Merge branch 'adamierymenko-dev' into android-jni

4 files changed, 52 insertions, 46 deletions

diff --git a/node/Network.cpp b/node/Network.cpp
index ddfb01c7..ebff1a5d 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -334,29 +334,6 @@ bool Network::peerNeedsOurMembershipCertificate(const Address &to,uint64_t now)
 	return false;
 }
 
-bool Network::isAllowed(const Address &peer) const
-{
-	try {
-		Mutex::Lock _l(_lock);
-
-		if (!_config)
-			return false;
-		if (_config->isPublic())
-			return true;
-
-		std::map<Address,CertificateOfMembership>::const_iterator pc(_membershipCertificates.find(peer));
-		if (pc == _membershipCertificates.end())
-			return false; // no certificate on file
-
-		return _config->com().agreesWith(pc->second); // is other cert valid against ours?
-	} catch (std::exception &exc) {
-		TRACE("isAllowed() check failed for peer %s: unexpected exception: %s",peer.toString().c_str(),exc.what());
-	} catch ( ... ) {
-		TRACE("isAllowed() check failed for peer %s: unexpected exception: unknown exception",peer.toString().c_str());
-	}
-	return false; // default position on any failure
-}
-
 void Network::clean()
 {
 	const uint64_t now = RR->node->now();
@@ -511,6 +488,28 @@ void Network::_externalConfig(ZT1_VirtualNetworkConfig *ec) const
 	} else ec->assignedAddressCount = 0;
 }
 
+bool Network::_isAllowed(const Address &peer) const
+{
+	// Assumes _lock is locked
+	try {
+		if (!_config)
+			return false;
+		if (_config->isPublic())
+			return true;
+
+		std::map<Address,CertificateOfMembership>::const_iterator pc(_membershipCertificates.find(peer));
+		if (pc == _membershipCertificates.end())
+			return false; // no certificate on file
+
+		return _config->com().agreesWith(pc->second); // is other cert valid against ours?
+	} catch (std::exception &exc) {
+		TRACE("isAllowed() check failed for peer %s: unexpected exception: %s",peer.toString().c_str(),exc.what());
+	} catch ( ... ) {
+		TRACE("isAllowed() check failed for peer %s: unexpected exception: unknown exception",peer.toString().c_str());
+	}
+	return false; // default position on any failure
+}
+
 // Used in Network::_announceMulticastGroups()
 class _AnnounceMulticastGroupsToPeersWithActiveDirectPaths
 {
@@ -524,7 +523,7 @@ public:
 
 	inline void operator()(Topology &t,const SharedPtr<Peer> &p)
 	{
-		if ( ( (p->hasActiveDirectPath(_now)) && (_network->isAllowed(p->address())) ) || (std::find(_supernodeAddresses.begin(),_supernodeAddresses.end(),p->address()) != _supernodeAddresses.end()) ) {
+		if ( ( (p->hasActiveDirectPath(_now)) && (_network->_isAllowed(p->address())) ) || (std::find(_supernodeAddresses.begin(),_supernodeAddresses.end(),p->address()) != _supernodeAddresses.end()) ) {
 			Packet outp(p->address(),RR->identity.address(),Packet::VERB_MULTICAST_LIKE);
 
 			std::vector<MulticastGroup> mgs(_network->allMulticastGroups());
@@ -557,6 +556,7 @@ private:
 
 void Network::_announceMulticastGroups()
 {
+	// Assumes _lock is locked
 	_AnnounceMulticastGroupsToPeersWithActiveDirectPaths afunc(RR,this);
 	RR->topology->eachPeer<_AnnounceMulticastGroupsToPeersWithActiveDirectPaths &>(afunc);
 }
diff --git a/node/Network.hpp b/node/Network.hpp
index 79ae3a90..f99ea525 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -55,6 +55,7 @@
 namespace ZeroTier {
 
 class RuntimeEnvironment;
+class _AnnounceMulticastGroupsToPeersWithActiveDirectPaths;
 
 /**
  * A virtual LAN
@@ -62,6 +63,7 @@ class RuntimeEnvironment;
 class Network : NonCopyable
 {
 	friend class SharedPtr<Network>;
+	friend class _AnnounceMulticastGroupsToPeersWithActiveDirectPaths;
 
 public:
 	/**
@@ -197,7 +199,11 @@ public:
 	 * @param peer Peer address to check
 	 * @return True if peer is allowed to communicate on this network
 	 */
-	bool isAllowed(const Address &peer) const;
+	inline bool isAllowed(const Address &peer) const
+	{
+		Mutex::Lock _l(_lock);
+		return _isAllowed(peer);
+	}
 
 	/**
 	 * Perform cleanup and possibly save state
@@ -348,6 +354,7 @@ public:
 private:
 	ZT1_VirtualNetworkStatus _status() const;
 	void _externalConfig(ZT1_VirtualNetworkConfig *ec) const; // assumes _lock is locked
+	bool _isAllowed(const Address &peer) const;
 	void _announceMulticastGroups();
 
 	const RuntimeEnvironment *RR;
diff --git a/node/Packet.cpp b/node/Packet.cpp
index 176dea09..f72f64b2 100644
--- a/node/Packet.cpp
+++ b/node/Packet.cpp
@@ -118,8 +118,6 @@ bool Packet::dearmor(const void *key)
 			s20.decrypt(payload,payload,payloadLen);
 
 		return true;
-	} else if (cs == ZT_PROTO_CIPHER_SUITE__C25519_AES256_GCM) {
-		return false; // not implemented yet
 	} else return false; // unrecognized cipher suite
 }
 
diff --git a/node/Packet.hpp b/node/Packet.hpp
index d365e845..76f84996 100644
--- a/node/Packet.hpp
+++ b/node/Packet.hpp
@@ -99,14 +99,12 @@
 #define ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_SALSA2012 1
 
 /**
- * Cipher suite: Curve25519/AES256-GCM
+ * DEPRECATED payload encrypted flag, will be removed for re-use soon.
  *
- * This specifies AES256 in GCM mode using GCM's built-in authentication
- * with Curve25519 elliptic curve Diffie-Hellman.
- *
- * (Not implemented yet in client but reserved for future use.)
+ * This has been replaced by the two-bit cipher suite selection field where
+ * a value of 0 indicated unencrypted (but authenticated) messages.
  */
-#define ZT_PROTO_CIPHER_SUITE__C25519_AES256_GCM 2
+#define ZT_PROTO_FLAG_ENCRYPTED 0x80
 
 /**
  * Header flag indicating that a packet is fragmented
@@ -117,6 +115,13 @@
 #define ZT_PROTO_FLAG_FRAGMENTED 0x40
 
 /**
+ * Flag indicating encryption with a PFS session key
+ *
+ * Not used yet -- for future PFS session re-keying support.
+ */
+#define ZT_PROTO_FLAG_PFS_SESSION 0x20
+
+/**
  * Verb flag indicating payload is compressed with LZ4
  */
 #define ZT_PROTO_VERB_FLAG_COMPRESSED 0x80
@@ -293,9 +298,9 @@ namespace ZeroTier {
  * 
  * Packets smaller than 28 bytes are invalid and silently discarded.
  *
- * The flags/cipher/hops bit field is: FFCCCHHH where C is a 3-bit cipher
- * selection allowing up to 8 cipher suites, F is flags (reserved, currently
- * all zero), and H is hop count.
+ * The flags/cipher/hops bit field is: FFFCCHHH where C is a 2-bit cipher
+ * selection allowing up to 4 cipher suites, F is outside-envelope flags,
+ * and H is hop count.
  *
  * The three-bit hop count is the only part of a packet that is mutable in
  * transit without invalidating the MAC. All other bits in the packet are
@@ -968,25 +973,21 @@ public:
 	 */
 	inline unsigned int cipher() const
 	{
-		//return (((unsigned int)(*this)[ZT_PACKET_IDX_FLAGS] & 0x38) >> 3);
-		// Use DEPRECATED 0x80 "encrypted" flag -- this will go away once there are no more <1.0.0 peers on the net
-		return (((*this)[ZT_PACKET_IDX_FLAGS] & 0x80) == 0) ? ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_NONE : ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_SALSA2012;
+		// Note: this uses the new cipher spec field, which is incompatible with <1.0.0 peers
+		return (((unsigned int)(*this)[ZT_PACKET_IDX_FLAGS] & 0x18) >> 3);
 	}
 
 	/**
 	 * Set this packet's cipher suite
-	 *
-	 * This normally shouldn't be called directly as armor() will set it after
-	 * encrypting and MACing the packet.
 	 */
 	inline void setCipher(unsigned int c)
 	{
 		unsigned char &b = (*this)[ZT_PACKET_IDX_FLAGS];
-		b = (b & 0xc7) | (unsigned char)((c << 3) & 0x38);
-		// Set both the new cipher suite spec field and the old DEPRECATED "encrypted" flag as long as there's <1.0.0 peers online
+		b = (b & 0xe7) | (unsigned char)((c << 3) & 0x18); // bits: FFFCCHHH
+		// DEPRECATED "encrypted" flag -- used by pre-1.0.3 peers
 		if (c == ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_SALSA2012)
-			b |= 0x80;
-		else b &= 0x7f;
+			b |= ZT_PROTO_FLAG_ENCRYPTED;
+		else b &= (~ZT_PROTO_FLAG_ENCRYPTED);
 	}
 
 	/**