main.go 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321
  1. package nebula
  2. import (
  3. "encoding/binary"
  4. "fmt"
  5. "net"
  6. "os"
  7. "os/signal"
  8. "strconv"
  9. "strings"
  10. "syscall"
  11. "time"
  12. "github.com/sirupsen/logrus"
  13. "gopkg.in/yaml.v2"
  14. "github.com/slackhq/nebula/sshd"
  15. )
  16. var l = logrus.New()
  17. type m map[string]interface{}
  18. func Main(configPath string, configTest bool, buildVersion string) {
  19. l.Out = os.Stdout
  20. l.Formatter = &logrus.TextFormatter{
  21. FullTimestamp: true,
  22. }
  23. config := NewConfig()
  24. err := config.Load(configPath)
  25. if err != nil {
  26. l.WithError(err).Error("Failed to load config")
  27. os.Exit(1)
  28. }
  29. // Print the config if in test, the exit comes later
  30. if configTest {
  31. b, err := yaml.Marshal(config.Settings)
  32. if err != nil {
  33. l.Println(err)
  34. os.Exit(1)
  35. }
  36. l.Println(string(b))
  37. }
  38. err = configLogger(config)
  39. if err != nil {
  40. l.WithError(err).Error("Failed to configure the logger")
  41. }
  42. config.RegisterReloadCallback(func(c *Config) {
  43. err := configLogger(c)
  44. if err != nil {
  45. l.WithError(err).Error("Failed to configure the logger")
  46. }
  47. })
  48. // trustedCAs is currently a global, so loadCA operates on that global directly
  49. trustedCAs, err = loadCAFromConfig(config)
  50. if err != nil {
  51. //The errors coming out of loadCA are already nicely formatted
  52. l.Fatal(err)
  53. }
  54. l.WithField("fingerprints", trustedCAs.GetFingerprints()).Debug("Trusted CA fingerprints")
  55. cs, err := NewCertStateFromConfig(config)
  56. if err != nil {
  57. //The errors coming out of NewCertStateFromConfig are already nicely formatted
  58. l.Fatal(err)
  59. }
  60. l.WithField("cert", cs.certificate).Debug("Client nebula certificate")
  61. fw, err := NewFirewallFromConfig(cs.certificate, config)
  62. if err != nil {
  63. l.Fatal("Error while loading firewall rules: ", err)
  64. }
  65. l.WithField("firewallHash", fw.GetRuleHash()).Info("Firewall started")
  66. // TODO: make sure mask is 4 bytes
  67. tunCidr := cs.certificate.Details.Ips[0]
  68. routes, err := parseRoutes(config, tunCidr)
  69. if err != nil {
  70. l.WithError(err).Fatal("Could not parse tun.routes")
  71. }
  72. ssh, err := sshd.NewSSHServer(l.WithField("subsystem", "sshd"))
  73. wireSSHReload(ssh, config)
  74. if config.GetBool("sshd.enabled", false) {
  75. err = configSSH(ssh, config)
  76. if err != nil {
  77. l.WithError(err).Fatal("Error while configuring the sshd")
  78. }
  79. }
  80. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  81. // All non system modifying configuration consumption should live above this line
  82. // tun config, listeners, anything modifying the computer should be below
  83. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  84. if configTest {
  85. os.Exit(0)
  86. }
  87. config.CatchHUP()
  88. // set up our tun dev
  89. tun, err := newTun(
  90. config.GetString("tun.dev", ""),
  91. tunCidr,
  92. config.GetInt("tun.mtu", 1300),
  93. routes,
  94. config.GetInt("tun.tx_queue", 500),
  95. )
  96. if err != nil {
  97. l.Fatal(err)
  98. }
  99. // set up our UDP listener
  100. udpQueues := config.GetInt("listen.routines", 1)
  101. udpServer, err := NewListener(config.GetString("listen.host", "0.0.0.0"), config.GetInt("listen.port", 0), udpQueues > 1)
  102. if err != nil {
  103. l.Fatal(err)
  104. }
  105. udpServer.reloadConfig(config)
  106. // Set up my internal host map
  107. var preferredRanges []*net.IPNet
  108. rawPreferredRanges := config.GetStringSlice("preferred_ranges", []string{})
  109. // First, check if 'preferred_ranges' is set and fallback to 'local_range'
  110. if len(rawPreferredRanges) > 0 {
  111. for _, rawPreferredRange := range rawPreferredRanges {
  112. _, preferredRange, err := net.ParseCIDR(rawPreferredRange)
  113. if err != nil {
  114. l.Fatal(err)
  115. }
  116. preferredRanges = append(preferredRanges, preferredRange)
  117. }
  118. }
  119. // local_range was superseded by preferred_ranges. If it is still present,
  120. // merge the local_range setting into preferred_ranges. We will probably
  121. // deprecate local_range and remove in the future.
  122. rawLocalRange := config.GetString("local_range", "")
  123. if rawLocalRange != "" {
  124. _, localRange, err := net.ParseCIDR(rawLocalRange)
  125. if err != nil {
  126. l.Fatal(err)
  127. }
  128. // Check if the entry for local_range was already specified in
  129. // preferred_ranges. Don't put it into the slice twice if so.
  130. var found bool
  131. for _, r := range preferredRanges {
  132. if r.String() == localRange.String() {
  133. found = true
  134. break
  135. }
  136. }
  137. if !found {
  138. preferredRanges = append(preferredRanges, localRange)
  139. }
  140. }
  141. hostMap := NewHostMap("main", tunCidr, preferredRanges)
  142. hostMap.SetDefaultRoute(ip2int(net.ParseIP(config.GetString("default_route", "0.0.0.0"))))
  143. l.WithField("network", hostMap.vpnCIDR).WithField("preferredRanges", hostMap.preferredRanges).Info("Main HostMap created")
  144. /*
  145. config.SetDefault("promoter.interval", 10)
  146. go hostMap.Promoter(config.GetInt("promoter.interval"))
  147. */
  148. punchy := config.GetBool("punchy", false)
  149. if punchy == true {
  150. l.Info("UDP hole punching enabled")
  151. go hostMap.Punchy(udpServer)
  152. }
  153. port := config.GetInt("listen.port", 0)
  154. // If port is dynamic, discover it
  155. if port == 0 {
  156. uPort, err := udpServer.LocalAddr()
  157. if err != nil {
  158. l.WithError(err).Fatal("Failed to get listening port")
  159. }
  160. port = int(uPort.Port)
  161. }
  162. punchBack := config.GetBool("punch_back", false)
  163. amLighthouse := config.GetBool("lighthouse.am_lighthouse", false)
  164. serveDns := config.GetBool("lighthouse.serve_dns", false)
  165. lightHouse := NewLightHouse(
  166. amLighthouse,
  167. ip2int(tunCidr.IP),
  168. config.GetStringSlice("lighthouse.hosts", []string{}),
  169. //TODO: change to a duration
  170. config.GetInt("lighthouse.interval", 10),
  171. port,
  172. udpServer,
  173. punchBack,
  174. )
  175. if amLighthouse && serveDns {
  176. l.Debugln("Starting dns server")
  177. go dnsMain(hostMap)
  178. }
  179. for k, v := range config.GetMap("static_host_map", map[interface{}]interface{}{}) {
  180. vpnIp := net.ParseIP(fmt.Sprintf("%v", k))
  181. vals, ok := v.([]interface{})
  182. if ok {
  183. for _, v := range vals {
  184. parts := strings.Split(fmt.Sprintf("%v", v), ":")
  185. addr, err := net.ResolveIPAddr("ip", parts[0])
  186. if err == nil {
  187. ip := addr.IP
  188. port, err := strconv.Atoi(parts[1])
  189. if err != nil {
  190. l.Fatalf("Static host address for %s could not be parsed: %s", vpnIp, v)
  191. }
  192. lightHouse.AddRemote(ip2int(vpnIp), NewUDPAddr(ip2int(ip), uint16(port)), true)
  193. }
  194. }
  195. } else {
  196. //TODO: make this all a helper
  197. parts := strings.Split(fmt.Sprintf("%v", v), ":")
  198. addr, err := net.ResolveIPAddr("ip", parts[0])
  199. if err == nil {
  200. ip := addr.IP
  201. port, err := strconv.Atoi(parts[1])
  202. if err != nil {
  203. l.Fatalf("Static host address for %s could not be parsed: %s", vpnIp, v)
  204. }
  205. lightHouse.AddRemote(ip2int(vpnIp), NewUDPAddr(ip2int(ip), uint16(port)), true)
  206. }
  207. }
  208. }
  209. handshakeManager := NewHandshakeManager(tunCidr, preferredRanges, hostMap, lightHouse, udpServer)
  210. handshakeMACKey := config.GetString("handshake_mac.key", "")
  211. handshakeAcceptedMACKeys := config.GetStringSlice("handshake_mac.accepted_keys", []string{})
  212. checkInterval := config.GetInt("timers.connection_alive_interval", 5)
  213. pendingDeletionInterval := config.GetInt("timers.pending_deletion_interval", 10)
  214. ifConfig := &InterfaceConfig{
  215. HostMap: hostMap,
  216. Inside: tun,
  217. Outside: udpServer,
  218. certState: cs,
  219. Cipher: config.GetString("cipher", "aes"),
  220. Firewall: fw,
  221. ServeDns: serveDns,
  222. HandshakeManager: handshakeManager,
  223. lightHouse: lightHouse,
  224. checkInterval: checkInterval,
  225. pendingDeletionInterval: pendingDeletionInterval,
  226. handshakeMACKey: handshakeMACKey,
  227. handshakeAcceptedMACKeys: handshakeAcceptedMACKeys,
  228. DropLocalBroadcast: config.GetBool("tun.drop_local_broadcast", false),
  229. DropMulticast: config.GetBool("tun.drop_multicast", false),
  230. UDPBatchSize: config.GetInt("listen.batch", 64),
  231. }
  232. switch ifConfig.Cipher {
  233. case "aes":
  234. noiseEndiannes = binary.BigEndian
  235. case "chachapoly":
  236. noiseEndiannes = binary.LittleEndian
  237. default:
  238. l.Fatalf("Unknown cipher: %v", ifConfig.Cipher)
  239. }
  240. ifce, err := NewInterface(ifConfig)
  241. if err != nil {
  242. l.Fatal(err)
  243. }
  244. ifce.RegisterConfigChangeCallbacks(config)
  245. go handshakeManager.Run(ifce)
  246. go lightHouse.LhUpdateWorker(ifce)
  247. err = startStats(config)
  248. if err != nil {
  249. l.Fatal(err)
  250. }
  251. //TODO: check if we _should_ be emitting stats
  252. go ifce.emitStats(config.GetDuration("stats.interval", time.Second*10))
  253. attachCommands(ssh, hostMap, handshakeManager.pendingHostMap, lightHouse, ifce)
  254. ifce.Run(config.GetInt("tun.routines", 1), udpQueues, buildVersion)
  255. // Just sit here and be friendly, main thread.
  256. shutdownBlock(ifce)
  257. }
  258. func shutdownBlock(ifce *Interface) {
  259. var sigChan = make(chan os.Signal)
  260. signal.Notify(sigChan, syscall.SIGTERM)
  261. signal.Notify(sigChan, syscall.SIGINT)
  262. sig := <-sigChan
  263. l.WithField("signal", sig).Info("Caught signal, shutting down")
  264. //TODO: stop tun and udp routines, the lock on hostMap does effectively does that though
  265. //TODO: this is probably better as a function in ConnectionManager or HostMap directly
  266. ifce.hostMap.Lock()
  267. for _, h := range ifce.hostMap.Hosts {
  268. if h.ConnectionState.ready {
  269. ifce.send(closeTunnel, 0, h.ConnectionState, h, h.remote, []byte{}, make([]byte, 12, 12), make([]byte, mtu))
  270. l.WithField("vpnIp", IntIp(h.hostId)).WithField("udpAddr", h.remote).
  271. Debug("Sending close tunnel message")
  272. }
  273. }
  274. ifce.hostMap.Unlock()
  275. l.WithField("signal", sig).Info("Goodbye")
  276. os.Exit(0)
  277. }