hostmap.go 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817
  1. package nebula
  2. import (
  3. "errors"
  4. "net"
  5. "net/netip"
  6. "slices"
  7. "sync"
  8. "sync/atomic"
  9. "time"
  10. "github.com/gaissmai/bart"
  11. "github.com/rcrowley/go-metrics"
  12. "github.com/sirupsen/logrus"
  13. "github.com/slackhq/nebula/cert"
  14. "github.com/slackhq/nebula/config"
  15. "github.com/slackhq/nebula/header"
  16. )
  17. // const ProbeLen = 100
  18. const defaultPromoteEvery = 1000 // Count of packets sent before we try moving a tunnel to a preferred underlay ip address
  19. const defaultReQueryEvery = 5000 // Count of packets sent before re-querying a hostinfo to the lighthouse
  20. const defaultReQueryWait = time.Minute // Minimum amount of seconds to wait before re-querying a hostinfo the lighthouse. Evaluated every ReQueryEvery
  21. const MaxRemotes = 10
  22. const maxRecvError = 4
  23. // MaxHostInfosPerVpnIp is the max number of hostinfos we will track for a given vpn ip
  24. // 5 allows for an initial handshake and each host pair re-handshaking twice
  25. const MaxHostInfosPerVpnIp = 5
  26. // How long we should prevent roaming back to the previous IP.
  27. // This helps prevent flapping due to packets already in flight
  28. const RoamingSuppressSeconds = 2
  29. const (
  30. Requested = iota
  31. PeerRequested
  32. Established
  33. Disestablished
  34. )
  35. const (
  36. Unknowntype = iota
  37. ForwardingType
  38. TerminalType
  39. )
  40. type Relay struct {
  41. Type int
  42. State int
  43. LocalIndex uint32
  44. RemoteIndex uint32
  45. PeerAddr netip.Addr
  46. }
  47. type HostMap struct {
  48. sync.RWMutex //Because we concurrently read and write to our maps
  49. Indexes map[uint32]*HostInfo
  50. Relays map[uint32]*HostInfo // Maps a Relay IDX to a Relay HostInfo object
  51. RemoteIndexes map[uint32]*HostInfo
  52. Hosts map[netip.Addr]*HostInfo
  53. preferredRanges atomic.Pointer[[]netip.Prefix]
  54. l *logrus.Logger
  55. }
  56. // For synchronization, treat the pointed-to Relay struct as immutable. To edit the Relay
  57. // struct, make a copy of an existing value, edit the fileds in the copy, and
  58. // then store a pointer to the new copy in both realyForBy* maps.
  59. type RelayState struct {
  60. sync.RWMutex
  61. relays []netip.Addr // Ordered set of VpnAddrs of Hosts to use as relays to access this peer
  62. // For data race avoidance, the contents of a *Relay are treated immutably. To update a *Relay, copy the existing data,
  63. // modify what needs to be updated, and store the new modified copy in the relayForByIp and relayForByIdx maps (with
  64. // the RelayState Lock held)
  65. relayForByAddr map[netip.Addr]*Relay // Maps vpnAddr of peers for which this HostInfo is a relay to some Relay info
  66. relayForByIdx map[uint32]*Relay // Maps a local index to some Relay info
  67. }
  68. func (rs *RelayState) DeleteRelay(ip netip.Addr) {
  69. rs.Lock()
  70. defer rs.Unlock()
  71. for idx, val := range rs.relays {
  72. if val == ip {
  73. rs.relays = append(rs.relays[:idx], rs.relays[idx+1:]...)
  74. return
  75. }
  76. }
  77. }
  78. func (rs *RelayState) UpdateRelayForByIpState(vpnIp netip.Addr, state int) {
  79. rs.Lock()
  80. defer rs.Unlock()
  81. if r, ok := rs.relayForByAddr[vpnIp]; ok {
  82. newRelay := *r
  83. newRelay.State = state
  84. rs.relayForByAddr[newRelay.PeerAddr] = &newRelay
  85. rs.relayForByIdx[newRelay.LocalIndex] = &newRelay
  86. }
  87. }
  88. func (rs *RelayState) UpdateRelayForByIdxState(idx uint32, state int) {
  89. rs.Lock()
  90. defer rs.Unlock()
  91. if r, ok := rs.relayForByIdx[idx]; ok {
  92. newRelay := *r
  93. newRelay.State = state
  94. rs.relayForByAddr[newRelay.PeerAddr] = &newRelay
  95. rs.relayForByIdx[newRelay.LocalIndex] = &newRelay
  96. }
  97. }
  98. func (rs *RelayState) CopyAllRelayFor() []*Relay {
  99. rs.RLock()
  100. defer rs.RUnlock()
  101. ret := make([]*Relay, 0, len(rs.relayForByIdx))
  102. for _, r := range rs.relayForByIdx {
  103. ret = append(ret, r)
  104. }
  105. return ret
  106. }
  107. func (rs *RelayState) GetRelayForByAddr(addr netip.Addr) (*Relay, bool) {
  108. rs.RLock()
  109. defer rs.RUnlock()
  110. r, ok := rs.relayForByAddr[addr]
  111. return r, ok
  112. }
  113. func (rs *RelayState) InsertRelayTo(ip netip.Addr) {
  114. rs.Lock()
  115. defer rs.Unlock()
  116. if !slices.Contains(rs.relays, ip) {
  117. rs.relays = append(rs.relays, ip)
  118. }
  119. }
  120. func (rs *RelayState) CopyRelayIps() []netip.Addr {
  121. ret := make([]netip.Addr, len(rs.relays))
  122. rs.RLock()
  123. defer rs.RUnlock()
  124. copy(ret, rs.relays)
  125. return ret
  126. }
  127. func (rs *RelayState) CopyRelayForIps() []netip.Addr {
  128. rs.RLock()
  129. defer rs.RUnlock()
  130. currentRelays := make([]netip.Addr, 0, len(rs.relayForByAddr))
  131. for relayIp := range rs.relayForByAddr {
  132. currentRelays = append(currentRelays, relayIp)
  133. }
  134. return currentRelays
  135. }
  136. func (rs *RelayState) CopyRelayForIdxs() []uint32 {
  137. rs.RLock()
  138. defer rs.RUnlock()
  139. ret := make([]uint32, 0, len(rs.relayForByIdx))
  140. for i := range rs.relayForByIdx {
  141. ret = append(ret, i)
  142. }
  143. return ret
  144. }
  145. func (rs *RelayState) CompleteRelayByIP(vpnIp netip.Addr, remoteIdx uint32) bool {
  146. rs.Lock()
  147. defer rs.Unlock()
  148. r, ok := rs.relayForByAddr[vpnIp]
  149. if !ok {
  150. return false
  151. }
  152. newRelay := *r
  153. newRelay.State = Established
  154. newRelay.RemoteIndex = remoteIdx
  155. rs.relayForByIdx[r.LocalIndex] = &newRelay
  156. rs.relayForByAddr[r.PeerAddr] = &newRelay
  157. return true
  158. }
  159. func (rs *RelayState) CompleteRelayByIdx(localIdx uint32, remoteIdx uint32) (*Relay, bool) {
  160. rs.Lock()
  161. defer rs.Unlock()
  162. r, ok := rs.relayForByIdx[localIdx]
  163. if !ok {
  164. return nil, false
  165. }
  166. newRelay := *r
  167. newRelay.State = Established
  168. newRelay.RemoteIndex = remoteIdx
  169. rs.relayForByIdx[r.LocalIndex] = &newRelay
  170. rs.relayForByAddr[r.PeerAddr] = &newRelay
  171. return &newRelay, true
  172. }
  173. func (rs *RelayState) QueryRelayForByIp(vpnIp netip.Addr) (*Relay, bool) {
  174. rs.RLock()
  175. defer rs.RUnlock()
  176. r, ok := rs.relayForByAddr[vpnIp]
  177. return r, ok
  178. }
  179. func (rs *RelayState) QueryRelayForByIdx(idx uint32) (*Relay, bool) {
  180. rs.RLock()
  181. defer rs.RUnlock()
  182. r, ok := rs.relayForByIdx[idx]
  183. return r, ok
  184. }
  185. func (rs *RelayState) InsertRelay(ip netip.Addr, idx uint32, r *Relay) {
  186. rs.Lock()
  187. defer rs.Unlock()
  188. rs.relayForByAddr[ip] = r
  189. rs.relayForByIdx[idx] = r
  190. }
  191. type HostInfo struct {
  192. remote netip.AddrPort
  193. remotes *RemoteList
  194. promoteCounter atomic.Uint32
  195. ConnectionState *ConnectionState
  196. remoteIndexId uint32
  197. localIndexId uint32
  198. // vpnAddrs is a list of vpn addresses assigned to this host that are within our own vpn networks
  199. // The host may have other vpn addresses that are outside our
  200. // vpn networks but were removed because they are not usable
  201. vpnAddrs []netip.Addr
  202. recvError atomic.Uint32
  203. // networks are both all vpn and unsafe networks assigned to this host
  204. networks *bart.Lite
  205. relayState RelayState
  206. // HandshakePacket records the packets used to create this hostinfo
  207. // We need these to avoid replayed handshake packets creating new hostinfos which causes churn
  208. HandshakePacket map[uint8][]byte
  209. // nextLHQuery is the earliest we can ask the lighthouse for new information.
  210. // This is used to limit lighthouse re-queries in chatty clients
  211. nextLHQuery atomic.Int64
  212. // lastRebindCount is the other side of Interface.rebindCount, if these values don't match then we need to ask LH
  213. // for a punch from the remote end of this tunnel. The goal being to prime their conntrack for our traffic just like
  214. // with a handshake
  215. lastRebindCount int8
  216. // lastHandshakeTime records the time the remote side told us about at the stage when the handshake was completed locally
  217. // Stage 1 packet will contain it if I am a responder, stage 2 packet if I am an initiator
  218. // This is used to avoid an attack where a handshake packet is replayed after some time
  219. lastHandshakeTime uint64
  220. lastRoam time.Time
  221. lastRoamRemote netip.AddrPort
  222. // Used to track other hostinfos for this vpn ip since only 1 can be primary
  223. // Synchronised via hostmap lock and not the hostinfo lock.
  224. next, prev *HostInfo
  225. }
  226. type ViaSender struct {
  227. relayHI *HostInfo // relayHI is the host info object of the relay
  228. remoteIdx uint32 // remoteIdx is the index included in the header of the received packet
  229. relay *Relay // relay contains the rest of the relay information, including the PeerIP of the host trying to communicate with us.
  230. }
  231. type cachedPacket struct {
  232. messageType header.MessageType
  233. messageSubType header.MessageSubType
  234. callback packetCallback
  235. packet []byte
  236. }
  237. type packetCallback func(t header.MessageType, st header.MessageSubType, h *HostInfo, p, nb, out []byte)
  238. type cachedPacketMetrics struct {
  239. sent metrics.Counter
  240. dropped metrics.Counter
  241. }
  242. func NewHostMapFromConfig(l *logrus.Logger, c *config.C) *HostMap {
  243. hm := newHostMap(l)
  244. hm.reload(c, true)
  245. c.RegisterReloadCallback(func(c *config.C) {
  246. hm.reload(c, false)
  247. })
  248. l.WithField("preferredRanges", hm.GetPreferredRanges()).
  249. Info("Main HostMap created")
  250. return hm
  251. }
  252. func newHostMap(l *logrus.Logger) *HostMap {
  253. return &HostMap{
  254. Indexes: map[uint32]*HostInfo{},
  255. Relays: map[uint32]*HostInfo{},
  256. RemoteIndexes: map[uint32]*HostInfo{},
  257. Hosts: map[netip.Addr]*HostInfo{},
  258. l: l,
  259. }
  260. }
  261. func (hm *HostMap) reload(c *config.C, initial bool) {
  262. if initial || c.HasChanged("preferred_ranges") {
  263. var preferredRanges []netip.Prefix
  264. rawPreferredRanges := c.GetStringSlice("preferred_ranges", []string{})
  265. for _, rawPreferredRange := range rawPreferredRanges {
  266. preferredRange, err := netip.ParsePrefix(rawPreferredRange)
  267. if err != nil {
  268. hm.l.WithError(err).WithField("range", rawPreferredRanges).Warn("Failed to parse preferred ranges, ignoring")
  269. continue
  270. }
  271. preferredRanges = append(preferredRanges, preferredRange)
  272. }
  273. oldRanges := hm.preferredRanges.Swap(&preferredRanges)
  274. if !initial {
  275. hm.l.WithField("oldPreferredRanges", *oldRanges).WithField("newPreferredRanges", preferredRanges).Info("preferred_ranges changed")
  276. }
  277. }
  278. }
  279. // EmitStats reports host, index, and relay counts to the stats collection system
  280. func (hm *HostMap) EmitStats() {
  281. hm.RLock()
  282. hostLen := len(hm.Hosts)
  283. indexLen := len(hm.Indexes)
  284. remoteIndexLen := len(hm.RemoteIndexes)
  285. relaysLen := len(hm.Relays)
  286. hm.RUnlock()
  287. metrics.GetOrRegisterGauge("hostmap.main.hosts", nil).Update(int64(hostLen))
  288. metrics.GetOrRegisterGauge("hostmap.main.indexes", nil).Update(int64(indexLen))
  289. metrics.GetOrRegisterGauge("hostmap.main.remoteIndexes", nil).Update(int64(remoteIndexLen))
  290. metrics.GetOrRegisterGauge("hostmap.main.relayIndexes", nil).Update(int64(relaysLen))
  291. }
  292. // DeleteHostInfo will fully unlink the hostinfo and return true if it was the final hostinfo for this vpn ip
  293. func (hm *HostMap) DeleteHostInfo(hostinfo *HostInfo) bool {
  294. // Delete the host itself, ensuring it's not modified anymore
  295. hm.Lock()
  296. // If we have a previous or next hostinfo then we are not the last one for this vpn ip
  297. final := (hostinfo.next == nil && hostinfo.prev == nil)
  298. hm.unlockedDeleteHostInfo(hostinfo)
  299. hm.Unlock()
  300. return final
  301. }
  302. func (hm *HostMap) MakePrimary(hostinfo *HostInfo) {
  303. hm.Lock()
  304. defer hm.Unlock()
  305. hm.unlockedMakePrimary(hostinfo)
  306. }
  307. func (hm *HostMap) unlockedMakePrimary(hostinfo *HostInfo) {
  308. // Get the current primary, if it exists
  309. oldHostinfo := hm.Hosts[hostinfo.vpnAddrs[0]]
  310. // Every address in the hostinfo gets elevated to primary
  311. for _, vpnAddr := range hostinfo.vpnAddrs {
  312. //NOTE: It is possible that we leave a dangling hostinfo here but connection manager works on
  313. // indexes so it should be fine.
  314. hm.Hosts[vpnAddr] = hostinfo
  315. }
  316. // If we are already primary then we won't bother re-linking
  317. if oldHostinfo == hostinfo {
  318. return
  319. }
  320. // Unlink this hostinfo
  321. if hostinfo.prev != nil {
  322. hostinfo.prev.next = hostinfo.next
  323. }
  324. if hostinfo.next != nil {
  325. hostinfo.next.prev = hostinfo.prev
  326. }
  327. // If there wasn't a previous primary then clear out any links
  328. if oldHostinfo == nil {
  329. hostinfo.next = nil
  330. hostinfo.prev = nil
  331. return
  332. }
  333. // Relink the hostinfo as primary
  334. hostinfo.next = oldHostinfo
  335. oldHostinfo.prev = hostinfo
  336. hostinfo.prev = nil
  337. }
  338. func (hm *HostMap) unlockedDeleteHostInfo(hostinfo *HostInfo) {
  339. for _, addr := range hostinfo.vpnAddrs {
  340. h := hm.Hosts[addr]
  341. for h != nil {
  342. if h == hostinfo {
  343. hm.unlockedInnerDeleteHostInfo(h, addr)
  344. }
  345. h = h.next
  346. }
  347. }
  348. }
  349. func (hm *HostMap) unlockedInnerDeleteHostInfo(hostinfo *HostInfo, addr netip.Addr) {
  350. primary, ok := hm.Hosts[addr]
  351. isLastHostinfo := hostinfo.next == nil && hostinfo.prev == nil
  352. if ok && primary == hostinfo {
  353. // The vpn addr pointer points to the same hostinfo as the local index id, we can remove it
  354. delete(hm.Hosts, addr)
  355. if len(hm.Hosts) == 0 {
  356. hm.Hosts = map[netip.Addr]*HostInfo{}
  357. }
  358. if hostinfo.next != nil {
  359. // We had more than 1 hostinfo at this vpn addr, promote the next in the list to primary
  360. hm.Hosts[addr] = hostinfo.next
  361. // It is primary, there is no previous hostinfo now
  362. hostinfo.next.prev = nil
  363. }
  364. } else {
  365. // Relink if we were in the middle of multiple hostinfos for this vpn addr
  366. if hostinfo.prev != nil {
  367. hostinfo.prev.next = hostinfo.next
  368. }
  369. if hostinfo.next != nil {
  370. hostinfo.next.prev = hostinfo.prev
  371. }
  372. }
  373. hostinfo.next = nil
  374. hostinfo.prev = nil
  375. // The remote index uses index ids outside our control so lets make sure we are only removing
  376. // the remote index pointer here if it points to the hostinfo we are deleting
  377. hostinfo2, ok := hm.RemoteIndexes[hostinfo.remoteIndexId]
  378. if ok && hostinfo2 == hostinfo {
  379. delete(hm.RemoteIndexes, hostinfo.remoteIndexId)
  380. if len(hm.RemoteIndexes) == 0 {
  381. hm.RemoteIndexes = map[uint32]*HostInfo{}
  382. }
  383. }
  384. delete(hm.Indexes, hostinfo.localIndexId)
  385. if len(hm.Indexes) == 0 {
  386. hm.Indexes = map[uint32]*HostInfo{}
  387. }
  388. if hm.l.Level >= logrus.DebugLevel {
  389. hm.l.WithField("hostMap", m{"mapTotalSize": len(hm.Hosts),
  390. "vpnAddrs": hostinfo.vpnAddrs, "indexNumber": hostinfo.localIndexId, "remoteIndexNumber": hostinfo.remoteIndexId}).
  391. Debug("Hostmap hostInfo deleted")
  392. }
  393. if isLastHostinfo {
  394. // I have lost connectivity to my peers. My relay tunnel is likely broken. Mark the next
  395. // hops as 'Requested' so that new relay tunnels are created in the future.
  396. hm.unlockedDisestablishVpnAddrRelayFor(hostinfo)
  397. }
  398. // Clean up any local relay indexes for which I am acting as a relay hop
  399. for _, localRelayIdx := range hostinfo.relayState.CopyRelayForIdxs() {
  400. delete(hm.Relays, localRelayIdx)
  401. }
  402. }
  403. func (hm *HostMap) QueryIndex(index uint32) *HostInfo {
  404. hm.RLock()
  405. if h, ok := hm.Indexes[index]; ok {
  406. hm.RUnlock()
  407. return h
  408. } else {
  409. hm.RUnlock()
  410. return nil
  411. }
  412. }
  413. func (hm *HostMap) QueryRelayIndex(index uint32) *HostInfo {
  414. hm.RLock()
  415. if h, ok := hm.Relays[index]; ok {
  416. hm.RUnlock()
  417. return h
  418. } else {
  419. hm.RUnlock()
  420. return nil
  421. }
  422. }
  423. func (hm *HostMap) QueryReverseIndex(index uint32) *HostInfo {
  424. hm.RLock()
  425. if h, ok := hm.RemoteIndexes[index]; ok {
  426. hm.RUnlock()
  427. return h
  428. } else {
  429. hm.RUnlock()
  430. return nil
  431. }
  432. }
  433. func (hm *HostMap) QueryVpnAddr(vpnIp netip.Addr) *HostInfo {
  434. return hm.queryVpnAddr(vpnIp, nil)
  435. }
  436. func (hm *HostMap) QueryVpnAddrsRelayFor(targetIps []netip.Addr, relayHostIp netip.Addr) (*HostInfo, *Relay, error) {
  437. hm.RLock()
  438. defer hm.RUnlock()
  439. h, ok := hm.Hosts[relayHostIp]
  440. if !ok {
  441. return nil, nil, errors.New("unable to find host")
  442. }
  443. for h != nil {
  444. for _, targetIp := range targetIps {
  445. r, ok := h.relayState.QueryRelayForByIp(targetIp)
  446. if ok && r.State == Established {
  447. return h, r, nil
  448. }
  449. }
  450. h = h.next
  451. }
  452. return nil, nil, errors.New("unable to find host with relay")
  453. }
  454. func (hm *HostMap) unlockedDisestablishVpnAddrRelayFor(hi *HostInfo) {
  455. for _, relayHostIp := range hi.relayState.CopyRelayIps() {
  456. if h, ok := hm.Hosts[relayHostIp]; ok {
  457. for h != nil {
  458. h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
  459. h = h.next
  460. }
  461. }
  462. }
  463. for _, rs := range hi.relayState.CopyAllRelayFor() {
  464. if rs.Type == ForwardingType {
  465. if h, ok := hm.Hosts[rs.PeerAddr]; ok {
  466. for h != nil {
  467. h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
  468. h = h.next
  469. }
  470. }
  471. }
  472. }
  473. }
  474. func (hm *HostMap) queryVpnAddr(vpnIp netip.Addr, promoteIfce *Interface) *HostInfo {
  475. hm.RLock()
  476. if h, ok := hm.Hosts[vpnIp]; ok {
  477. hm.RUnlock()
  478. // Do not attempt promotion if you are a lighthouse
  479. if promoteIfce != nil && !promoteIfce.lightHouse.amLighthouse {
  480. h.TryPromoteBest(hm.GetPreferredRanges(), promoteIfce)
  481. }
  482. return h
  483. }
  484. hm.RUnlock()
  485. return nil
  486. }
  487. // unlockedAddHostInfo assumes you have a write-lock and will add a hostinfo object to the hostmap Indexes and RemoteIndexes maps.
  488. // If an entry exists for the Hosts table (vpnIp -> hostinfo) then the provided hostinfo will be made primary
  489. func (hm *HostMap) unlockedAddHostInfo(hostinfo *HostInfo, f *Interface) {
  490. if f.serveDns {
  491. remoteCert := hostinfo.ConnectionState.peerCert
  492. dnsR.Add(remoteCert.Certificate.Name()+".", hostinfo.vpnAddrs)
  493. }
  494. for _, addr := range hostinfo.vpnAddrs {
  495. hm.unlockedInnerAddHostInfo(addr, hostinfo, f)
  496. }
  497. hm.Indexes[hostinfo.localIndexId] = hostinfo
  498. hm.RemoteIndexes[hostinfo.remoteIndexId] = hostinfo
  499. if hm.l.Level >= logrus.DebugLevel {
  500. hm.l.WithField("hostMap", m{"vpnAddrs": hostinfo.vpnAddrs, "mapTotalSize": len(hm.Hosts),
  501. "hostinfo": m{"existing": true, "localIndexId": hostinfo.localIndexId, "vpnAddrs": hostinfo.vpnAddrs}}).
  502. Debug("Hostmap vpnIp added")
  503. }
  504. }
  505. func (hm *HostMap) unlockedInnerAddHostInfo(vpnAddr netip.Addr, hostinfo *HostInfo, f *Interface) {
  506. existing := hm.Hosts[vpnAddr]
  507. hm.Hosts[vpnAddr] = hostinfo
  508. if existing != nil && existing != hostinfo {
  509. hostinfo.next = existing
  510. existing.prev = hostinfo
  511. }
  512. i := 1
  513. check := hostinfo
  514. for check != nil {
  515. if i > MaxHostInfosPerVpnIp {
  516. hm.unlockedDeleteHostInfo(check)
  517. }
  518. check = check.next
  519. i++
  520. }
  521. }
  522. func (hm *HostMap) GetPreferredRanges() []netip.Prefix {
  523. //NOTE: if preferredRanges is ever not stored before a load this will fail to dereference a nil pointer
  524. return *hm.preferredRanges.Load()
  525. }
  526. func (hm *HostMap) ForEachVpnAddr(f controlEach) {
  527. hm.RLock()
  528. defer hm.RUnlock()
  529. for _, v := range hm.Hosts {
  530. f(v)
  531. }
  532. }
  533. func (hm *HostMap) ForEachIndex(f controlEach) {
  534. hm.RLock()
  535. defer hm.RUnlock()
  536. for _, v := range hm.Indexes {
  537. f(v)
  538. }
  539. }
  540. // TryPromoteBest handles re-querying lighthouses and probing for better paths
  541. // NOTE: It is an error to call this if you are a lighthouse since they should not roam clients!
  542. func (i *HostInfo) TryPromoteBest(preferredRanges []netip.Prefix, ifce *Interface) {
  543. c := i.promoteCounter.Add(1)
  544. if c%ifce.tryPromoteEvery.Load() == 0 {
  545. remote := i.remote
  546. // return early if we are already on a preferred remote
  547. if remote.IsValid() {
  548. rIP := remote.Addr()
  549. for _, l := range preferredRanges {
  550. if l.Contains(rIP) {
  551. return
  552. }
  553. }
  554. }
  555. i.remotes.ForEach(preferredRanges, func(addr netip.AddrPort, preferred bool) {
  556. if remote.IsValid() && (!addr.IsValid() || !preferred) {
  557. return
  558. }
  559. // Try to send a test packet to that host, this should
  560. // cause it to detect a roaming event and switch remotes
  561. ifce.sendTo(header.Test, header.TestRequest, i.ConnectionState, i, addr, []byte(""), make([]byte, 12, 12), make([]byte, mtu))
  562. })
  563. }
  564. // Re query our lighthouses for new remotes occasionally
  565. if c%ifce.reQueryEvery.Load() == 0 && ifce.lightHouse != nil {
  566. now := time.Now().UnixNano()
  567. if now < i.nextLHQuery.Load() {
  568. return
  569. }
  570. i.nextLHQuery.Store(now + ifce.reQueryWait.Load())
  571. ifce.lightHouse.QueryServer(i.vpnAddrs[0])
  572. }
  573. }
  574. func (i *HostInfo) GetCert() *cert.CachedCertificate {
  575. if i.ConnectionState != nil {
  576. return i.ConnectionState.peerCert
  577. }
  578. return nil
  579. }
  580. func (i *HostInfo) SetRemote(remote netip.AddrPort) {
  581. // We copy here because we likely got this remote from a source that reuses the object
  582. if i.remote != remote {
  583. i.remote = remote
  584. i.remotes.LearnRemote(i.vpnAddrs[0], remote)
  585. }
  586. }
  587. // SetRemoteIfPreferred returns true if the remote was changed. The lastRoam
  588. // time on the HostInfo will also be updated.
  589. func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, newRemote netip.AddrPort) bool {
  590. if !newRemote.IsValid() {
  591. // relays have nil udp Addrs
  592. return false
  593. }
  594. currentRemote := i.remote
  595. if !currentRemote.IsValid() {
  596. i.SetRemote(newRemote)
  597. return true
  598. }
  599. // NOTE: We do this loop here instead of calling `isPreferred` in
  600. // remote_list.go so that we only have to loop over preferredRanges once.
  601. newIsPreferred := false
  602. for _, l := range hm.GetPreferredRanges() {
  603. // return early if we are already on a preferred remote
  604. if l.Contains(currentRemote.Addr()) {
  605. return false
  606. }
  607. if l.Contains(newRemote.Addr()) {
  608. newIsPreferred = true
  609. }
  610. }
  611. if newIsPreferred {
  612. // Consider this a roaming event
  613. i.lastRoam = time.Now()
  614. i.lastRoamRemote = currentRemote
  615. i.SetRemote(newRemote)
  616. return true
  617. }
  618. return false
  619. }
  620. func (i *HostInfo) RecvErrorExceeded() bool {
  621. if i.recvError.Add(1) >= maxRecvError {
  622. return true
  623. }
  624. return true
  625. }
  626. func (i *HostInfo) buildNetworks(networks, unsafeNetworks []netip.Prefix) {
  627. if len(networks) == 1 && len(unsafeNetworks) == 0 {
  628. // Simple case, no CIDRTree needed
  629. return
  630. }
  631. i.networks = new(bart.Lite)
  632. for _, network := range networks {
  633. i.networks.Insert(network)
  634. }
  635. for _, network := range unsafeNetworks {
  636. i.networks.Insert(network)
  637. }
  638. }
  639. func (i *HostInfo) logger(l *logrus.Logger) *logrus.Entry {
  640. if i == nil {
  641. return logrus.NewEntry(l)
  642. }
  643. li := l.WithField("vpnAddrs", i.vpnAddrs).
  644. WithField("localIndex", i.localIndexId).
  645. WithField("remoteIndex", i.remoteIndexId)
  646. if connState := i.ConnectionState; connState != nil {
  647. if peerCert := connState.peerCert; peerCert != nil {
  648. li = li.WithField("certName", peerCert.Certificate.Name())
  649. }
  650. }
  651. return li
  652. }
  653. // Utility functions
  654. func localAddrs(l *logrus.Logger, allowList *LocalAllowList) []netip.Addr {
  655. //FIXME: This function is pretty garbage
  656. var finalAddrs []netip.Addr
  657. ifaces, _ := net.Interfaces()
  658. for _, i := range ifaces {
  659. allow := allowList.AllowName(i.Name)
  660. if l.Level >= logrus.TraceLevel {
  661. l.WithField("interfaceName", i.Name).WithField("allow", allow).Trace("localAllowList.AllowName")
  662. }
  663. if !allow {
  664. continue
  665. }
  666. addrs, _ := i.Addrs()
  667. for _, rawAddr := range addrs {
  668. var addr netip.Addr
  669. switch v := rawAddr.(type) {
  670. case *net.IPNet:
  671. //continue
  672. addr, _ = netip.AddrFromSlice(v.IP)
  673. case *net.IPAddr:
  674. addr, _ = netip.AddrFromSlice(v.IP)
  675. }
  676. if !addr.IsValid() {
  677. if l.Level >= logrus.DebugLevel {
  678. l.WithField("localAddr", rawAddr).Debug("addr was invalid")
  679. }
  680. continue
  681. }
  682. addr = addr.Unmap()
  683. if addr.IsLoopback() == false && addr.IsLinkLocalUnicast() == false {
  684. isAllowed := allowList.Allow(addr)
  685. if l.Level >= logrus.TraceLevel {
  686. l.WithField("localAddr", addr).WithField("allowed", isAllowed).Trace("localAllowList.Allow")
  687. }
  688. if !isAllowed {
  689. continue
  690. }
  691. finalAddrs = append(finalAddrs, addr)
  692. }
  693. }
  694. }
  695. return finalAddrs
  696. }