Merge my adamierymenko-dev into the new master that incorporates Raspberry Pi build changes in order to keep everything in sync.

1 files changed, 179 insertions, 134 deletions

diff --git a/node/NodeConfig.cpp b/node/NodeConfig.cpp
index fcbbc6bd..4a174535 100644
--- a/node/NodeConfig.cpp
+++ b/node/NodeConfig.cpp
@@ -27,180 +27,225 @@
 
 #include <stdio.h>
 #include <string.h>
+#include <stdlib.h>
+#include <stdint.h>
+
 #include <memory>
 #include <string>
 
-#include <json/json.h>
+#include <openssl/sha.h>
 
 #include "NodeConfig.hpp"
 #include "RuntimeEnvironment.hpp"
 #include "Defaults.hpp"
 #include "Utils.hpp"
 #include "Logger.hpp"
+#include "Topology.hpp"
+#include "Demarc.hpp"
+#include "InetAddress.hpp"
+#include "Peer.hpp"
+#include "Salsa20.hpp"
+#include "HMAC.hpp"
 
 namespace ZeroTier {
 
-NodeConfig::NodeConfig(const RuntimeEnvironment *renv,const std::string &url) :
+NodeConfig::NodeConfig(const RuntimeEnvironment *renv,const char *authToken)
+	throw(std::runtime_error) :
 	_r(renv),
-	_lastAutoconfigure(0),
-	_lastAutoconfigureLastModified(),
-	_url(url),
-	_autoconfigureLock(),
-	_networks(),
-	_networks_m()
+	_controlSocket(true,ZT_CONTROL_UDP_PORT,false,&_CBcontrolPacketHandler,this)
 {
+	SHA256_CTX sha;
+	SHA256_Init(&sha);
+	SHA256_Update(&sha,authToken,strlen(authToken));
+	SHA256_Final(_controlSocketKey,&sha);
 }
 
 NodeConfig::~NodeConfig()
 {
-	_autoconfigureLock.lock(); // wait for any autoconfs to finish
-	_autoconfigureLock.unlock();
 }
 
-void NodeConfig::refreshConfiguration()
+void NodeConfig::whackAllTaps()
+{
+	std::vector< SharedPtr<Network> > nwlist;
+	Mutex::Lock _l(_networks_m);
+	for(std::map< uint64_t,SharedPtr<Network> >::const_iterator n(_networks.begin());n!=_networks.end();++n)
+		n->second->tap().whack();
+}
+
+void NodeConfig::cleanAllNetworks()
+{
+	Mutex::Lock _l(_networks_m);
+	for(std::map< uint64_t,SharedPtr<Network> >::const_iterator n(_networks.begin());n!=_networks.end();++n)
+		n->second->clean();
+}
+
+// Macro used in execute()
+#undef _P
+#define _P(f,...) { r.push_back(std::string()); Utils::stdsprintf(r.back(),(f),##__VA_ARGS__); }
+
+// Used with Topology::eachPeer to dump peer stats
+class _DumpPeerStatistics
 {
-	_autoconfigureLock.lock(); // unlocked when handler gets called
+public:
+	_DumpPeerStatistics(std::vector<std::string> &out) :
+		r(out),
+		_now(Utils::now())
+	{
+	}
+
+	inline void operator()(Topology &t,const SharedPtr<Peer> &p)
+	{
+		InetAddress v4(p->ipv4ActivePath(_now));
+		InetAddress v6(p->ipv6ActivePath(_now));
+		_P("200 listpeers %s %s %s %u",
+			p->address().toString().c_str(),
+			((v4) ? v4.toString().c_str() : "(none)"),
+			((v6) ? v6.toString().c_str() : "(none)"),
+			(((v4)||(v6)) ? p->latency() : 0));
+	}
 
-	TRACE("refreshing autoconfigure URL %s (if modified since: '%s')",_url.c_str(),_lastAutoconfigureLastModified.c_str());
+private:
+	std::vector<std::string> &r;
+	uint64_t _now;
+};
 
-	std::map<std::string,std::string> reqHeaders;
-	reqHeaders["X-ZT-ID"] = _r->identity.toString(false);
-	reqHeaders["X-ZT-OVSH"] = _r->ownershipVerificationSecretHash;
-	if (_lastAutoconfigureLastModified.length())
-		reqHeaders["If-Modified-Since"] = _lastAutoconfigureLastModified;
+std::vector<std::string> NodeConfig::execute(const char *command)
+{
+	std::vector<std::string> r;
+	std::vector<std::string> cmd(Utils::split(command,"\r\n \t","\\","'"));
+
+	//
+	// Not coincidentally, response type codes correspond with HTTP
+	// status codes.
+	//
+
+	if ((cmd.empty())||(cmd[0] == "help")) {
+		_P("200 help help");
+		_P("200 help listpeers");
+		_P("200 help listnetworks");
+		_P("200 help join <network ID> [<network invitation code>]");
+		_P("200 help leave <network ID>");
+	} else if (cmd[0] == "listpeers") {
+		_r->topology->eachPeer(_DumpPeerStatistics(r));
+	} else if (cmd[0] == "listnetworks") {
+		Mutex::Lock _l(_networks_m);
+		for(std::map< uint64_t,SharedPtr<Network> >::const_iterator nw(_networks.begin());nw!=_networks.end();++nw) {
+			_P("200 listnetworks %llu %s %s",
+				nw->first,
+				nw->second->tap().deviceName().c_str(),
+				(nw->second->isOpen() ? "public" : "private"));
+		}
+	} else if (cmd[0] == "join") {
+		_P("404 join Not implemented yet.");
+	} else if (cmd[0] == "leave") {
+		_P("404 leave Not implemented yet.");
+	} else {
+		_P("404 %s No such command. Use 'help' for help.",cmd[0].c_str());
+	}
 
-	new Http::Request(Http::HTTP_METHOD_GET,_url,reqHeaders,std::string(),&NodeConfig::_CBautoconfHandler,this);
+	return r;
 }
 
-void NodeConfig::__CBautoconfHandler(const std::string &lastModified,const std::string &body)
+std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> > NodeConfig::encodeControlMessage(const void *key,unsigned long conversationId,const std::vector<std::string> &payload)
+	throw(std::out_of_range)
 {
-	try {
-		Json::Value root;
-		Json::Reader reader;
+	char hmac[32];
+	char keytmp[32];
+	std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> > packets;
+	Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> packet;
 
-		std::string dec(_r->identity.decrypt(_r->configAuthority,body.data(),body.length()));
-		if (!dec.length()) {
-			LOG("autoconfigure from %s failed: data did not decrypt as from config authority %s",_url.c_str(),_r->configAuthority.address().toString().c_str());
-			return;
-		}
-		TRACE("decrypted autoconf: %s",dec.c_str());
+	packet.setSize(16); // HMAC and IV
+	packet.append((uint32_t)(conversationId & 0xffffffff));
+	for(unsigned int i=0;i<payload.size();++i) {
+		packet.append(payload[i]); // will throw if too big
+		packet.append((unsigned char)0);
 
-		if (!reader.parse(dec,root,false)) {
-			LOG("autoconfigure from %s failed: JSON parse error: %s",_url.c_str(),reader.getFormattedErrorMessages().c_str());
-			return;
-		}
+		if (((i + 1) >= payload.size())||((packet.size() + payload[i + 1].length() + 1) >= packet.capacity())) {
+			Utils::getSecureRandom(packet.field(8,8),8);
 
-		if (!root.isObject()) {
-			LOG("autoconfigure from %s failed: not a JSON object",_url.c_str());
-			return;
+			Salsa20 s20(key,256,packet.field(8,8));
+			s20.encrypt(packet.field(16,packet.size() - 16),packet.field(16,packet.size() - 16),packet.size() - 16);
+
+			memcpy(keytmp,key,32);
+			for(unsigned int i=0;i<32;++i)
+				keytmp[i] ^= 0x77; // use a different permutation of key for HMAC than for Salsa20
+			HMAC::sha256(keytmp,32,packet.field(16,packet.size() - 16),packet.size() - 16,hmac);
+			memcpy(packet.field(0,8),hmac,8);
+
+			packets.push_back(packet);
+
+			packet.setSize(16); // HMAC and IV
+			packet.append((uint32_t)(conversationId & 0xffffffff));
 		}
+	}
 
-		// Configure networks
-		const Json::Value &networks = root["_networks"];
-		if (networks.isArray()) {
-			Mutex::Lock _l(_networks_m);
-			for(unsigned int ni=0;ni<networks.size();++ni) {
-				if (networks[ni].isObject()) {
-					const Json::Value &nwid_ = networks[ni]["id"];
-					uint64_t nwid = nwid_.isNumeric() ? (uint64_t)nwid_.asUInt64() : (uint64_t)strtoull(networks[ni]["id"].asString().c_str(),(char **)0,10);
-
-					if (nwid) {
-						SharedPtr<Network> nw;
-						std::map< uint64_t,SharedPtr<Network> >::iterator nwent(_networks.find(nwid));
-						if (nwent != _networks.end())
-							nw = nwent->second;
-						else {
-							try {
-								nw = SharedPtr<Network>(new Network(_r,nwid));
-								_networks[nwid] = nw;
-							} catch (std::exception &exc) {
-								LOG("unable to create network %llu: %s",nwid,exc.what());
-							} catch ( ... ) {
-								LOG("unable to create network %llu: unknown exception",nwid);
-							}
-						}
-
-						if (nw) {
-							Mutex::Lock _l2(nw->_lock);
-							nw->_open = networks[ni]["isOpen"].asBool();
-
-							// Ensure that TAP device has all the right IP addresses
-							// TODO: IPv6 might work a tad differently
-							std::set<InetAddress> allIps;
-							const Json::Value &addresses = networks[ni]["_addresses"];
-							if (addresses.isArray()) {
-								for(unsigned int ai=0;ai<addresses.size();++ai) {
-									if (addresses[ai].isString()) {
-										InetAddress addr(addresses[ai].asString());
-										if (addr) {
-											TRACE("network %llu IP/netmask: %s",nwid,addr.toString().c_str());
-											allIps.insert(addr);
-										}
-									}
-								}
-							}
-							nw->_tap.setIps(allIps);
-
-							// NOTE: the _members field is optional for open networks,
-							// since members of open nets do not need to check membership
-							// of packet senders and mutlicasters.
-							const Json::Value &members = networks[ni]["_members"];
-							nw->_members.clear();
-							if (members.isArray()) {
-								for(unsigned int mi=0;mi<members.size();++mi) {
-									std::string rawAddr(Utils::unhex(members[mi].asString()));
-									if (rawAddr.length() == ZT_ADDRESS_LENGTH) {
-										Address addr(rawAddr.data());
-										if ((addr)&&(!addr.isReserved())) {
-											//TRACE("network %llu member: %s",nwid,addr.toString().c_str());
-											nw->_members.insert(addr);
-										}
-									}
-								}
-							}
-						}
-					} else {
-						TRACE("ignored networks[%u], 'id' field missing");
-					}
-				} else {
-					TRACE("ignored networks[%u], not a JSON object",ni);
-				}
-			}
+	return packets;
+}
+
+bool NodeConfig::decodeControlMessagePacket(const void *key,const void *data,unsigned int len,unsigned long &conversationId,std::vector<std::string> &payload)
+{
+	char hmac[32];
+	char keytmp[32];
+
+	try {
+		if (len < 20)
+			return false;
+
+		Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> packet(data,len);
+
+		memcpy(keytmp,key,32);
+		for(unsigned int i=0;i<32;++i)
+			keytmp[i] ^= 0x77; // use a different permutation of key for HMAC than for Salsa20
+		HMAC::sha256(keytmp,32,packet.field(16,packet.size() - 16),packet.size() - 16,hmac);
+		if (memcmp(packet.field(0,8),hmac,8))
+			return false;
+
+		Salsa20 s20(key,256,packet.field(8,8));
+		s20.decrypt(packet.field(16,packet.size() - 16),packet.field(16,packet.size() - 16),packet.size() - 16);
+
+		conversationId = packet.at<uint32_t>(16);
+
+		const char *pl = ((const char *)packet.data()) + 20;
+		unsigned int pll = packet.size() - 20;
+		for(unsigned int i=0;i<pll;) {
+			unsigned int eos = i;
+			while ((eos < pll)&&(pl[eos]))
+				++eos;
+			if (eos > i) {
+				payload.push_back(std::string(pl + i,eos - i));
+				i = eos + 1;
+			} else break;
 		}
 
-		_lastAutoconfigure = Utils::now();
-		_lastAutoconfigureLastModified = lastModified;
-	} catch (std::exception &exc) {
-		TRACE("exception parsing autoconf URL response: %s",exc.what());
+		return true;
 	} catch ( ... ) {
-		TRACE("unexpected exception parsing autoconf URL response");
+		return false;
 	}
 }
 
-bool NodeConfig::_CBautoconfHandler(Http::Request *req,void *arg,const std::string &url,int code,const std::map<std::string,std::string> &headers,const std::string &body)
+void NodeConfig::_CBcontrolPacketHandler(UdpSocket *sock,void *arg,const InetAddress &remoteAddr,const void *data,unsigned int len)
 {
-#ifdef ZT_TRACE
-	const RuntimeEnvironment *_r = ((NodeConfig *)arg)->_r;
-#endif
-
-	if (code == 200) {
-		TRACE("200 got autoconfigure response from %s: %u bytes",url.c_str(),(unsigned int)body.length());
-
-		std::map<std::string,std::string>::const_iterator lm(headers.find("Last-Modified"));
-		if (lm != headers.end())
-			((NodeConfig *)arg)->__CBautoconfHandler(lm->second,body);
-		else ((NodeConfig *)arg)->__CBautoconfHandler(std::string(),body);
-	} else if (code == 304) {
-		TRACE("304 autoconfigure deferred, remote URL %s not modified",url.c_str());
-		((NodeConfig *)arg)->_lastAutoconfigure = Utils::now(); // still considered a success
-	} else if (code == 409) { // conflict, ID address in use by another ID
-		TRACE("%d autoconfigure failed from %s",code,url.c_str());
-	} else {
-		TRACE("%d autoconfigure failed from %s",code,url.c_str());
-	}
+	NodeConfig *nc = (NodeConfig *)arg;
+	const RuntimeEnvironment *_r = nc->_r;
+
+	try {
+		unsigned long convId = 0;
+		std::vector<std::string> commands;
+
+		if (!decodeControlMessagePacket(nc->_controlSocketKey,data,len,convId,commands)) {
+			TRACE("control bus packet from %s failed decode, discarded",remoteAddr.toString().c_str());
+			return;
+		}
+		TRACE("control bus packet from %s, contains %d commands",remoteAddr.toString().c_str(),(int)commands.size());
 
-	((NodeConfig *)arg)->_autoconfigureLock.unlock();
-	return false; // causes Request to delete itself
+		for(std::vector<std::string>::iterator c(commands.begin());c!=commands.end();++c) {
+			std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> > resultPackets(encodeControlMessage(nc->_controlSocketKey,convId,nc->execute(c->c_str())));
+			for(std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> >::iterator p(resultPackets.begin());p!=resultPackets.end();++p)
+				sock->send(remoteAddr,p->data(),p->size(),-1);
+		}
+	} catch ( ... ) {
+		TRACE("exception handling control bus packet from %s",remoteAddr.toString().c_str());
+	}
 }
 
 } // namespace ZeroTier