. // wait for up to 5 seconds for the WindowsEthernetTap to actually be initialized
  2595. //
  2596. // without WindowsEthernetTap::isInitialized() returning true, the won't actually
  2597. // be online yet and setting managed routes on it will fail.
  2598. const int MAX_SLEEP_COUNT = 500;
  2599. for (int i = 0; !((WindowsEthernetTap *)(n.tap().get()))->isInitialized() && i < MAX_SLEEP_COUNT; i++) {
  2600. Sleep(10);
  2601. }
  2602. #endif
  2603. syncManagedStuff(n,true,true,true);
  2604. n.tap()->setMtu(nwc->mtu);
  2605. } else {
  2606. _nets.erase(nwid);
  2607. return -999; // tap init failed
  2608. }
  2609. break;
  2610. case ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_DOWN:
  2611. case ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_DESTROY:
  2612. if (n.tap()) { // sanity check
  2613. #if defined(__WINDOWS__) && !defined(ZT_SDK)
  2614. std::string winInstanceId(((WindowsEthernetTap *)(n.tap().get()))->instanceId());
  2615. #endif
  2616. *nuptr = (void *)0;
  2617. n.tap().reset();
  2618. _nets.erase(nwid);
  2619. #if defined(__WINDOWS__) && !defined(ZT_SDK)
  2620. if ((op == ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_DESTROY) && (winInstanceId.length() > 0)) {
  2621. WindowsEthernetTap::deletePersistentTapDevice(winInstanceId.c_str());
  2622. WinFWHelper::removeICMPRules(nwid);
  2623. }
  2624. #endif
  2625. if (op == ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_DESTROY) {
  2626. char nlcpath[256];
  2627. OSUtils::ztsnprintf(nlcpath,sizeof(nlcpath),"%s" ZT_PATH_SEPARATOR_S "networks.d" ZT_PATH_SEPARATOR_S "%.16llx.local.conf",_homePath.c_str(),nwid);
  2628. OSUtils::rm(nlcpath);
  2629. }
  2630. } else {
  2631. _nets.erase(nwid);
  2632. }
  2633. break;
  2634. }
  2635. return 0;
  2636. }
  2637. inline void nodeEventCallback(enum ZT_Event event,const void *metaData)
  2638. {
  2639. switch(event) {
  2640. case ZT_EVENT_FATAL_ERROR_IDENTITY_COLLISION: {
  2641. Mutex::Lock _l(_termReason_m);
  2642. _termReason = ONE_IDENTITY_COLLISION;
  2643. _fatalErrorMessage = "identity/address collision";
  2644. this->terminate();
  2645. } break;
  2646. case ZT_EVENT_TRACE: {
  2647. if (metaData) {
  2648. ::fprintf(stderr,"%s" ZT_EOL_S,(const char *)metaData);
  2649. ::fflush(stderr);
  2650. }
  2651. } break;
  2652. case ZT_EVENT_USER_MESSAGE: {
  2653. const ZT_UserMessage *um = reinterpret_cast<const ZT_UserMessage *>(metaData);
  2654. if ((um->typeId == ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE)&&(_updater)) {
  2655. _updater->handleSoftwareUpdateUserMessage(um->origin,um->data,um->length);
  2656. }
  2657. } break;
  2658. case ZT_EVENT_REMOTE_TRACE: {
  2659. const ZT_RemoteTrace *rt = reinterpret_cast<const ZT_RemoteTrace *>(metaData);
  2660. if ((rt)&&(rt->len > 0)&&(rt->len <= ZT_MAX_REMOTE_TRACE_SIZE)&&(rt->data))
  2661. _controller->handleRemoteTrace(*rt);
  2662. }
  2663. default:
  2664. break;
  2665. }
  2666. }
  2667. #if ZT_VAULT_SUPPORT
  2668. inline bool nodeVaultPutIdentity(enum ZT_StateObjectType type, const void *data, int len)
  2669. {
  2670. bool retval = false;
  2671. if (type != ZT_STATE_OBJECT_IDENTITY_PUBLIC && type != ZT_STATE_OBJECT_IDENTITY_SECRET) {
  2672. return retval;
  2673. }
  2674. CURL *curl = curl_easy_init();
  2675. if (curl) {
  2676. char token[512] = { 0 };
  2677. snprintf(token, sizeof(token), "X-Vault-Token: %s", _vaultToken.c_str());
  2678. struct curl_slist *chunk = NULL;
  2679. chunk = curl_slist_append(chunk, token);
  2680. char content_type[512] = { 0 };
  2681. snprintf(content_type, sizeof(content_type), "Content-Type: application/json");
  2682. chunk = curl_slist_append(chunk, content_type);
  2683. curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
  2684. char url[2048] = { 0 };
  2685. snprintf(url, sizeof(url), "%s/v1/%s", _vaultURL.c_str(), _vaultPath.c_str());
  2686. curl_easy_setopt(curl, CURLOPT_URL, url);
  2687. json d = json::object();
  2688. if (type == ZT_STATE_OBJECT_IDENTITY_PUBLIC) {
  2689. std::string key((const char*)data, len);
  2690. d["public"] = key;
  2691. }
  2692. else if (type == ZT_STATE_OBJECT_IDENTITY_SECRET) {
  2693. std::string key((const char*)data, len);
  2694. d["secret"] = key;
  2695. }
  2696. if (!d.empty()) {
  2697. std::string post = d.dump();
  2698. if (!post.empty()) {
  2699. curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post.c_str());
  2700. curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, post.length());
  2701. #ifndef NDEBUG
  2702. curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
  2703. #endif
  2704. CURLcode res = curl_easy_perform(curl);
  2705. if (res == CURLE_OK) {
  2706. long response_code = 0;
  2707. curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
  2708. if (response_code == 200 || response_code == 204) {
  2709. retval = true;
  2710. }
  2711. }
  2712. }
  2713. }
  2714. curl_easy_cleanup(curl);
  2715. curl = NULL;
  2716. curl_slist_free_all(chunk);
  2717. chunk = NULL;
  2718. }
  2719. return retval;
  2720. }
  2721. #endif
  2722. inline void nodeStatePutFunction(enum ZT_StateObjectType type,const uint64_t id[2],const void *data,int len)
  2723. {
  2724. #if ZT_VAULT_SUPPORT
  2725. if (_vaultEnabled && (type == ZT_STATE_OBJECT_IDENTITY_SECRET || type == ZT_STATE_OBJECT_IDENTITY_PUBLIC)) {
  2726. if (nodeVaultPutIdentity(type, data, len)) {
  2727. // value successfully written to Vault
  2728. return;
  2729. }
  2730. // else fallback to disk
  2731. }
  2732. #endif
  2733. char p[1024];
  2734. FILE *f;
  2735. bool secure = false;
  2736. char dirname[1024];
  2737. dirname[0] = 0;
  2738. switch(type) {
  2739. case ZT_STATE_OBJECT_IDENTITY_PUBLIC:
  2740. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "identity.public",_homePath.c_str());
  2741. break;
  2742. case ZT_STATE_OBJECT_IDENTITY_SECRET:
  2743. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "identity.secret",_homePath.c_str());
  2744. secure = true;
  2745. break;
  2746. case ZT_STATE_OBJECT_PLANET:
  2747. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "planet",_homePath.c_str());
  2748. break;
  2749. case ZT_STATE_OBJECT_MOON:
  2750. OSUtils::ztsnprintf(dirname,sizeof(dirname),"%s" ZT_PATH_SEPARATOR_S "moons.d",_homePath.c_str());
  2751. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "%.16llx.moon",dirname,(unsigned long long)id[0]);
  2752. break;
  2753. case ZT_STATE_OBJECT_NETWORK_CONFIG:
  2754. OSUtils::ztsnprintf(dirname,sizeof(dirname),"%s" ZT_PATH_SEPARATOR_S "networks.d",_homePath.c_str());
  2755. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "%.16llx.conf",dirname,(unsigned long long)id[0]);
  2756. break;
  2757. case ZT_STATE_OBJECT_PEER:
  2758. OSUtils::ztsnprintf(dirname,sizeof(dirname),"%s" ZT_PATH_SEPARATOR_S "peers.d",_homePath.c_str());
  2759. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "%.10llx.peer",dirname,(unsigned long long)id[0]);
  2760. break;
  2761. default:
  2762. return;
  2763. }
  2764. if ((len >= 0)&&(data)) {
  2765. // Check to see if we've already written this first. This reduces
  2766. // redundant writes and I/O overhead on most platforms and has
  2767. // little effect on others.
  2768. f = fopen(p,"rb");
  2769. if (f) {
  2770. char *const buf = (char *)malloc(len*4);
  2771. if (buf) {
  2772. long l = (long)fread(buf,1,(size_t)(len*4),f);
  2773. fclose(f);
  2774. if ((l == (long)len)&&(memcmp(data,buf,l) == 0)) {
  2775. free(buf);
  2776. return;
  2777. }
  2778. free(buf);
  2779. }
  2780. }
  2781. f = fopen(p,"wb");
  2782. if ((!f)&&(dirname[0])) { // create subdirectory if it does not exist
  2783. OSUtils::mkdir(dirname);
  2784. f = fopen(p,"wb");
  2785. }
  2786. if (f) {
  2787. if (fwrite(data,len,1,f) != 1)
  2788. fprintf(stderr,"WARNING: unable to write to file: %s (I/O error)" ZT_EOL_S,p);
  2789. fclose(f);
  2790. if (secure)
  2791. OSUtils::lockDownFile(p,false);
  2792. } else {
  2793. fprintf(stderr,"WARNING: unable to write to file: %s (unable to open)" ZT_EOL_S,p);
  2794. }
  2795. } else {
  2796. OSUtils::rm(p);
  2797. }
  2798. }
  2799. #if ZT_VAULT_SUPPORT
  2800. inline int nodeVaultGetIdentity(enum ZT_StateObjectType type, void *data, unsigned int maxlen)
  2801. {
  2802. if (type != ZT_STATE_OBJECT_IDENTITY_SECRET && type != ZT_STATE_OBJECT_IDENTITY_PUBLIC) {
  2803. return -1;
  2804. }
  2805. int ret = -1;
  2806. CURL *curl = curl_easy_init();
  2807. if (curl) {
  2808. char token[512] = { 0 };
  2809. snprintf(token, sizeof(token), "X-Vault-Token: %s", _vaultToken.c_str());
  2810. struct curl_slist *chunk = NULL;
  2811. chunk = curl_slist_append(chunk, token);
  2812. curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
  2813. char url[2048] = { 0 };
  2814. snprintf(url, sizeof(url), "%s/v1/%s", _vaultURL.c_str(), _vaultPath.c_str());
  2815. curl_easy_setopt(curl, CURLOPT_URL, url);
  2816. std::string response;
  2817. std::string res_headers;
  2818. curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, &curlResponseWrite);
  2819. curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
  2820. curl_easy_setopt(curl, CURLOPT_HEADERDATA, &res_headers);
  2821. #ifndef NDEBUG
  2822. curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
  2823. #endif
  2824. CURLcode res = curl_easy_perform(curl);
  2825. if (res == CURLE_OK) {
  2826. long response_code = 0;
  2827. curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
  2828. if (response_code == 200) {
  2829. try {
  2830. json payload = json::parse(response);
  2831. if (!payload["data"].is_null()) {
  2832. json &d = payload["data"];
  2833. if (type == ZT_STATE_OBJECT_IDENTITY_SECRET) {
  2834. std::string secret = OSUtils::jsonString(d["secret"],"");
  2835. if (!secret.empty()) {
  2836. ret = (int)secret.length();
  2837. memcpy(data, secret.c_str(), ret);
  2838. }
  2839. }
  2840. else if (type == ZT_STATE_OBJECT_IDENTITY_PUBLIC) {
  2841. std::string pub = OSUtils::jsonString(d["public"],"");
  2842. if (!pub.empty()) {
  2843. ret = (int)pub.length();
  2844. memcpy(data, pub.c_str(), ret);
  2845. }
  2846. }
  2847. }
  2848. }
  2849. catch (...) {
  2850. ret = -1;
  2851. }
  2852. }
  2853. }
  2854. curl_easy_cleanup(curl);
  2855. curl = NULL;
  2856. curl_slist_free_all(chunk);
  2857. chunk = NULL;
  2858. }
  2859. return ret;
  2860. }
  2861. #endif
  2862. inline int nodeStateGetFunction(enum ZT_StateObjectType type,const uint64_t id[2],void *data,unsigned int maxlen)
  2863. {
  2864. #if ZT_VAULT_SUPPORT
  2865. if (_vaultEnabled && (type == ZT_STATE_OBJECT_IDENTITY_SECRET || type == ZT_STATE_OBJECT_IDENTITY_PUBLIC) ) {
  2866. int retval = nodeVaultGetIdentity(type, data, maxlen);
  2867. if (retval >= 0)
  2868. return retval;
  2869. // else continue file based lookup
  2870. }
  2871. #endif
  2872. char p[4096];
  2873. switch(type) {
  2874. case ZT_STATE_OBJECT_IDENTITY_PUBLIC:
  2875. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "identity.public",_homePath.c_str());
  2876. break;
  2877. case ZT_STATE_OBJECT_IDENTITY_SECRET:
  2878. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "identity.secret",_homePath.c_str());
  2879. break;
  2880. case ZT_STATE_OBJECT_PLANET:
  2881. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "planet",_homePath.c_str());
  2882. break;
  2883. case ZT_STATE_OBJECT_MOON:
  2884. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "moons.d" ZT_PATH_SEPARATOR_S "%.16llx.moon",_homePath.c_str(),(unsigned long long)id[0]);
  2885. break;
  2886. case ZT_STATE_OBJECT_NETWORK_CONFIG:
  2887. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "networks.d" ZT_PATH_SEPARATOR_S "%.16llx.conf",_homePath.c_str(),(unsigned long long)id[0]);
  2888. break;
  2889. case ZT_STATE_OBJECT_PEER:
  2890. OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "peers.d" ZT_PATH_SEPARATOR_S "%.10llx.peer",_homePath.c_str(),(unsigned long long)id[0]);
  2891. break;
  2892. default:
  2893. return -1;
  2894. }
  2895. FILE *f = fopen(p,"rb");
  2896. if (f) {
  2897. int n = (int)fread(data,1,maxlen,f);
  2898. fclose(f);
  2899. #if ZT_VAULT_SUPPORT
  2900. if (_vaultEnabled && (type == ZT_STATE_OBJECT_IDENTITY_SECRET || type == ZT_STATE_OBJECT_IDENTITY_PUBLIC)) {
  2901. // If we've gotten here while Vault is enabled, Vault does not know the key and it's been
  2902. // read from disk instead.
  2903. //
  2904. // We should put the value in Vault and remove the local file.
  2905. if (nodeVaultPutIdentity(type, data, n)) {
  2906. unlink(p);
  2907. }
  2908. }
  2909. #endif
  2910. if (n >= 0)
  2911. return n;
  2912. }
  2913. return -1;
  2914. }
  2915. inline int nodeWirePacketSendFunction(const int64_t localSocket,const struct sockaddr_storage *addr,const void *data,unsigned int len,unsigned int ttl)
  2916. {
  2917. #ifdef ZT_TCP_FALLBACK_RELAY
  2918. if(_allowTcpFallbackRelay) {
  2919. if (addr->ss_family == AF_INET) {
  2920. // TCP fallback tunnel support, currently IPv4 only
  2921. if ((len >= 16)&&(reinterpret_cast<const InetAddress *>(addr)->ipScope() == InetAddress::IP_SCOPE_GLOBAL)) {
  2922. // Engage TCP tunnel fallback if we haven't received anything valid from a global
  2923. // IP address in ZT_TCP_FALLBACK_AFTER milliseconds. If we do start getting
  2924. // valid direct traffic we'll stop using it and close the socket after a while.
  2925. const int64_t now = OSUtils::now();
  2926. if (_forceTcpRelay || (((now - _lastDirectReceiveFromGlobal) > ZT_TCP_FALLBACK_AFTER)&&((now - _lastRestart) > ZT_TCP_FALLBACK_AFTER))) {
  2927. if (_tcpFallbackTunnel) {
  2928. bool flushNow = false;
  2929. {
  2930. Mutex::Lock _l(_tcpFallbackTunnel->writeq_m);
  2931. if (_tcpFallbackTunnel->writeq.size() < (1024 * 64)) {
  2932. if (_tcpFallbackTunnel->writeq.length() == 0) {
  2933. _phy.setNotifyWritable(_tcpFallbackTunnel->sock,true);
  2934. flushNow = true;
  2935. }
  2936. const unsigned long mlen = len + 7;
  2937. _tcpFallbackTunnel->writeq.push_back((char)0x17);
  2938. _tcpFallbackTunnel->writeq.push_back((char)0x03);
  2939. _tcpFallbackTunnel->writeq.push_back((char)0x03); // fake TLS 1.2 header
  2940. _tcpFallbackTunnel->writeq.push_back((char)((mlen >> 8) & 0xff));
  2941. _tcpFallbackTunnel->writeq.push_back((char)(mlen & 0xff));
  2942. _tcpFallbackTunnel->writeq.push_back((char)4); // IPv4
  2943. _tcpFallbackTunnel->writeq.append(reinterpret_cast<const char *>(reinterpret_cast<const void *>(&(reinterpret_cast<const struct sockaddr_in *>(addr)->sin_addr.s_addr))),4);
  2944. _tcpFallbackTunnel->writeq.append(reinterpret_cast<const char *>(reinterpret_cast<const void *>(&(reinterpret_cast<const struct sockaddr_in *>(addr)->sin_port))),2);
  2945. _tcpFallbackTunnel->writeq.append((const char *)data,len);
  2946. }
  2947. }
  2948. if (flushNow) {
  2949. void *tmpptr = (void *)_tcpFallbackTunnel;
  2950. phyOnTcpWritable(_tcpFallbackTunnel->sock,&tmpptr);
  2951. }
  2952. } else if (_forceTcpRelay || (((now - _lastSendToGlobalV4) < ZT_TCP_FALLBACK_AFTER)&&((now - _lastSendToGlobalV4) > (ZT_PING_CHECK_INVERVAL / 2)))) {
  2953. const InetAddress addr(_fallbackRelayAddress);
  2954. TcpConnection *tc = new TcpConnection();
  2955. {
  2956. Mutex::Lock _l(_tcpConnections_m);
  2957. _tcpConnections.push_back(tc);
  2958. }
  2959. tc->type = TcpConnection::TCP_TUNNEL_OUTGOING;
  2960. tc->remoteAddr = addr;
  2961. tc->lastReceive = OSUtils::now();
  2962. tc->parent = this;
  2963. tc->sock = (PhySocket *)0; // set in connect handler
  2964. tc->messageSize = 0;
  2965. bool connected = false;
  2966. _phy.tcpConnect(reinterpret_cast<const struct sockaddr *>(&addr),connected,(void *)tc,true);
  2967. }
  2968. }
  2969. _lastSendToGlobalV4 = now;
  2970. }
  2971. }
  2972. }
  2973. if (_forceTcpRelay) {
  2974. // Shortcut here so that we don't emit any UDP packets
  2975. return 0;
  2976. }
  2977. #endif // ZT_TCP_FALLBACK_RELAY
  2978. // Even when relaying we still send via UDP. This way if UDP starts
  2979. // working we can instantly "fail forward" to it and stop using TCP
  2980. // proxy fallback, which is slow.
  2981. if ((localSocket != -1)&&(localSocket != 0)&&(_binder.isUdpSocketValid((PhySocket *)((uintptr_t)localSocket)))) {
  2982. if ((ttl)&&(addr->ss_family == AF_INET)) {
  2983. _phy.setIp4UdpTtl((PhySocket *)((uintptr_t)localSocket),ttl);
  2984. }
  2985. const bool r = _phy.udpSend((PhySocket *)((uintptr_t)localSocket),(const struct sockaddr *)addr,data,len);
  2986. if ((ttl)&&(addr->ss_family == AF_INET)) {
  2987. _phy.setIp4UdpTtl((PhySocket *)((uintptr_t)localSocket),255);
  2988. }
  2989. return ((r) ? 0 : -1);
  2990. } else {
  2991. return ((_binder.udpSendAll(_phy,addr,data,len,ttl)) ? 0 : -1);
  2992. }
  2993. }
  2994. inline void nodeVirtualNetworkFrameFunction(uint64_t nwid,void **nuptr,uint64_t sourceMac,uint64_t destMac,unsigned int etherType,unsigned int vlanId,const void *data,unsigned int len)
  2995. {
  2996. NetworkState *n = reinterpret_cast<NetworkState *>(*nuptr);
  2997. if ((!n)||(!n->tap()))
  2998. return;
  2999. n->tap()->put(MAC(sourceMac),MAC(destMac),etherType,data,len);
  3000. }
  3001. inline int nodePathCheckFunction(uint64_t ztaddr,const int64_t localSocket,const struct sockaddr_storage *remoteAddr)
  3002. {
  3003. // Make sure we're not trying to do ZeroTier-over-ZeroTier
  3004. {
  3005. Mutex::Lock _l(_nets_m);
  3006. for(std::map<uint64_t,NetworkState>::const_iterator n(_nets.begin());n!=_nets.end();++n) {
  3007. if (n->second.tap()) {
  3008. std::vector<InetAddress> ips(n->second.tap()->ips());
  3009. for(std::vector<InetAddress>::const_iterator i(ips.begin());i!=ips.end();++i) {
  3010. if (i->containsAddress(*(reinterpret_cast<const InetAddress *>(remoteAddr)))) {
  3011. return 0;
  3012. }
  3013. }
  3014. }
  3015. }
  3016. }
  3017. /* Note: I do not think we need to scan for overlap with managed routes
  3018. * because of the "route forking" and interface binding that we do. This
  3019. * ensures (we hope) that ZeroTier traffic will still take the physical
  3020. * path even if its managed routes override this for other traffic. Will
  3021. * revisit if we see recursion problems. */
  3022. // Check blacklists
  3023. const Hashtable< uint64_t,std::vector<InetAddress> > *blh = (const Hashtable< uint64_t,std::vector<InetAddress> > *)0;
  3024. const std::vector<InetAddress> *gbl = (const std::vector<InetAddress> *)0;
  3025. if (remoteAddr->ss_family == AF_INET) {
  3026. blh = &_v4Blacklists;
  3027. gbl = &_globalV4Blacklist;
  3028. } else if (remoteAddr->ss_family == AF_INET6) {
  3029. blh = &_v6Blacklists;
  3030. gbl = &_globalV6Blacklist;
  3031. }
  3032. if (blh) {
  3033. Mutex::Lock _l(_localConfig_m);
  3034. const std::vector<InetAddress> *l = blh->get(ztaddr);
  3035. if (l) {
  3036. for(std::vector<InetAddress>::const_iterator a(l->begin());a!=l->end();++a) {
  3037. if (a->containsAddress(*reinterpret_cast<const InetAddress *>(remoteAddr)))
  3038. return 0;
  3039. }
  3040. }
  3041. }
  3042. if (gbl) {
  3043. for(std::vector<InetAddress>::const_iterator a(gbl->begin());a!=gbl->end();++a) {
  3044. if (a->containsAddress(*reinterpret_cast<const InetAddress *>(remoteAddr)))
  3045. return 0;
  3046. }
  3047. }
  3048. return 1;
  3049. }
  3050. inline int nodePathLookupFunction(uint64_t ztaddr, int family, struct sockaddr_storage* result)
  3051. {
  3052. const Hashtable< uint64_t, std::vector<InetAddress> >* lh = (const Hashtable< uint64_t, std::vector<InetAddress> > *)0;
  3053. if (family < 0)
  3054. lh = (_node->prng() & 1) ? &_v4Hints : &_v6Hints;
  3055. else if (family == AF_INET)
  3056. lh = &_v4Hints;
  3057. else if (family == AF_INET6)
  3058. lh = &_v6Hints;
  3059. else return 0;
  3060. const std::vector<InetAddress>* l = lh->get(ztaddr);
  3061. if ((l) && (!l->empty())) {
  3062. memcpy(result, &((*l)[(unsigned long)_node->prng() % l->size()]), sizeof(struct sockaddr_storage));
  3063. return 1;
  3064. }
  3065. else return 0;
  3066. }
  3067. inline void tapFrameHandler(uint64_t nwid, const MAC& from, const MAC& to, unsigned int etherType, unsigned int vlanId, const void* data, unsigned int len)
  3068. {
  3069. _node->processVirtualNetworkFrame((void*)0, OSUtils::now(), nwid, from.toInt(), to.toInt(), etherType, vlanId, data, len, &_nextBackgroundTaskDeadline);
  3070. }
  3071. inline void onHttpResponseFromClient(TcpConnection* tc)
  3072. {
  3073. _phy.close(tc->sock);
  3074. }
  3075. bool shouldBindInterface(const char* ifname, const InetAddress& ifaddr)
  3076. {
  3077. #if defined(__linux__) || defined(linux) || defined(__LINUX__) || defined(__linux)
  3078. if ((ifname[0] == 'l') && (ifname[1] == 'o')) return false; // loopback
  3079. if ((ifname[0] == 'z') && (ifname[1] == 't')) return false; // sanity check: zt#
  3080. if ((ifname[0] == 't') && (ifname[1] == 'u') && (ifname[2] == 'n')) return false; // tun# is probably an OpenVPN tunnel or similar
  3081. if ((ifname[0] == 't') && (ifname[1] == 'a') && (ifname[2] == 'p')) return false; // tap# is probably an OpenVPN tunnel or similar
  3082. #endif
  3083. #ifdef __APPLE__
  3084. if ((ifname[0] == 'f') && (ifname[1] == 'e') && (ifname[2] == 't') && (ifname[3] == 'h')) return false; // ... as is feth#
  3085. if ((ifname[0] == 'l') && (ifname[1] == 'o')) return false; // loopback
  3086. if ((ifname[0] == 'z') && (ifname[1] == 't')) return false; // sanity check: zt#
  3087. if ((ifname[0] == 't') && (ifname[1] == 'u') && (ifname[2] == 'n')) return false; // tun# is probably an OpenVPN tunnel or similar
  3088. if ((ifname[0] == 't') && (ifname[1] == 'a') && (ifname[2] == 'p')) return false; // tap# is probably an OpenVPN tunnel or similar
  3089. if ((ifname[0] == 'u') && (ifname[1] == 't') && (ifname[2] == 'u') && (ifname[3] == 'n')) return false; // ... as is utun#
  3090. #endif
  3091. #ifdef __FreeBSD__
  3092. if ((ifname[0] == 'l') && (ifname[1] == 'o')) return false; // loopback
  3093. if ((ifname[0] == 'z') && (ifname[1] == 't')) return false; // sanity check: zt#
  3094. #endif
  3095. {
  3096. Mutex::Lock _l(_localConfig_m);
  3097. for(std::vector<std::string>::const_iterator p(_interfacePrefixBlacklist.begin());p!=_interfacePrefixBlacklist.end();++p) {
  3098. if (!strncmp(p->c_str(),ifname,p->length()))
  3099. return false;
  3100. }
  3101. }
  3102. {
  3103. // Check global blacklists
  3104. const std::vector<InetAddress> *gbl = (const std::vector<InetAddress> *)0;
  3105. if (ifaddr.ss_family == AF_INET) {
  3106. gbl = &_globalV4Blacklist;
  3107. } else if (ifaddr.ss_family == AF_INET6) {
  3108. gbl = &_globalV6Blacklist;
  3109. }
  3110. if (gbl) {
  3111. Mutex::Lock _l(_localConfig_m);
  3112. for(std::vector<InetAddress>::const_iterator a(gbl->begin());a!=gbl->end();++a) {
  3113. if (a->containsAddress(ifaddr))
  3114. return false;
  3115. }
  3116. }
  3117. }
  3118. {
  3119. Mutex::Lock _l(_nets_m);
  3120. for(std::map<uint64_t,NetworkState>::const_iterator n(_nets.begin());n!=_nets.end();++n) {
  3121. if (n->second.tap()) {
  3122. std::vector<InetAddress> ips(n->second.tap()->ips());
  3123. for(std::vector<InetAddress>::const_iterator i(ips.begin());i!=ips.end();++i) {
  3124. if (i->ipsEqual(ifaddr))
  3125. return false;
  3126. }
  3127. #ifdef _WIN32
  3128. if (n->second.tap()->friendlyName() == ifname)
  3129. return false;
  3130. #endif
  3131. }
  3132. }
  3133. }
  3134. return true;
  3135. }
  3136. unsigned int _getRandomPort()
  3137. {
  3138. unsigned int randp = 0;
  3139. Utils::getSecureRandom(&randp,sizeof(randp));
  3140. randp = 20000 + (randp % 45500);
  3141. for(int i=0;;++i) {
  3142. if (i > 1000) {
  3143. return 0;
  3144. } else if (++randp >= 65536) {
  3145. randp = 20000;
  3146. }
  3147. if (_trialBind(randp))
  3148. break;
  3149. }
  3150. return randp;
  3151. }
  3152. bool _trialBind(unsigned int port)
  3153. {
  3154. struct sockaddr_in in4;
  3155. struct sockaddr_in6 in6;
  3156. PhySocket *tb;
  3157. memset(&in4,0,sizeof(in4));
  3158. in4.sin_family = AF_INET;
  3159. in4.sin_port = Utils::hton((uint16_t)port);
  3160. tb = _phy.udpBind(reinterpret_cast<const struct sockaddr *>(&in4),(void *)0,0);
  3161. if (tb) {
  3162. _phy.close(tb,false);
  3163. tb = _phy.tcpListen(reinterpret_cast<const struct sockaddr *>(&in4),(void *)0);
  3164. if (tb) {
  3165. _phy.close(tb,false);
  3166. return true;
  3167. }
  3168. }
  3169. memset(&in6,0,sizeof(in6));
  3170. in6.sin6_family = AF_INET6;
  3171. in6.sin6_port = Utils::hton((uint16_t)port);
  3172. tb = _phy.udpBind(reinterpret_cast<const struct sockaddr *>(&in6),(void *)0,0);
  3173. if (tb) {
  3174. _phy.close(tb,false);
  3175. tb = _phy.tcpListen(reinterpret_cast<const struct sockaddr *>(&in6),(void *)0);
  3176. if (tb) {
  3177. _phy.close(tb,false);
  3178. return true;
  3179. }
  3180. }
  3181. return false;
  3182. }
  3183. };
  3184. static int SnodeVirtualNetworkConfigFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t nwid,void **nuptr,enum ZT_VirtualNetworkConfigOperation op,const ZT_VirtualNetworkConfig *nwconf)
  3185. { return reinterpret_cast<OneServiceImpl *>(uptr)->nodeVirtualNetworkConfigFunction(nwid,nuptr,op,nwconf); }
  3186. static void SnodeEventCallback(ZT_Node *node,void *uptr,void *tptr,enum ZT_Event event,const void *metaData)
  3187. { reinterpret_cast<OneServiceImpl *>(uptr)->nodeEventCallback(event,metaData); }
  3188. static void SnodeStatePutFunction(ZT_Node *node,void *uptr,void *tptr,enum ZT_StateObjectType type,const uint64_t id[2],const void *data,int len)
  3189. { reinterpret_cast<OneServiceImpl *>(uptr)->nodeStatePutFunction(type,id,data,len); }
  3190. static int SnodeStateGetFunction(ZT_Node *node,void *uptr,void *tptr,enum ZT_StateObjectType type,const uint64_t id[2],void *data,unsigned int maxlen)
  3191. { return reinterpret_cast<OneServiceImpl *>(uptr)->nodeStateGetFunction(type,id,data,maxlen); }
  3192. static int SnodeWirePacketSendFunction(ZT_Node *node,void *uptr,void *tptr,int64_t localSocket,const struct sockaddr_storage *addr,const void *data,unsigned int len,unsigned int ttl)
  3193. { return reinterpret_cast<OneServiceImpl *>(uptr)->nodeWirePacketSendFunction(localSocket,addr,data,len,ttl); }
  3194. static void SnodeVirtualNetworkFrameFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t nwid,void **nuptr,uint64_t sourceMac,uint64_t destMac,unsigned int etherType,unsigned int vlanId,const void *data,unsigned int len)
  3195. { reinterpret_cast<OneServiceImpl *>(uptr)->nodeVirtualNetworkFrameFunction(nwid,nuptr,sourceMac,destMac,etherType,vlanId,data,len); }
  3196. static int SnodePathCheckFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t ztaddr,int64_t localSocket,const struct sockaddr_storage *remoteAddr)
  3197. { return reinterpret_cast<OneServiceImpl *>(uptr)->nodePathCheckFunction(ztaddr,localSocket,remoteAddr); }
  3198. static int SnodePathLookupFunction(ZT_Node *node,void *uptr,void *tptr,uint64_t ztaddr,int family,struct sockaddr_storage *result)
  3199. { return reinterpret_cast<OneServiceImpl *>(uptr)->nodePathLookupFunction(ztaddr,family,result); }
  3200. static void StapFrameHandler(void *uptr,void *tptr,uint64_t nwid,const MAC &from,const MAC &to,unsigned int etherType,unsigned int vlanId,const void *data,unsigned int len)
  3201. { reinterpret_cast<OneServiceImpl *>(uptr)->tapFrameHandler(nwid,from,to,etherType,vlanId,data,len); }
  3202. static int ShttpOnMessageBegin(http_parser *parser)
  3203. {
  3204. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3205. tc->currentHeaderField = "";
  3206. tc->currentHeaderValue = "";
  3207. tc->messageSize = 0;
  3208. tc->url.clear();
  3209. tc->status.clear();
  3210. tc->headers.clear();
  3211. tc->readq.clear();
  3212. return 0;
  3213. }
  3214. static int ShttpOnUrl(http_parser *parser,const char *ptr,size_t length)
  3215. {
  3216. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3217. tc->messageSize += (unsigned long)length;
  3218. if (tc->messageSize > ZT_MAX_HTTP_MESSAGE_SIZE)
  3219. return -1;
  3220. tc->url.append(ptr,length);
  3221. return 0;
  3222. }
  3223. #if (HTTP_PARSER_VERSION_MAJOR >= 2) && (HTTP_PARSER_VERSION_MINOR >= 2)
  3224. static int ShttpOnStatus(http_parser *parser,const char *ptr,size_t length)
  3225. #else
  3226. static int ShttpOnStatus(http_parser *parser)
  3227. #endif
  3228. { return 0; }
  3229. static int ShttpOnHeaderField(http_parser *parser,const char *ptr,size_t length)
  3230. {
  3231. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3232. tc->messageSize += (unsigned long)length;
  3233. if (tc->messageSize > ZT_MAX_HTTP_MESSAGE_SIZE)
  3234. return -1;
  3235. if ((tc->currentHeaderField.length())&&(tc->currentHeaderValue.length())) {
  3236. tc->headers[tc->currentHeaderField] = tc->currentHeaderValue;
  3237. tc->currentHeaderField = "";
  3238. tc->currentHeaderValue = "";
  3239. }
  3240. for(size_t i=0;i<length;++i)
  3241. tc->currentHeaderField.push_back(OSUtils::toLower(ptr[i]));
  3242. return 0;
  3243. }
  3244. static int ShttpOnValue(http_parser *parser,const char *ptr,size_t length)
  3245. {
  3246. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3247. tc->messageSize += (unsigned long)length;
  3248. if (tc->messageSize > ZT_MAX_HTTP_MESSAGE_SIZE)
  3249. return -1;
  3250. tc->currentHeaderValue.append(ptr,length);
  3251. return 0;
  3252. }
  3253. static int ShttpOnHeadersComplete(http_parser *parser)
  3254. {
  3255. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3256. if ((tc->currentHeaderField.length())&&(tc->currentHeaderValue.length()))
  3257. tc->headers[tc->currentHeaderField] = tc->currentHeaderValue;
  3258. return 0;
  3259. }
  3260. static int ShttpOnBody(http_parser *parser,const char *ptr,size_t length)
  3261. {
  3262. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3263. tc->messageSize += (unsigned long)length;
  3264. if (tc->messageSize > ZT_MAX_HTTP_MESSAGE_SIZE)
  3265. return -1;
  3266. tc->readq.append(ptr,length);
  3267. return 0;
  3268. }
  3269. static int ShttpOnMessageComplete(http_parser *parser)
  3270. {
  3271. TcpConnection *tc = reinterpret_cast<TcpConnection *>(parser->data);
  3272. if (tc->type == TcpConnection::TCP_HTTP_INCOMING) {
  3273. } else {
  3274. tc->parent->onHttpResponseFromClient(tc);
  3275. }
  3276. return 0;
  3277. }
  3278. } // anonymous namespace
  3279. std::string OneService::platformDefaultHomePath()
  3280. {
  3281. return OSUtils::platformDefaultHomePath();
  3282. }
  3283. OneService *OneService::newInstance(const char *hp,unsigned int port) { return new OneServiceImpl(hp,port); }
  3284. OneService::~OneService() {}
  3285. } // namespace ZeroTier