{

char tmp[128];

json r = json::object();

switch((rule.t) & 0x7f) {

case ZT_NETWORK_RULE_ACTION_DROP:

r["type"] = "ACTION_DROP";

break;

case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:

r["type"] = "MATCH_SOURCE_ZEROTIER_ADDRESS";

r["zt"] = Address(rule.v.zt).toString();

break;

case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:

r["type"] = "MATCH_DEST_ZEROTIER_ADDRESS";

r["zt"] = Address(rule.v.zt).toString();

break;

case ZT_NETWORK_RULE_MATCH_VLAN_ID:

r["type"] = "MATCH_VLAN_ID";

r["vlanId"] = (uint64_t)rule.v.vlanId;

break;

case ZT_NETWORK_RULE_MATCH_VLAN_PCP:

r["type"] = "MATCH_VLAN_PCP";

r["vlanPcp"] = (uint64_t)rule.v.vlanPcp;

break;

case ZT_NETWORK_RULE_MATCH_VLAN_DEI:

r["type"] = "MATCH_VLAN_DEI";

r["vlanDei"] = (uint64_t)rule.v.vlanDei;

break;

case ZT_NETWORK_RULE_MATCH_ETHERTYPE:

r["type"] = "MATCH_ETHERTYPE";

r["etherType"] = (uint64_t)rule.v.etherType;

break;

case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:

r["type"] = "MATCH_MAC_SOURCE";

Utils::snprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);

r["mac"] = tmp;

break;

case ZT_NETWORK_RULE_MATCH_MAC_DEST:

r["type"] = "MATCH_MAC_DEST";

Utils::snprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);

r["mac"] = tmp;

break;

case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:

r["type"] = "MATCH_IPV4_SOURCE";

r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString();

break;

case ZT_NETWORK_RULE_MATCH_IPV4_DEST:

r["type"] = "MATCH_IPV4_DEST";

r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString();

break;

case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:

r["type"] = "MATCH_IPV6_SOURCE";

r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString();

break;

case ZT_NETWORK_RULE_MATCH_IPV6_DEST:

r["type"] = "MATCH_IPV6_DEST";

r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString();

break;

case ZT_NETWORK_RULE_MATCH_IP_TOS:

r["type"] = "MATCH_IP_TOS";

r["ipTos"] = (uint64_t)rule.v.ipTos;

break;

case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:

r["type"] = "MATCH_IP_PROTOCOL";

r["ipProtocol"] = (uint64_t)rule.v.ipProtocol;

break;

case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:

r["type"] = "MATCH_IP_SOURCE_PORT_RANGE";

r["start"] = (uint64_t)rule.v.port[0];

r["end"] = (uint64_t)rule.v.port[1];

break;

case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:

r["type"] = "MATCH_IP_DEST_PORT_RANGE";

r["start"] = (uint64_t)rule.v.port[0];

r["end"] = (uint64_t)rule.v.port[1];

break;

case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:

r["type"] = "MATCH_CHARACTERISTICS";

Utils::snprintf(tmp,sizeof(tmp),"%.16llx",rule.v.characteristics[0]);

r["mask"] = tmp;

Utils::snprintf(tmp,sizeof(tmp),"%.16llx",rule.v.characteristics[1]);

break;

case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:

r["type"] = "MATCH_FRAME_SIZE_RANGE";

r["start"] = (uint64_t)rule.v.frameSize[0];

r["end"] = (uint64_t)rule.v.frameSize[1];

break;

case ZT_NETWORK_RULE_MATCH_TAGS_SAMENESS:

r["type"] = "MATCH_TAGS_SAMENESS";

r["id"] = (uint64_t)rule.v.tag.id;

r["value"] = (uint64_t)rule.v.tag.value;

break;

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_AND:

r["type"] = "MATCH_TAGS_BITWISE_AND";

r["id"] = (uint64_t)rule.v.tag.id;

r["value"] = (uint64_t)rule.v.tag.value;

break;

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_OR:

r["type"] = "MATCH_TAGS_BITWISE_OR";

r["id"] = (uint64_t)rule.v.tag.id;

r["value"] = (uint64_t)rule.v.tag.value;

break;

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_XOR:

r["type"] = "MATCH_TAGS_BITWISE_XOR";

r["id"] = (uint64_t)rule.v.tag.id;

r["value"] = (uint64_t)rule.v.tag.value;

break;

return r;

}

{

return false;

const std::string t(_jS(r["type"],""));

memset(&rule,0,sizeof(ZT_VirtualNetworkRule));

lrt = now;

}

if (!network.size())

return NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND;

for(std::set<Address>::const_iterator ab(nmi.activeBridges.begin());ab!=nmi.activeBridges.end();++ab)

nc.addSpecialist(*ab,ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE);

if (rules.is_array()) {

for(unsigned long i=0;i<rules.size();++i) {

}

if ((memberCapabilities.is_array())&&(memberCapabilities.size() > 0)&&(capabilities.is_array())) {

for(unsigned long i=0;i<capabilities.size();++i) {

if (cap.is_object())

capsById[_jI(cap["id"],0ULL) & 0xffffffffULL] = &cap;

}

for(unsigned long i=0;i<memberCapabilities.size();++i) {

const uint64_t capId = _jI(memberCapabilities[i],0ULL) & 0xffffffffULL;

if ((cap->is_object())&&(cap->size() > 0)) {

ZT_VirtualNetworkRule capr[ZT_MAX_CAPABILITY_RULES];

unsigned int caprc = 0;

if ((caprj.is_array())&&(caprj.size() > 0)) {

for(unsigned long j=0;j<caprj.size();++j) {

if (caprc >= ZT_MAX_CAPABILITY_RULES)

if (memberTags.is_array()) {

std::map< uint32_t,uint32_t > tagsById;

for(unsigned long i=0;i<memberTags.size();++i) {

if ((t.is_array())&&(t.size() == 2))

tagsById[(uint32_t)(_jI(t[0],0ULL) & 0xffffffffULL)] = (uint32_t)(_jI(t[1],0ULL) & 0xffffffffULL);

}

for(unsigned long i=0;i<routes.size();++i) {

if (nc.routeCount >= ZT_MAX_NETWORK_ROUTES)

break;

}

}

}

if ((_jB(v6AssignMode["rfc4193"],false))&&(nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {

nc.staticIps[nc.staticIpCount++] = InetAddress::makeIpv6rfc4193(nwid,identity.address().toInt());

nc.flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION;

bool haveManagedIpv4AutoAssignment = false;

bool haveManagedIpv6AutoAssignment = false; // "special" NDP-emulated address types do not count

if (ipAssignments.is_array()) {

for(unsigned long i=0;i<ipAssignments.size();++i) {

std::string ips = ipAssignments[i];

InetAddress ip(ips);

ipAssignments = json::array();

}

for(unsigned long p=0;((p<ipAssignmentPools.size())&&(!haveManagedIpv6AutoAssignment));++p) {

if (pool.is_object()) {

InetAddress ipRangeStart(_jS(pool["ipRangeStart"],""));

InetAddress ipRangeEnd(_jS(pool["ipRangeEnd"],""));

ip6.setPort((unsigned int)routedNetmaskBits);

if (nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)

nc.staticIps[nc.staticIpCount++] = ip6;

break;

}

}

}

}

for(unsigned long p=0;((p<ipAssignmentPools.size())&&(!haveManagedIpv4AutoAssignment));++p) {

if (pool.is_object()) {

continue;

uint32_t ipRangeLen = ipRangeEnd - ipRangeStart;

// Start with the LSB of the member's address

uint32_t ipTrialCounter = (uint32_t)(identity.address().toInt() & 0xffffffff);

uint32_t ip = (ipRangeLen > 0) ? (ipRangeStart + (ipTrialCounter % ipRangeLen)) : ipRangeStart;

++ipTrialCounter;

if ((ip & 0x000000ff) == 0x000000ff)

continue; // don't allow addresses that end in .255

// Check if this IP is within a local-to-Ethernet routed network

for(unsigned int rk=0;rk<nc.routeCount;++rk) {

uint32_t targetIp = Utils::ntoh((uint32_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc.routes[rk].target))->sin_addr.s_addr));

int targetBits = Utils::ntoh((uint16_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc.routes[rk].target))->sin_port));

if ((ip & (0xffffffff << (32 - targetBits))) == targetIp) {

}

}

// If it's routed, then try to claim and assign it and if successful end loop

if ((routedNetmaskBits > 0)&&(!nmi.allocatedIps.count(ip4))) {

ipAssignments.push_back(ip4.toIpString());

member["ipAssignments"] = ipAssignments;

json b;

try {

b = json::parse(body);

return 400;

} catch ( ... ) {

return 400;

}

const uint64_t now = OSUtils::now();

}

}

} catch ( ... ) {

return 400;

}

if (!test->hopCount) {

::free((void *)test);

return 400;

}

if (b.count("multicastLimit")) network["multicastLimit"] = _jI(b["multicastLimit"],32ULL);

if (b.count("v4AssignMode")) {

if (!nv4m.is_object()) nv4m = json::object();

if (b["v4AssignMode"].is_string()) { // backward compatibility

nv4m["zt"] = (_jS(b["v4AssignMode"],"") == "zt");

} else if (b["v4AssignMode"].is_object()) {

if (v4m.count("zt")) nv4m["zt"] = _jB(v4m["zt"],false);

}

if (!nv4m.count("zt")) nv4m["zt"] = false;

}

if (b.count("v6AssignMode")) {

if (!nv6m.is_object()) nv6m = json::object();

if (b["v6AssignMode"].is_string()) { // backward compatibility

std::vector<std::string> v6m(Utils::split(_jS(b["v6AssignMode"],"").c_str(),",","",""));

nv6m["6plane"] = true;

}

} else if (b["v6AssignMode"].is_object()) {

if (v6m.count("rfc4193")) nv6m["rfc4193"] = _jB(v6m["rfc4193"],false);

if (v6m.count("zt")) nv6m["rfc4193"] = _jB(v6m["zt"],false);

if (v6m.count("6plane")) nv6m["rfc4193"] = _jB(v6m["6plane"],false);

}

if (b.count("routes")) {

if (rts.is_array()) {

for(unsigned long i=0;i<rts.size();++i) {

}

}

}

}

}

if (b.count("ipAssignmentPools")) {

if (ipp.is_array()) {

for(unsigned long i=0;i<ipp.size();++i) {

auto ip = ipp[i];

if ((ip.is_object())&&(ip.count("ipRangeStart"))&&(ip.count("ipRangeEnd"))) {

InetAddress f(_jS(ip["ipRangeStart"],""));

InetAddress t(_jS(ip["ipRangeEnd"],""));

if ( ((f.ss_family == AF_INET)||(f.ss_family == AF_INET6)) && (f.ss_family == t.ss_family) ) {

tmp["ipRangeStart"] = f.toIpString();

tmp["ipRangeEnd"] = t.toIpString();

nipp.push_back(tmp);

}

}

}

}

}

if (b.count("rules")) {

if (rules.is_array()) {

json nrules = json::array();

for(unsigned long i=0;i<rules.size();++i) {

if (rule.is_object()) {

ZT_VirtualNetworkRule ztr;

}

}

network["rules"] = nrules;

}

if (b.count("authTokens")) {

if (authTokens.is_array()) {

json nat = json::array();

for(unsigned long i=0;i<authTokens.size();++i) {

}

if (b.count("capabilities")) {

if (capabilities.is_array()) {

std::map< uint64_t,json > ncaps;

for(unsigned long i=0;i<capabilities.size();++i) {

if (cap.is_object()) {

json ncap = json::object();

const uint64_t capId = _jI(cap["id"],0ULL);

ncap["id"] = capId;

json nrules = json::array();

if (rules.is_array()) {

for(unsigned long i=0;i<rules.size();++i) {

json rule = rules[i];

if (rule.is_object()) {

ZT_VirtualNetworkRule ztr;

}

}

}

}

}

} catch ( ... ) {

return 400;

}

if (!member.count("capabilities")) member["capabilities"] = nlohmann::json::array();

if (!member.count("creationTime")) member["creationTime"] = OSUtils::now();

if (!member.count("noAutoAssignIps")) member["noAutoAssignIps"] = false;

member["objtype"] = "member";

}

inline void _initNetwork(nlohmann::json &network)

// Uncomment to enable ZT_NETWORK_RULE_ACTION_DEBUG_LOG rule output to STDOUT

#define ZT_RULES_ENGINE_DEBUGGING 1

namespace ZeroTier {

#ifdef ZT_RULES_ENGINE_DEBUGGING