summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--controller/EmbeddedNetworkController.cpp77
-rw-r--r--controller/EmbeddedNetworkController.hpp14
-rw-r--r--node/IncomingPacket.cpp84
-rw-r--r--node/Network.cpp105
-rw-r--r--node/Network.hpp10
-rw-r--r--node/NetworkController.hpp69
-rw-r--r--node/Node.cpp85
-rw-r--r--node/Node.hpp8
8 files changed, 252 insertions, 200 deletions
diff --git a/controller/EmbeddedNetworkController.cpp b/controller/EmbeddedNetworkController.cpp
index 624c3145..91b59215 100644
--- a/controller/EmbeddedNetworkController.cpp
+++ b/controller/EmbeddedNetworkController.cpp
@@ -470,11 +470,21 @@ EmbeddedNetworkController::~EmbeddedNetworkController()
{
}
-NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(const InetAddress &fromAddr,const Identity &signingId,const Identity &identity,uint64_t nwid,const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData,NetworkConfig &nc)
+void EmbeddedNetworkController::init(const Identity &signingId,Sender *sender)
{
- if (((!signingId)||(!signingId.hasPrivate()))||(signingId.address().toInt() != (nwid >> 24))) {
- return NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
- }
+ this->_sender = sender;
+ this->_signingId = signingId;
+}
+
+void EmbeddedNetworkController::request(
+ uint64_t nwid,
+ const InetAddress &fromAddr,
+ uint64_t requestPacketId,
+ const Identity &identity,
+ const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData)
+{
+ if (((!_signingId)||(!_signingId.hasPrivate()))||(_signingId.address().toInt() != (nwid >> 24))||(!_sender))
+ return;
const uint64_t now = OSUtils::now();
@@ -483,7 +493,7 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
Mutex::Lock _l(_lastRequestTime_m);
uint64_t &lrt = _lastRequestTime[std::pair<uint64_t,uint64_t>(identity.address().toInt(),nwid)];
if ((now - lrt) <= ZT_NETCONF_MIN_REQUEST_PERIOD)
- return NetworkController::NETCONF_QUERY_IGNORE;
+ return;
lrt = now;
}
@@ -496,8 +506,13 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
network = _db.get("network",nwids,0);
member = _db.get("network",nwids,"member",identity.address().toString(),0);
}
- if (!network.size())
- return NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND;
+
+ if (!network.size()) {
+ _sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_OBJECT_NOT_FOUND);
+ return;
+ }
+
+ json origMember(member); // for detecting modification later
_initMember(member);
{
@@ -507,10 +522,13 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
// a "collision" from being able to auth onto our network in place of an already
// known member.
try {
- if (Identity(haveIdStr.c_str()) != identity)
- return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
+ if (Identity(haveIdStr.c_str()) != identity) {
+ _sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_ACCESS_DENIED);
+ return;
+ }
} catch ( ... ) {
- return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
+ _sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_ACCESS_DENIED);
+ return;
}
} else {
// If we do not yet know this member's identity, learn it.
@@ -521,7 +539,7 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
// These are always the same, but make sure they are set
member["id"] = identity.address().toString();
member["address"] = member["id"];
- member["nwid"] = network["id"];
+ member["nwid"] = nwids;
// Determine whether and how member is authorized
const char *authorizedBy = (const char *)0;
@@ -597,7 +615,7 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
}
// Log this request
- {
+ if (requestPacketId) { // only log if this is a request, not for generated pushes
json rlEntry = json::object();
rlEntry["ts"] = now;
rlEntry["authorized"] = (authorizedBy) ? true : false;
@@ -620,22 +638,27 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
}
}
member["recentLog"] = recentLog;
- }
- member["lastModified"] = now;
- member["lastRequestMetaData"] = metaData.data();
+ // Also only do this on real requests
+ member["lastRequestMetaData"] = metaData.data();
+ }
// If they are not authorized, STOP!
if (!authorizedBy) {
- Mutex::Lock _l(_db_m);
- _db.put("network",nwids,"member",identity.address().toString(),member);
- return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
+ if (origMember != member) {
+ member["lastModified"] = now;
+ Mutex::Lock _l(_db_m);
+ _db.put("network",nwids,"member",identity.address().toString(),member);
+ }
+ _sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_ACCESS_DENIED);
+ return;
}
// -------------------------------------------------------------------------
// If we made it this far, they are authorized.
// -------------------------------------------------------------------------
+ NetworkConfig nc;
_NetworkMemberInfo nmi;
_getNetworkMemberInfo(now,nwid,nmi);
@@ -661,8 +684,9 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
Utils::scopy(nc.name,sizeof(nc.name),_jS(network["name"],"").c_str());
nc.multicastLimit = (unsigned int)_jI(network["multicastLimit"],32ULL);
- for(std::set<Address>::const_iterator ab(nmi.activeBridges.begin());ab!=nmi.activeBridges.end();++ab)
+ for(std::set<Address>::const_iterator ab(nmi.activeBridges.begin());ab!=nmi.activeBridges.end();++ab) {
nc.addSpecialist(*ab,ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE);
+ }
json &v4AssignMode = network["v4AssignMode"];
json &v6AssignMode = network["v6AssignMode"];
@@ -714,7 +738,7 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
}
}
nc.capabilities[nc.capabilityCount] = Capability((uint32_t)capId,nwid,now,1,capr,caprc);
- if (nc.capabilities[nc.capabilityCount].sign(signingId,identity.address()))
+ if (nc.capabilities[nc.capabilityCount].sign(_signingId,identity.address()))
++nc.capabilityCount;
if (nc.capabilityCount >= ZT_MAX_NETWORK_CAPABILITIES)
break;
@@ -733,7 +757,7 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
if (nc.tagCount >= ZT_MAX_NETWORK_TAGS)
break;
nc.tags[nc.tagCount] = Tag(nwid,now,identity.address(),t->first,t->second);
- if (nc.tags[nc.tagCount].sign(signingId))
+ if (nc.tags[nc.tagCount].sign(_signingId))
++nc.tagCount;
}
}
@@ -923,17 +947,20 @@ NetworkController::ResultCode EmbeddedNetworkController::doNetworkConfigRequest(
}
CertificateOfMembership com(now,credentialtmd,nwid,identity.address());
- if (com.sign(signingId)) {
+ if (com.sign(_signingId)) {
nc.com = com;
} else {
- return NETCONF_QUERY_INTERNAL_SERVER_ERROR;
+ _sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_INTERNAL_SERVER_ERROR);
+ return;
}
- {
+ if (member != origMember) {
+ member["lastModified"] = now;
Mutex::Lock _l(_db_m);
_db.put("network",nwids,"member",identity.address().toString(),member);
}
- return NetworkController::NETCONF_QUERY_OK;
+
+ _sender->ncSendConfig(nwid,requestPacketId,identity.address(),nc,metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,0) < 6);
}
unsigned int EmbeddedNetworkController::handleControlPlaneHttpGET(
diff --git a/controller/EmbeddedNetworkController.hpp b/controller/EmbeddedNetworkController.hpp
index 53d3be0f..79b919b9 100644
--- a/controller/EmbeddedNetworkController.hpp
+++ b/controller/EmbeddedNetworkController.hpp
@@ -52,13 +52,14 @@ public:
EmbeddedNetworkController(Node *node,const char *dbPath);
virtual ~EmbeddedNetworkController();
- virtual NetworkController::ResultCode doNetworkConfigRequest(
+ virtual void init(const Identity &signingId,Sender *sender);
+
+ virtual void request(
+ uint64_t nwid,
const InetAddress &fromAddr,
- const Identity &signingId,
+ uint64_t requestPacketId,
const Identity &identity,
- uint64_t nwid,
- const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData,
- NetworkConfig &nc);
+ const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData);
unsigned int handleControlPlaneHttpGET(
const std::vector<std::string> &path,
@@ -157,6 +158,9 @@ private:
Node *const _node;
std::string _path;
+ NetworkController::Sender *_sender;
+ Identity _signingId;
+
struct _CircuitTestEntry
{
ZT_CircuitTest *test;
diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 5afacd0e..bde5df71 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -865,92 +865,12 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
const uint64_t nwid = at<uint64_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_NETWORK_ID);
const unsigned int hopCount = hops();
const uint64_t requestPacketId = packetId();
- bool trustEstablished = false;
if (RR->localNetworkController) {
const unsigned int metaDataLength = at<uint16_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT_LEN);
const char *metaDataBytes = (const char *)field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT,metaDataLength);
const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> metaData(metaDataBytes,metaDataLength);
-
- NetworkConfig *netconf = new NetworkConfig();
- try {
- switch(RR->localNetworkController->doNetworkConfigRequest((hopCount > 0) ? InetAddress() : _path->address(),RR->identity,peer->identity(),nwid,metaData,*netconf)) {
-
- case NetworkController::NETCONF_QUERY_OK: {
- trustEstablished = true;
- Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> *dconf = new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>();
- try {
- if (netconf->toDictionary(*dconf,metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,0) < 6)) {
- uint64_t configUpdateId = RR->node->prng();
- if (!configUpdateId) ++configUpdateId;
- const unsigned int totalSize = dconf->sizeBytes();
- unsigned int chunkIndex = 0;
- while (chunkIndex < totalSize) {
- const unsigned int chunkLen = std::min(totalSize - chunkIndex,(unsigned int)(ZT_UDP_DEFAULT_PAYLOAD_MTU - (ZT_PACKET_IDX_PAYLOAD + 256)));
- Packet outp(peer->address(),RR->identity.address(),Packet::VERB_OK);
- outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
- outp.append(requestPacketId);
-
- const unsigned int sigStart = outp.size();
- outp.append(nwid);
- outp.append((uint16_t)chunkLen);
- outp.append((const void *)(dconf->data() + chunkIndex),chunkLen);
-
- outp.append((uint8_t)0); // no flags
- outp.append((uint64_t)configUpdateId);
- outp.append((uint32_t)totalSize);
- outp.append((uint32_t)chunkIndex);
-
- C25519::Signature sig(RR->identity.sign(reinterpret_cast<const uint8_t *>(outp.data()) + sigStart,outp.size() - sigStart));
- outp.append((uint8_t)1);
- outp.append((uint16_t)ZT_C25519_SIGNATURE_LEN);
- outp.append(sig.data,ZT_C25519_SIGNATURE_LEN);
-
- outp.compress();
- RR->sw->send(outp,true);
- chunkIndex += chunkLen;
- }
- }
- delete dconf;
- } catch ( ... ) {
- delete dconf;
- throw;
- }
- } break;
-
- case NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND: {
- Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
- outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
- outp.append(requestPacketId);
- outp.append((unsigned char)Packet::ERROR_OBJ_NOT_FOUND);
- outp.append(nwid);
- outp.armor(peer->key(),true);
- _path->send(RR,outp.data(),outp.size(),RR->node->now());
- } break;
-
- case NetworkController::NETCONF_QUERY_ACCESS_DENIED: {
- Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
- outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
- outp.append(requestPacketId);
- outp.append((unsigned char)Packet::ERROR_NETWORK_ACCESS_DENIED_);
- outp.append(nwid);
- outp.armor(peer->key(),true);
- _path->send(RR,outp.data(),outp.size(),RR->node->now());
- } break;
-
- case NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR:
- break;
- case NetworkController::NETCONF_QUERY_IGNORE:
- break;
- default:
- TRACE("NETWORK_CONFIG_REQUEST failed: invalid return value from NetworkController::doNetworkConfigRequest()");
- break;
- }
- delete netconf;
- } catch ( ... ) {
- delete netconf;
- throw;
- }
+ RR->localNetworkController->request(nwid,(hopCount > 0) ? InetAddress() : _path->address(),requestPacketId,peer->identity(),metaData);
} else {
Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
@@ -961,7 +881,7 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
_path->send(RR,outp.data(),outp.size(),RR->node->now());
}
- peer->received(_path,hopCount,requestPacketId,Packet::VERB_NETWORK_CONFIG_REQUEST,0,Packet::VERB_NOP,trustEstablished);
+ peer->received(_path,hopCount,requestPacketId,Packet::VERB_NETWORK_CONFIG_REQUEST,0,Packet::VERB_NOP,false);
} catch (std::exception &exc) {
fprintf(stderr,"WARNING: network config request failed with exception: %s" ZT_EOL_S,exc.what());
TRACE("dropped NETWORK_CONFIG_REQUEST from %s(%s): %s",source().toString().c_str(),_path->address().toString().c_str(),exc.what());
diff --git a/node/Network.cpp b/node/Network.cpp
index c0e4b105..1f8e7ebf 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -599,7 +599,7 @@ Network::Network(const RuntimeEnvironment *renv,uint64_t nwid,void *uptr) :
if (conf.length()) {
dconf->load(conf.c_str());
if (nconf->fromDictionary(*dconf)) {
- this->_setConfiguration(*nconf,false);
+ this->setConfiguration(*nconf,false);
_lastConfigUpdate = 0; // we still want to re-request a new config from the network
gotConf = true;
}
@@ -1015,7 +1015,7 @@ uint64_t Network::handleConfigChunk(const Packet &chunk,unsigned int ptr)
}
if (nc) {
- this->_setConfiguration(*nc,true);
+ this->setConfiguration(*nc,true);
delete nc;
return configUpdateId;
} else {
@@ -1025,6 +1025,46 @@ uint64_t Network::handleConfigChunk(const Packet &chunk,unsigned int ptr)
return 0;
}
+int Network::setConfiguration(const NetworkConfig &nconf,bool saveToDisk)
+{
+ // _lock is NOT locked when this is called
+ try {
+ if ((nconf.issuedTo != RR->identity.address())||(nconf.networkId != _id))
+ return 0;
+ if (_config == nconf)
+ return 1; // OK config, but duplicate of what we already have
+
+ ZT_VirtualNetworkConfig ctmp;
+ bool oldPortInitialized;
+ {
+ Mutex::Lock _l(_lock);
+ _config = nconf;
+ _lastConfigUpdate = RR->node->now();
+ _netconfFailure = NETCONF_FAILURE_NONE;
+ oldPortInitialized = _portInitialized;
+ _portInitialized = true;
+ _externalConfig(&ctmp);
+ }
+ _portError = RR->node->configureVirtualNetworkPort(_id,&_uPtr,(oldPortInitialized) ? ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE : ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP,&ctmp);
+
+ if (saveToDisk) {
+ Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> *d = new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>();
+ try {
+ char n[64];
+ Utils::snprintf(n,sizeof(n),"networks.d/%.16llx.conf",_id);
+ if (nconf.toDictionary(*d,false))
+ RR->node->dataStorePut(n,(const void *)d->data(),d->sizeBytes(),true);
+ } catch ( ... ) {}
+ delete d;
+ }
+
+ return 2; // OK and configuration has changed
+ } catch ( ... ) {
+ TRACE("ignored invalid configuration for network %.16llx",(unsigned long long)_id);
+ }
+ return 0;
+}
+
void Network::requestConfiguration()
{
const Address ctrl(controller());
@@ -1046,26 +1086,7 @@ void Network::requestConfiguration()
if (ctrl == RR->identity.address()) {
if (RR->localNetworkController) {
- NetworkConfig *nconf = new NetworkConfig();
- try {
- switch(RR->localNetworkController->doNetworkConfigRequest(InetAddress(),RR->identity,RR->identity,_id,rmd,*nconf)) {
- case NetworkController::NETCONF_QUERY_OK:
- this->_setConfiguration(*nconf,true);
- break;
- case NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND:
- this->setNotFound();
- break;
- case NetworkController::NETCONF_QUERY_ACCESS_DENIED:
- this->setAccessDenied();
- break;
- default:
- this->setNotFound();
- break;
- }
- } catch ( ... ) {
- this->setNotFound();
- }
- delete nconf;
+ RR->localNetworkController->request(_id,InetAddress(),0xffffffffffffffffULL,RR->identity,rmd);
} else {
this->setNotFound();
}
@@ -1257,46 +1278,6 @@ ZT_VirtualNetworkStatus Network::_status() const
}
}
-int Network::_setConfiguration(const NetworkConfig &nconf,bool saveToDisk)
-{
- // _lock is NOT locked when this is called
- try {
- if ((nconf.issuedTo != RR->identity.address())||(nconf.networkId != _id))
- return 0;
- if (_config == nconf)
- return 1; // OK config, but duplicate of what we already have
-
- ZT_VirtualNetworkConfig ctmp;
- bool oldPortInitialized;
- {
- Mutex::Lock _l(_lock);
- _config = nconf;
- _lastConfigUpdate = RR->node->now();
- _netconfFailure = NETCONF_FAILURE_NONE;
- oldPortInitialized = _portInitialized;
- _portInitialized = true;
- _externalConfig(&ctmp);
- }
- _portError = RR->node->configureVirtualNetworkPort(_id,&_uPtr,(oldPortInitialized) ? ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE : ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP,&ctmp);
-
- if (saveToDisk) {
- Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> *d = new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>();
- try {
- char n[64];
- Utils::snprintf(n,sizeof(n),"networks.d/%.16llx.conf",_id);
- if (nconf.toDictionary(*d,false))
- RR->node->dataStorePut(n,(const void *)d->data(),d->sizeBytes(),true);
- } catch ( ... ) {}
- delete d;
- }
-
- return 2; // OK and configuration has changed
- } catch ( ... ) {
- TRACE("ignored invalid configuration for network %.16llx",(unsigned long long)_id);
- }
- return 0;
-}
-
void Network::_externalConfig(ZT_VirtualNetworkConfig *ec) const
{
// assumes _lock is locked
diff --git a/node/Network.hpp b/node/Network.hpp
index 527d3048..1627be58 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -188,6 +188,15 @@ public:
uint64_t handleConfigChunk(const Packet &chunk,unsigned int ptr);
/**
+ * Set network configuration
+ *
+ * @param nconf Network configuration
+ * @param saveToDisk Save to disk? Used during loading, should usually be true otherwise.
+ * @return 0 == bad, 1 == accepted but duplicate/unchanged, 2 == accepted and new
+ */
+ int setConfiguration(const NetworkConfig &nconf,bool saveToDisk);
+
+ /**
* Set netconf failure to 'access denied' -- called in IncomingPacket when controller reports this
*/
inline void setAccessDenied()
@@ -328,7 +337,6 @@ public:
inline void **userPtr() throw() { return &_uPtr; }
private:
- int _setConfiguration(const NetworkConfig &nconf,bool saveToDisk);
ZT_VirtualNetworkStatus _status() const;
void _externalConfig(ZT_VirtualNetworkConfig *ec) const; // assumes _lock is locked
bool _gate(const SharedPtr<Peer> &peer);
diff --git a/node/NetworkController.hpp b/node/NetworkController.hpp
index db95dd14..fc5db4af 100644
--- a/node/NetworkController.hpp
+++ b/node/NetworkController.hpp
@@ -27,7 +27,6 @@
namespace ZeroTier {
-class RuntimeEnvironment;
class Identity;
class Address;
struct InetAddress;
@@ -38,45 +37,69 @@ struct InetAddress;
class NetworkController
{
public:
+ enum ErrorCode
+ {
+ NC_ERROR_NONE = 0,
+ NC_ERROR_OBJECT_NOT_FOUND = 1,
+ NC_ERROR_ACCESS_DENIED = 2,
+ NC_ERROR_INTERNAL_SERVER_ERROR = 3
+ };
+
/**
- * Return value of doNetworkConfigRequest
+ * Interface for sender used to send pushes and replies
*/
- enum ResultCode
+ class Sender
{
- NETCONF_QUERY_OK = 0,
- NETCONF_QUERY_OBJECT_NOT_FOUND = 1,
- NETCONF_QUERY_ACCESS_DENIED = 2,
- NETCONF_QUERY_INTERNAL_SERVER_ERROR = 3,
- NETCONF_QUERY_IGNORE = 4
+ public:
+ /**
+ * Send a configuration to a remote peer
+ *
+ * @param nwid Network ID
+ * @param requestPacketId Request packet ID to send OK(NETWORK_CONFIG_REQUEST) or 0 to send NETWORK_CONFIG (push)
+ * @param destination Destination peer Address
+ * @param nc Network configuration to send
+ * @param sendLegacyFormatConfig If true, send an old-format network config
+ */
+ virtual void ncSendConfig(uint64_t nwid,uint64_t requestPacketId,const Address &destination,const NetworkConfig &nc,bool sendLegacyFormatConfig) = 0;
+
+ /**
+ * Send a network configuration request error
+ *
+ * @param nwid Network ID
+ * @param requestPacketId Request packet ID or 0 if none
+ * @param destination Destination peer Address
+ * @param errorCode Error code
+ */
+ virtual void ncSendError(uint64_t nwid,uint64_t requestPacketId,const Address &destination,NetworkController::ErrorCode errorCode) = 0;
};
NetworkController() {}
virtual ~NetworkController() {}
/**
- * Handle a network config request, sending replies if necessary
- *
- * This call is permitted to block, and may be called concurrently from more
- * than one thread. Implementations must use locks if needed.
+ * Called when this is added to a Node to initialize and supply info
*
- * On internal server errors, the 'error' field in result can be filled in
- * to indicate the error.
+ * @param signingId Identity for signing of network configurations, certs, etc.
+ * @param sender Sender implementation for sending replies or config pushes
+ */
+ virtual void init(const Identity &signingId,Sender *sender) = 0;
+
+ /**
+ * Handle a network configuration request
*
- * @param fromAddr Originating wire address or null address if packet is not direct (or from self)
- * @param signingId Identity that should be used to sign results -- must include private key
- * @param identity Originating peer ZeroTier identity
* @param nwid 64-bit network ID
+ * @param fromAddr Originating wire address or null address if packet is not direct (or from self)
+ * @param requestPacketId Packet ID of request packet or 0 if not initiated by remote request
+ * @param identity ZeroTier identity of originating peer
* @param metaData Meta-data bundled with request (if any)
- * @param nc NetworkConfig to fill with results
* @return Returns NETCONF_QUERY_OK if result 'nc' is valid, or an error code on error
*/
- virtual NetworkController::ResultCode doNetworkConfigRequest(
+ virtual void request(
+ uint64_t nwid,
const InetAddress &fromAddr,
- const Identity &signingId,
+ uint64_t requestPacketId,
const Identity &identity,
- uint64_t nwid,
- const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData,
- NetworkConfig &nc) = 0;
+ const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData) = 0;
};
} // namespace ZeroTier
diff --git a/node/Node.cpp b/node/Node.cpp
index 9314478f..69808bcf 100644
--- a/node/Node.cpp
+++ b/node/Node.cpp
@@ -490,6 +490,7 @@ void Node::clearLocalInterfaceAddresses()
void Node::setNetconfMaster(void *networkControllerInstance)
{
RR->localNetworkController = reinterpret_cast<NetworkController *>(networkControllerInstance);
+ RR->localNetworkController->init(RR->identity,this);
}
ZT_ResultCode Node::circuitTestBegin(ZT_CircuitTest *test,void (*reportCallback)(ZT_Node *,ZT_CircuitTest *,const ZT_CircuitTestReport *))
@@ -718,6 +719,90 @@ void Node::setTrustedPaths(const struct sockaddr_storage *networks,const uint64_
RR->topology->setTrustedPaths(reinterpret_cast<const InetAddress *>(networks),ids,count);
}
+void Node::ncSendConfig(uint64_t nwid,uint64_t requestPacketId,const Address &destination,const NetworkConfig &nc,bool sendLegacyFormatConfig)
+{
+ if (destination == RR->identity.address()) {
+ SharedPtr<Network> n(network(nwid));
+ if (!n) return;
+ n->setConfiguration(nc,true);
+ } else {
+ Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> *dconf = new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>();
+ try {
+ if (nc.toDictionary(*dconf,sendLegacyFormatConfig)) {
+ uint64_t configUpdateId = prng();
+ if (!configUpdateId) ++configUpdateId;
+
+ const unsigned int totalSize = dconf->sizeBytes();
+ unsigned int chunkIndex = 0;
+ while (chunkIndex < totalSize) {
+ const unsigned int chunkLen = std::min(totalSize - chunkIndex,(unsigned int)(ZT_UDP_DEFAULT_PAYLOAD_MTU - (ZT_PACKET_IDX_PAYLOAD + 256)));
+ Packet outp(destination,RR->identity.address(),Packet::VERB_OK);
+ outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
+ outp.append(requestPacketId);
+
+ const unsigned int sigStart = outp.size();
+ outp.append(nwid);
+ outp.append((uint16_t)chunkLen);
+ outp.append((const void *)(dconf->data() + chunkIndex),chunkLen);
+
+ outp.append((uint8_t)0); // no flags
+ outp.append((uint64_t)configUpdateId);
+ outp.append((uint32_t)totalSize);
+ outp.append((uint32_t)chunkIndex);
+
+ C25519::Signature sig(RR->identity.sign(reinterpret_cast<const uint8_t *>(outp.data()) + sigStart,outp.size() - sigStart));
+ outp.append((uint8_t)1);
+ outp.append((uint16_t)ZT_C25519_SIGNATURE_LEN);
+ outp.append(sig.data,ZT_C25519_SIGNATURE_LEN);
+
+ outp.compress();
+ RR->sw->send(outp,true);
+ chunkIndex += chunkLen;
+ }
+ }
+ delete dconf;
+ } catch ( ... ) {
+ delete dconf;
+ throw;
+ }
+ }
+}
+
+void Node::ncSendError(uint64_t nwid,uint64_t requestPacketId,const Address &destination,NetworkController::ErrorCode errorCode)
+{
+ if (destination == RR->identity.address()) {
+ SharedPtr<Network> n(network(nwid));
+ if (!n) return;
+ switch(errorCode) {
+ case NetworkController::NC_ERROR_OBJECT_NOT_FOUND:
+ case NetworkController::NC_ERROR_INTERNAL_SERVER_ERROR:
+ n->setNotFound();
+ break;
+ case NetworkController::NC_ERROR_ACCESS_DENIED:
+ n->setAccessDenied();
+ break;
+
+ default: break;
+ }
+ } else if (requestPacketId) {
+ Packet outp(destination,RR->identity.address(),Packet::VERB_ERROR);
+ outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
+ outp.append(requestPacketId);
+ switch(errorCode) {
+ //case NetworkController::NC_ERROR_OBJECT_NOT_FOUND:
+ //case NetworkController::NC_ERROR_INTERNAL_SERVER_ERROR:
+ default:
+ outp.append((unsigned char)Packet::ERROR_OBJ_NOT_FOUND);
+ break;
+ case NetworkController::NC_ERROR_ACCESS_DENIED:
+ outp.append((unsigned char)Packet::ERROR_NETWORK_ACCESS_DENIED_);
+ break;
+ }
+ outp.append(nwid);
+ RR->sw->send(outp,true);
+ }
+}
+
} // namespace ZeroTier
/****************************************************************************/
diff --git a/node/Node.hpp b/node/Node.hpp
index 11462531..e616da3d 100644
--- a/node/Node.hpp
+++ b/node/Node.hpp
@@ -36,6 +36,7 @@
#include "Network.hpp"
#include "Path.hpp"
#include "Salsa20.hpp"
+#include "NetworkController.hpp"
#undef TRACE
#ifdef ZT_TRACE
@@ -55,7 +56,7 @@ namespace ZeroTier {
*
* The pointer returned by ZT_Node_new() is an instance of this class.
*/
-class Node
+class Node : public NetworkController::Sender
{
public:
Node(
@@ -69,7 +70,7 @@ public:
ZT_PathCheckFunction pathCheckFunction,
ZT_EventCallback eventCallback);
- ~Node();
+ virtual ~Node();
// Public API Functions ----------------------------------------------------
@@ -282,6 +283,9 @@ public:
return false;
}
+ virtual void ncSendConfig(uint64_t nwid,uint64_t requestPacketId,const Address &destination,const NetworkConfig &nc,bool sendLegacyFormatConfig);
+ virtual void ncSendError(uint64_t nwid,uint64_t requestPacketId,const Address &destination,NetworkController::ErrorCode errorCode);
+
private:
inline SharedPtr<Network> _network(uint64_t nwid) const
{
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-13 06:23:13 +0000