dark/zerotiertspu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

New simpler command interface via loopback UDP protected by a crypto token.

Browse source
This commit is contained in:
Adam Ierymenko 2013-07-17 14:10:44 -04:00
parent 557cc359b3
commit 76bc9968ff
28 changed files with 202 additions and 7121 deletions
Download patch file Download diff file Expand all files Collapse all files

43
node/Constants.hpp
View file

@ -117,6 +117,11 @@ error_no_ZT_ARCH_defined;
*/
#define ZT_DEFAULT_UDP_PORT 8993
/**
* Local control port, also used for multiple invocation check
*/
#define ZT_CONTROL_UDP_PORT 39393
/**
* Default payload MTU for UDP packets
*
@ -151,13 +156,6 @@ error_no_ZT_ARCH_defined;
*/
#define ZT_IF_MTU 2800
/**
* Maximum number of networks we can be a member of
*
* This is a safe value that's within the tap device limit on all known OSes.
*/
#define ZT_MAX_NETWORK_MEMBERSHIPS 16
/**
* Maximum number of packet fragments we'll support
*
@ -233,20 +231,15 @@ error_no_ZT_ARCH_defined;
#define ZT_MULTICAST_PROPAGATION_DEPTH 7
/**
* Length of circular ring buffer history of multicast packets
* Length of ring buffer history of recent multicast packets
*/
#define ZT_MULTICAST_DEDUP_HISTORY_LENGTH 1024
/**
* Expiration time in ms for multicast history items
* Expiration time in ms for multicast deduplication history items
*/
#define ZT_MULTICAST_DEDUP_HISTORY_EXPIRE 4000
/**
* Number of bits to randomly "decay" in bloom filter per hop
*/
#define ZT_MULTICAST_BLOOM_FILTER_DECAY_RATE 2
/**
* Period between announcements of all multicast 'likes' in ms
*
@ -281,23 +274,6 @@ error_no_ZT_ARCH_defined;
*/
#define ZT_PEER_DIRECT_PING_DELAY 120000
/**
* Period between rechecks of autoconfigure URL
*
* This is in the absence of an external message ordering a recheck.
*/
#define ZT_AUTOCONFIGURE_INTERVAL 3600000
/**
* Period between autoconfigure attempts if no successful autoconfig
*/
#define ZT_AUTOCONFIGURE_CHECK_DELAY 15000
/**
* Delay between updates of status file in home directory
*/
#define ZT_STATUS_OUTPUT_PERIOD 120000
/**
* Minimum delay in Node service loop
*
@ -348,9 +324,4 @@ error_no_ZT_ARCH_defined;
*/
#define ZT_RENDEZVOUS_NAT_T_DELAY 500
/**
* Generate a new ownership verify secret on launch if older than this
*/
#define ZT_OVS_GENERATE_NEW_IF_OLDER_THAN 86400000
#endif

4
node/Defaults.cpp
View file

@ -68,9 +68,7 @@ static inline std::map< Identity,std::vector<InetAddress> > _mkSupernodeMap()
Defaults::Defaults()
throw(std::runtime_error) :
supernodes(_mkSupernodeMap()),
configUrlPrefix("http://api.zerotier.com/one/nc/"),
configAuthority("f9f34184ac:1:AwGgrWjb8dARXzruqxiy1+Qf+gz4iM5IMfQTCWrJXkwERdvbvxTPZvtIyitw4gS90TGIxW+e7uJxweg9Vyq5lZJBrg==:QeEQLm9ymLC3EcnIw2OUqufUwb2wgHSAg6wQOXKyhT779p/8Hz5485PZLJCbr/aVHjwzop8APJk9B45Zm0Mb/LEhQTBMH2jvc7qqoYnMCNCO9jpADeMJwMW5e1VFgIObWl9uNjhRbf5/m8dZcn0pKKGwjSoP1QTeVWOC8GkZhE25bUWj")
supernodes(_mkSupernodeMap())
{
}

10
node/Defaults.hpp
View file

@ -55,16 +55,6 @@ public:
* Supernodes on the ZeroTier network
*/
const std::map< Identity,std::vector<InetAddress> > supernodes;
/**
* URL prefix for autoconfiguration
*/
const std::string configUrlPrefix;
/**
* Identity used to encrypt and authenticate configuration from URL
*/
const std::string configAuthority;
};
extern const Defaults ZT_DEFAULTS;

4
node/Demarc.cpp
View file

@ -100,7 +100,7 @@ bool Demarc::bindLocalUdp(unsigned int localPort)
DemarcPortObj *v4r = &(_ports[(Port)v4p]);
v4r->port = (Port)v4p;
v4r->parent = this;
v4r->obj = v4 = new UdpSocket(localPort,false,&Demarc::_CBudpSocketPacketHandler,v4r);
v4r->obj = v4 = new UdpSocket(false,localPort,false,&Demarc::_CBudpSocketPacketHandler,v4r);
v4r->type = PORT_TYPE_UDP_SOCKET_V4;
} catch ( ... ) {
_ports.erase((Port)v4p);
@ -112,7 +112,7 @@ bool Demarc::bindLocalUdp(unsigned int localPort)
DemarcPortObj *v6r = &(_ports[(Port)v6p]);
v6r->port = (Port)v6p;
v6r->parent = this;
v6r->obj = v6 = new UdpSocket(localPort,true,&Demarc::_CBudpSocketPacketHandler,v6r);
v6r->obj = v6 = new UdpSocket(false,localPort,true,&Demarc::_CBudpSocketPacketHandler,v6r);
v6r->type = PORT_TYPE_UDP_SOCKET_V6;
} catch ( ... ) {
_ports.erase((Port)v6p);

282
node/NodeConfig.cpp
View file

@ -27,34 +27,48 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <memory>
#include <string>
#include <json/json.h>
#include <openssl/sha.h>
#include "NodeConfig.hpp"
#include "RuntimeEnvironment.hpp"
#include "Defaults.hpp"
#include "Utils.hpp"
#include "Logger.hpp"
#include "Topology.hpp"
#include "Demarc.hpp"
#include "InetAddress.hpp"
#include "Peer.hpp"
#include "Salsa20.hpp"
#include "HMAC.hpp"
namespace ZeroTier {
NodeConfig::NodeConfig(const RuntimeEnvironment *renv,const std::string &url) :
NodeConfig::NodeConfig(const RuntimeEnvironment *renv,const char *authToken)
throw(std::runtime_error) :
_r(renv),
_lastAutoconfigure(0),
_lastAutoconfigureLastModified(),
_url(url),
_autoconfigureLock(),
_networks(),
_networks_m()
_authToken(authToken),
_controlSocket(true,ZT_CONTROL_UDP_PORT,false,&_CBcontrolPacketHandler,this)
{
SHA256_CTX sha;
SHA256_Init(&sha);
SHA256_Update(&sha,_authToken.data(),_authToken.length());
SHA256_Final(_keys,&sha); // first 32 bytes of keys[]: Salsa20 key
SHA256_Init(&sha);
SHA256_Update(&sha,_keys,32);
SHA256_Update(&sha,_authToken.data(),_authToken.length());
SHA256_Final(_keys + 32,&sha); // second 32 bytes of keys[]: HMAC key
}
NodeConfig::~NodeConfig()
{
_autoconfigureLock.lock(); // wait for any autoconfs to finish
_autoconfigureLock.unlock();
}
void NodeConfig::whackAllTaps()
@ -65,150 +79,128 @@ void NodeConfig::whackAllTaps()
n->second->tap().whack();
}
void NodeConfig::refreshConfiguration()
// Macro used in execute()
#undef _P
#define _P(f,...) { r.push_back(std::string()); Utils::stdsprintf(r.back(),(f),##__VA_ARGS__); }
// Used with Topology::eachPeer to dump peer stats
class _DumpPeerStatistics
{
_autoconfigureLock.lock(); // unlocked when handler gets called
TRACE("refreshing autoconfigure URL %s (if modified since: '%s')",_url.c_str(),_lastAutoconfigureLastModified.c_str());
std::map<std::string,std::string> reqHeaders;
reqHeaders["X-ZT-ID"] = _r->identity.toString(false);
reqHeaders["X-ZT-OVSH"] = _r->ownershipVerificationSecretHash;
if (_lastAutoconfigureLastModified.length())
reqHeaders["If-Modified-Since"] = _lastAutoconfigureLastModified;
new Http::Request(Http::HTTP_METHOD_GET,_url,reqHeaders,std::string(),&NodeConfig::_CBautoconfHandler,this);
}
void NodeConfig::__CBautoconfHandler(const std::string &lastModified,const std::string &body)
{
try {
Json::Value root;
Json::Reader reader;
std::string dec(_r->identity.decrypt(_r->configAuthority,body.data(),body.length()));
if (!dec.length()) {
LOG("autoconfigure from %s failed: data did not decrypt as from config authority %s",_url.c_str(),_r->configAuthority.address().toString().c_str());
return;
}
TRACE("decrypted autoconf: %s",dec.c_str());
if (!reader.parse(dec,root,false)) {
LOG("autoconfigure from %s failed: JSON parse error: %s",_url.c_str(),reader.getFormattedErrorMessages().c_str());
return;
}
if (!root.isObject()) {
LOG("autoconfigure from %s failed: not a JSON object",_url.c_str());
return;
}
// Configure networks
const Json::Value &networks = root["_networks"];
if (networks.isArray()) {
Mutex::Lock _l(_networks_m);
for(unsigned int ni=0;ni<networks.size();++ni) {
if (networks[ni].isObject()) {
const Json::Value &nwid_ = networks[ni]["id"];
uint64_t nwid = nwid_.isNumeric() ? (uint64_t)nwid_.asUInt64() : (uint64_t)strtoull(networks[ni]["id"].asString().c_str(),(char **)0,10);
if (nwid) {
SharedPtr<Network> nw;
std::map< uint64_t,SharedPtr<Network> >::iterator nwent(_networks.find(nwid));
if (nwent != _networks.end())
nw = nwent->second;
else {
try {
nw = SharedPtr<Network>(new Network(_r,nwid));
_networks[nwid] = nw;
} catch (std::exception &exc) {
LOG("unable to create network %llu: %s",nwid,exc.what());
} catch ( ... ) {
LOG("unable to create network %llu: unknown exception",nwid);
}
}
if (nw) {
Mutex::Lock _l2(nw->_lock);
nw->_open = networks[ni]["isOpen"].asBool();
// Ensure that TAP device has all the right IP addresses
// TODO: IPv6 might work a tad differently
std::set<InetAddress> allIps;
const Json::Value &addresses = networks[ni]["_addresses"];
if (addresses.isArray()) {
for(unsigned int ai=0;ai<addresses.size();++ai) {
if (addresses[ai].isString()) {
InetAddress addr(addresses[ai].asString());
if (addr) {
TRACE("network %llu IP/netmask: %s",nwid,addr.toString().c_str());
allIps.insert(addr);
}
}
}
}
nw->_tap.setIps(allIps);
// NOTE: the _members field is optional for open networks,
// since members of open nets do not need to check membership
// of packet senders and mutlicasters.
const Json::Value &members = networks[ni]["_members"];
nw->_members.clear();
if (members.isArray()) {
for(unsigned int mi=0;mi<members.size();++mi) {
std::string rawAddr(Utils::unhex(members[mi].asString()));
if (rawAddr.length() == ZT_ADDRESS_LENGTH) {
Address addr(rawAddr.data());
if ((addr)&&(!addr.isReserved())) {
//TRACE("network %llu member: %s",nwid,addr.toString().c_str());
nw->_members.insert(addr);
}
}
}
}
}
} else {
TRACE("ignored networks[%u], 'id' field missing");
}
} else {
TRACE("ignored networks[%u], not a JSON object",ni);
}
}
}
_lastAutoconfigure = Utils::now();
_lastAutoconfigureLastModified = lastModified;
} catch (std::exception &exc) {
TRACE("exception parsing autoconf URL response: %s",exc.what());
} catch ( ... ) {
TRACE("unexpected exception parsing autoconf URL response");
public:
_DumpPeerStatistics(std::vector<std::string> &out) :
r(out),
_now(Utils::now())
{
}
}
bool NodeConfig::_CBautoconfHandler(Http::Request *req,void *arg,const std::string &url,int code,const std::map<std::string,std::string> &headers,const std::string &body)
inline void operator()(Topology &t,const SharedPtr<Peer> &p)
{
InetAddress v4(p->ipv4ActivePath(_now));
InetAddress v6(p->ipv6ActivePath(_now));
_P("200 listpeers %s %s %s %u",
p->address().toString().c_str(),
((v4) ? v4.toString().c_str() : "(none)"),
((v6) ? v6.toString().c_str() : "(none)"),
(((v4)||(v6)) ? p->latency() : 0));
}
private:
std::vector<std::string> &r;
uint64_t _now;
};
std::vector<std::string> NodeConfig::execute(const char *command)
{
#ifdef ZT_TRACE
const RuntimeEnvironment *_r = ((NodeConfig *)arg)->_r;
#endif
std::vector<std::string> r;
std::vector<std::string> cmd(Utils::split(command,"\r\n \t","\\","'"));
if (code == 200) {
TRACE("200 got autoconfigure response from %s: %u bytes",url.c_str(),(unsigned int)body.length());
//
// Not coincidentally, response type codes correspond with HTTP
// status codes.
//
std::map<std::string,std::string>::const_iterator lm(headers.find("Last-Modified"));
if (lm != headers.end())
((NodeConfig *)arg)->__CBautoconfHandler(lm->second,body);
else ((NodeConfig *)arg)->__CBautoconfHandler(std::string(),body);
} else if (code == 304) {
TRACE("304 autoconfigure deferred, remote URL %s not modified",url.c_str());
((NodeConfig *)arg)->_lastAutoconfigure = Utils::now(); // still considered a success
} else if (code == 409) { // conflict, ID address in use by another ID
TRACE("%d autoconfigure failed from %s",code,url.c_str());
if ((cmd.empty())||(cmd[0] == "help")) {
_P("200 help help");
_P("200 help listpeers");
_P("200 help listnetworks");
_P("200 help join <network ID> [<network invitation code>]");
_P("200 help leave <network ID>");
} else if (cmd[0] == "listpeers") {
_r->topology->eachPeer(_DumpPeerStatistics(r));
} else if (cmd[0] == "listnetworks") {
Mutex::Lock _l(_networks_m);
for(std::map< uint64_t,SharedPtr<Network> >::const_iterator nw(_networks.begin());nw!=_networks.end();++nw) {
_P("200 listnetworks %llu %s %s",
nw->first,
nw->second->tap().deviceName().c_str(),
(nw->second->open() ? "public" : "private"));
}
} else if (cmd[0] == "join") {
_P("404 join Not implemented yet.");
} else if (cmd[0] == "leave") {
_P("404 leave Not implemented yet.");
} else {
TRACE("%d autoconfigure failed from %s",code,url.c_str());
_P("404 %s No such command. Use 'help' for help.",cmd[0].c_str());
}
((NodeConfig *)arg)->_autoconfigureLock.unlock();
return false; // causes Request to delete itself
return r;
}
void NodeConfig::_CBcontrolPacketHandler(UdpSocket *sock,void *arg,const InetAddress &remoteAddr,const void *data,unsigned int len)
{
char hmacKey[32];
char hmac[32];
char buf[131072];
NodeConfig *nc = (NodeConfig *)arg;
const RuntimeEnvironment *_r = nc->_r;
try {
// Minimum length
if (len < 24)
return;
if (len >= sizeof(buf)) // only up to len - 24 bytes are used on receive/decrypt
return;
// Compare first 16 bytes of HMAC, which is after IV in packet
memcpy(hmacKey,nc->_keys + 32,32);
*((uint64_t *)hmacKey) ^= *((const uint64_t *)data); // include IV in HMAC
HMAC::sha256(hmacKey,32,((const unsigned char *)data) + 24,len - 24,hmac);
if (memcmp(hmac,((const unsigned char *)data) + 8,16))
return;
// Decrypt payload if we passed HMAC
Salsa20 s20(nc->_keys,256,data); // first 64 bits of data are IV
s20.decrypt(((const unsigned char *)data) + 24,buf,len - 24);
// Null-terminate string for execute()
buf[len - 24] = (char)0;
// Execute command
std::vector<std::string> r(nc->execute(buf));
// Result packet contains a series of null-terminated results
unsigned int resultLen = 24;
for(std::vector<std::string>::iterator i(r.begin());i!=r.end();++i) {
if ((resultLen + i->length() + 1) >= sizeof(buf))
return; // result too long
memcpy(buf + resultLen,i->c_str(),i->length() + 1);
resultLen += i->length() + 1;
}
// Generate result packet IV
Utils::getSecureRandom(buf,8);
// Generate result packet HMAC
memcpy(hmacKey,nc->_keys + 32,32);
*((uint64_t *)hmacKey) ^= *((const uint64_t *)buf); // include IV in HMAC
HMAC::sha256(hmacKey,32,((const unsigned char *)buf) + 24,resultLen - 24,hmac);
memcpy(buf + 8,hmac,16);
// Send encrypted result back to requester
sock->send(remoteAddr,buf,resultLen,-1);
} catch ( ... ) {
TRACE("unexpected exception parsing control packet or generating response");
}
}
} // namespace ZeroTier

37
node/NodeConfig.hpp
View file

@ -31,11 +31,14 @@
#include <map>
#include <set>
#include <string>
#include <vector>
#include <stdexcept>
#include <stdint.h>
#include "SharedPtr.hpp"
#include "Network.hpp"
#include "Utils.hpp"
#include "Http.hpp"
#include "UdpSocket.hpp"
namespace ZeroTier {
@ -49,9 +52,11 @@ class NodeConfig
public:
/**
* @param renv Runtime environment
* @param url Autoconfiguration URL (http:// or file://)
* @param authToken Configuration authentication token
* @throws std::runtime_error Unable to bind to local control port
*/
NodeConfig(const RuntimeEnvironment *renv,const std::string &url);
NodeConfig(const RuntimeEnvironment *renv,const char *authToken)
throw(std::runtime_error);
~NodeConfig();
@ -106,32 +111,22 @@ public:
}
/**
* @return Time of last successful autoconfigure or refresh
* Execute a command
*
* @param command Command and arguments separated by whitespace (must already be trimmed of CR+LF, etc.)
* @return One or more command results (lines of output)
*/
inline uint64_t lastAutoconfigure() const { return _lastAutoconfigure; }
/**
* @return Autoconfiguration URL
*/
inline const std::string &url() const { return _url; }
/**
* Refresh configuration from autoconf URL
*/
void refreshConfiguration();
std::vector<std::string> execute(const char *command);
private:
void __CBautoconfHandler(const std::string &lastModified,const std::string &body);
static bool _CBautoconfHandler(Http::Request *req,void *arg,const std::string &url,int code,const std::map<std::string,std::string> &headers,const std::string &body);
static void _CBcontrolPacketHandler(UdpSocket *sock,void *arg,const InetAddress &remoteAddr,const void *data,unsigned int len);
const RuntimeEnvironment *_r;
volatile uint64_t _lastAutoconfigure;
std::string _lastAutoconfigureLastModified;
std::string _url;
Mutex _autoconfigureLock;
const std::string _authToken;
unsigned char _keys[64]; // Salsa20 key, HMAC key
UdpSocket _controlSocket;
std::map< uint64_t,SharedPtr<Network> > _networks;
Mutex _networks_m;
};

29
node/Topology.hpp
View file

@ -271,35 +271,6 @@ public:
std::vector< SharedPtr<Peer> > &_v;
};
/**
* Dump peer I/O statistics to an open FILE (for status reporting and debug)
*/
class DumpPeerStatistics
{
public:
DumpPeerStatistics(FILE *out) :
_out(out),
_now(Utils::now())
{
fprintf(_out,"Peer Direct IPv4 Direct IPv6 Latency(ms)"ZT_EOL_S);
}
inline void operator()(Topology &t,const SharedPtr<Peer> &p)
{
InetAddress v4(p->ipv4ActivePath(_now));
InetAddress v6(p->ipv6ActivePath(_now));
fprintf(_out,"%-10s %-21s %-51s %u"ZT_EOL_S,
p->address().toString().c_str(),
((v4) ? v4.toString().c_str() : "(none)"),
((v6) ? v6.toString().c_str() : "(none)"),
p->latency());
}
private:
FILE *_out;
uint64_t _now;
};
protected:
virtual void main()
throw();

9
node/UdpSocket.cpp
View file

@ -49,6 +49,7 @@
namespace ZeroTier {
UdpSocket::UdpSocket(
bool localOnly,
int localPort,
bool ipv6,
void (*packetHandler)(UdpSocket *,void *,const InetAddress &,const void *,unsigned int),
@ -87,7 +88,9 @@ UdpSocket::UdpSocket(
memset(&sin6,0,sizeof(sin6));
sin6.sin6_family = AF_INET6;
sin6.sin6_port = htons(localPort);
memcpy(&(sin6.sin6_addr),&in6addr_any,sizeof(struct in6_addr));
if (localOnly)
memcpy(&(sin6.sin6_addr.s6_addr),InetAddress::LO6.rawIpBytes(),16);
else memcpy(&(sin6.sin6_addr),&in6addr_any,sizeof(struct in6_addr));
if (::bind(_sock,(const struct sockaddr *)&sin6,sizeof(sin6))) {
::close(_sock);
throw std::runtime_error("unable to bind to port");
@ -109,7 +112,9 @@ UdpSocket::UdpSocket(
memset(&sin,0,sizeof(sin));
sin.sin_family = AF_INET;
sin.sin_port = htons(localPort);
sin.sin_addr.s_addr = INADDR_ANY;
if (localOnly)
memcpy(&(sin.sin_addr.s_addr),InetAddress::LO4.rawIpBytes(),4);
else sin.sin_addr.s_addr = INADDR_ANY;
if (::bind(_sock,(const struct sockaddr *)&sin,sizeof(sin))) {
::close(_sock);
throw std::runtime_error("unable to bind to port");

2
node/UdpSocket.hpp
View file

@ -46,6 +46,7 @@ public:
/**
* Create and bind a local UDP socket
*
* @param localOnly If true, bind to loopback address only
* @param localPort Local port to listen to
* @param ipv6 If true, bind this as an IPv6 socket, otherwise IPv4
* @param packetHandler Function to call when packets are read
@ -53,6 +54,7 @@ public:
* @throws std::runtime_error Unable to bind
*/
UdpSocket(
bool localOnly,
int localPort,
bool ipv6,
void (*packetHandler)(UdpSocket *,void *,const InetAddress &,const void *,unsigned int),

17
node/Utils.cpp
View file

@ -28,6 +28,7 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdarg.h>
#include "Utils.hpp"
#include "Mutex.hpp"
@ -530,4 +531,20 @@ std::string Utils::trim(const std::string &s)
return s.substr(start,end - start);
}
void Utils::stdsprintf(std::string &s,const char *fmt,...)
throw(std::bad_alloc,std::length_error)
{
char buf[65536];
va_list ap;
va_start(ap,fmt);
int n = vsnprintf(buf,sizeof(buf),fmt,ap);
va_end(ap);
if ((n >= (int)sizeof(buf))||(n < 0))
throw std::length_error("printf result too large");
s.append(buf);
}
} // namespace ZeroTier

13
node/Utils.hpp
View file

@ -34,6 +34,7 @@
#include <time.h>
#include <sys/time.h>
#include <arpa/inet.h>
#include <string>
#include <stdexcept>
#include <vector>
@ -391,6 +392,18 @@ public:
*/
static std::string trim(const std::string &s);
/**
* Like sprintf, but appends to std::string
*
* @param s String to append to
* @param fmt Printf format string
* @param ... Format arguments
* @throws std::bad_alloc Memory allocation failure
* @throws std::length_error Format + args exceeds internal buffer maximum
*/
static void stdsprintf(std::string &s,const char *fmt,...)
throw(std::bad_alloc,std::length_error);
/**
* Count the number of bits set in an integer
*