summaryrefslogtreecommitdiff
path: root/controller
diff options
context:
space:
mode:
Diffstat (limited to 'controller')
-rw-r--r--controller/DB.cpp511
-rw-r--r--controller/DB.hpp139
-rw-r--r--controller/EmbeddedNetworkController.cpp1206
-rw-r--r--controller/EmbeddedNetworkController.hpp151
-rw-r--r--controller/FileDB.cpp150
-rw-r--r--controller/FileDB.hpp46
-rw-r--r--controller/JSONDB.cpp219
-rw-r--r--controller/JSONDB.hpp116
-rw-r--r--controller/README.md85
-rw-r--r--controller/RethinkDB.cpp488
-rw-r--r--controller/RethinkDB.hpp84
-rw-r--r--controller/migrate-sqlite/migrate.js320
-rw-r--r--controller/migrate-sqlite/package.json15
13 files changed, 2035 insertions, 1495 deletions
diff --git a/controller/DB.cpp b/controller/DB.cpp
new file mode 100644
index 00000000..b2e8878a
--- /dev/null
+++ b/controller/DB.cpp
@@ -0,0 +1,511 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "DB.hpp"
+#include "EmbeddedNetworkController.hpp"
+
+#include <chrono>
+#include <algorithm>
+#include <stdexcept>
+
+using json = nlohmann::json;
+
+namespace ZeroTier {
+
+void DB::initNetwork(nlohmann::json &network)
+{
+ if (!network.count("private")) network["private"] = true;
+ if (!network.count("creationTime")) network["creationTime"] = OSUtils::now();
+ if (!network.count("name")) network["name"] = "";
+ if (!network.count("multicastLimit")) network["multicastLimit"] = (uint64_t)32;
+ if (!network.count("enableBroadcast")) network["enableBroadcast"] = true;
+ if (!network.count("v4AssignMode")) network["v4AssignMode"] = {{"zt",false}};
+ if (!network.count("v6AssignMode")) network["v6AssignMode"] = {{"rfc4193",false},{"zt",false},{"6plane",false}};
+ if (!network.count("authTokens")) network["authTokens"] = {{}};
+ if (!network.count("capabilities")) network["capabilities"] = nlohmann::json::array();
+ if (!network.count("tags")) network["tags"] = nlohmann::json::array();
+ if (!network.count("routes")) network["routes"] = nlohmann::json::array();
+ if (!network.count("ipAssignmentPools")) network["ipAssignmentPools"] = nlohmann::json::array();
+ if (!network.count("mtu")) network["mtu"] = ZT_DEFAULT_MTU;
+ if (!network.count("remoteTraceTarget")) network["remoteTraceTarget"] = nlohmann::json();
+ if (!network.count("removeTraceLevel")) network["remoteTraceLevel"] = 0;
+ if (!network.count("rules")) {
+ // If unspecified, rules are set to allow anything and behave like a flat L2 segment
+ network["rules"] = {{
+ { "not",false },
+ { "or", false },
+ { "type","ACTION_ACCEPT" }
+ }};
+ }
+ network["objtype"] = "network";
+}
+
+void DB::initMember(nlohmann::json &member)
+{
+ if (!member.count("authorized")) member["authorized"] = false;
+ if (!member.count("ipAssignments")) member["ipAssignments"] = nlohmann::json::array();
+ if (!member.count("activeBridge")) member["activeBridge"] = false;
+ if (!member.count("tags")) member["tags"] = nlohmann::json::array();
+ if (!member.count("capabilities")) member["capabilities"] = nlohmann::json::array();
+ if (!member.count("creationTime")) member["creationTime"] = OSUtils::now();
+ if (!member.count("noAutoAssignIps")) member["noAutoAssignIps"] = false;
+ if (!member.count("revision")) member["revision"] = 0ULL;
+ if (!member.count("lastDeauthorizedTime")) member["lastDeauthorizedTime"] = 0ULL;
+ if (!member.count("lastAuthorizedTime")) member["lastAuthorizedTime"] = 0ULL;
+ if (!member.count("lastAuthorizedCredentialType")) member["lastAuthorizedCredentialType"] = nlohmann::json();
+ if (!member.count("lastAuthorizedCredential")) member["lastAuthorizedCredential"] = nlohmann::json();
+ if (!member.count("vMajor")) member["vMajor"] = -1;
+ if (!member.count("vMinor")) member["vMinor"] = -1;
+ if (!member.count("vRev")) member["vRev"] = -1;
+ if (!member.count("vProto")) member["vProto"] = -1;
+ if (!member.count("remoteTraceTarget")) member["remoteTraceTarget"] = nlohmann::json();
+ if (!member.count("removeTraceLevel")) member["remoteTraceLevel"] = 0;
+ member["objtype"] = "member";
+}
+
+void DB::cleanNetwork(nlohmann::json &network)
+{
+ network.erase("clock");
+ network.erase("authorizedMemberCount");
+ network.erase("activeMemberCount");
+ network.erase("totalMemberCount");
+ network.erase("lastModified");
+}
+
+void DB::cleanMember(nlohmann::json &member)
+{
+ member.erase("clock");
+ member.erase("physicalAddr");
+ member.erase("recentLog");
+ member.erase("lastModified");
+ member.erase("lastRequestMetaData");
+}
+
+DB::DB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path) :
+ _controller(nc),
+ _myId(myId),
+ _myAddress(myId.address()),
+ _path((path) ? path : "")
+{
+ char tmp[32];
+ _myAddress.toString(tmp);
+ _myAddressStr = tmp;
+}
+
+DB::~DB()
+{
+}
+
+bool DB::get(const uint64_t networkId,nlohmann::json &network)
+{
+ waitForReady();
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nwi = _networks.find(networkId);
+ if (nwi == _networks.end())
+ return false;
+ nw = nwi->second;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ network = nw->config;
+ }
+ return true;
+}
+
+bool DB::get(const uint64_t networkId,nlohmann::json &network,const uint64_t memberId,nlohmann::json &member)
+{
+ waitForReady();
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nwi = _networks.find(networkId);
+ if (nwi == _networks.end())
+ return false;
+ nw = nwi->second;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ network = nw->config;
+ auto m = nw->members.find(memberId);
+ if (m == nw->members.end())
+ return false;
+ member = m->second;
+ }
+ return true;
+}
+
+bool DB::get(const uint64_t networkId,nlohmann::json &network,const uint64_t memberId,nlohmann::json &member,NetworkSummaryInfo &info)
+{
+ waitForReady();
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nwi = _networks.find(networkId);
+ if (nwi == _networks.end())
+ return false;
+ nw = nwi->second;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ network = nw->config;
+ _fillSummaryInfo(nw,info);
+ auto m = nw->members.find(memberId);
+ if (m == nw->members.end())
+ return false;
+ member = m->second;
+ }
+ return true;
+}
+
+bool DB::get(const uint64_t networkId,nlohmann::json &network,std::vector<nlohmann::json> &members)
+{
+ waitForReady();
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nwi = _networks.find(networkId);
+ if (nwi == _networks.end())
+ return false;
+ nw = nwi->second;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ network = nw->config;
+ for(auto m=nw->members.begin();m!=nw->members.end();++m)
+ members.push_back(m->second);
+ }
+ return true;
+}
+
+bool DB::summary(const uint64_t networkId,NetworkSummaryInfo &info)
+{
+ waitForReady();
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nwi = _networks.find(networkId);
+ if (nwi == _networks.end())
+ return false;
+ nw = nwi->second;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ _fillSummaryInfo(nw,info);
+ }
+ return true;
+}
+
+void DB::networks(std::vector<uint64_t> &networks)
+{
+ waitForReady();
+ std::lock_guard<std::mutex> l(_networks_l);
+ networks.reserve(_networks.size() + 1);
+ for(auto n=_networks.begin();n!=_networks.end();++n)
+ networks.push_back(n->first);
+}
+
+void DB::_memberChanged(nlohmann::json &old,nlohmann::json &memberConfig,bool push)
+{
+ uint64_t memberId = 0;
+ uint64_t networkId = 0;
+ bool isAuth = false;
+ bool wasAuth = false;
+ std::shared_ptr<_Network> nw;
+
+ if (old.is_object()) {
+ memberId = OSUtils::jsonIntHex(old["id"],0ULL);
+ networkId = OSUtils::jsonIntHex(old["nwid"],0ULL);
+ if ((memberId)&&(networkId)) {
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nw2 = _networks.find(networkId);
+ if (nw2 != _networks.end())
+ nw = nw2->second;
+ }
+ if (nw) {
+ std::lock_guard<std::mutex> l(nw->lock);
+ if (OSUtils::jsonBool(old["activeBridge"],false))
+ nw->activeBridgeMembers.erase(memberId);
+ wasAuth = OSUtils::jsonBool(old["authorized"],false);
+ if (wasAuth)
+ nw->authorizedMembers.erase(memberId);
+ json &ips = old["ipAssignments"];
+ if (ips.is_array()) {
+ for(unsigned long i=0;i<ips.size();++i) {
+ json &ipj = ips[i];
+ if (ipj.is_string()) {
+ const std::string ips = ipj;
+ InetAddress ipa(ips.c_str());
+ ipa.setPort(0);
+ nw->allocatedIps.erase(ipa);
+ }
+ }
+ }
+ }
+ }
+ }
+
+ if (memberConfig.is_object()) {
+ if (!nw) {
+ memberId = OSUtils::jsonIntHex(memberConfig["id"],0ULL);
+ networkId = OSUtils::jsonIntHex(memberConfig["nwid"],0ULL);
+ if ((!memberId)||(!networkId))
+ return;
+ std::lock_guard<std::mutex> l(_networks_l);
+ std::shared_ptr<_Network> &nw2 = _networks[networkId];
+ if (!nw2)
+ nw2.reset(new _Network);
+ nw = nw2;
+ }
+
+ {
+ std::lock_guard<std::mutex> l(nw->lock);
+
+ nw->members[memberId] = memberConfig;
+
+ if (OSUtils::jsonBool(memberConfig["activeBridge"],false))
+ nw->activeBridgeMembers.insert(memberId);
+ isAuth = OSUtils::jsonBool(memberConfig["authorized"],false);
+ if (isAuth)
+ nw->authorizedMembers.insert(memberId);
+ json &ips = memberConfig["ipAssignments"];
+ if (ips.is_array()) {
+ for(unsigned long i=0;i<ips.size();++i) {
+ json &ipj = ips[i];
+ if (ipj.is_string()) {
+ const std::string ips = ipj;
+ InetAddress ipa(ips.c_str());
+ ipa.setPort(0);
+ nw->allocatedIps.insert(ipa);
+ }
+ }
+ }
+
+ if (!isAuth) {
+ const int64_t ldt = (int64_t)OSUtils::jsonInt(memberConfig["lastDeauthorizedTime"],0ULL);
+ if (ldt > nw->mostRecentDeauthTime)
+ nw->mostRecentDeauthTime = ldt;
+ }
+ }
+
+ if (push)
+ _controller->onNetworkMemberUpdate(networkId,memberId);
+ } else if (memberId) {
+ if (nw) {
+ std::lock_guard<std::mutex> l(nw->lock);
+ nw->members.erase(memberId);
+ }
+ if (networkId) {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto er = _networkByMember.equal_range(memberId);
+ for(auto i=er.first;i!=er.second;++i) {
+ if (i->second == networkId) {
+ _networkByMember.erase(i);
+ break;
+ }
+ }
+ }
+ }
+
+ /*
+ if (old.is_object()) {
+ json &config = old["config"];
+ if (config.is_object()) {
+ memberId = OSUtils::jsonIntHex(config["id"],0ULL);
+ networkId = OSUtils::jsonIntHex(config["nwid"],0ULL);
+ if ((memberId)&&(networkId)) {
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto nw2 = _networks.find(networkId);
+ if (nw2 != _networks.end())
+ nw = nw2->second;
+ }
+ if (nw) {
+ std::lock_guard<std::mutex> l(nw->lock);
+ if (OSUtils::jsonBool(config["activeBridge"],false))
+ nw->activeBridgeMembers.erase(memberId);
+ wasAuth = OSUtils::jsonBool(config["authorized"],false);
+ if (wasAuth)
+ nw->authorizedMembers.erase(memberId);
+ json &ips = config["ipAssignments"];
+ if (ips.is_array()) {
+ for(unsigned long i=0;i<ips.size();++i) {
+ json &ipj = ips[i];
+ if (ipj.is_string()) {
+ const std::string ips = ipj;
+ InetAddress ipa(ips.c_str());
+ ipa.setPort(0);
+ nw->allocatedIps.erase(ipa);
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+
+ if (member.is_object()) {
+ json &config = member["config"];
+ if (config.is_object()) {
+ if (!nw) {
+ memberId = OSUtils::jsonIntHex(config["id"],0ULL);
+ networkId = OSUtils::jsonIntHex(config["nwid"],0ULL);
+ if ((!memberId)||(!networkId))
+ return;
+ std::lock_guard<std::mutex> l(_networks_l);
+ std::shared_ptr<_Network> &nw2 = _networks[networkId];
+ if (!nw2)
+ nw2.reset(new _Network);
+ nw = nw2;
+ }
+
+ {
+ std::lock_guard<std::mutex> l(nw->lock);
+
+ nw->members[memberId] = config;
+
+ if (OSUtils::jsonBool(config["activeBridge"],false))
+ nw->activeBridgeMembers.insert(memberId);
+ isAuth = OSUtils::jsonBool(config["authorized"],false);
+ if (isAuth)
+ nw->authorizedMembers.insert(memberId);
+ json &ips = config["ipAssignments"];
+ if (ips.is_array()) {
+ for(unsigned long i=0;i<ips.size();++i) {
+ json &ipj = ips[i];
+ if (ipj.is_string()) {
+ const std::string ips = ipj;
+ InetAddress ipa(ips.c_str());
+ ipa.setPort(0);
+ nw->allocatedIps.insert(ipa);
+ }
+ }
+ }
+
+ if (!isAuth) {
+ const int64_t ldt = (int64_t)OSUtils::jsonInt(config["lastDeauthorizedTime"],0ULL);
+ if (ldt > nw->mostRecentDeauthTime)
+ nw->mostRecentDeauthTime = ldt;
+ }
+ }
+
+ if (push)
+ _controller->onNetworkMemberUpdate(networkId,memberId);
+ }
+ } else if (memberId) {
+ if (nw) {
+ std::lock_guard<std::mutex> l(nw->lock);
+ nw->members.erase(memberId);
+ }
+ if (networkId) {
+ std::lock_guard<std::mutex> l(_networks_l);
+ auto er = _networkByMember.equal_range(memberId);
+ for(auto i=er.first;i!=er.second;++i) {
+ if (i->second == networkId) {
+ _networkByMember.erase(i);
+ break;
+ }
+ }
+ }
+ }
+ */
+
+ if ((push)&&((wasAuth)&&(!isAuth)&&(networkId)&&(memberId)))
+ _controller->onNetworkMemberDeauthorize(networkId,memberId);
+}
+
+void DB::_networkChanged(nlohmann::json &old,nlohmann::json &networkConfig,bool push)
+{
+ if (networkConfig.is_object()) {
+ const std::string ids = networkConfig["id"];
+ const uint64_t id = Utils::hexStrToU64(ids.c_str());
+ if (id) {
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ std::shared_ptr<_Network> &nw2 = _networks[id];
+ if (!nw2)
+ nw2.reset(new _Network);
+ nw = nw2;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ nw->config = networkConfig;
+ }
+ if (push)
+ _controller->onNetworkUpdate(id);
+ }
+ } else if (old.is_object()) {
+ const std::string ids = old["id"];
+ const uint64_t id = Utils::hexStrToU64(ids.c_str());
+ if (id) {
+ std::lock_guard<std::mutex> l(_networks_l);
+ _networks.erase(id);
+ }
+ }
+
+ /*
+ if (network.is_object()) {
+ json &config = network["config"];
+ if (networkConfig.is_object()) {
+ const std::string ids = config["id"];
+ const uint64_t id = Utils::hexStrToU64(ids.c_str());
+ if (id) {
+ std::shared_ptr<_Network> nw;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ std::shared_ptr<_Network> &nw2 = _networks[id];
+ if (!nw2)
+ nw2.reset(new _Network);
+ nw = nw2;
+ }
+ {
+ std::lock_guard<std::mutex> l2(nw->lock);
+ nw->config = config;
+ }
+ if (push)
+ _controller->onNetworkUpdate(id);
+ }
+ }
+ } else if (old.is_object()) {
+ const std::string ids = old["id"];
+ const uint64_t id = Utils::hexStrToU64(ids.c_str());
+ if (id) {
+ std::lock_guard<std::mutex> l(_networks_l);
+ _networks.erase(id);
+ }
+ }
+ */
+}
+
+void DB::_fillSummaryInfo(const std::shared_ptr<_Network> &nw,NetworkSummaryInfo &info)
+{
+ for(auto ab=nw->activeBridgeMembers.begin();ab!=nw->activeBridgeMembers.end();++ab)
+ info.activeBridges.push_back(Address(*ab));
+ std::sort(info.activeBridges.begin(),info.activeBridges.end());
+ for(auto ip=nw->allocatedIps.begin();ip!=nw->allocatedIps.end();++ip)
+ info.allocatedIps.push_back(*ip);
+ std::sort(info.allocatedIps.begin(),info.allocatedIps.end());
+ info.authorizedMemberCount = (unsigned long)nw->authorizedMembers.size();
+ info.totalMemberCount = (unsigned long)nw->members.size();
+ info.mostRecentDeauthTime = nw->mostRecentDeauthTime;
+}
+
+} // namespace ZeroTier
diff --git a/controller/DB.hpp b/controller/DB.hpp
new file mode 100644
index 00000000..4757bb40
--- /dev/null
+++ b/controller/DB.hpp
@@ -0,0 +1,139 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef ZT_CONTROLLER_DB_HPP
+#define ZT_CONTROLLER_DB_HPP
+
+#include "../node/Constants.hpp"
+#include "../node/Identity.hpp"
+#include "../node/InetAddress.hpp"
+#include "../osdep/OSUtils.hpp"
+#include "../osdep/BlockingQueue.hpp"
+
+#include <memory>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+#include <atomic>
+
+#include "../ext/json/json.hpp"
+
+#define ZT_CONTROLLER_RETHINKDB_COMMIT_THREADS 2
+
+namespace ZeroTier
+{
+
+class EmbeddedNetworkController;
+
+/**
+ * Base class with common infrastructure for all controller DB implementations
+ */
+class DB
+{
+public:
+ struct NetworkSummaryInfo
+ {
+ NetworkSummaryInfo() : authorizedMemberCount(0),totalMemberCount(0),mostRecentDeauthTime(0) {}
+ std::vector<Address> activeBridges;
+ std::vector<InetAddress> allocatedIps;
+ unsigned long authorizedMemberCount;
+ unsigned long totalMemberCount;
+ int64_t mostRecentDeauthTime;
+ };
+
+ /**
+ * Ensure that all network fields are present
+ */
+ static void initNetwork(nlohmann::json &network);
+
+ /**
+ * Ensure that all member fields are present
+ */
+ static void initMember(nlohmann::json &member);
+
+ /**
+ * Remove old and temporary network fields
+ */
+ static void cleanNetwork(nlohmann::json &network);
+
+ /**
+ * Remove old and temporary member fields
+ */
+ static void cleanMember(nlohmann::json &member);
+
+ DB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path);
+ virtual ~DB();
+
+ virtual bool waitForReady() = 0;
+
+ inline bool hasNetwork(const uint64_t networkId) const
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ return (_networks.find(networkId) != _networks.end());
+ }
+
+ bool get(const uint64_t networkId,nlohmann::json &network);
+ bool get(const uint64_t networkId,nlohmann::json &network,const uint64_t memberId,nlohmann::json &member);
+ bool get(const uint64_t networkId,nlohmann::json &network,const uint64_t memberId,nlohmann::json &member,NetworkSummaryInfo &info);
+ bool get(const uint64_t networkId,nlohmann::json &network,std::vector<nlohmann::json> &members);
+
+ bool summary(const uint64_t networkId,NetworkSummaryInfo &info);
+
+ void networks(std::vector<uint64_t> &networks);
+
+ virtual void save(nlohmann::json *orig,nlohmann::json &record) = 0;
+
+ virtual void eraseNetwork(const uint64_t networkId) = 0;
+
+ virtual void eraseMember(const uint64_t networkId,const uint64_t memberId) = 0;
+
+ virtual void nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress) = 0;
+
+protected:
+ struct _Network
+ {
+ _Network() : mostRecentDeauthTime(0) {}
+ nlohmann::json config;
+ std::unordered_map<uint64_t,nlohmann::json> members;
+ std::unordered_set<uint64_t> activeBridgeMembers;
+ std::unordered_set<uint64_t> authorizedMembers;
+ std::unordered_set<InetAddress,InetAddress::Hasher> allocatedIps;
+ int64_t mostRecentDeauthTime;
+ std::mutex lock;
+ };
+
+ void _memberChanged(nlohmann::json &old,nlohmann::json &memberConfig,bool push);
+ void _networkChanged(nlohmann::json &old,nlohmann::json &networkConfig,bool push);
+ void _fillSummaryInfo(const std::shared_ptr<_Network> &nw,NetworkSummaryInfo &info);
+
+ EmbeddedNetworkController *const _controller;
+ const Identity _myId;
+ const Address _myAddress;
+ const std::string _path;
+ std::string _myAddressStr;
+
+ std::unordered_map< uint64_t,std::shared_ptr<_Network> > _networks;
+ std::unordered_multimap< uint64_t,uint64_t > _networkByMember;
+ mutable std::mutex _networks_l;
+};
+
+} // namespace ZeroTier
+
+#endif
diff --git a/controller/EmbeddedNetworkController.cpp b/controller/EmbeddedNetworkController.cpp
index 597bc9c9..9a07b285 100644
--- a/controller/EmbeddedNetworkController.cpp
+++ b/controller/EmbeddedNetworkController.cpp
@@ -1,6 +1,6 @@
/*
* ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2015 ZeroTier, Inc.
+ * Copyright (C) 2011-2018 ZeroTier, Inc
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -30,39 +30,36 @@
#include <algorithm>
#include <utility>
#include <stdexcept>
-#include <set>
#include <map>
+#include <thread>
+#include <memory>
#include "../include/ZeroTierOne.h"
-#include "../node/Constants.hpp"
+#include "../version.h"
#include "EmbeddedNetworkController.hpp"
#include "../node/Node.hpp"
-#include "../node/Utils.hpp"
#include "../node/CertificateOfMembership.hpp"
#include "../node/NetworkConfig.hpp"
#include "../node/Dictionary.hpp"
-#include "../node/InetAddress.hpp"
#include "../node/MAC.hpp"
-#include "../node/Address.hpp"
using json = nlohmann::json;
// API version reported via JSON control plane
-#define ZT_NETCONF_CONTROLLER_API_VERSION 3
-
-// Number of requests to remember in member history
-#define ZT_NETCONF_DB_MEMBER_HISTORY_LENGTH 2
+#define ZT_NETCONF_CONTROLLER_API_VERSION 4
// Min duration between requests for an address/nwid combo to prevent floods
#define ZT_NETCONF_MIN_REQUEST_PERIOD 1000
-// Nodes are considered active if they've queried in less than this long
-#define ZT_NETCONF_NODE_ACTIVE_THRESHOLD (ZT_NETWORK_AUTOCONF_DELAY * 2)
+// Global maximum size of arrays in JSON objects
+#define ZT_CONTROLLER_MAX_ARRAY_SIZE 16384
namespace ZeroTier {
+namespace {
+
static json _renderRule(ZT_VirtualNetworkRule &rule)
{
char tmp[128];
@@ -78,19 +75,19 @@ static json _renderRule(ZT_VirtualNetworkRule &rule)
break;
case ZT_NETWORK_RULE_ACTION_TEE:
r["type"] = "ACTION_TEE";
- r["address"] = Address(rule.v.fwd.address).toString();
+ r["address"] = Address(rule.v.fwd.address).toString(tmp);
r["flags"] = (unsigned int)rule.v.fwd.flags;
r["length"] = (unsigned int)rule.v.fwd.length;
break;
case ZT_NETWORK_RULE_ACTION_WATCH:
r["type"] = "ACTION_WATCH";
- r["address"] = Address(rule.v.fwd.address).toString();
+ r["address"] = Address(rule.v.fwd.address).toString(tmp);
r["flags"] = (unsigned int)rule.v.fwd.flags;
r["length"] = (unsigned int)rule.v.fwd.length;
break;
case ZT_NETWORK_RULE_ACTION_REDIRECT:
r["type"] = "ACTION_REDIRECT";
- r["address"] = Address(rule.v.fwd.address).toString();
+ r["address"] = Address(rule.v.fwd.address).toString(tmp);
r["flags"] = (unsigned int)rule.v.fwd.flags;
break;
case ZT_NETWORK_RULE_ACTION_BREAK:
@@ -104,11 +101,11 @@ static json _renderRule(ZT_VirtualNetworkRule &rule)
switch(rt) {
case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
r["type"] = "MATCH_SOURCE_ZEROTIER_ADDRESS";
- r["zt"] = Address(rule.v.zt).toString();
+ r["zt"] = Address(rule.v.zt).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
r["type"] = "MATCH_DEST_ZEROTIER_ADDRESS";
- r["zt"] = Address(rule.v.zt).toString();
+ r["zt"] = Address(rule.v.zt).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_VLAN_ID:
r["type"] = "MATCH_VLAN_ID";
@@ -124,29 +121,29 @@ static json _renderRule(ZT_VirtualNetworkRule &rule)
break;
case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
r["type"] = "MATCH_MAC_SOURCE";
- Utils::snprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);
r["mac"] = tmp;
break;
case ZT_NETWORK_RULE_MATCH_MAC_DEST:
r["type"] = "MATCH_MAC_DEST";
- Utils::snprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(unsigned int)rule.v.mac[0],(unsigned int)rule.v.mac[1],(unsigned int)rule.v.mac[2],(unsigned int)rule.v.mac[3],(unsigned int)rule.v.mac[4],(unsigned int)rule.v.mac[5]);
r["mac"] = tmp;
break;
case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
r["type"] = "MATCH_IPV4_SOURCE";
- r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString();
+ r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
r["type"] = "MATCH_IPV4_DEST";
- r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString();
+ r["ip"] = InetAddress(&(rule.v.ipv4.ip),4,(unsigned int)rule.v.ipv4.mask).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
r["type"] = "MATCH_IPV6_SOURCE";
- r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString();
+ r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
r["type"] = "MATCH_IPV6_DEST";
- r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString();
+ r["ip"] = InetAddress(rule.v.ipv6.ip,16,(unsigned int)rule.v.ipv6.mask).toString(tmp);
break;
case ZT_NETWORK_RULE_MATCH_IP_TOS:
r["type"] = "MATCH_IP_TOS";
@@ -181,7 +178,7 @@ static json _renderRule(ZT_VirtualNetworkRule &rule)
break;
case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
r["type"] = "MATCH_CHARACTERISTICS";
- Utils::snprintf(tmp,sizeof(tmp),"%.16llx",rule.v.characteristics);
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",rule.v.characteristics);
r["mask"] = tmp;
break;
case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
@@ -228,6 +225,16 @@ static json _renderRule(ZT_VirtualNetworkRule &rule)
r["id"] = rule.v.tag.id;
r["value"] = rule.v.tag.value;
break;
+ case ZT_NETWORK_RULE_MATCH_INTEGER_RANGE:
+ r["type"] = "INTEGER_RANGE";
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",rule.v.intRange.start);
+ r["start"] = tmp;
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx",rule.v.intRange.start + (uint64_t)rule.v.intRange.end);
+ r["end"] = tmp;
+ r["idx"] = rule.v.intRange.idx;
+ r["little"] = ((rule.v.intRange.format & 0x80) != 0);
+ r["bits"] = (rule.v.intRange.format & 63) + 1;
+ break;
default:
break;
}
@@ -314,29 +321,29 @@ static bool _parseRule(json &r,ZT_VirtualNetworkRule &rule)
return true;
} else if (t == "MATCH_IPV4_SOURCE") {
rule.t |= ZT_NETWORK_RULE_MATCH_IPV4_SOURCE;
- InetAddress ip(OSUtils::jsonString(r["ip"],"0.0.0.0"));
+ InetAddress ip(OSUtils::jsonString(r["ip"],"0.0.0.0").c_str());
rule.v.ipv4.ip = reinterpret_cast<struct sockaddr_in *>(&ip)->sin_addr.s_addr;
rule.v.ipv4.mask = Utils::ntoh(reinterpret_cast<struct sockaddr_in *>(&ip)->sin_port) & 0xff;
if (rule.v.ipv4.mask > 32) rule.v.ipv4.mask = 32;
return true;
} else if (t == "MATCH_IPV4_DEST") {
rule.t |= ZT_NETWORK_RULE_MATCH_IPV4_DEST;
- InetAddress ip(OSUtils::jsonString(r["ip"],"0.0.0.0"));
+ InetAddress ip(OSUtils::jsonString(r["ip"],"0.0.0.0").c_str());
rule.v.ipv4.ip = reinterpret_cast<struct sockaddr_in *>(&ip)->sin_addr.s_addr;
rule.v.ipv4.mask = Utils::ntoh(reinterpret_cast<struct sockaddr_in *>(&ip)->sin_port) & 0xff;
if (rule.v.ipv4.mask > 32) rule.v.ipv4.mask = 32;
return true;
} else if (t == "MATCH_IPV6_SOURCE") {
rule.t |= ZT_NETWORK_RULE_MATCH_IPV6_SOURCE;
- InetAddress ip(OSUtils::jsonString(r["ip"],"::0"));
- memcpy(rule.v.ipv6.ip,reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_addr.s6_addr,16);
+ InetAddress ip(OSUtils::jsonString(r["ip"],"::0").c_str());
+ ZT_FAST_MEMCPY(rule.v.ipv6.ip,reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_addr.s6_addr,16);
rule.v.ipv6.mask = Utils::ntoh(reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_port) & 0xff;
if (rule.v.ipv6.mask > 128) rule.v.ipv6.mask = 128;
return true;
} else if (t == "MATCH_IPV6_DEST") {
rule.t |= ZT_NETWORK_RULE_MATCH_IPV6_DEST;
- InetAddress ip(OSUtils::jsonString(r["ip"],"::0"));
- memcpy(rule.v.ipv6.ip,reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_addr.s6_addr,16);
+ InetAddress ip(OSUtils::jsonString(r["ip"],"::0").c_str());
+ ZT_FAST_MEMCPY(rule.v.ipv6.ip,reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_addr.s6_addr,16);
rule.v.ipv6.mask = Utils::ntoh(reinterpret_cast<struct sockaddr_in6 *>(&ip)->sin6_port) & 0xff;
if (rule.v.ipv6.mask > 128) rule.v.ipv6.mask = 128;
return true;
@@ -418,7 +425,26 @@ static bool _parseRule(json &r,ZT_VirtualNetworkRule &rule)
} else if (t == "MATCH_TAG_RECEIVER") {
rule.t |= ZT_NETWORK_RULE_MATCH_TAG_RECEIVER;
tag = true;
+ } else if (t == "INTEGER_RANGE") {
+ json &s = r["start"];
+ if (s.is_string()) {
+ std::string tmp = s;
+ rule.v.intRange.start = Utils::hexStrToU64(tmp.c_str());
+ } else {
+ rule.v.intRange.start = OSUtils::jsonInt(s,0ULL);
+ }
+ json &e = r["end"];
+ if (e.is_string()) {
+ std::string tmp = e;
+ rule.v.intRange.end = (uint32_t)(Utils::hexStrToU64(tmp.c_str()) - rule.v.intRange.start);
+ } else {
+ rule.v.intRange.end = (uint32_t)(OSUtils::jsonInt(e,0ULL) - rule.v.intRange.start);
+ }
+ rule.v.intRange.idx = (uint16_t)OSUtils::jsonInt(r["idx"],0ULL);
+ rule.v.intRange.format = (OSUtils::jsonBool(r["little"],false)) ? 0x80 : 0x00;
+ rule.v.intRange.format |= (uint8_t)((OSUtils::jsonInt(r["bits"],1ULL) - 1) & 63);
}
+
if (tag) {
rule.v.tag.id = (uint32_t)(OSUtils::jsonInt(r["id"],0ULL) & 0xffffffffULL);
rule.v.tag.value = (uint32_t)(OSUtils::jsonInt(r["value"],0ULL) & 0xffffffffULL);
@@ -428,29 +454,37 @@ static bool _parseRule(json &r,ZT_VirtualNetworkRule &rule)
return false;
}
+} // anonymous namespace
+
EmbeddedNetworkController::EmbeddedNetworkController(Node *node,const char *dbPath) :
_startTime(OSUtils::now()),
- _threadsStarted(false),
- _db(dbPath),
- _node(node)
+ _node(node),
+ _path(dbPath),
+ _sender((NetworkController::Sender *)0)
{
}
EmbeddedNetworkController::~EmbeddedNetworkController()
{
- Mutex::Lock _l(_threads_m);
- if (_threadsStarted) {
- for(int i=0;i<(ZT_EMBEDDEDNETWORKCONTROLLER_BACKGROUND_THREAD_COUNT*2);++i)
- _queue.post((_RQEntry *)0);
- for(int i=0;i<ZT_EMBEDDEDNETWORKCONTROLLER_BACKGROUND_THREAD_COUNT;++i)
- Thread::join(_threads[i]);
- }
+ std::lock_guard<std::mutex> l(_threads_l);
+ _queue.stop();
+ for(auto t=_threads.begin();t!=_threads.end();++t)
+ t->join();
}
void EmbeddedNetworkController::init(const Identity &signingId,Sender *sender)
{
- this->_sender = sender;
- this->_signingId = signingId;
+ char tmp[64];
+ _signingId = signingId;
+ _sender = sender;
+ _signingIdAddressString = signingId.address().toString(tmp);
+#ifdef ZT_CONTROLLER_USE_RETHINKDB
+ if ((_path.length() > 10)&&(_path.substr(0,10) == "rethinkdb:"))
+ _db.reset(new RethinkDB(this,_signingId,_path.c_str()));
+ else // else use FileDB after endif
+#endif
+ _db.reset(new FileDB(this,_signingId,_path.c_str()));
+ _db->waitForReady();
}
void EmbeddedNetworkController::request(
@@ -462,22 +496,14 @@ void EmbeddedNetworkController::request(
{
if (((!_signingId)||(!_signingId.hasPrivate()))||(_signingId.address().toInt() != (nwid >> 24))||(!_sender))
return;
-
- {
- Mutex::Lock _l(_threads_m);
- if (!_threadsStarted) {
- for(int i=0;i<ZT_EMBEDDEDNETWORKCONTROLLER_BACKGROUND_THREAD_COUNT;++i)
- _threads[i] = Thread::start(this);
- }
- _threadsStarted = true;
- }
-
+ _startThreads();
_RQEntry *qe = new _RQEntry;
qe->nwid = nwid;
qe->requestPacketId = requestPacketId;
qe->fromAddr = fromAddr;
qe->identity = identity;
qe->metaData = metaData;
+ qe->type = _RQEntry::RQENTRY_TYPE_REQUEST;
_queue.post(qe);
}
@@ -489,19 +515,15 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpGET(
std::string &responseBody,
std::string &responseContentType)
{
+ if (!_db)
+ return 500;
+
if ((path.size() > 0)&&(path[0] == "network")) {
if ((path.size() >= 2)&&(path[1].length() == 16)) {
const uint64_t nwid = Utils::hexStrToU64(path[1].c_str());
- char nwids[24];
- Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
-
json network;
- {
- Mutex::Lock _l(_db_m);
- network = _db.get("network",nwids);
- }
- if (!network.size())
+ if (!_db->get(nwid,network))
return 404;
if (path.size() >= 3) {
@@ -509,82 +531,72 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpGET(
if (path[2] == "member") {
if (path.size() >= 4) {
- const uint64_t address = Utils::hexStrToU64(path[3].c_str());
+ // Get member
+ const uint64_t address = Utils::hexStrToU64(path[3].c_str());
json member;
- {
- Mutex::Lock _l(_db_m);
- member = _db.get("network",nwids,"member",Address(address).toString());
- }
- if (!member.size())
+ if (!_db->get(nwid,network,address,member))
return 404;
-
- _addMemberNonPersistedFields(member,OSUtils::now());
responseBody = OSUtils::jsonDump(member);
responseContentType = "application/json";
- return 200;
} else {
-
- Mutex::Lock _l(_db_m);
+ // List members and their revisions
responseBody = "{";
- _db.filter((std::string("network/") + nwids + "/member/"),[&responseBody](const std::string &n,const json &member) {
- if ((member.is_object())&&(member.size() > 0)) {
- responseBody.append((responseBody.length() == 1) ? "\"" : ",\"");
- responseBody.append(OSUtils::jsonString(member["id"],"0"));
- responseBody.append("\":");
- responseBody.append(OSUtils::jsonString(member["revision"],"0"));
+ std::vector<json> members;
+ if (_db->get(nwid,network,members)) {
+ responseBody.reserve((members.size() + 2) * 32);
+ std::string mid;
+ for(auto member=members.begin();member!=members.end();++member) {
+ mid = (*member)["id"];
+ char tmp[128];
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%s\"%s\":%llu",(responseBody.length() > 1) ? ",\"" : "\"",mid.c_str(),(unsigned long long)OSUtils::jsonInt((*member)["revision"],0));
+ responseBody.append(tmp);
}
- return true; // never delete
- });
+ }
responseBody.push_back('}');
responseContentType = "application/json";
- return 200;
}
+ return 200;
} // else 404
} else {
+ // Get network
- const uint64_t now = OSUtils::now();
- _NetworkMemberInfo nmi;
- _getNetworkMemberInfo(now,nwid,nmi);
- _addNetworkNonPersistedFields(network,now,nmi);
responseBody = OSUtils::jsonDump(network);
responseContentType = "application/json";
return 200;
}
} else if (path.size() == 1) {
-
- std::set<std::string> networkIds;
- {
- Mutex::Lock _l(_db_m);
- _db.filter("network/",[&networkIds](const std::string &n,const json &obj) {
- if (n.length() == (16 + 8))
- networkIds.insert(n.substr(8));
- return true; // do not delete
- });
- }
-
- responseBody.push_back('[');
- for(std::set<std::string>::iterator i(networkIds.begin());i!=networkIds.end();++i) {
- responseBody.append((responseBody.length() == 1) ? "\"" : ",\"");
- responseBody.append(*i);
- responseBody.append("\"");
+ // List networks
+
+ std::vector<uint64_t> networkIds;
+ _db->networks(networkIds);
+ char tmp[64];
+ responseBody = "[";
+ responseBody.reserve((networkIds.size() + 1) * 24);
+ for(std::vector<uint64_t>::const_iterator i(networkIds.begin());i!=networkIds.end();++i) {
+ if (responseBody.length() > 1)
+ responseBody.push_back(',');
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"\"%.16llx\"",(unsigned long long)*i);
+ responseBody.append(tmp);
}
responseBody.push_back(']');
responseContentType = "application/json";
+
return 200;
} // else 404
} else {
+ // Controller status
char tmp[4096];
- Utils::snprintf(tmp,sizeof(tmp),"{\n\t\"controller\": true,\n\t\"apiVersion\": %d,\n\t\"clock\": %llu\n}\n",ZT_NETCONF_CONTROLLER_API_VERSION,(unsigned long long)OSUtils::now());
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"{\n\t\"controller\": true,\n\t\"apiVersion\": %d,\n\t\"clock\": %llu\n}\n",ZT_NETCONF_CONTROLLER_API_VERSION,(unsigned long long)OSUtils::now());
responseBody = tmp;
responseContentType = "application/json";
return 200;
@@ -602,6 +614,8 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
std::string &responseBody,
std::string &responseContentType)
{
+ if (!_db)
+ return 500;
if (path.empty())
return 404;
@@ -618,58 +632,49 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
responseContentType = "application/json";
return 400;
}
- const uint64_t now = OSUtils::now();
+ const int64_t now = OSUtils::now();
if (path[0] == "network") {
if ((path.size() >= 2)&&(path[1].length() == 16)) {
uint64_t nwid = Utils::hexStrToU64(path[1].c_str());
char nwids[24];
- Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
+ OSUtils::ztsnprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
if (path.size() >= 3) {
if ((path.size() == 4)&&(path[2] == "member")&&(path[3].length() == 10)) {
uint64_t address = Utils::hexStrToU64(path[3].c_str());
char addrs[24];
- Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)address);
+ OSUtils::ztsnprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)address);
- json member;
- {
- Mutex::Lock _l(_db_m);
- member = _db.get("network",nwids,"member",Address(address).toString());
- }
+ json member,network;
+ _db->get(nwid,network,address,member);
json origMember(member); // for detecting changes
- _initMember(member);
+ DB::initMember(member);
try {
if (b.count("activeBridge")) member["activeBridge"] = OSUtils::jsonBool(b["activeBridge"],false);
if (b.count("noAutoAssignIps")) member["noAutoAssignIps"] = OSUtils::jsonBool(b["noAutoAssignIps"],false);
+ if (b.count("remoteTraceTarget")) {
+ const std::string rtt(OSUtils::jsonString(b["remoteTraceTarget"],""));
+ if (rtt.length() == 10) {
+ member["remoteTraceTarget"] = rtt;
+ } else {
+ member["remoteTraceTarget"] = json();
+ }
+ }
+ if (b.count("remoteTraceLevel")) member["remoteTraceLevel"] = OSUtils::jsonInt(b["remoteTraceLevel"],0ULL);
+
if (b.count("authorized")) {
const bool newAuth = OSUtils::jsonBool(b["authorized"],false);
if (newAuth != OSUtils::jsonBool(member["authorized"],false)) {
member["authorized"] = newAuth;
member[((newAuth) ? "lastAuthorizedTime" : "lastDeauthorizedTime")] = now;
-
- json ah;
- ah["a"] = newAuth;
- ah["by"] = "api";
- ah["ts"] = now;
- ah["ct"] = json();
- ah["c"] = json();
- member["authHistory"].push_back(ah);
-
- // Member is being de-authorized, so spray Revocation objects to all online members
- if (!newAuth) {
- _clearNetworkMemberInfoCache(nwid);
- Revocation rev((uint32_t)_node->prng(),nwid,0,now,ZT_REVOCATION_FLAG_FAST_PROPAGATE,Address(address),Revocation::CREDENTIAL_TYPE_COM);
- rev.sign(_signingId);
- Mutex::Lock _l(_lastRequestTime_m);
- for(std::map< std::pair<uint64_t,uint64_t>,uint64_t >::iterator i(_lastRequestTime.begin());i!=_lastRequestTime.end();++i) {
- if ((now - i->second) < ZT_NETWORK_AUTOCONF_DELAY)
- _node->ncSendRevocation(Address(i->first.first),rev);
- }
+ if (newAuth) {
+ member["lastAuthorizedCredentialType"] = "api";
+ member["lastAuthorizedCredential"] = json();
}
}
}
@@ -680,9 +685,12 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
json mipa(json::array());
for(unsigned long i=0;i<ipa.size();++i) {
std::string ips = ipa[i];
- InetAddress ip(ips);
+ InetAddress ip(ips.c_str());
if ((ip.ss_family == AF_INET)||(ip.ss_family == AF_INET6)) {
- mipa.push_back(ip.toIpString());
+ char tmpip[64];
+ mipa.push_back(ip.toIpString(tmpip));
+ if (mipa.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
}
}
member["ipAssignments"] = mipa;
@@ -704,6 +712,8 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
ta.push_back(t->first);
ta.push_back(t->second);
mtagsa.push_back(ta);
+ if (mtagsa.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
}
member["tags"] = mtagsa;
}
@@ -715,6 +725,8 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
json mcaps = json::array();
for(unsigned long i=0;i<capabilities.size();++i) {
mcaps.push_back(OSUtils::jsonInt(capabilities[i],0ULL));
+ if (mcaps.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
}
std::sort(mcaps.begin(),mcaps.end());
mcaps.erase(std::unique(mcaps.begin(),mcaps.end()),mcaps.end());
@@ -731,115 +743,57 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
member["address"] = addrs; // legacy
member["nwid"] = nwids;
- if (member != origMember) {
- member["lastModified"] = now;
- json &revj = member["revision"];
- member["revision"] = (revj.is_number() ? ((uint64_t)revj + 1ULL) : 1ULL);
- {
- Mutex::Lock _l(_db_m);
- _db.put("network",nwids,"member",Address(address).toString(),member);
- }
- _pushMemberUpdate(now,nwid,member);
- }
-
- // Add non-persisted fields
- member["clock"] = now;
-
+ DB::cleanMember(member);
+ _db->save(&origMember,member);
responseBody = OSUtils::jsonDump(member);
responseContentType = "application/json";
- return 200;
- } else if ((path.size() == 3)&&(path[2] == "test")) {
-
- Mutex::Lock _l(_tests_m);
-
- _tests.push_back(ZT_CircuitTest());
- ZT_CircuitTest *const test = &(_tests.back());
- memset(test,0,sizeof(ZT_CircuitTest));
-
- Utils::getSecureRandom(&(test->testId),sizeof(test->testId));
- test->credentialNetworkId = nwid;
- test->ptr = (void *)this;
- json hops = b["hops"];
- if (hops.is_array()) {
- for(unsigned long i=0;i<hops.size();++i) {
- json &hops2 = hops[i];
- if (hops2.is_array()) {
- for(unsigned long j=0;j<hops2.size();++j) {
- std::string s = hops2[j];
- test->hops[test->hopCount].addresses[test->hops[test->hopCount].breadth++] = Utils::hexStrToU64(s.c_str()) & 0xffffffffffULL;
- }
- ++test->hopCount;
- } else if (hops2.is_string()) {
- std::string s = hops2;
- test->hops[test->hopCount].addresses[test->hops[test->hopCount].breadth++] = Utils::hexStrToU64(s.c_str()) & 0xffffffffffULL;
- ++test->hopCount;
- }
- }
- }
- test->reportAtEveryHop = (OSUtils::jsonBool(b["reportAtEveryHop"],true) ? 1 : 0);
-
- if (!test->hopCount) {
- _tests.pop_back();
- responseBody = "{ \"message\": \"a test must contain at least one hop\" }";
- responseContentType = "application/json";
- return 400;
- }
-
- test->timestamp = OSUtils::now();
-
- if (_node) {
- _node->circuitTestBegin((void *)0,test,&(EmbeddedNetworkController::_circuitTestCallback));
- } else {
- _tests.pop_back();
- return 500;
- }
-
- char json[512];
- Utils::snprintf(json,sizeof(json),"{\"testId\":\"%.16llx\",\"timestamp\":%llu}",test->testId,test->timestamp);
- responseBody = json;
- responseContentType = "application/json";
return 200;
-
} // else 404
} else {
// POST to network ID
- json network;
- {
- Mutex::Lock _l(_db_m);
-
- // Magic ID ending with ______ picks a random unused network ID
- if (path[1].substr(10) == "______") {
- nwid = 0;
- uint64_t nwidPrefix = (Utils::hexStrToU64(path[1].substr(0,10).c_str()) << 24) & 0xffffffffff000000ULL;
- uint64_t nwidPostfix = 0;
- for(unsigned long k=0;k<100000;++k) { // sanity limit on trials
- Utils::getSecureRandom(&nwidPostfix,sizeof(nwidPostfix));
- uint64_t tryNwid = nwidPrefix | (nwidPostfix & 0xffffffULL);
- if ((tryNwid & 0xffffffULL) == 0ULL) tryNwid |= 1ULL;
- Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)tryNwid);
- if (_db.get("network",nwids).size() <= 0) {
- nwid = tryNwid;
- break;
- }
+ // Magic ID ending with ______ picks a random unused network ID
+ if (path[1].substr(10) == "______") {
+ nwid = 0;
+ uint64_t nwidPrefix = (Utils::hexStrToU64(path[1].substr(0,10).c_str()) << 24) & 0xffffffffff000000ULL;
+ uint64_t nwidPostfix = 0;
+ for(unsigned long k=0;k<100000;++k) { // sanity limit on trials
+ Utils::getSecureRandom(&nwidPostfix,sizeof(nwidPostfix));
+ uint64_t tryNwid = nwidPrefix | (nwidPostfix & 0xffffffULL);
+ if ((tryNwid & 0xffffffULL) == 0ULL) tryNwid |= 1ULL;
+ if (!_db->hasNetwork(tryNwid)) {
+ nwid = tryNwid;
+ break;
}
- if (!nwid)
- return 503;
}
-
- network = _db.get("network",nwids);
+ if (!nwid)
+ return 503;
}
+ OSUtils::ztsnprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
+
+ json network;
+ _db->get(nwid,network);
json origNetwork(network); // for detecting changes
- _initNetwork(network);
+ DB::initNetwork(network);
try {
if (b.count("name")) network["name"] = OSUtils::jsonString(b["name"],"");
if (b.count("private")) network["private"] = OSUtils::jsonBool(b["private"],true);
if (b.count("enableBroadcast")) network["enableBroadcast"] = OSUtils::jsonBool(b["enableBroadcast"],false);
- if (b.count("allowPassiveBridging")) network["allowPassiveBridging"] = OSUtils::jsonBool(b["allowPassiveBridging"],false);
if (b.count("multicastLimit")) network["multicastLimit"] = OSUtils::jsonInt(b["multicastLimit"],32ULL);
+ if (b.count("mtu")) network["mtu"] = std::max(std::min((unsigned int)OSUtils::jsonInt(b["mtu"],ZT_DEFAULT_MTU),(unsigned int)ZT_MAX_MTU),(unsigned int)ZT_MIN_MTU);
+
+ if (b.count("remoteTraceTarget")) {
+ const std::string rtt(OSUtils::jsonString(b["remoteTraceTarget"],""));
+ if (rtt.length() == 10) {
+ network["remoteTraceTarget"] = rtt;
+ } else {
+ network["remoteTraceTarget"] = json();
+ }
+ }
+ if (b.count("remoteTraceLevel")) network["remoteTraceLevel"] = OSUtils::jsonInt(b["remoteTraceLevel"],0ULL);
if (b.count("v4AssignMode")) {
json nv4m;
@@ -893,16 +847,19 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
json &target = rt["target"];
json &via = rt["via"];
if (target.is_string()) {
- InetAddress t(target.get<std::string>());
+ InetAddress t(target.get<std::string>().c_str());
InetAddress v;
- if (via.is_string()) v.fromString(via.get<std::string>());
+ if (via.is_string()) v.fromString(via.get<std::string>().c_str());
if ( ((t.ss_family == AF_INET)||(t.ss_family == AF_INET6)) && (t.netmaskBitsValid()) ) {
json tmp;
- tmp["target"] = t.toString();
+ char tmp2[64];
+ tmp["target"] = t.toString(tmp2);
if (v.ss_family == t.ss_family)
- tmp["via"] = v.toIpString();
+ tmp["via"] = v.toIpString(tmp2);
else tmp["via"] = json();
nrts.push_back(tmp);
+ if (nrts.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
}
}
}
@@ -918,13 +875,16 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
for(unsigned long i=0;i<ipp.size();++i) {
json &ip = ipp[i];
if ((ip.is_object())&&(ip.count("ipRangeStart"))&&(ip.count("ipRangeEnd"))) {
- InetAddress f(OSUtils::jsonString(ip["ipRangeStart"],""));
- InetAddress t(OSUtils::jsonString(ip["ipRangeEnd"],""));
+ InetAddress f(OSUtils::jsonString(ip["ipRangeStart"],"").c_str());
+ InetAddress t(OSUtils::jsonString(ip["ipRangeEnd"],"").c_str());
if ( ((f.ss_family == AF_INET)||(f.ss_family == AF_INET6)) && (f.ss_family == t.ss_family) ) {
json tmp = json::object();
- tmp["ipRangeStart"] = f.toIpString();
- tmp["ipRangeEnd"] = t.toIpString();
+ char tmp2[64];
+ tmp["ipRangeStart"] = f.toIpString(tmp2);
+ tmp["ipRangeEnd"] = t.toIpString(tmp2);
nipp.push_back(tmp);
+ if (nipp.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
}
}
}
@@ -940,8 +900,11 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
json &rule = rules[i];
if (rule.is_object()) {
ZT_VirtualNetworkRule ztr;
- if (_parseRule(rule,ztr))
+ if (_parseRule(rule,ztr)) {
nrules.push_back(_renderRule(ztr));
+ if (nrules.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
+ }
}
}
network["rules"] = nrules;
@@ -950,22 +913,15 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
if (b.count("authTokens")) {
json &authTokens = b["authTokens"];
- if (authTokens.is_array()) {
- json nat = json::array();
- for(unsigned long i=0;i<authTokens.size();++i) {
- json &token = authTokens[i];
- if (token.is_object()) {
- std::string tstr = token["token"];
- if (tstr.length() > 0) {
- json t = json::object();
- t["token"] = tstr;
- t["expires"] = OSUtils::jsonInt(token["expires"],0ULL);
- t["maxUsesPerMember"] = OSUtils::jsonInt(token["maxUsesPerMember"],0ULL);
- nat.push_back(t);
- }
- }
+ if (authTokens.is_object()) {
+ json nat;
+ for(json::iterator t(authTokens.begin());t!=authTokens.end();++t) {
+ if ((t.value().is_number())&&(t.value() >= 0))
+ nat[t.key()] = t.value();
}
network["authTokens"] = nat;
+ } else {
+ network["authTokens"] = {{}};
}
}
@@ -988,8 +944,11 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
json &rule = rules[i];
if (rule.is_object()) {
ZT_VirtualNetworkRule ztr;
- if (_parseRule(rule,ztr))
+ if (_parseRule(rule,ztr)) {
nrules.push_back(_renderRule(ztr));
+ if (nrules.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
+ }
}
}
}
@@ -1000,8 +959,11 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
}
json ncapsa = json::array();
- for(std::map< uint64_t,json >::iterator c(ncaps.begin());c!=ncaps.end();++c)
+ for(std::map< uint64_t,json >::iterator c(ncaps.begin());c!=ncaps.end();++c) {
ncapsa.push_back(c->second);
+ if (ncapsa.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
+ }
network["capabilities"] = ncapsa;
}
}
@@ -1025,8 +987,11 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
}
json ntagsa = json::array();
- for(std::map< uint64_t,json >::iterator t(ntags.begin());t!=ntags.end();++t)
+ for(std::map< uint64_t,json >::iterator t(ntags.begin());t!=ntags.end();++t) {
ntagsa.push_back(t->second);
+ if (ntagsa.size() >= ZT_CONTROLLER_MAX_ARRAY_SIZE)
+ break;
+ }
network["tags"] = ntagsa;
}
}
@@ -1040,25 +1005,8 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
network["id"] = nwids;
network["nwid"] = nwids; // legacy
- if (network != origNetwork) {
- json &revj = network["revision"];
- network["revision"] = (revj.is_number() ? ((uint64_t)revj + 1ULL) : 1ULL);
- network["lastModified"] = now;
- {
- Mutex::Lock _l(_db_m);
- _db.put("network",nwids,network);
- }
-
- // Send an update to all members of the network
- _db.filter((std::string("network/") + nwids + "/member/"),[this,&now,&nwid](const std::string &n,const json &obj) {
- _pushMemberUpdate(now,nwid,obj);
- return true; // do not delete
- });
- }
-
- _NetworkMemberInfo nmi;
- _getNetworkMemberInfo(now,nwid,nmi);
- _addNetworkNonPersistedFields(network,now,nmi);
+ DB::cleanNetwork(network);
+ _db->save(&origNetwork,network);
responseBody = OSUtils::jsonDump(network);
responseContentType = "application/json";
@@ -1067,18 +1015,6 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
} // else 404
- } else if (path[0] == "ping") {
-
- json testRec;
- const uint64_t now = OSUtils::now();
- testRec["clock"] = now;
- testRec["uptime"] = (now - _startTime);
- testRec["content"] = b;
- responseBody = OSUtils::jsonDump(testRec);
- _db.writeRaw("pong",responseBody);
- responseContentType = "application/json";
- return 200;
-
}
return 404;
@@ -1092,31 +1028,25 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpDELETE(
std::string &responseBody,
std::string &responseContentType)
{
+ if (!_db)
+ return 500;
if (path.empty())
return 404;
if (path[0] == "network") {
if ((path.size() >= 2)&&(path[1].length() == 16)) {
const uint64_t nwid = Utils::hexStrToU64(path[1].c_str());
-
- char nwids[24];
- Utils::snprintf(nwids,sizeof(nwids),"%.16llx",nwid);
- json network;
- {
- Mutex::Lock _l(_db_m);
- network = _db.get("network",nwids);
- }
- if (!network.size())
- return 404;
-
if (path.size() >= 3) {
if ((path.size() == 4)&&(path[2] == "member")&&(path[3].length() == 10)) {
const uint64_t address = Utils::hexStrToU64(path[3].c_str());
- Mutex::Lock _l(_db_m);
+ json network,member;
+ _db->get(nwid,network,address,member);
- json member = _db.get("network",nwids,"member",Address(address).toString());
- _db.erase("network",nwids,"member",Address(address).toString());
+ {
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ _memberStatus.erase(_MemberStatusKey(nwid,address));
+ }
if (!member.size())
return 404;
@@ -1125,17 +1055,21 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpDELETE(
return 200;
}
} else {
- Mutex::Lock _l(_db_m);
-
- std::string pfx("network/");
- pfx.append(nwids);
- _db.filter(pfx,[](const std::string &n,const json &obj) {
- return false; // delete
- });
+ json network;
+ _db->get(nwid,network);
+ _db->eraseNetwork(nwid);
- Mutex::Lock _l2(_nmiCache_m);
- _nmiCache.erase(nwid);
+ {
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ for(auto i=_memberStatus.begin();i!=_memberStatus.end();) {
+ if (i->first.networkId == nwid)
+ _memberStatus.erase(i++);
+ else ++i;
+ }
+ }
+ if (!network.size())
+ return 404;
responseBody = OSUtils::jsonDump(network);
responseContentType = "application/json";
return 200;
@@ -1147,87 +1081,93 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpDELETE(
return 404;
}
-void EmbeddedNetworkController::threadMain()
- throw()
+void EmbeddedNetworkController::handleRemoteTrace(const ZT_RemoteTrace &rt)
{
- uint64_t lastCircuitTestCheck = 0;
- for(;;) {
- _RQEntry *const qe = _queue.get(); // waits on next request
- if (!qe) break; // enqueue a NULL to terminate threads
- try {
- _request(qe->nwid,qe->fromAddr,qe->requestPacketId,qe->identity,qe->metaData);
- } catch ( ... ) {}
- delete qe;
-
- uint64_t now = OSUtils::now();
- if ((now - lastCircuitTestCheck) > ZT_EMBEDDEDNETWORKCONTROLLER_CIRCUIT_TEST_EXPIRATION) {
- lastCircuitTestCheck = now;
- Mutex::Lock _l(_tests_m);
- for(std::list< ZT_CircuitTest >::iterator i(_tests.begin());i!=_tests.end();) {
- if ((now - i->timestamp) > ZT_EMBEDDEDNETWORKCONTROLLER_CIRCUIT_TEST_EXPIRATION) {
- _node->circuitTestEnd(&(*i));
- _tests.erase(i++);
- } else ++i;
+ static volatile unsigned long idCounter = 0;
+ char id[128],tmp[128];
+ std::string k,v;
+
+ if (!_db)
+ return;
+
+ try {
+ // Convert Dictionary into JSON object
+ json d;
+ char *saveptr = (char *)0;
+ for(char *l=Utils::stok(rt.data,"\n",&saveptr);(l);l=Utils::stok((char *)0,"\n",&saveptr)) {
+ char *eq = strchr(l,'=');
+ if (eq > l) {
+ k.assign(l,(unsigned long)(eq - l));
+ v.clear();
+ ++eq;
+ while (*eq) {
+ if (*eq == '\\') {
+ ++eq;
+ if (*eq) {
+ switch(*eq) {
+ case 'r': v.push_back('\r'); break;
+ case 'n': v.push_back('\n'); break;
+ case '0': v.push_back((char)0); break;
+ case 'e': v.push_back('='); break;
+ default: v.push_back(*eq); break;
+ }
+ ++eq;
+ }
+ } else {
+ v.push_back(*(eq++));
+ }
+ }
+ if ((k.length() > 0)&&(v.length() > 0))
+ d[k] = v;
}
}
+
+ const int64_t now = OSUtils::now();
+ OSUtils::ztsnprintf(id,sizeof(id),"%.10llx-%.16llx-%.10llx-%.4x",_signingId.address().toInt(),now,rt.origin,(unsigned int)(idCounter++ & 0xffff));
+ d["id"] = id;
+ d["objtype"] = "trace";
+ d["ts"] = now;
+ d["nodeId"] = Utils::hex10(rt.origin,tmp);
+ _db->save((nlohmann::json *)0,d);
+ } catch ( ... ) {
+ // drop invalid trace messages if an error occurs
+ }
+}
+
+void EmbeddedNetworkController::onNetworkUpdate(const uint64_t networkId)
+{
+ // Send an update to all members of the network that are online
+ const int64_t now = OSUtils::now();
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ for(auto i=_memberStatus.begin();i!=_memberStatus.end();++i) {
+ if ((i->first.networkId == networkId)&&(i->second.online(now))&&(i->second.lastRequestMetaData))
+ request(networkId,InetAddress(),0,i->second.identity,i->second.lastRequestMetaData);
}
}
-void EmbeddedNetworkController::_circuitTestCallback(ZT_Node *node,ZT_CircuitTest *test,const ZT_CircuitTestReport *report)
+void EmbeddedNetworkController::onNetworkMemberUpdate(const uint64_t networkId,const uint64_t memberId)
{
- char tmp[1024],id[128];
- EmbeddedNetworkController *const self = reinterpret_cast<EmbeddedNetworkController *>(test->ptr);
-
- if ((!test)||(!report)||(!test->credentialNetworkId)) return; // sanity check
-
- const uint64_t now = OSUtils::now();
- Utils::snprintf(id,sizeof(id),"network/%.16llx/test/%.16llx-%.16llx-%.10llx-%.10llx",test->credentialNetworkId,test->testId,now,report->upstream,report->current);
- Utils::snprintf(tmp,sizeof(tmp),
- "{\"id\": \"%s\","
- "\"timestamp\": %llu,"
- "\"networkId\": \"%.16llx\","
- "\"testId\": \"%.16llx\","
- "\"upstream\": \"%.10llx\","
- "\"current\": \"%.10llx\","
- "\"receivedTimestamp\": %llu,"
- "\"sourcePacketId\": \"%.16llx\","
- "\"flags\": %llu,"
- "\"sourcePacketHopCount\": %u,"
- "\"errorCode\": %u,"
- "\"vendor\": %d,"
- "\"protocolVersion\": %u,"
- "\"majorVersion\": %u,"
- "\"minorVersion\": %u,"
- "\"revision\": %u,"
- "\"platform\": %d,"
- "\"architecture\": %d,"
- "\"receivedOnLocalAddress\": \"%s\","
- "\"receivedFromRemoteAddress\": \"%s\","
- "\"receivedFromLinkQuality\": %f}",
- id + 30, // last bit only, not leading path
- (unsigned long long)test->timestamp,
- (unsigned long long)test->credentialNetworkId,
- (unsigned long long)test->testId,
- (unsigned long long)report->upstream,
- (unsigned long long)report->current,
- (unsigned long long)now,
- (unsigned long long)report->sourcePacketId,
- (unsigned long long)report->flags,
- report->sourcePacketHopCount,
- report->errorCode,
- (int)report->vendor,
- report->protocolVersion,
- report->majorVersion,
- report->minorVersion,
- report->revision,
- (int)report->platform,
- (int)report->architecture,
- reinterpret_cast<const InetAddress *>(&(report->receivedOnLocalAddress))->toString().c_str(),
- reinterpret_cast<const InetAddress *>(&(report->receivedFromRemoteAddress))->toString().c_str(),
- ((double)report->receivedFromLinkQuality / (double)ZT_PATH_LINK_QUALITY_MAX));
-
- Mutex::Lock _l(self->_db_m);
- self->_db.writeRaw(id,std::string(tmp));
+ // Push update to member if online
+ try {
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ _MemberStatus &ms = _memberStatus[_MemberStatusKey(networkId,memberId)];
+ if ((ms.online(OSUtils::now()))&&(ms.lastRequestMetaData))
+ request(networkId,InetAddress(),0,ms.identity,ms.lastRequestMetaData);
+ } catch ( ... ) {}
+}
+
+void EmbeddedNetworkController::onNetworkMemberDeauthorize(const uint64_t networkId,const uint64_t memberId)
+{
+ const int64_t now = OSUtils::now();
+ Revocation rev((uint32_t)_node->prng(),networkId,0,now,ZT_REVOCATION_FLAG_FAST_PROPAGATE,Address(memberId),Revocation::CREDENTIAL_TYPE_COM);
+ rev.sign(_signingId);
+ {
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ for(auto i=_memberStatus.begin();i!=_memberStatus.end();++i) {
+ if ((i->first.networkId == networkId)&&(i->second.online(now)))
+ _node->ncSendRevocation(Address(i->first.nodeId),rev);
+ }
+ }
}
void EmbeddedNetworkController::_request(
@@ -1237,41 +1177,40 @@ void EmbeddedNetworkController::_request(
const Identity &identity,
const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData)
{
+ char nwids[24];
+ DB::NetworkSummaryInfo ns;
+ json network,member,origMember;
+
+ if (!_db)
+ return;
+
if (((!_signingId)||(!_signingId.hasPrivate()))||(_signingId.address().toInt() != (nwid >> 24))||(!_sender))
return;
- const uint64_t now = OSUtils::now();
+ const int64_t now = OSUtils::now();
if (requestPacketId) {
- Mutex::Lock _l(_lastRequestTime_m);
- uint64_t &lrt = _lastRequestTime[std::pair<uint64_t,uint64_t>(identity.address().toInt(),nwid)];
- if ((now - lrt) <= ZT_NETCONF_MIN_REQUEST_PERIOD)
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ _MemberStatus &ms = _memberStatus[_MemberStatusKey(nwid,identity.address().toInt())];
+ if ((now - ms.lastRequestTime) <= ZT_NETCONF_MIN_REQUEST_PERIOD)
return;
- lrt = now;
+ ms.lastRequestTime = now;
}
- char nwids[24];
- Utils::snprintf(nwids,sizeof(nwids),"%.16llx",nwid);
- json network;
- json member;
- {
- Mutex::Lock _l(_db_m);
- network = _db.get("network",nwids);
- member = _db.get("network",nwids,"member",identity.address().toString());
- }
+ _db->nodeIsOnline(nwid,identity.address().toInt(),fromAddr);
- if (!network.size()) {
+ Utils::hex(nwid,nwids);
+ _db->get(nwid,network,identity.address().toInt(),member,ns);
+ if ((!network.is_object())||(network.size() == 0)) {
_sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_OBJECT_NOT_FOUND);
return;
}
-
- const bool newMember = (member.size() == 0);
-
- json origMember(member); // for detecting modification later
- _initMember(member);
+ origMember = member;
+ const bool newMember = ((!member.is_object())||(member.size() == 0));
+ DB::initMember(member);
{
- std::string haveIdStr(OSUtils::jsonString(member["identity"],""));
+ const std::string haveIdStr(OSUtils::jsonString(member["identity"],""));
if (haveIdStr.length() > 0) {
// If we already know this member's identity perform a full compare. This prevents
// a "collision" from being able to auth onto our network in place of an already
@@ -1287,66 +1226,44 @@ void EmbeddedNetworkController::_request(
}
} else {
// If we do not yet know this member's identity, learn it.
- member["identity"] = identity.toString(false);
+ char idtmp[1024];
+ member["identity"] = identity.toString(false,idtmp);
}
}
// These are always the same, but make sure they are set
- member["id"] = identity.address().toString();
- member["address"] = member["id"];
- member["nwid"] = nwids;
+ {
+ char tmpid[128];
+ const std::string addrs(identity.address().toString(tmpid));
+ member["id"] = addrs;
+ member["address"] = addrs;
+ member["nwid"] = nwids;
+ }
// Determine whether and how member is authorized
- const char *authorizedBy = (const char *)0;
+ bool authorized = false;
bool autoAuthorized = false;
json autoAuthCredentialType,autoAuthCredential;
if (OSUtils::jsonBool(member["authorized"],false)) {
- authorizedBy = "memberIsAuthorized";
+ authorized = true;
} else if (!OSUtils::jsonBool(network["private"],true)) {
- authorizedBy = "networkIsPublic";
- json &ahist = member["authHistory"];
- if ((!ahist.is_array())||(ahist.size() == 0))
- autoAuthorized = true;
+ authorized = true;
+ autoAuthorized = true;
+ autoAuthCredentialType = "public";
} else {
char presentedAuth[512];
if (metaData.get(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_AUTH,presentedAuth,sizeof(presentedAuth)) > 0) {
presentedAuth[511] = (char)0; // sanity check
-
- // Check for bearer token presented by member
if ((strlen(presentedAuth) > 6)&&(!strncmp(presentedAuth,"token:",6))) {
const char *const presentedToken = presentedAuth + 6;
-
- json &authTokens = network["authTokens"];
- if (authTokens.is_array()) {
- for(unsigned long i=0;i<authTokens.size();++i) {
- json &token = authTokens[i];
- if (token.is_object()) {
- const uint64_t expires = OSUtils::jsonInt(token["expires"],0ULL);
- const uint64_t maxUses = OSUtils::jsonInt(token["maxUsesPerMember"],0ULL);
- std::string tstr = OSUtils::jsonString(token["token"],"");
-
- if (((expires == 0ULL)||(expires > now))&&(tstr == presentedToken)) {
- bool usable = (maxUses == 0);
- if (!usable) {
- uint64_t useCount = 0;
- json &ahist = member["authHistory"];
- if (ahist.is_array()) {
- for(unsigned long j=0;j<ahist.size();++j) {
- json &ah = ahist[j];
- if ((OSUtils::jsonString(ah["ct"],"") == "token")&&(OSUtils::jsonString(ah["c"],"") == tstr)&&(OSUtils::jsonBool(ah["a"],false)))
- ++useCount;
- }
- }
- usable = (useCount < maxUses);
- }
- if (usable) {
- authorizedBy = "token";
- autoAuthorized = true;
- autoAuthCredentialType = "token";
- autoAuthCredential = tstr;
- }
- }
- }
+ json authTokens(network["authTokens"]);
+ json &tokenExpires = authTokens[presentedToken];
+ if (tokenExpires.is_number()) {
+ if ((tokenExpires == 0)||(tokenExpires > now)) {
+ authorized = true;
+ autoAuthorized = true;
+ autoAuthCredentialType = "token";
+ autoAuthCredential = presentedToken;
}
}
}
@@ -1354,58 +1271,42 @@ void EmbeddedNetworkController::_request(
}
// If we auto-authorized, update member record
- if ((autoAuthorized)&&(authorizedBy)) {
+ if ((autoAuthorized)&&(authorized)) {
member["authorized"] = true;
member["lastAuthorizedTime"] = now;
-
- json ah;
- ah["a"] = true;
- ah["by"] = authorizedBy;
- ah["ts"] = now;
- ah["ct"] = autoAuthCredentialType;
- ah["c"] = autoAuthCredential;
- member["authHistory"].push_back(ah);
-
- json &revj = member["revision"];
- member["revision"] = (revj.is_number() ? ((uint64_t)revj + 1ULL) : 1ULL);
+ member["lastAuthorizedCredentialType"] = autoAuthCredentialType;
+ member["lastAuthorizedCredential"] = autoAuthCredential;
}
- // Log this request
- if (requestPacketId) { // only log if this is a request, not for generated pushes
- json rlEntry = json::object();
- rlEntry["ts"] = now;
- rlEntry["auth"] = (authorizedBy) ? true : false;
- rlEntry["authBy"] = (authorizedBy) ? authorizedBy : "";
- rlEntry["vMajor"] = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION,0);
- rlEntry["vMinor"] = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION,0);
- rlEntry["vRev"] = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION,0);
- rlEntry["vProto"] = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION,0);
- if (fromAddr)
- rlEntry["fromAddr"] = fromAddr.toString();
-
- json recentLog = json::array();
- recentLog.push_back(rlEntry);
- json &oldLog = member["recentLog"];
- if (oldLog.is_array()) {
- for(unsigned long i=0;i<oldLog.size();++i) {
- recentLog.push_back(oldLog[i]);
- if (recentLog.size() >= ZT_NETCONF_DB_MEMBER_HISTORY_LENGTH)
- break;
- }
- }
- member["recentLog"] = recentLog;
+ if (authorized) {
+ // Update version info and meta-data if authorized and if this is a genuine request
+ if (requestPacketId) {
+ const uint64_t vMajor = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION,0);
+ const uint64_t vMinor = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION,0);
+ const uint64_t vRev = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION,0);
+ const uint64_t vProto = metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION,0);
- // Also only do this on real requests
- member["lastRequestMetaData"] = metaData.data();
- }
+ member["vMajor"] = vMajor;
+ member["vMinor"] = vMinor;
+ member["vRev"] = vRev;
+ member["vProto"] = vProto;
- // If they are not authorized, STOP!
- if (!authorizedBy) {
- if (origMember != member) {
- member["lastModified"] = now;
- Mutex::Lock _l(_db_m);
- _db.put("network",nwids,"member",identity.address().toString(),member);
+ {
+ std::lock_guard<std::mutex> l(_memberStatus_l);
+ _MemberStatus &ms = _memberStatus[_MemberStatusKey(nwid,identity.address().toInt())];
+
+ ms.vMajor = (int)vMajor;
+ ms.vMinor = (int)vMinor;
+ ms.vRev = (int)vRev;
+ ms.vProto = (int)vProto;
+ ms.lastRequestMetaData = metaData;
+ ms.identity = identity;
+ }
}
+ } else {
+ // If they are not authorized, STOP!
+ DB::cleanMember(member);
+ _db->save(&origMember,member);
_sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_ACCESS_DENIED);
return;
}
@@ -1414,16 +1315,12 @@ void EmbeddedNetworkController::_request(
// If we made it this far, they are authorized.
// -------------------------------------------------------------------------
- NetworkConfig nc;
- _NetworkMemberInfo nmi;
- _getNetworkMemberInfo(now,nwid,nmi);
-
- uint64_t credentialtmd = ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MAX_MAX_DELTA;
- if (now > nmi.mostRecentDeauthTime) {
+ int64_t credentialtmd = ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MAX_MAX_DELTA;
+ if (now > ns.mostRecentDeauthTime) {
// If we recently de-authorized a member, shrink credential TTL/max delta to
// be below the threshold required to exclude it. Cap this to a min/max to
// prevent jitter or absurdly large values.
- const uint64_t deauthWindow = now - nmi.mostRecentDeauthTime;
+ const uint64_t deauthWindow = now - ns.mostRecentDeauthTime;
if (deauthWindow < ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MIN_MAX_DELTA) {
credentialtmd = ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MIN_MAX_DELTA;
} else if (deauthWindow < (ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MAX_MAX_DELTA + 5000ULL)) {
@@ -1431,21 +1328,36 @@ void EmbeddedNetworkController::_request(
}
}
- nc.networkId = nwid;
- nc.type = OSUtils::jsonBool(network["private"],true) ? ZT_NETWORK_TYPE_PRIVATE : ZT_NETWORK_TYPE_PUBLIC;
- nc.timestamp = now;
- nc.credentialTimeMaxDelta = credentialtmd;
- nc.revision = OSUtils::jsonInt(network["revision"],0ULL);
- nc.issuedTo = identity.address();
- if (OSUtils::jsonBool(network["enableBroadcast"],true)) nc.flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST;
- if (OSUtils::jsonBool(network["allowPassiveBridging"],false)) nc.flags |= ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING;
- Utils::scopy(nc.name,sizeof(nc.name),OSUtils::jsonString(network["name"],"").c_str());
- nc.multicastLimit = (unsigned int)OSUtils::jsonInt(network["multicastLimit"],32ULL);
-
- for(std::set<Address>::const_iterator ab(nmi.activeBridges.begin());ab!=nmi.activeBridges.end();++ab) {
- nc.addSpecialist(*ab,ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE);
+ std::unique_ptr<NetworkConfig> nc(new NetworkConfig());
+
+ nc->networkId = nwid;
+ nc->type = OSUtils::jsonBool(network["private"],true) ? ZT_NETWORK_TYPE_PRIVATE : ZT_NETWORK_TYPE_PUBLIC;
+ nc->timestamp = now;
+ nc->credentialTimeMaxDelta = credentialtmd;
+ nc->revision = OSUtils::jsonInt(network["revision"],0ULL);
+ nc->issuedTo = identity.address();
+ if (OSUtils::jsonBool(network["enableBroadcast"],true)) nc->flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST;
+ Utils::scopy(nc->name,sizeof(nc->name),OSUtils::jsonString(network["name"],"").c_str());
+ nc->mtu = std::max(std::min((unsigned int)OSUtils::jsonInt(network["mtu"],ZT_DEFAULT_MTU),(unsigned int)ZT_MAX_MTU),(unsigned int)ZT_MIN_MTU);
+ nc->multicastLimit = (unsigned int)OSUtils::jsonInt(network["multicastLimit"],32ULL);
+
+ std::string rtt(OSUtils::jsonString(member["remoteTraceTarget"],""));
+ if (rtt.length() == 10) {
+ nc->remoteTraceTarget = Address(Utils::hexStrToU64(rtt.c_str()));
+ nc->remoteTraceLevel = (Trace::Level)OSUtils::jsonInt(member["remoteTraceLevel"],0ULL);
+ } else {
+ rtt = OSUtils::jsonString(network["remoteTraceTarget"],"");
+ if (rtt.length() == 10) {
+ nc->remoteTraceTarget = Address(Utils::hexStrToU64(rtt.c_str()));
+ } else {
+ nc->remoteTraceTarget.zero();
+ }
+ nc->remoteTraceLevel = (Trace::Level)OSUtils::jsonInt(network["remoteTraceLevel"],0ULL);
}
+ for(std::vector<Address>::const_iterator ab(ns.activeBridges.begin());ab!=ns.activeBridges.end();++ab)
+ nc->addSpecialist(*ab,ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE);
+
json &v4AssignMode = network["v4AssignMode"];
json &v6AssignMode = network["v6AssignMode"];
json &ipAssignmentPools = network["ipAssignmentPools"];
@@ -1460,15 +1372,15 @@ void EmbeddedNetworkController::_request(
// Old versions with no rules engine support get an allow everything rule.
// Since rules are enforced bidirectionally, newer versions *will* still
// enforce rules on the inbound side.
- nc.ruleCount = 1;
- nc.rules[0].t = ZT_NETWORK_RULE_ACTION_ACCEPT;
+ nc->ruleCount = 1;
+ nc->rules[0].t = ZT_NETWORK_RULE_ACTION_ACCEPT;
} else {
if (rules.is_array()) {
for(unsigned long i=0;i<rules.size();++i) {
- if (nc.ruleCount >= ZT_MAX_NETWORK_RULES)
+ if (nc->ruleCount >= ZT_MAX_NETWORK_RULES)
break;
- if (_parseRule(rules[i],nc.rules[nc.ruleCount]))
- ++nc.ruleCount;
+ if (_parseRule(rules[i],nc->rules[nc->ruleCount]))
+ ++nc->ruleCount;
}
}
@@ -1512,10 +1424,10 @@ void EmbeddedNetworkController::_request(
++caprc;
}
}
- nc.capabilities[nc.capabilityCount] = Capability((uint32_t)capId,nwid,now,1,capr,caprc);
- if (nc.capabilities[nc.capabilityCount].sign(_signingId,identity.address()))
- ++nc.capabilityCount;
- if (nc.capabilityCount >= ZT_MAX_NETWORK_CAPABILITIES)
+ nc->capabilities[nc->capabilityCount] = Capability((uint32_t)capId,nwid,now,1,capr,caprc);
+ if (nc->capabilities[nc->capabilityCount].sign(_signingId,identity.address()))
+ ++nc->capabilityCount;
+ if (nc->capabilityCount >= ZT_MAX_NETWORK_CAPABILITIES)
break;
}
}
@@ -1546,31 +1458,31 @@ void EmbeddedNetworkController::_request(
}
}
for(std::map< uint32_t,uint32_t >::const_iterator t(memberTagsById.begin());t!=memberTagsById.end();++t) {
- if (nc.tagCount >= ZT_MAX_NETWORK_TAGS)
+ if (nc->tagCount >= ZT_MAX_NETWORK_TAGS)
break;
- nc.tags[nc.tagCount] = Tag(nwid,now,identity.address(),t->first,t->second);
- if (nc.tags[nc.tagCount].sign(_signingId))
- ++nc.tagCount;
+ nc->tags[nc->tagCount] = Tag(nwid,now,identity.address(),t->first,t->second);
+ if (nc->tags[nc->tagCount].sign(_signingId))
+ ++nc->tagCount;
}
}
if (routes.is_array()) {
for(unsigned long i=0;i<routes.size();++i) {
- if (nc.routeCount >= ZT_MAX_NETWORK_ROUTES)
+ if (nc->routeCount >= ZT_MAX_NETWORK_ROUTES)
break;
json &route = routes[i];
json &target = route["target"];
json &via = route["via"];
if (target.is_string()) {
- const InetAddress t(target.get<std::string>());
+ const InetAddress t(target.get<std::string>().c_str());
InetAddress v;
- if (via.is_string()) v.fromString(via.get<std::string>());
+ if (via.is_string()) v.fromString(via.get<std::string>().c_str());
if ((t.ss_family == AF_INET)||(t.ss_family == AF_INET6)) {
- ZT_VirtualNetworkRoute *r = &(nc.routes[nc.routeCount]);
+ ZT_VirtualNetworkRoute *r = &(nc->routes[nc->routeCount]);
*(reinterpret_cast<InetAddress *>(&(r->target))) = t;
if (v.ss_family == t.ss_family)
*(reinterpret_cast<InetAddress *>(&(r->via))) = v;
- ++nc.routeCount;
+ ++nc->routeCount;
}
}
}
@@ -1579,13 +1491,13 @@ void EmbeddedNetworkController::_request(
const bool noAutoAssignIps = OSUtils::jsonBool(member["noAutoAssignIps"],false);
if ((v6AssignMode.is_object())&&(!noAutoAssignIps)) {
- if ((OSUtils::jsonBool(v6AssignMode["rfc4193"],false))&&(nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
- nc.staticIps[nc.staticIpCount++] = InetAddress::makeIpv6rfc4193(nwid,identity.address().toInt());
- nc.flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION;
+ if ((OSUtils::jsonBool(v6AssignMode["rfc4193"],false))&&(nc->staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
+ nc->staticIps[nc->staticIpCount++] = InetAddress::makeIpv6rfc4193(nwid,identity.address().toInt());
+ nc->flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION;
}
- if ((OSUtils::jsonBool(v6AssignMode["6plane"],false))&&(nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
- nc.staticIps[nc.staticIpCount++] = InetAddress::makeIpv66plane(nwid,identity.address().toInt());
- nc.flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION;
+ if ((OSUtils::jsonBool(v6AssignMode["6plane"],false))&&(nc->staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
+ nc->staticIps[nc->staticIpCount++] = InetAddress::makeIpv66plane(nwid,identity.address().toInt());
+ nc->flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION;
}
}
@@ -1594,29 +1506,29 @@ void EmbeddedNetworkController::_request(
json ipAssignments = member["ipAssignments"]; // we want to make a copy
if (ipAssignments.is_array()) {
for(unsigned long i=0;i<ipAssignments.size();++i) {
- if (!ipAssignments[i].is_string())
- continue;
- std::string ips = ipAssignments[i];
- InetAddress ip(ips);
-
- // IP assignments are only pushed if there is a corresponding local route. We also now get the netmask bits from
- // this route, ignoring the netmask bits field of the assigned IP itself. Using that was worthless and a source
- // of user error / poor UX.
- int routedNetmaskBits = 0;
- for(unsigned int rk=0;rk<nc.routeCount;++rk) {
- if ( (!nc.routes[rk].via.ss_family) && (reinterpret_cast<const InetAddress *>(&(nc.routes[rk].target))->containsAddress(ip)) )
- routedNetmaskBits = reinterpret_cast<const InetAddress *>(&(nc.routes[rk].target))->netmaskBits();
- }
+ if (ipAssignments[i].is_string()) {
+ const std::string ips = ipAssignments[i];
+ InetAddress ip(ips.c_str());
+
+ // IP assignments are only pushed if there is a corresponding local route. We also now get the netmask bits from
+ // this route, ignoring the netmask bits field of the assigned IP itself. Using that was worthless and a source
+ // of user error / poor UX.
+ int routedNetmaskBits = -1;
+ for(unsigned int rk=0;rk<nc->routeCount;++rk) {
+ if ( (!nc->routes[rk].via.ss_family) && (reinterpret_cast<const InetAddress *>(&(nc->routes[rk].target))->containsAddress(ip)) )
+ routedNetmaskBits = reinterpret_cast<const InetAddress *>(&(nc->routes[rk].target))->netmaskBits();
+ }
- if (routedNetmaskBits > 0) {
- if (nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES) {
- ip.setPort(routedNetmaskBits);
- nc.staticIps[nc.staticIpCount++] = ip;
+ if (routedNetmaskBits >= 0) {
+ if (nc->staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES) {
+ ip.setPort(routedNetmaskBits);
+ nc->staticIps[nc->staticIpCount++] = ip;
+ }
+ if (ip.ss_family == AF_INET)
+ haveManagedIpv4AutoAssignment = true;
+ else if (ip.ss_family == AF_INET6)
+ haveManagedIpv6AutoAssignment = true;
}
- if (ip.ss_family == AF_INET)
- haveManagedIpv4AutoAssignment = true;
- else if (ip.ss_family == AF_INET6)
- haveManagedIpv6AutoAssignment = true;
}
}
} else {
@@ -1627,12 +1539,12 @@ void EmbeddedNetworkController::_request(
for(unsigned long p=0;((p<ipAssignmentPools.size())&&(!haveManagedIpv6AutoAssignment));++p) {
json &pool = ipAssignmentPools[p];
if (pool.is_object()) {
- InetAddress ipRangeStart(OSUtils::jsonString(pool["ipRangeStart"],""));
- InetAddress ipRangeEnd(OSUtils::jsonString(pool["ipRangeEnd"],""));
+ InetAddress ipRangeStart(OSUtils::jsonString(pool["ipRangeStart"],"").c_str());
+ InetAddress ipRangeEnd(OSUtils::jsonString(pool["ipRangeEnd"],"").c_str());
if ( (ipRangeStart.ss_family == AF_INET6) && (ipRangeEnd.ss_family == AF_INET6) ) {
uint64_t s[2],e[2],x[2],xx[2];
- memcpy(s,ipRangeStart.rawIpData(),16);
- memcpy(e,ipRangeEnd.rawIpData(),16);
+ ZT_FAST_MEMCPY(s,ipRangeStart.rawIpData(),16);
+ ZT_FAST_MEMCPY(e,ipRangeEnd.rawIpData(),16);
s[0] = Utils::ntoh(s[0]);
s[1] = Utils::ntoh(s[1]);
e[0] = Utils::ntoh(e[0]);
@@ -1662,21 +1574,24 @@ void EmbeddedNetworkController::_request(
// Check if this IP is within a local-to-Ethernet routed network
int routedNetmaskBits = 0;
- for(unsigned int rk=0;rk<nc.routeCount;++rk) {
- if ( (!nc.routes[rk].via.ss_family) && (nc.routes[rk].target.ss_family == AF_INET6) && (reinterpret_cast<const InetAddress *>(&(nc.routes[rk].target))->containsAddress(ip6)) )
- routedNetmaskBits = reinterpret_cast<const InetAddress *>(&(nc.routes[rk].target))->netmaskBits();
+ for(unsigned int rk=0;rk<nc->routeCount;++rk) {
+ if ( (!nc->routes[rk].via.ss_family) && (nc->routes[rk].target.ss_family == AF_INET6) && (reinterpret_cast<const InetAddress *>(&(nc->routes[rk].target))->containsAddress(ip6)) )
+ routedNetmaskBits = reinterpret_cast<const InetAddress *>(&(nc->routes[rk].target))->netmaskBits();
}
// If it's routed, then try to claim and assign it and if successful end loop
- if ((routedNetmaskBits > 0)&&(!nmi.allocatedIps.count(ip6))) {
- ipAssignments.push_back(ip6.toIpString());
- member["ipAssignments"] = ipAssignments;
- ip6.setPort((unsigned int)routedNetmaskBits);
- if (nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)
- nc.staticIps[nc.staticIpCount++] = ip6;
- haveManagedIpv6AutoAssignment = true;
- _clearNetworkMemberInfoCache(nwid); // clear cache to prevent IP assignment duplication on many rapid assigns
- break;
+ if ( (routedNetmaskBits > 0) && (!std::binary_search(ns.allocatedIps.begin(),ns.allocatedIps.end(),ip6)) ) {
+ char tmpip[64];
+ const std::string ipStr(ip6.toIpString(tmpip));
+ if (std::find(ipAssignments.begin(),ipAssignments.end(),ipStr) == ipAssignments.end()) {
+ ipAssignments.push_back(ipStr);
+ member["ipAssignments"] = ipAssignments;
+ ip6.setPort((unsigned int)routedNetmaskBits);
+ if (nc->staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)
+ nc->staticIps[nc->staticIpCount++] = ip6;
+ haveManagedIpv6AutoAssignment = true;
+ break;
+ }
}
}
}
@@ -1688,8 +1603,8 @@ void EmbeddedNetworkController::_request(
for(unsigned long p=0;((p<ipAssignmentPools.size())&&(!haveManagedIpv4AutoAssignment));++p) {
json &pool = ipAssignmentPools[p];
if (pool.is_object()) {
- InetAddress ipRangeStartIA(OSUtils::jsonString(pool["ipRangeStart"],""));
- InetAddress ipRangeEndIA(OSUtils::jsonString(pool["ipRangeEnd"],""));
+ InetAddress ipRangeStartIA(OSUtils::jsonString(pool["ipRangeStart"],"").c_str());
+ InetAddress ipRangeEndIA(OSUtils::jsonString(pool["ipRangeEnd"],"").c_str());
if ( (ipRangeStartIA.ss_family == AF_INET) && (ipRangeEndIA.ss_family == AF_INET) ) {
uint32_t ipRangeStart = Utils::ntoh((uint32_t)(reinterpret_cast<struct sockaddr_in *>(&ipRangeStartIA)->sin_addr.s_addr));
uint32_t ipRangeEnd = Utils::ntoh((uint32_t)(reinterpret_cast<struct sockaddr_in *>(&ipRangeEndIA)->sin_addr.s_addr));
@@ -1708,10 +1623,10 @@ void EmbeddedNetworkController::_request(
// Check if this IP is within a local-to-Ethernet routed network
int routedNetmaskBits = -1;
- for(unsigned int rk=0;rk<nc.routeCount;++rk) {
- if (nc.routes[rk].target.ss_family == AF_INET) {
- uint32_t targetIp = Utils::ntoh((uint32_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc.routes[rk].target))->sin_addr.s_addr));
- int targetBits = Utils::ntoh((uint16_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc.routes[rk].target))->sin_port));
+ for(unsigned int rk=0;rk<nc->routeCount;++rk) {
+ if (nc->routes[rk].target.ss_family == AF_INET) {
+ uint32_t targetIp = Utils::ntoh((uint32_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc->routes[rk].target))->sin_addr.s_addr));
+ int targetBits = Utils::ntoh((uint16_t)(reinterpret_cast<const struct sockaddr_in *>(&(nc->routes[rk].target))->sin_port));
if ((ip & (0xffffffff << (32 - targetBits))) == targetIp) {
routedNetmaskBits = targetBits;
break;
@@ -1721,18 +1636,21 @@ void EmbeddedNetworkController::_request(
// If it's routed, then try to claim and assign it and if successful end loop
const InetAddress ip4(Utils::hton(ip),0);
- if ((routedNetmaskBits > 0)&&(!nmi.allocatedIps.count(ip4))) {
- ipAssignments.push_back(ip4.toIpString());
- member["ipAssignments"] = ipAssignments;
- if (nc.staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES) {
- struct sockaddr_in *const v4ip = reinterpret_cast<struct sockaddr_in *>(&(nc.staticIps[nc.staticIpCount++]));
- v4ip->sin_family = AF_INET;
- v4ip->sin_port = Utils::hton((uint16_t)routedNetmaskBits);
- v4ip->sin_addr.s_addr = Utils::hton(ip);
+ if ( (routedNetmaskBits > 0) && (!std::binary_search(ns.allocatedIps.begin(),ns.allocatedIps.end(),ip4)) ) {
+ char tmpip[64];
+ const std::string ipStr(ip4.toIpString(tmpip));
+ if (std::find(ipAssignments.begin(),ipAssignments.end(),ipStr) == ipAssignments.end()) {
+ ipAssignments.push_back(ipStr);
+ member["ipAssignments"] = ipAssignments;
+ if (nc->staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES) {
+ struct sockaddr_in *const v4ip = reinterpret_cast<struct sockaddr_in *>(&(nc->staticIps[nc->staticIpCount++]));
+ v4ip->sin_family = AF_INET;
+ v4ip->sin_port = Utils::hton((uint16_t)routedNetmaskBits);
+ v4ip->sin_addr.s_addr = Utils::hton(ip);
+ }
+ haveManagedIpv4AutoAssignment = true;
+ break;
}
- haveManagedIpv4AutoAssignment = true;
- _clearNetworkMemberInfoCache(nwid); // clear cache to prevent IP assignment duplication on many rapid assigns
- break;
}
}
}
@@ -1741,114 +1659,52 @@ void EmbeddedNetworkController::_request(
}
// Issue a certificate of ownership for all static IPs
- if (nc.staticIpCount) {
- nc.certificatesOfOwnership[0] = CertificateOfOwnership(nwid,now,identity.address(),1);
- for(unsigned int i=0;i<nc.staticIpCount;++i)
- nc.certificatesOfOwnership[0].addThing(nc.staticIps[i]);
- nc.certificatesOfOwnership[0].sign(_signingId);
- nc.certificateOfOwnershipCount = 1;
+ if (nc->staticIpCount) {
+ nc->certificatesOfOwnership[0] = CertificateOfOwnership(nwid,now,identity.address(),1);
+ for(unsigned int i=0;i<nc->staticIpCount;++i)
+ nc->certificatesOfOwnership[0].addThing(nc->staticIps[i]);
+ nc->certificatesOfOwnership[0].sign(_signingId);
+ nc->certificateOfOwnershipCount = 1;
}
CertificateOfMembership com(now,credentialtmd,nwid,identity.address());
if (com.sign(_signingId)) {
- nc.com = com;
+ nc->com = com;
} else {
_sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_INTERNAL_SERVER_ERROR);
return;
}
- if (member != origMember) {
- member["lastModified"] = now;
- Mutex::Lock _l(_db_m);
- _db.put("network",nwids,"member",identity.address().toString(),member);
- }
-
- _sender->ncSendConfig(nwid,requestPacketId,identity.address(),nc,metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,0) < 6);
+ DB::cleanMember(member);
+ _db->save(&origMember,member);
+ _sender->ncSendConfig(nwid,requestPacketId,identity.address(),*(nc.get()),metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,0) < 6);
}
-void EmbeddedNetworkController::_getNetworkMemberInfo(uint64_t now,uint64_t nwid,_NetworkMemberInfo &nmi)
+void EmbeddedNetworkController::_startThreads()
{
- char pfx[256];
- Utils::snprintf(pfx,sizeof(pfx),"network/%.16llx/member",nwid);
-
- {
- Mutex::Lock _l(_nmiCache_m);
- std::map<uint64_t,_NetworkMemberInfo>::iterator c(_nmiCache.find(nwid));
- if ((c != _nmiCache.end())&&((now - c->second.nmiTimestamp) < 1000)) { // a short duration cache but limits CPU use on big networks
- nmi = c->second;
- return;
- }
- }
-
- {
- Mutex::Lock _l(_db_m);
- _db.filter(pfx,[&nmi,&now](const std::string &n,const json &member) {
- try {
- if (OSUtils::jsonBool(member["authorized"],false)) {
- ++nmi.authorizedMemberCount;
-
- if (member.count("recentLog")) {
- const json &mlog = member["recentLog"];
- if ((mlog.is_array())&&(mlog.size() > 0)) {
- const json &mlog1 = mlog[0];
- if (mlog1.is_object()) {
- if ((now - OSUtils::jsonInt(mlog1["ts"],0ULL)) < ZT_NETCONF_NODE_ACTIVE_THRESHOLD)
- ++nmi.activeMemberCount;
- }
- }
- }
-
- if (OSUtils::jsonBool(member["activeBridge"],false)) {
- nmi.activeBridges.insert(Address(Utils::hexStrToU64(OSUtils::jsonString(member["id"],"0000000000").c_str())));
- }
-
- if (member.count("ipAssignments")) {
- const json &mips = member["ipAssignments"];
- if (mips.is_array()) {
- for(unsigned long i=0;i<mips.size();++i) {
- InetAddress mip(OSUtils::jsonString(mips[i],""));
- if ((mip.ss_family == AF_INET)||(mip.ss_family == AF_INET6))
- nmi.allocatedIps.insert(mip);
- }
- }
+ std::lock_guard<std::mutex> l(_threads_l);
+ if (!_threads.empty())
+ return;
+ const long hwc = std::max((long)std::thread::hardware_concurrency(),(long)1);
+ for(long t=0;t<hwc;++t) {
+ _threads.emplace_back([this]() {
+ for(;;) {
+ _RQEntry *qe = (_RQEntry *)0;
+ if (!_queue.get(qe))
+ break;
+ try {
+ if (qe) {
+ _request(qe->nwid,qe->fromAddr,qe->requestPacketId,qe->identity,qe->metaData);
+ delete qe;
}
- } else {
- nmi.mostRecentDeauthTime = std::max(nmi.mostRecentDeauthTime,OSUtils::jsonInt(member["lastDeauthorizedTime"],0ULL));
+ } catch (std::exception &e) {
+ fprintf(stderr,"ERROR: exception in controller request handling thread: %s" ZT_EOL_S,e.what());
+ } catch ( ... ) {
+ fprintf(stderr,"ERROR: exception in controller request handling thread: unknown exception" ZT_EOL_S);
}
- } catch ( ... ) {}
- return true;
+ }
});
}
- nmi.nmiTimestamp = now;
-
- {
- Mutex::Lock _l(_nmiCache_m);
- _nmiCache[nwid] = nmi;
- }
-}
-
-void EmbeddedNetworkController::_pushMemberUpdate(uint64_t now,uint64_t nwid,const nlohmann::json &member)
-{
- try {
- const std::string idstr = member["identity"];
- const std::string mdstr = member["lastRequestMetaData"];
- if ((idstr.length() > 0)&&(mdstr.length() > 0)) {
- const Identity id(idstr);
- bool online;
- {
- Mutex::Lock _l(_lastRequestTime_m);
- std::map< std::pair<uint64_t,uint64_t>,uint64_t >::iterator lrt(_lastRequestTime.find(std::pair<uint64_t,uint64_t>(id.address().toInt(),nwid)));
- online = ( (lrt != _lastRequestTime.end()) && ((now - lrt->second) < ZT_NETWORK_AUTOCONF_DELAY) );
- }
- if (online) {
- Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> *metaData = new Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY>(mdstr.c_str());
- try {
- this->request(nwid,InetAddress(),0,id,*metaData);
- } catch ( ... ) {}
- delete metaData;
- }
- }
- } catch ( ... ) {}
}
} // namespace ZeroTier
diff --git a/controller/EmbeddedNetworkController.hpp b/controller/EmbeddedNetworkController.hpp
index 0ae2f3b5..417005a4 100644
--- a/controller/EmbeddedNetworkController.hpp
+++ b/controller/EmbeddedNetworkController.hpp
@@ -1,6 +1,6 @@
/*
* ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2015 ZeroTier, Inc.
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -26,11 +26,12 @@
#include <vector>
#include <set>
#include <list>
+#include <thread>
+#include <unordered_map>
+#include <atomic>
#include "../node/Constants.hpp"
-
#include "../node/NetworkController.hpp"
-#include "../node/Mutex.hpp"
#include "../node/Utils.hpp"
#include "../node/Address.hpp"
#include "../node/InetAddress.hpp"
@@ -41,13 +42,11 @@
#include "../ext/json/json.hpp"
-#include "JSONDB.hpp"
-
-// Number of background threads to start -- not actually started until needed
-#define ZT_EMBEDDEDNETWORKCONTROLLER_BACKGROUND_THREAD_COUNT 4
-
-// TTL for circuit tests
-#define ZT_EMBEDDEDNETWORKCONTROLLER_CIRCUIT_TEST_EXPIRATION 120000
+#include "DB.hpp"
+#include "FileDB.hpp"
+#ifdef ZT_CONTROLLER_USE_RETHINKDB
+#include "RethinkDB.hpp"
+#endif
namespace ZeroTier {
@@ -58,7 +57,7 @@ class EmbeddedNetworkController : public NetworkController
public:
/**
* @param node Parent node
- * @param dbPath Path to store data
+ * @param dbPath Database path (file path or database credentials)
*/
EmbeddedNetworkController(Node *node,const char *dbPath);
virtual ~EmbeddedNetworkController();
@@ -94,10 +93,17 @@ public:
std::string &responseBody,
std::string &responseContentType);
- void threadMain()
- throw();
+ void handleRemoteTrace(const ZT_RemoteTrace &rt);
+
+ // Called on update via POST or by JSONDB on external update of network or network member records
+ void onNetworkUpdate(const uint64_t networkId);
+ void onNetworkMemberUpdate(const uint64_t networkId,const uint64_t memberId);
+ void onNetworkMemberDeauthorize(const uint64_t networkId,const uint64_t memberId);
private:
+ void _request(uint64_t nwid,const InetAddress &fromAddr,uint64_t requestPacketId,const Identity &identity,const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData);
+ void _startThreads();
+
struct _RQEntry
{
uint64_t nwid;
@@ -105,104 +111,47 @@ private:
InetAddress fromAddr;
Identity identity;
Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> metaData;
+ enum {
+ RQENTRY_TYPE_REQUEST = 0
+ } type;
};
-
- // Gathers a bunch of statistics about members of a network, IP assignments, etc. that we need in various places
- struct _NetworkMemberInfo
+ struct _MemberStatusKey
{
- _NetworkMemberInfo() : authorizedMemberCount(0),activeMemberCount(0),totalMemberCount(0),mostRecentDeauthTime(0) {}
- std::set<Address> activeBridges;
- std::set<InetAddress> allocatedIps;
- unsigned long authorizedMemberCount;
- unsigned long activeMemberCount;
- unsigned long totalMemberCount;
- uint64_t mostRecentDeauthTime;
- uint64_t nmiTimestamp; // time this NMI structure was computed
+ _MemberStatusKey() : networkId(0),nodeId(0) {}
+ _MemberStatusKey(const uint64_t nwid,const uint64_t nid) : networkId(nwid),nodeId(nid) {}
+ uint64_t networkId;
+ uint64_t nodeId;
+ inline bool operator==(const _MemberStatusKey &k) const { return ((k.networkId == networkId)&&(k.nodeId == nodeId)); }
};
-
- static void _circuitTestCallback(ZT_Node *node,ZT_CircuitTest *test,const ZT_CircuitTestReport *report);
- void _request(uint64_t nwid,const InetAddress &fromAddr,uint64_t requestPacketId,const Identity &identity,const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData);
- void _getNetworkMemberInfo(uint64_t now,uint64_t nwid,_NetworkMemberInfo &nmi);
- inline void _clearNetworkMemberInfoCache(const uint64_t nwid) { Mutex::Lock _l(_nmiCache_m); _nmiCache.erase(nwid); }
- void _pushMemberUpdate(uint64_t now,uint64_t nwid,const nlohmann::json &member);
-
- // These init objects with default and static/informational fields
- inline void _initMember(nlohmann::json &member)
+ struct _MemberStatus
{
- if (!member.count("authorized")) member["authorized"] = false;
- if (!member.count("authHistory")) member["authHistory"] = nlohmann::json::array();
- if (!member.count("ipAssignments")) member["ipAssignments"] = nlohmann::json::array();
- if (!member.count("recentLog")) member["recentLog"] = nlohmann::json::array();
- if (!member.count("activeBridge")) member["activeBridge"] = false;
- if (!member.count("tags")) member["tags"] = nlohmann::json::array();
- if (!member.count("capabilities")) member["capabilities"] = nlohmann::json::array();
- if (!member.count("creationTime")) member["creationTime"] = OSUtils::now();
- if (!member.count("noAutoAssignIps")) member["noAutoAssignIps"] = false;
- if (!member.count("revision")) member["revision"] = 0ULL;
- if (!member.count("lastDeauthorizedTime")) member["lastDeauthorizedTime"] = 0ULL;
- if (!member.count("lastAuthorizedTime")) member["lastAuthorizedTime"] = 0ULL;
- member["objtype"] = "member";
- }
- inline void _initNetwork(nlohmann::json &network)
+ _MemberStatus() : lastRequestTime(0),vMajor(-1),vMinor(-1),vRev(-1),vProto(-1) {}
+ uint64_t lastRequestTime;
+ int vMajor,vMinor,vRev,vProto;
+ Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> lastRequestMetaData;
+ Identity identity;
+ inline bool online(const int64_t now) const { return ((now - lastRequestTime) < (ZT_NETWORK_AUTOCONF_DELAY * 2)); }
+ };
+ struct _MemberStatusHash
{
- if (!network.count("private")) network["private"] = true;
- if (!network.count("creationTime")) network["creationTime"] = OSUtils::now();
- if (!network.count("name")) network["name"] = "";
- if (!network.count("multicastLimit")) network["multicastLimit"] = (uint64_t)32;
- if (!network.count("enableBroadcast")) network["enableBroadcast"] = true;
- if (!network.count("v4AssignMode")) network["v4AssignMode"] = {{"zt",false}};
- if (!network.count("v6AssignMode")) network["v6AssignMode"] = {{"rfc4193",false},{"zt",false},{"6plane",false}};
- if (!network.count("authTokens")) network["authTokens"] = nlohmann::json::array();
- if (!network.count("capabilities")) network["capabilities"] = nlohmann::json::array();
- if (!network.count("tags")) network["tags"] = nlohmann::json::array();
- if (!network.count("routes")) network["routes"] = nlohmann::json::array();
- if (!network.count("ipAssignmentPools")) network["ipAssignmentPools"] = nlohmann::json::array();
- if (!network.count("rules")) {
- // If unspecified, rules are set to allow anything and behave like a flat L2 segment
- network["rules"] = {{
- { "not",false },
- { "or", false },
- { "type","ACTION_ACCEPT" }
- }};
+ inline std::size_t operator()(const _MemberStatusKey &networkIdNodeId) const
+ {
+ return (std::size_t)(networkIdNodeId.networkId + networkIdNodeId.nodeId);
}
- network["objtype"] = "network";
- }
- inline void _addNetworkNonPersistedFields(nlohmann::json &network,uint64_t now,const _NetworkMemberInfo &nmi)
- {
- network["clock"] = now;
- network["authorizedMemberCount"] = nmi.authorizedMemberCount;
- network["activeMemberCount"] = nmi.activeMemberCount;
- network["totalMemberCount"] = nmi.totalMemberCount;
- }
- inline void _addMemberNonPersistedFields(nlohmann::json &member,uint64_t now)
- {
- member["clock"] = now;
- }
-
- const uint64_t _startTime;
-
- BlockingQueue<_RQEntry *> _queue;
- Thread _threads[ZT_EMBEDDEDNETWORKCONTROLLER_BACKGROUND_THREAD_COUNT];
- bool _threadsStarted;
- Mutex _threads_m;
-
- std::map<uint64_t,_NetworkMemberInfo> _nmiCache;
- Mutex _nmiCache_m;
-
- JSONDB _db;
- Mutex _db_m;
+ };
+ const int64_t _startTime;
Node *const _node;
std::string _path;
-
- NetworkController::Sender *_sender;
Identity _signingId;
-
- std::list< ZT_CircuitTest > _tests;
- Mutex _tests_m;
-
- std::map< std::pair<uint64_t,uint64_t>,uint64_t > _lastRequestTime; // last request time by <address,networkId>
- Mutex _lastRequestTime_m;
+ std::string _signingIdAddressString;
+ NetworkController::Sender *_sender;
+ std::unique_ptr<DB> _db;
+ BlockingQueue< _RQEntry * > _queue;
+ std::vector<std::thread> _threads;
+ std::mutex _threads_l;
+ std::unordered_map< _MemberStatusKey,_MemberStatus,_MemberStatusHash > _memberStatus;
+ std::mutex _memberStatus_l;
};
} // namespace ZeroTier
diff --git a/controller/FileDB.cpp b/controller/FileDB.cpp
new file mode 100644
index 00000000..a7b59cbf
--- /dev/null
+++ b/controller/FileDB.cpp
@@ -0,0 +1,150 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "FileDB.hpp"
+
+namespace ZeroTier
+{
+
+FileDB::FileDB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path) :
+ DB(nc,myId,path),
+ _networksPath(_path + ZT_PATH_SEPARATOR_S + "network"),
+ _tracePath(_path + ZT_PATH_SEPARATOR_S + "trace")
+{
+ OSUtils::mkdir(_path.c_str());
+ OSUtils::lockDownFile(_path.c_str(),true);
+ OSUtils::mkdir(_networksPath.c_str());
+ OSUtils::mkdir(_tracePath.c_str());
+
+ std::vector<std::string> networks(OSUtils::listDirectory(_networksPath.c_str(),false));
+ std::string buf;
+ for(auto n=networks.begin();n!=networks.end();++n) {
+ buf.clear();
+ if ((n->length() == 21)&&(OSUtils::readFile((_networksPath + ZT_PATH_SEPARATOR_S + *n).c_str(),buf))) {
+ try {
+ nlohmann::json network(OSUtils::jsonParse(buf));
+ const std::string nwids = network["id"];
+ if (nwids.length() == 16) {
+ nlohmann::json nullJson;
+ _networkChanged(nullJson,network,false);
+ std::string membersPath(_networksPath + ZT_PATH_SEPARATOR_S + nwids + ZT_PATH_SEPARATOR_S "member");
+ std::vector<std::string> members(OSUtils::listDirectory(membersPath.c_str(),false));
+ for(auto m=members.begin();m!=members.end();++m) {
+ buf.clear();
+ if ((m->length() == 15)&&(OSUtils::readFile((membersPath + ZT_PATH_SEPARATOR_S + *m).c_str(),buf))) {
+ try {
+ nlohmann::json member(OSUtils::jsonParse(buf));
+ const std::string addrs = member["id"];
+ if (addrs.length() == 10) {
+ nlohmann::json nullJson2;
+ _memberChanged(nullJson2,member,false);
+ }
+ } catch ( ... ) {}
+ }
+ }
+ }
+ } catch ( ... ) {}
+ }
+ }
+}
+
+FileDB::~FileDB()
+{
+}
+
+bool FileDB::waitForReady()
+{
+ return true;
+}
+
+void FileDB::save(nlohmann::json *orig,nlohmann::json &record)
+{
+ char p1[4096],p2[4096],pb[4096];
+ try {
+ if (orig) {
+ if (*orig != record) {
+ record["revision"] = OSUtils::jsonInt(record["revision"],0ULL) + 1;
+ }
+ } else {
+ record["revision"] = 1;
+ }
+
+ const std::string objtype = record["objtype"];
+ if (objtype == "network") {
+ const uint64_t nwid = OSUtils::jsonIntHex(record["id"],0ULL);
+ if (nwid) {
+ nlohmann::json old;
+ get(nwid,old);
+
+ OSUtils::ztsnprintf(p1,sizeof(p1),"%s" ZT_PATH_SEPARATOR_S "%.16llx.json.new",_networksPath.c_str(),nwid);
+ OSUtils::ztsnprintf(p2,sizeof(p2),"%s" ZT_PATH_SEPARATOR_S "%.16llx.json",_networksPath.c_str(),nwid);
+ if (!OSUtils::writeFile(p1,OSUtils::jsonDump(record,-1)))
+ fprintf(stderr,"WARNING: controller unable to write to path: %s" ZT_EOL_S,p1);
+ OSUtils::rename(p1,p2);
+
+ _networkChanged(old,record,true);
+ }
+ } else if (objtype == "member") {
+ const uint64_t id = OSUtils::jsonIntHex(record["id"],0ULL);
+ const uint64_t nwid = OSUtils::jsonIntHex(record["nwid"],0ULL);
+ if ((id)&&(nwid)) {
+ nlohmann::json network,old;
+ get(nwid,network,id,old);
+
+ OSUtils::ztsnprintf(pb,sizeof(pb),"%s" ZT_PATH_SEPARATOR_S "%.16llx" ZT_PATH_SEPARATOR_S "member",_networksPath.c_str(),(unsigned long long)nwid);
+ OSUtils::ztsnprintf(p1,sizeof(p1),"%s" ZT_PATH_SEPARATOR_S "%.10llx.json.new",pb,(unsigned long long)id);
+ OSUtils::ztsnprintf(p2,sizeof(p2),"%s" ZT_PATH_SEPARATOR_S "%.10llx.json",pb,(unsigned long long)id);
+ if (!OSUtils::writeFile(p1,OSUtils::jsonDump(record,-1))) {
+ OSUtils::mkdir(pb);
+ if (!OSUtils::writeFile(p1,OSUtils::jsonDump(record,-1)))
+ fprintf(stderr,"WARNING: controller unable to write to path: %s" ZT_EOL_S,p1);
+ }
+ OSUtils::rename(p1,p2);
+
+ _memberChanged(old,record,true);
+ }
+ } else if (objtype == "trace") {
+ const std::string id = record["id"];
+ if (id.length() > 0) {
+ OSUtils::ztsnprintf(p1,sizeof(p1),"%s" ZT_PATH_SEPARATOR_S "%s.json",_tracePath.c_str(),id.c_str());
+ OSUtils::writeFile(p1,OSUtils::jsonDump(record,-1));
+ }
+ }
+ } catch ( ... ) {} // drop invalid records missing fields
+}
+
+void FileDB::eraseNetwork(const uint64_t networkId)
+{
+ nlohmann::json network,nullJson;
+ get(networkId,network);
+ char p[16384];
+ OSUtils::ztsnprintf(p,sizeof(p),"%s" ZT_PATH_SEPARATOR_S "%.16llx.json",_networksPath.c_str(),networkId);
+ OSUtils::rm(p);
+ _networkChanged(network,nullJson,true);
+}
+
+void FileDB::eraseMember(const uint64_t networkId,const uint64_t memberId)
+{
+}
+
+void FileDB::nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress)
+{
+ // Nothing to do here right now in the filesystem store mode since we can just get this from the peer list
+}
+
+} // namespace ZeroTier
diff --git a/controller/FileDB.hpp b/controller/FileDB.hpp
new file mode 100644
index 00000000..1e275a36
--- /dev/null
+++ b/controller/FileDB.hpp
@@ -0,0 +1,46 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef ZT_CONTROLLER_FILEDB_HPP
+#define ZT_CONTROLLER_FILEDB_HPP
+
+#include "DB.hpp"
+
+namespace ZeroTier
+{
+
+class FileDB : public DB
+{
+public:
+ FileDB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path);
+ virtual ~FileDB();
+
+ virtual bool waitForReady();
+ virtual void save(nlohmann::json *orig,nlohmann::json &record);
+ virtual void eraseNetwork(const uint64_t networkId);
+ virtual void eraseMember(const uint64_t networkId,const uint64_t memberId);
+ virtual void nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress);
+
+protected:
+ std::string _networksPath;
+ std::string _tracePath;
+};
+
+} // namespace ZeroTier
+
+#endif
diff --git a/controller/JSONDB.cpp b/controller/JSONDB.cpp
deleted file mode 100644
index d3e76fc1..00000000
--- a/controller/JSONDB.cpp
+++ /dev/null
@@ -1,219 +0,0 @@
-/*
- * ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2015 ZeroTier, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "JSONDB.hpp"
-
-#define ZT_JSONDB_HTTP_TIMEOUT 60000
-
-namespace ZeroTier {
-
-static const nlohmann::json _EMPTY_JSON(nlohmann::json::object());
-static const std::map<std::string,std::string> _ZT_JSONDB_GET_HEADERS;
-
-JSONDB::JSONDB(const std::string &basePath) :
- _basePath(basePath),
- _ready(false)
-{
- if ((_basePath.length() > 7)&&(_basePath.substr(0,7) == "http://")) {
- // TODO: this doesn't yet support IPv6 since bracketed address notiation isn't supported.
- // Typically it's used with 127.0.0.1 anyway.
- std::string hn = _basePath.substr(7);
- std::size_t hnend = hn.find_first_of('/');
- if (hnend != std::string::npos)
- hn = hn.substr(0,hnend);
- std::size_t hnsep = hn.find_last_of(':');
- if (hnsep != std::string::npos)
- hn[hnsep] = '/';
- _httpAddr.fromString(hn);
- if (hnend != std::string::npos)
- _basePath = _basePath.substr(7 + hnend);
- if (_basePath.length() == 0)
- _basePath = "/";
- if (_basePath[0] != '/')
- _basePath = std::string("/") + _basePath;
- } else {
- OSUtils::mkdir(_basePath.c_str());
- OSUtils::lockDownFile(_basePath.c_str(),true); // networks might contain auth tokens, etc., so restrict directory permissions
- }
- _ready = _reload(_basePath,std::string());
-}
-
-bool JSONDB::writeRaw(const std::string &n,const std::string &obj)
-{
- if (!_isValidObjectName(n))
- return false;
- if (_httpAddr) {
- std::map<std::string,std::string> headers;
- std::string body;
- std::map<std::string,std::string> reqHeaders;
- char tmp[64];
- Utils::snprintf(tmp,sizeof(tmp),"%lu",(unsigned long)obj.length());
- reqHeaders["Content-Length"] = tmp;
- reqHeaders["Content-Type"] = "application/json";
- const unsigned int sc = Http::PUT(1048576,ZT_JSONDB_HTTP_TIMEOUT,reinterpret_cast<const struct sockaddr *>(&_httpAddr),(_basePath+"/"+n).c_str(),reqHeaders,obj.data(),(unsigned long)obj.length(),headers,body);
- return (sc == 200);
- } else {
- const std::string path(_genPath(n,true));
- if (!path.length())
- return false;
- return OSUtils::writeFile(path.c_str(),obj);
- }
-}
-
-bool JSONDB::put(const std::string &n,const nlohmann::json &obj)
-{
- const bool r = writeRaw(n,OSUtils::jsonDump(obj));
- _db[n].obj = obj;
- return r;
-}
-
-const nlohmann::json &JSONDB::get(const std::string &n)
-{
- while (!_ready) {
- Thread::sleep(250);
- _ready = _reload(_basePath,std::string());
- }
-
- if (!_isValidObjectName(n))
- return _EMPTY_JSON;
- std::map<std::string,_E>::iterator e(_db.find(n));
- if (e != _db.end())
- return e->second.obj;
-
- std::string buf;
- if (_httpAddr) {
- std::map<std::string,std::string> headers;
- const unsigned int sc = Http::GET(1048576,ZT_JSONDB_HTTP_TIMEOUT,reinterpret_cast<const struct sockaddr *>(&_httpAddr),(_basePath+"/"+n).c_str(),_ZT_JSONDB_GET_HEADERS,headers,buf);
- if (sc != 200)
- return _EMPTY_JSON;
- } else {
- const std::string path(_genPath(n,false));
- if (!path.length())
- return _EMPTY_JSON;
- if (!OSUtils::readFile(path.c_str(),buf))
- return _EMPTY_JSON;
- }
-
- try {
- _E &e2 = _db[n];
- e2.obj = OSUtils::jsonParse(buf);
- return e2.obj;
- } catch ( ... ) {
- _db.erase(n);
- return _EMPTY_JSON;
- }
-}
-
-void JSONDB::erase(const std::string &n)
-{
- if (!_isValidObjectName(n))
- return;
-
- if (_httpAddr) {
- std::string body;
- std::map<std::string,std::string> headers;
- Http::DEL(1048576,ZT_JSONDB_HTTP_TIMEOUT,reinterpret_cast<const struct sockaddr *>(&_httpAddr),(_basePath+"/"+n).c_str(),_ZT_JSONDB_GET_HEADERS,headers,body);
- } else {
- std::string path(_genPath(n,true));
- if (!path.length())
- return;
- OSUtils::rm(path.c_str());
- }
-
- _db.erase(n);
-}
-
-bool JSONDB::_reload(const std::string &p,const std::string &b)
-{
- if (_httpAddr) {
- std::string body;
- std::map<std::string,std::string> headers;
- const unsigned int sc = Http::GET(2147483647,ZT_JSONDB_HTTP_TIMEOUT,reinterpret_cast<const struct sockaddr *>(&_httpAddr),_basePath.c_str(),_ZT_JSONDB_GET_HEADERS,headers,body);
- if (sc == 200) {
- try {
- nlohmann::json dbImg(OSUtils::jsonParse(body));
- std::string tmp;
- if (dbImg.is_object()) {
- for(nlohmann::json::iterator i(dbImg.begin());i!=dbImg.end();++i) {
- if (i.value().is_object()) {
- tmp = i.key();
- _db[tmp].obj = i.value();
- }
- }
- return true;
- }
- } catch ( ... ) {} // invalid JSON, so maybe incomplete request
- }
- return false;
- } else {
- std::vector<std::string> dl(OSUtils::listDirectory(p.c_str(),true));
- for(std::vector<std::string>::const_iterator di(dl.begin());di!=dl.end();++di) {
- if ((di->length() > 5)&&(di->substr(di->length() - 5) == ".json")) {
- this->get(b + di->substr(0,di->length() - 5));
- } else {
- this->_reload((p + ZT_PATH_SEPARATOR + *di),(b + *di + ZT_PATH_SEPARATOR));
- }
- }
- return true;
- }
-}
-
-bool JSONDB::_isValidObjectName(const std::string &n)
-{
- if (n.length() == 0)
- return false;
- const char *p = n.c_str();
- char c;
- // For security reasons we should not allow dots, backslashes, or other path characters or potential path characters.
- while ((c = *(p++))) {
- if (!( ((c >= 'a')&&(c <= 'z')) || ((c >= 'A')&&(c <= 'Z')) || ((c >= '0')&&(c <= '9')) || (c == '/') || (c == '_') || (c == '~') || (c == '-') ))
- return false;
- }
- return true;
-}
-
-std::string JSONDB::_genPath(const std::string &n,bool create)
-{
- std::vector<std::string> pt(OSUtils::split(n.c_str(),"/","",""));
- if (pt.size() == 0)
- return std::string();
-
- char sep;
- if (_httpAddr) {
- sep = '/';
- create = false;
- } else {
- sep = ZT_PATH_SEPARATOR;
- }
-
- std::string p(_basePath);
- if (create) OSUtils::mkdir(p.c_str());
- for(unsigned long i=0,j=(unsigned long)(pt.size()-1);i<j;++i) {
- p.push_back(sep);
- p.append(pt[i]);
- if (create) OSUtils::mkdir(p.c_str());
- }
-
- p.push_back(sep);
- p.append(pt[pt.size()-1]);
- p.append(".json");
-
- return p;
-}
-
-} // namespace ZeroTier
diff --git a/controller/JSONDB.hpp b/controller/JSONDB.hpp
deleted file mode 100644
index beafbaf5..00000000
--- a/controller/JSONDB.hpp
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2015 ZeroTier, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef ZT_JSONDB_HPP
-#define ZT_JSONDB_HPP
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <string>
-#include <map>
-#include <stdexcept>
-#include <vector>
-#include <algorithm>
-
-#include "../node/Constants.hpp"
-#include "../node/Utils.hpp"
-#include "../node/InetAddress.hpp"
-#include "../node/Mutex.hpp"
-#include "../ext/json/json.hpp"
-#include "../osdep/OSUtils.hpp"
-#include "../osdep/Http.hpp"
-#include "../osdep/Thread.hpp"
-
-namespace ZeroTier {
-
-/**
- * Hierarchical JSON store that persists into the filesystem or via HTTP
- */
-class JSONDB
-{
-public:
- JSONDB(const std::string &basePath);
-
- bool writeRaw(const std::string &n,const std::string &obj);
-
- bool put(const std::string &n,const nlohmann::json &obj);
-
- inline bool put(const std::string &n1,const std::string &n2,const nlohmann::json &obj) { return this->put((n1 + "/" + n2),obj); }
- inline bool put(const std::string &n1,const std::string &n2,const std::string &n3,const nlohmann::json &obj) { return this->put((n1 + "/" + n2 + "/" + n3),obj); }
- inline bool put(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4,const nlohmann::json &obj) { return this->put((n1 + "/" + n2 + "/" + n3 + "/" + n4),obj); }
- inline bool put(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4,const std::string &n5,const nlohmann::json &obj) { return this->put((n1 + "/" + n2 + "/" + n3 + "/" + n4 + "/" + n5),obj); }
-
- const nlohmann::json &get(const std::string &n);
-
- inline const nlohmann::json &get(const std::string &n1,const std::string &n2) { return this->get((n1 + "/" + n2)); }
- inline const nlohmann::json &get(const std::string &n1,const std::string &n2,const std::string &n3) { return this->get((n1 + "/" + n2 + "/" + n3)); }
- inline const nlohmann::json &get(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4) { return this->get((n1 + "/" + n2 + "/" + n3 + "/" + n4)); }
- inline const nlohmann::json &get(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4,const std::string &n5) { return this->get((n1 + "/" + n2 + "/" + n3 + "/" + n4 + "/" + n5)); }
-
- void erase(const std::string &n);
-
- inline void erase(const std::string &n1,const std::string &n2) { this->erase(n1 + "/" + n2); }
- inline void erase(const std::string &n1,const std::string &n2,const std::string &n3) { this->erase(n1 + "/" + n2 + "/" + n3); }
- inline void erase(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4) { this->erase(n1 + "/" + n2 + "/" + n3 + "/" + n4); }
- inline void erase(const std::string &n1,const std::string &n2,const std::string &n3,const std::string &n4,const std::string &n5) { this->erase(n1 + "/" + n2 + "/" + n3 + "/" + n4 + "/" + n5); }
-
- template<typename F>
- inline void filter(const std::string &prefix,F func)
- {
- while (!_ready) {
- Thread::sleep(250);
- _ready = _reload(_basePath,std::string());
- }
-
- for(std::map<std::string,_E>::iterator i(_db.lower_bound(prefix));i!=_db.end();) {
- if ((i->first.length() >= prefix.length())&&(!memcmp(i->first.data(),prefix.data(),prefix.length()))) {
- if (!func(i->first,get(i->first))) {
- std::map<std::string,_E>::iterator i2(i); ++i2;
- this->erase(i->first);
- i = i2;
- } else ++i;
- } else break;
- }
- }
-
- inline bool operator==(const JSONDB &db) const { return ((_basePath == db._basePath)&&(_db == db._db)); }
- inline bool operator!=(const JSONDB &db) const { return (!(*this == db)); }
-
-private:
- bool _reload(const std::string &p,const std::string &b);
- bool _isValidObjectName(const std::string &n);
- std::string _genPath(const std::string &n,bool create);
-
- struct _E
- {
- nlohmann::json obj;
- inline bool operator==(const _E &e) const { return (obj == e.obj); }
- inline bool operator!=(const _E &e) const { return (obj != e.obj); }
- };
-
- InetAddress _httpAddr;
- std::string _basePath;
- std::map<std::string,_E> _db;
- volatile bool _ready;
-};
-
-} // namespace ZeroTier
-
-#endif
diff --git a/controller/README.md b/controller/README.md
index 8a1a3dff..23bd931d 100644
--- a/controller/README.md
+++ b/controller/README.md
@@ -1,43 +1,47 @@
Network Controller Microservice
======
-Every ZeroTier virtual network has a *network controller*. This is our reference implementation and is the same one we use to power our own hosted services at [my.zerotier.com](https://my.zerotier.com/). Network controllers act as configuration servers and certificate authorities for the members of networks. Controllers are located on the network by simply parsing out the first 10 digits of a network's 16-digit network ID: these are the address of the controller.
+Every ZeroTier virtual network has a *network controller* responsible for admitting members to the network, issuing certificates, and issuing default configuration information.
-As of ZeroTier One version 1.2.0 this code is included in normal builds for desktop, laptop, and server (Linux, etc.) targets, allowing any device to create virtual networks without having to be rebuilt from source with special flags to enable this feature. While this does offer a convenient way to create ad-hoc networks or experiment, we recommend running a dedicated controller somewhere secure and stable for any "serious" use case.
+This is our reference controller implementation and is the same one we use to power our own hosted services at [my.zerotier.com](https://my.zerotier.com/). As of ZeroTier One version 1.2.0 this code is included in normal builds for desktop, laptop, and server (Linux, etc.) targets.
Controller data is stored in JSON format under `controller.d` in the ZeroTier working directory. It can be copied, rsync'd, placed in `git`, etc. The files under `controller.d` should not be modified in place while the controller is running or data loss may result, and if they are edited directly take care not to save corrupt JSON since that can also lead to data loss when the controller is restarted. Going through the API is strongly preferred to directly modifying these files.
-### Upgrading from Older (1.1.14 or earlier) Versions
-
-Older versions of this code used a SQLite database instead of in-filesystem JSON. A migration utility called `migrate-sqlite` is included here and *must* be used to migrate this data to the new format. If the controller is started with an old `controller.db` in its working directory it will terminate after printing an error to *stderr*. This is done to prevent "surprises" for those running DIY controllers using the old code.
-
-The migration tool is written in nodeJS and can be used like this:
-
- cd migrate-sqlite
- npm install
- node migrate.js </path/to/controller.db> </path/to/controller.d>
-
-Very old versions of nodeJS may have issues. We tested it with version 7.
+See the API section below for information about controlling the controller.
### Scalability and Reliability
Controllers can in theory host up to 2^24 networks and serve many millions of devices (or more), but we recommend spreading large numbers of networks across many controllers for load balancing and fault tolerance reasons. Since the controller uses the filesystem as its data store we recommend fast filesystems and fast SSD drives for heavily loaded controllers.
-Since ZeroTier nodes are mobile and do not need static IPs, implementing high availability fail-over for controllers is easy. Just replicate their working directories from master to backup and have something automatically fire up the backup if the master goes down. Many modern orchestration tools have built-in support for this. It would also be possible in theory to run controllers on a replicated or distributed filesystem, but we haven't tested this yet.
+Since ZeroTier nodes are mobile and do not need static IPs, implementing high availability fail-over for controllers is easy. Just replicate their working directories from master to backup and have something automatically fire up the backup if the master goes down. Modern orchestration tools like Nomad and Kubernetes can be of help here.
### Dockerizing Controllers
ZeroTier network controllers can easily be run in Docker or other container systems. Since containers do not need to actually join networks, extra privilege options like "--device=/dev/net/tun --privileged" are not needed. You'll just need to map the local JSON API port of the running controller and allow it to access the Internet (over UDP/9993 at a minimum) so things can reach and query it.
+### RethinkDB Database Implementation
+
+The default controller stores its data in the filesystem in `controller.d` under ZeroTier's home folder. There's an alternative implementation that stores data in RethinkDB that can be built with `make central-controller`. Right now this is only guaranteed to build and run on Linux and is designed for use with [ZeroTier Central](https://my.zerotier.com/). You're welcome to use it but we don't "officially" support it for end-user use and it could change at any time.
+
+### Upgrading from Older (1.1.14 or earlier) Versions
+
+Older versions of this code used a SQLite database instead of in-filesystem JSON. A migration utility called `migrate-sqlite` is included here and *must* be used to migrate this data to the new format. If the controller is started with an old `controller.db` in its working directory it will terminate after printing an error to *stderr*. This is done to prevent "surprises" for those running DIY controllers using the old code.
+
+The migration tool is written in nodeJS and can be used like this:
+
+ cd migrate-sqlite
+ npm install
+ node migrate.js </path/to/controller.db> </path/to/controller.d>
+
### Network Controller API
The controller API is hosted via the same JSON API endpoint that ZeroTier One uses for local control (usually at 127.0.0.1 port 9993). All controller options are routed under the `/controller` base path.
-The controller microservice does not implement any fine-grained access control (authentication is via authtoken.secret, simply append the value from authtoken.secret file, into a new querystring parameter named "auth" - for example `/controller/network?auth=6hdmozf8k5ds39kabcdefabc`) or other complex mangement features. It just takes network and network member configurations and reponds to controller queries. We have an enterprise product called [ZeroTier Central](https://my.zerotier.com/) that we host as a service (and that companies can license to self-host) that does this.
+The controller microservice itself does not implement any fine-grained access control. Access control is via the ZeroTier control interface itself and `authtoken.secret`. This can be sent as the `X-ZT1-Auth` HTTP header field or appended to the URL as `?auth=<token>`. Take care when doing the latter that request URLs are not being logged.
-All working network IDs on a controller must begin with the controller's ZeroTier address. The API will *allow* "foreign" networks to be added but the controller will have no way of doing anything with them since nobody will know to query it. (In the future we might support secondaries, which would make this relevant.)
+While networks with any valid ID can be added to the controller's database, it will only actually work to control networks whose first 10 hex digits correspond with the network controller's ZeroTier ID. See [section 2.2.1 of the ZeroTier manual](https://zerotier.com/manual.shtml#2_2_1).
-The JSON API is *very* sensitive about types. Integers must be integers and strings strings, etc. Incorrectly typed and unrecognized fields may result in ignored fields or a 400 (bad request) error.
+The controller JSON API is *very* sensitive about types. Integers must be integers and strings strings, etc. Incorrect types may be ignored, set to default values, or set to undefined values.
#### `/controller`
@@ -78,34 +82,30 @@ Example:
| Field | Type | Description | Writable |
| --------------------- | ------------- | ------------------------------------------------- | -------- |
| id | string | 16-digit network ID | no |
-| nwid | string | 16-digit network ID (old, but still around) | no |
-| clock | integer | Current clock, ms since epoch | no |
+| nwid | string | 16-digit network ID (legacy) | no |
+| objtype | string | Always "network" | no |
| name | string | A short name for this network | YES |
+| creationTime | integer | Time network record was created (ms since epoch) | no |
| private | boolean | Is access control enabled? | YES |
| enableBroadcast | boolean | Ethernet ff:ff:ff:ff:ff:ff allowed? | YES |
-| allowPassiveBridging | boolean | Allow any member to bridge (very experimental) | YES |
| v4AssignMode | object | IPv4 management and assign options (see below) | YES |
| v6AssignMode | object | IPv6 management and assign options (see below) | YES |
+| mtu | integer | Network MTU (default: 2800) | YES |
| multicastLimit | integer | Maximum recipients for a multicast packet | YES |
| creationTime | integer | Time network was first created | no |
| revision | integer | Network config revision counter | no |
-| authorizedMemberCount | integer | Number of authorized members (for private nets) | no |
-| activeMemberCount | integer | Number of members that appear to be online | no |
-| totalMemberCount | integer | Total known members of this network | no |
| routes | array[object] | Managed IPv4 and IPv6 routes; see below | YES |
| ipAssignmentPools | array[object] | IP auto-assign ranges; see below | YES |
| rules | array[object] | Traffic rules; see below | YES |
-
-Recent changes:
-
- * The `ipLocalRoutes` field appeared in older versions but is no longer present. Routes will now show up in `routes`.
- * The `relays` field is gone since network preferred relays are gone. This capability is replaced by VL1 level federation ("federated roots").
-
-Other important points:
+| capabilities | array[object] | Array of capability objects (see below) | YES |
+| tags | array[object] | Array of tag objects (see below) | YES |
+| remoteTraceTarget | string | 10-digit ZeroTier ID of remote trace target | YES |
+| remoteTraceLevel | integer | Remote trace verbosity level | YES |
* Networks without rules won't carry any traffic. If you don't specify any on network creation an "accept anything" rule set will automatically be added.
* Managed IP address assignments and IP assignment pools that do not fall within a route configured in `routes` are ignored and won't be used or sent to members.
* The default for `private` is `true` and this is probably what you want. Turning `private` off means *anyone* can join your network with only its 16-digit network ID. It's also impossible to de-authorize a member as these networks don't issue or enforce certificates. Such "party line" networks are used for decentralized app backplanes, gaming, and testing but are otherwise not common.
+ * Changing the MTU can be disruptive and on some operating systems may require a leave/rejoin of the network or a restart of the ZeroTier service.
**Auto-Assign Modes:**
@@ -191,7 +191,7 @@ The entry types and their additional fields are:
| `MATCH_TAGS_SAMENESS` | Match if both sides' tags differ by no more than value | `id`,`value` |
| `MATCH_TAGS_BITWISE_AND` | Match if both sides' tags AND to value | `id`,`value` |
| `MATCH_TAGS_BITWISE_OR` | Match if both sides' tags OR to value | `id`,`value` |
-| `MATCH_TAGS_BITWISE_XOR` | Match if both sides` tags XOR to value | `id`,`value` |
+| `MATCH_TAGS_BITWISE_XOR` | Match if both sides' tags XOR to value | `id`,`value` |
Important notes about rules engine behavior:
@@ -227,28 +227,15 @@ This returns an object containing all currently online members and the most rece
| id | string | Member's 10-digit ZeroTier address | no |
| address | string | Member's 10-digit ZeroTier address | no |
| nwid | string | 16-digit network ID | no |
-| clock | integer | Current clock, ms since epoch | no |
| authorized | boolean | Is member authorized? (for private networks) | YES |
-| authHistory | array[object] | History of auth changes, latest at end | no |
| activeBridge | boolean | Member is able to bridge to other Ethernet nets | YES |
| identity | string | Member's public ZeroTier identity (if known) | no |
| ipAssignments | array[string] | Managed IP address assignments | YES |
-| memberRevision | integer | Member revision counter | no |
-| recentLog | array[object] | Recent member activity log; see below | no |
+| revision | integer | Member revision counter | no |
+| vMajor | integer | Most recently known major version | no |
+| vMinor | integer | Most recently known minor version | no |
+| vRev | integer | Most recently known revision | no |
+| vProto | integer | Most recently known protocl version | no |
Note that managed IP assignments are only used if they fall within a managed route. Otherwise they are ignored.
-**Recent log object format:**
-
-| Field | Type | Description |
-| --------------------- | ------------- | ------------------------------------------------- |
-| ts | integer | Time of request, ms since epoch |
-| auth | boolean | Was member authorized? |
-| authBy | string | How was member authorized? |
-| vMajor | integer | Client major version or -1 if unknown |
-| vMinor | integer | Client minor version or -1 if unknown |
-| vRev | integer | Client revision or -1 if unknown |
-| vProto | integer | ZeroTier protocol version reported by client |
-| fromAddr | string | Physical address if known |
-
-The controller can only know a member's `fromAddr` if it's able to establish a direct path to it. Members behind very restrictive firewalls may not have this information since the controller will be receiving the member's requests by way of a relay. ZeroTier does not back-trace IP paths as packets are relayed since this would add a lot of protocol overhead.
diff --git a/controller/RethinkDB.cpp b/controller/RethinkDB.cpp
new file mode 100644
index 00000000..f6c8a59c
--- /dev/null
+++ b/controller/RethinkDB.cpp
@@ -0,0 +1,488 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+//#define ZT_CONTROLLER_USE_RETHINKDB
+
+#ifdef ZT_CONTROLLER_USE_RETHINKDB
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+#include "RethinkDB.hpp"
+#include "EmbeddedNetworkController.hpp"
+
+#include "../version.h"
+
+#include <chrono>
+#include <algorithm>
+#include <stdexcept>
+
+#include "../ext/librethinkdbxx/build/include/rethinkdb.h"
+
+namespace R = RethinkDB;
+using json = nlohmann::json;
+
+namespace ZeroTier {
+
+static const char *_timestr()
+{
+ time_t t = time(0);
+ char *ts = ctime(&t);
+ char *p = ts;
+ if (!p)
+ return "";
+ while (*p) {
+ if (*p == '\n') {
+ *p = (char)0;
+ break;
+ }
+ ++p;
+ }
+ return ts;
+}
+
+RethinkDB::RethinkDB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path) :
+ DB(nc,myId,path),
+ _ready(2), // two tables need to be synchronized before we're ready, so this is ready when it reaches 0
+ _run(1),
+ _waitNoticePrinted(false)
+{
+ // rethinkdb:host:port:db[:auth]
+ std::vector<std::string> ps(OSUtils::split(path,":","",""));
+ if ((ps.size() < 4)||(ps[0] != "rethinkdb"))
+ throw std::runtime_error("invalid rethinkdb database url");
+ _host = ps[1];
+ _port = Utils::strToInt(ps[2].c_str());
+ _db = ps[3];
+ if (ps.size() > 4)
+ _auth = ps[4];
+
+ _readyLock.lock();
+
+ _membersDbWatcher = std::thread([this]() {
+ try {
+ while (_run == 1) {
+ try {
+ std::unique_ptr<R::Connection> rdb(R::connect(this->_host,this->_port,this->_auth));
+ if (rdb) {
+ _membersDbWatcherConnection = (void *)rdb.get();
+ auto cur = R::db(this->_db).table("Member",R::optargs("read_mode","outdated")).get_all(this->_myAddressStr,R::optargs("index","controllerId")).changes(R::optargs("squash",0.05,"include_initial",true,"include_types",true,"include_states",true)).run(*rdb);
+ while (cur.has_next()) {
+ if (_run != 1) break;
+ json tmp(json::parse(cur.next().as_json()));
+ if ((tmp["type"] == "state")&&(tmp["state"] == "ready")) {
+ if (--this->_ready == 0) {
+ if (_waitNoticePrinted)
+ fprintf(stderr,"[%s] NOTICE: %.10llx controller RethinkDB data download complete." ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ this->_readyLock.unlock();
+ }
+ } else {
+ try {
+ json &ov = tmp["old_val"];
+ json &nv = tmp["new_val"];
+ json oldConfig,newConfig;
+ if (ov.is_object()) oldConfig = ov["config"];
+ if (nv.is_object()) newConfig = nv["config"];
+ if (oldConfig.is_object()||newConfig.is_object())
+ this->_memberChanged(oldConfig,newConfig,(this->_ready <= 0));
+ } catch ( ... ) {} // ignore bad records
+ }
+ }
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (member change stream): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what());
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (member change stream): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str());
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (member change stream): unknown exception" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ }
+ std::this_thread::sleep_for(std::chrono::milliseconds(250));
+ }
+ } catch ( ... ) {}
+ });
+
+ _networksDbWatcher = std::thread([this]() {
+ try {
+ while (_run == 1) {
+ try {
+ std::unique_ptr<R::Connection> rdb(R::connect(this->_host,this->_port,this->_auth));
+ if (rdb) {
+ _networksDbWatcherConnection = (void *)rdb.get();
+ auto cur = R::db(this->_db).table("Network",R::optargs("read_mode","outdated")).get_all(this->_myAddressStr,R::optargs("index","controllerId")).changes(R::optargs("squash",0.05,"include_initial",true,"include_types",true,"include_states",true)).run(*rdb);
+ while (cur.has_next()) {
+ if (_run != 1) break;
+ json tmp(json::parse(cur.next().as_json()));
+ if ((tmp["type"] == "state")&&(tmp["state"] == "ready")) {
+ if (--this->_ready == 0) {
+ if (_waitNoticePrinted)
+ fprintf(stderr,"[%s] NOTICE: %.10llx controller RethinkDB data download complete." ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ this->_readyLock.unlock();
+ }
+ } else {
+ try {
+ json &ov = tmp["old_val"];
+ json &nv = tmp["new_val"];
+ json oldConfig,newConfig;
+ if (ov.is_object()) oldConfig = ov["config"];
+ if (nv.is_object()) newConfig = nv["config"];
+ if (oldConfig.is_object()||newConfig.is_object())
+ this->_networkChanged(oldConfig,newConfig,(this->_ready <= 0));
+ } catch ( ... ) {} // ignore bad records
+ }
+ }
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (network change stream): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what());
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (network change stream): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str());
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (network change stream): unknown exception" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ }
+ std::this_thread::sleep_for(std::chrono::milliseconds(250));
+ }
+ } catch ( ... ) {}
+ });
+
+ for(int t=0;t<ZT_CONTROLLER_RETHINKDB_COMMIT_THREADS;++t) {
+ _commitThread[t] = std::thread([this]() {
+ try {
+ std::unique_ptr<R::Connection> rdb;
+ nlohmann::json *config = (nlohmann::json *)0;
+ while ((this->_commitQueue.get(config))&&(_run == 1)) {
+ if (!config)
+ continue;
+ nlohmann::json record;
+ const char *table = (const char *)0;
+ std::string deleteId;
+ try {
+ const std::string objtype = (*config)["objtype"];
+ if (objtype == "member") {
+ const std::string nwid = (*config)["nwid"];
+ const std::string id = (*config)["id"];
+ record["id"] = nwid + "-" + id;
+ record["controllerId"] = this->_myAddressStr;
+ record["networkId"] = nwid;
+ record["nodeId"] = id;
+ record["config"] = *config;
+ table = "Member";
+ } else if (objtype == "network") {
+ const std::string id = (*config)["id"];
+ record["id"] = id;
+ record["controllerId"] = this->_myAddressStr;
+ record["config"] = *config;
+ table = "Network";
+ } else if (objtype == "trace") {
+ record = *config;
+ table = "RemoteTrace";
+ } else if (objtype == "_delete_network") {
+ deleteId = (*config)["id"];
+ table = "Network";
+ } else if (objtype == "_delete_member") {
+ deleteId = (*config)["nwid"];
+ deleteId.push_back('-');
+ const std::string tmp = (*config)["id"];
+ deleteId.append(tmp);
+ table = "Member";
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update record creation): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what());
+ table = (const char *)0;
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update record creation): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str());
+ table = (const char *)0;
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update record creation): unknown exception" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ table = (const char *)0;
+ }
+ delete config;
+ if (!table)
+ continue;
+ const std::string jdump(OSUtils::jsonDump(record,-1));
+
+ while (_run == 1) {
+ try {
+ if (!rdb)
+ rdb = R::connect(this->_host,this->_port,this->_auth);
+ if (rdb) {
+ if (deleteId.length() > 0) {
+ //printf("DELETE: %s" ZT_EOL_S,deleteId.c_str());
+ R::db(this->_db).table(table).get(deleteId).delete_().run(*rdb);
+ } else {
+ //printf("UPSERT: %s" ZT_EOL_S,record.dump().c_str());
+ R::db(this->_db).table(table).insert(R::Datum::from_json(jdump),R::optargs("conflict","update","return_changes",false)).run(*rdb);
+ }
+ break;
+ } else {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update): connect failed (will retry)" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ rdb.reset();
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update): %s [%s]" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what(),jdump.c_str());
+ rdb.reset();
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update): %s [%s]" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str(),jdump.c_str());
+ rdb.reset();
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update): unknown exception [%s]" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),jdump.c_str());
+ rdb.reset();
+ }
+ std::this_thread::sleep_for(std::chrono::milliseconds(250));
+ }
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update outer loop): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what());
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update outer loop): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str());
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (insert/update outer loop): unknown exception" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ }
+ });
+ }
+
+ _onlineNotificationThread = std::thread([this]() {
+ int64_t lastUpdatedNetworkStatus = 0;
+ std::unordered_map< std::pair<uint64_t,uint64_t>,int64_t,_PairHasher > lastOnlineCumulative;
+ try {
+ std::unique_ptr<R::Connection> rdb;
+ while (_run == 1) {
+ try {
+ if (!rdb)
+ rdb = R::connect(this->_host,this->_port,this->_auth);
+ if (rdb) {
+ R::Array batch;
+ R::Object tmpobj;
+
+ std::unordered_map< std::pair<uint64_t,uint64_t>,std::pair<int64_t,InetAddress>,_PairHasher > lastOnline;
+ {
+ std::lock_guard<std::mutex> l(_lastOnline_l);
+ lastOnline.swap(_lastOnline);
+ }
+
+ for(auto i=lastOnline.begin();i!=lastOnline.end();++i) {
+ lastOnlineCumulative[i->first] = i->second.first;
+ char tmp[64],tmp2[64];
+ OSUtils::ztsnprintf(tmp,sizeof(tmp),"%.16llx-%.10llx",i->first.first,i->first.second);
+ tmpobj["id"] = tmp;
+ tmpobj["ts"] = i->second.first;
+ tmpobj["phy"] = i->second.second.toIpString(tmp2);
+ batch.emplace_back(tmpobj);
+ if (batch.size() >= 1024) {
+ R::db(this->_db).table("MemberStatus",R::optargs("read_mode","outdated")).insert(batch,R::optargs("conflict","update")).run(*rdb);
+ batch.clear();
+ }
+ }
+ if (batch.size() > 0) {
+ R::db(this->_db).table("MemberStatus",R::optargs("read_mode","outdated")).insert(batch,R::optargs("conflict","update")).run(*rdb);
+ batch.clear();
+ }
+ tmpobj.clear();
+
+ const int64_t now = OSUtils::now();
+ if ((now - lastUpdatedNetworkStatus) > 10000) {
+ lastUpdatedNetworkStatus = now;
+
+ std::vector< std::pair< uint64_t,std::shared_ptr<_Network> > > networks;
+ {
+ std::lock_guard<std::mutex> l(_networks_l);
+ networks.reserve(_networks.size() + 1);
+ for(auto i=_networks.begin();i!=_networks.end();++i)
+ networks.push_back(*i);
+ }
+
+ for(auto i=networks.begin();i!=networks.end();++i) {
+ char tmp[64];
+ Utils::hex(i->first,tmp);
+ tmpobj["id"] = tmp;
+ {
+ std::lock_guard<std::mutex> l2(i->second->lock);
+ tmpobj["authorizedMemberCount"] = i->second->authorizedMembers.size();
+ tmpobj["totalMemberCount"] = i->second->members.size();
+ unsigned long onlineMemberCount = 0;
+ for(auto m=i->second->members.begin();m!=i->second->members.end();++m) {
+ auto lo = lastOnlineCumulative.find(std::pair<uint64_t,uint64_t>(i->first,m->first));
+ if (lo != lastOnlineCumulative.end()) {
+ if ((now - lo->second) <= (ZT_NETWORK_AUTOCONF_DELAY * 2))
+ ++onlineMemberCount;
+ else lastOnlineCumulative.erase(lo);
+ }
+ }
+ tmpobj["onlineMemberCount"] = onlineMemberCount;
+ tmpobj["bridgeCount"] = i->second->activeBridgeMembers.size();
+ tmpobj["ts"] = now;
+ }
+ batch.emplace_back(tmpobj);
+ if (batch.size() >= 1024) {
+ R::db(this->_db).table("NetworkStatus",R::optargs("read_mode","outdated")).insert(batch,R::optargs("conflict","update")).run(*rdb);
+ batch.clear();
+ }
+ }
+ if (batch.size() > 0) {
+ R::db(this->_db).table("NetworkStatus",R::optargs("read_mode","outdated")).insert(batch,R::optargs("conflict","update")).run(*rdb);
+ batch.clear();
+ }
+ }
+ }
+ } catch (std::exception &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (node status update): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.what());
+ rdb.reset();
+ } catch (R::Error &e) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (node status update): %s" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt(),e.message.c_str());
+ rdb.reset();
+ } catch ( ... ) {
+ fprintf(stderr,"[%s] ERROR: %.10llx controller RethinkDB (node status update): unknown exception" ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ rdb.reset();
+ }
+ std::this_thread::sleep_for(std::chrono::milliseconds(250));
+ }
+ } catch ( ... ) {}
+ });
+
+ _heartbeatThread = std::thread([this]() {
+ try {
+ R::Object controllerRecord;
+ std::unique_ptr<R::Connection> rdb;
+
+ {
+ char publicId[1024];
+ //char secretId[1024];
+ char hostname[1024];
+ this->_myId.toString(false,publicId);
+ //this->_myId.toString(true,secretId);
+ if (gethostname(hostname,sizeof(hostname)) != 0) {
+ hostname[0] = (char)0;
+ } else {
+ for(int i=0;i<sizeof(hostname);++i) {
+ if ((hostname[i] == '.')||(hostname[i] == 0)) {
+ hostname[i] = (char)0;
+ break;
+ }
+ }
+ }
+ controllerRecord["id"] = this->_myAddressStr.c_str();
+ controllerRecord["publicIdentity"] = publicId;
+ //controllerRecord["secretIdentity"] = secretId;
+ if (hostname[0])
+ controllerRecord["clusterHost"] = hostname;
+ controllerRecord["vMajor"] = ZEROTIER_ONE_VERSION_MAJOR;
+ controllerRecord["vMinor"] = ZEROTIER_ONE_VERSION_MINOR;
+ controllerRecord["vRev"] = ZEROTIER_ONE_VERSION_REVISION;
+ controllerRecord["vBuild"] = ZEROTIER_ONE_VERSION_BUILD;
+ }
+
+ while (_run == 1) {
+ try {
+ if (!rdb)
+ rdb = R::connect(this->_host,this->_port,this->_auth);
+ if (rdb) {
+ controllerRecord["lastAlive"] = OSUtils::now();
+ //printf("HEARTBEAT: %s" ZT_EOL_S,tmp);
+ R::db(this->_db).table("Controller",R::optargs("read_mode","outdated")).insert(controllerRecord,R::optargs("conflict","update")).run(*rdb);
+ }
+ } catch ( ... ) {
+ rdb.reset();
+ }
+ std::this_thread::sleep_for(std::chrono::milliseconds(1000));
+ }
+ } catch ( ... ) {}
+ });
+}
+
+RethinkDB::~RethinkDB()
+{
+ _run = 0;
+ std::this_thread::sleep_for(std::chrono::milliseconds(100));
+ _commitQueue.stop();
+ for(int t=0;t<ZT_CONTROLLER_RETHINKDB_COMMIT_THREADS;++t)
+ _commitThread[t].join();
+ if (_membersDbWatcherConnection)
+ ((R::Connection *)_membersDbWatcherConnection)->close();
+ if (_networksDbWatcherConnection)
+ ((R::Connection *)_networksDbWatcherConnection)->close();
+ _membersDbWatcher.join();
+ _networksDbWatcher.join();
+ _heartbeatThread.join();
+ _onlineNotificationThread.join();
+}
+
+bool RethinkDB::waitForReady()
+{
+ while (_ready > 0) {
+ if (!_waitNoticePrinted) {
+ _waitNoticePrinted = true;
+ fprintf(stderr,"[%s] NOTICE: %.10llx controller RethinkDB waiting for initial data download..." ZT_EOL_S,_timestr(),(unsigned long long)_myAddress.toInt());
+ }
+ _readyLock.lock();
+ _readyLock.unlock();
+ }
+ return true;
+}
+
+void RethinkDB::save(nlohmann::json *orig,nlohmann::json &record)
+{
+ if (!record.is_object()) // sanity check
+ return;
+ waitForReady();
+ if (orig) {
+ if (*orig != record) {
+ record["revision"] = OSUtils::jsonInt(record["revision"],0ULL) + 1;
+ _commitQueue.post(new nlohmann::json(record));
+ }
+ } else {
+ record["revision"] = 1;
+ _commitQueue.post(new nlohmann::json(record));
+ }
+}
+
+void RethinkDB::eraseNetwork(const uint64_t networkId)
+{
+ char tmp2[24];
+ waitForReady();
+ Utils::hex(networkId,tmp2);
+ json *tmp = new json();
+ (*tmp)["id"] = tmp2;
+ (*tmp)["objtype"] = "_delete_network"; // pseudo-type, tells thread to delete network
+ _commitQueue.post(tmp);
+}
+
+void RethinkDB::eraseMember(const uint64_t networkId,const uint64_t memberId)
+{
+ char tmp2[24];
+ json *tmp = new json();
+ waitForReady();
+ Utils::hex(networkId,tmp2);
+ (*tmp)["nwid"] = tmp2;
+ Utils::hex10(memberId,tmp2);
+ (*tmp)["id"] = tmp2;
+ (*tmp)["objtype"] = "_delete_member"; // pseudo-type, tells thread to delete network
+ _commitQueue.post(tmp);
+}
+
+void RethinkDB::nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress)
+{
+ std::lock_guard<std::mutex> l(_lastOnline_l);
+ std::pair<int64_t,InetAddress> &i = _lastOnline[std::pair<uint64_t,uint64_t>(networkId,memberId)];
+ i.first = OSUtils::now();
+ if (physicalAddress)
+ i.second = physicalAddress;
+}
+
+} // namespace ZeroTier
+
+#endif // ZT_CONTROLLER_USE_RETHINKDB
diff --git a/controller/RethinkDB.hpp b/controller/RethinkDB.hpp
new file mode 100644
index 00000000..b1049ac3
--- /dev/null
+++ b/controller/RethinkDB.hpp
@@ -0,0 +1,84 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2018 ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef ZT_CONTROLLER_USE_RETHINKDB
+
+#ifndef ZT_CONTROLLER_RETHINKDB_HPP
+#define ZT_CONTROLLER_RETHINKDB_HPP
+
+#include "DB.hpp"
+
+#define ZT_CONTROLLER_RETHINKDB_COMMIT_THREADS 4
+
+namespace ZeroTier
+{
+
+/**
+ * A controller database driver that talks to RethinkDB
+ *
+ * This is for use with ZeroTier Central. Others are free to build and use it
+ * but be aware that we might change it at any time.
+ */
+class RethinkDB : public DB
+{
+public:
+ RethinkDB(EmbeddedNetworkController *const nc,const Identity &myId,const char *path);
+ virtual ~RethinkDB();
+
+ virtual bool waitForReady();
+ virtual void save(nlohmann::json *orig,nlohmann::json &record);
+ virtual void eraseNetwork(const uint64_t networkId);
+ virtual void eraseMember(const uint64_t networkId,const uint64_t memberId);
+ virtual void nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress);
+
+protected:
+ struct _PairHasher
+ {
+ inline std::size_t operator()(const std::pair<uint64_t,uint64_t> &p) const { return (std::size_t)(p.first ^ p.second); }
+ };
+
+ std::string _host;
+ std::string _db;
+ std::string _auth;
+ int _port;
+
+ void *_networksDbWatcherConnection;
+ void *_membersDbWatcherConnection;
+ std::thread _networksDbWatcher;
+ std::thread _membersDbWatcher;
+
+ BlockingQueue< nlohmann::json * > _commitQueue;
+ std::thread _commitThread[ZT_CONTROLLER_RETHINKDB_COMMIT_THREADS];
+
+ std::unordered_map< std::pair<uint64_t,uint64_t>,std::pair<int64_t,InetAddress>,_PairHasher > _lastOnline;
+ mutable std::mutex _lastOnline_l;
+ std::thread _onlineNotificationThread;
+
+ std::thread _heartbeatThread;
+
+ mutable std::mutex _readyLock; // locked until ready
+ std::atomic<int> _ready;
+ std::atomic<int> _run;
+ mutable volatile bool _waitNoticePrinted;
+};
+
+} // namespace ZeroTier
+
+#endif
+
+#endif // ZT_CONTROLLER_USE_RETHINKDB
diff --git a/controller/migrate-sqlite/migrate.js b/controller/migrate-sqlite/migrate.js
deleted file mode 100644
index ac9678a7..00000000
--- a/controller/migrate-sqlite/migrate.js
+++ /dev/null
@@ -1,320 +0,0 @@
-'use strict';
-
-var sqlite3 = require('sqlite3').verbose();
-var fs = require('fs');
-var async = require('async');
-
-function blobToIPv4(b)
-{
- if (!b)
- return null;
- if (b.length !== 16)
- return null;
- return b.readUInt8(12).toString()+'.'+b.readUInt8(13).toString()+'.'+b.readUInt8(14).toString()+'.'+b.readUInt8(15).toString();
-}
-function blobToIPv6(b)
-{
- if (!b)
- return null;
- if (b.length !== 16)
- return null;
- var s = '';
- for(var i=0;i<16;++i) {
- var x = b.readUInt8(i).toString(16);
- if (x.length === 1)
- s += '0';
- s += x;
- if ((((i+1) & 1) === 0)&&(i !== 15))
- s += ':';
- }
- return s;
-}
-
-if (process.argv.length !== 4) {
- console.log('ZeroTier Old Sqlite3 Controller DB Migration Utility');
- console.log('(c)2017 ZeroTier, Inc. [GPL3]');
- console.log('');
- console.log('Usage: node migrate.js </path/to/controller.db> </path/to/controller.d>');
- console.log('');
- console.log('The first argument must be the path to the old Sqlite3 controller.db');
- console.log('file. The second must be the path to the EMPTY controller.d database');
- console.log('directory for a new (1.1.17 or newer) controller. If this path does');
- console.log('not exist it will be created.');
- console.log('');
- console.log('WARNING: this will ONLY work correctly on a 1.1.14 controller database.');
- console.log('If your controller is old you should first upgrade to 1.1.14 and run the');
- console.log('controller so that it will brings its Sqlite3 database up to the latest');
- console.log('version before running this migration.');
- console.log('');
- process.exit(1);
-}
-
-var oldDbPath = process.argv[2];
-var newDbPath = process.argv[3];
-
-console.log('Starting migrate of "'+oldDbPath+'" to "'+newDbPath+'"...');
-console.log('');
-
-var old = new sqlite3.Database(oldDbPath);
-
-var networks = {};
-
-var nodeIdentities = {};
-var networkCount = 0;
-var memberCount = 0;
-var routeCount = 0;
-var ipAssignmentPoolCount = 0;
-var ipAssignmentCount = 0;
-var ruleCount = 0;
-var oldSchemaVersion = -1;
-
-async.series([function(nextStep) {
-
- old.each('SELECT v from Config WHERE k = \'schemaVersion\'',function(err,row) {
- oldSchemaVersion = parseInt(row.v)||-1;
- },nextStep);
-
-},function(nextStep) {
-
- if (oldSchemaVersion !== 4) {
- console.log('FATAL: this MUST be run on a 1.1.14 controller.db! Upgrade your old');
- console.log('controller to 1.1.14 first and run it once to bring its DB up to date.');
- return process.exit(1);
- }
-
- console.log('Reading networks...');
- old.each('SELECT * FROM Network',function(err,row) {
- if ((typeof row.id === 'string')&&(row.id.length === 16)) {
- var flags = parseInt(row.flags)||0;
- networks[row.id] = {
- id: row.id,
- nwid: row.id,
- objtype: 'network',
- authTokens: [],
- capabilities: [],
- creationTime: parseInt(row.creationTime)||0,
- enableBroadcast: !!row.enableBroadcast,
- ipAssignmentPools: [],
- lastModified: Date.now(),
- multicastLimit: row.multicastLimit||32,
- name: row.name||'',
- private: !!row.private,
- revision: parseInt(row.revision)||1,
- rules: [{ 'type': 'ACTION_ACCEPT' }], // populated later if there are defined rules, otherwise default is allow all
- routes: [],
- v4AssignMode: {
- 'zt': ((flags & 1) !== 0)
- },
- v6AssignMode: {
- '6plane': ((flags & 4) !== 0),
- 'rfc4193': ((flags & 2) !== 0),
- 'zt': ((flags & 8) !== 0)
- },
- _members: {} // temporary
- };
- ++networkCount;
- //console.log(networks[row.id]);
- }
- },nextStep);
-
-},function(nextStep) {
-
- console.log(' '+networkCount+' networks.');
- console.log('Reading network route definitions...');
- old.each('SELECT * from Route WHERE ipVersion = 4 OR ipVersion = 6',function(err,row) {
- var network = networks[row.networkId];
- if (network) {
- var rt = {
- target: (((row.ipVersion == 4) ? blobToIPv4(row.target) : blobToIPv6(row.target))+'/'+row.targetNetmaskBits),
- via: ((row.via) ? ((row.ipVersion == 4) ? blobToIPv4(row.via) : blobToIPv6(row.via)) : null)
- };
- network.routes.push(rt);
- ++routeCount;
- }
- },nextStep);
-
-},function(nextStep) {
-
- console.log(' '+routeCount+' routes in '+networkCount+' networks.');
- console.log('Reading IP assignment pools...');
- old.each('SELECT * FROM IpAssignmentPool WHERE ipVersion = 4 OR ipVersion = 6',function(err,row) {
- var network = networks[row.networkId];
- if (network) {
- var p = {
- ipRangeStart: ((row.ipVersion == 4) ? blobToIPv4(row.ipRangeStart) : blobToIPv6(row.ipRangeStart)),
- ipRangeEnd: ((row.ipVersion == 4) ? blobToIPv4(row.ipRangeEnd) : blobToIPv6(row.ipRangeEnd))
- };
- network.ipAssignmentPools.push(p);
- ++ipAssignmentPoolCount;
- }
- },nextStep);
-
-},function(nextStep) {
-
- console.log(' '+ipAssignmentPoolCount+' IP assignment pools in '+networkCount+' networks.');
- console.log('Reading known node identities...');
- old.each('SELECT * FROM Node',function(err,row) {
- nodeIdentities[row.id] = row.identity;
- },nextStep);
-
-},function(nextStep) {
-
- console.log(' '+Object.keys(nodeIdentities).length+' known identities.');
- console.log('Reading network members...');
- old.each('SELECT * FROM Member',function(err,row) {
- var network = networks[row.networkId];
- if (network) {
- network._members[row.nodeId] = {
- id: row.nodeId,
- address: row.nodeId,
- objtype: 'member',
- authorized: !!row.authorized,
- activeBridge: !!row.activeBridge,
- authHistory: [],
- capabilities: [],
- creationTime: 0,
- identity: nodeIdentities[row.nodeId]||null,
- ipAssignments: [],
- lastAuthorizedTime: (row.authorized) ? Date.now() : 0,
- lastDeauthorizedTime: (row.authorized) ? 0 : Date.now(),
- lastModified: Date.now(),
- lastRequestMetaData: '',
- noAutoAssignIps: false,
- nwid: row.networkId,
- revision: parseInt(row.memberRevision)||1,
- tags: [],
- recentLog: []
- };
- ++memberCount;
- //console.log(network._members[row.nodeId]);
- }
- },nextStep);
-
-},function(nextStep) {
-
- console.log(' '+memberCount+' members of '+networkCount+' networks.');
- console.log('Reading static IP assignments...');
- old.each('SELECT * FROM IpAssignment WHERE ipVersion = 4 OR ipVersion = 6',function(err,row) {
- var network = networks[row.networkId];
- if (network) {
- var member = network._members[row.nodeId];
- if ((member)&&((member.authorized)||(!network['private']))) { // don't mirror assignments to unauthorized members to avoid conflicts
- if (row.ipVersion == 4) {
- member.ipAssignments.push(blobToIPv4(row.ip));
- ++ipAssignmentCount;
- } else if (row.ipVersion == 6) {
- member.ipAssignments.push(blobToIPv6(row.ip));
- ++ipAssignmentCount;
- }
- }
- }
- },nextStep);
-
-},function(nextStep) {
-
- // Old versions only supported Ethertype whitelisting, so that's
- // all we mirror forward. The other fields were always unused.
-
- console.log(' '+ipAssignmentCount+' IP assignments for '+memberCount+' authorized members of '+networkCount+' networks.');
- console.log('Reading allowed Ethernet types (old basic rules)...');
- var etherTypesByNetwork = {};
- old.each('SELECT DISTINCT networkId,ruleNo,etherType FROM Rule WHERE "action" = \'accept\'',function(err,row) {
- if (row.networkId in networks) {
- var et = parseInt(row.etherType)||0;
- var ets = etherTypesByNetwork[row.networkId];
- if (!ets)
- etherTypesByNetwork[row.networkId] = [ et ];
- else ets.push(et);
- }
- },function(err) {
- if (err) return nextStep(err);
- for(var nwid in etherTypesByNetwork) {
- var ets = etherTypesByNetwork[nwid].sort();
- var network = networks[nwid];
- if (network) {
- var rules = [];
- if (ets.indexOf(0) >= 0) {
- // If 0 is in the list, all Ethernet types are allowed so we accept all.
- rules.push({ 'type': 'ACTION_ACCEPT' });
- } else {
- // Otherwise we whitelist.
- for(var i=0;i<ets.length;++i) {
- rules.push({
- 'etherType': ets[i],
- 'not': true,
- 'or': false,
- 'type': 'MATCH_ETHERTYPE'
- });
- }
- rules.push({ 'type': 'ACTION_DROP' });
- rules.push({ 'type': 'ACTION_ACCEPT' });
- }
- network.rules = rules;
- ++ruleCount;
- }
- }
- return nextStep(null);
- });
-
-}],function(err) {
-
- if (err) {
- console.log('FATAL: '+err.toString());
- return process.exit(1);
- }
-
- console.log(' '+ruleCount+' ethernet type whitelists converted to new format rules.');
- old.close();
- console.log('Done reading and converting Sqlite3 database! Writing JSONDB files...');
-
- try {
- fs.mkdirSync(newDbPath,0o700);
- } catch (e) {}
- var nwBase = newDbPath+'/network';
- try {
- fs.mkdirSync(nwBase,0o700);
- } catch (e) {}
- nwBase = nwBase + '/';
- var nwids = Object.keys(networks).sort();
- var fileCount = 0;
- for(var ni=0;ni<nwids.length;++ni) {
- var network = networks[nwids[ni]];
-
- var mids = Object.keys(network._members).sort();
- if (mids.length > 0) {
- try {
- fs.mkdirSync(nwBase+network.id);
- } catch (e) {}
- var mbase = nwBase+network.id+'/member';
- try {
- fs.mkdirSync(mbase,0o700);
- } catch (e) {}
- mbase = mbase + '/';
-
- for(var mi=0;mi<mids.length;++mi) {
- var member = network._members[mids[mi]];
- fs.writeFileSync(mbase+member.id+'.json',JSON.stringify(member,null,1),{ mode: 0o600 });
- ++fileCount;
- //console.log(mbase+member.id+'.json');
- }
- }
-
- delete network._members; // temporary field, not part of actual JSONDB, so don't write
- fs.writeFileSync(nwBase+network.id+'.json',JSON.stringify(network,null,1),{ mode: 0o600 });
- ++fileCount;
- //console.log(nwBase+network.id+'.json');
- }
-
- console.log('');
- console.log('SUCCESS! Wrote '+fileCount+' JSONDB files.');
-
- console.log('');
- console.log('You should still inspect the new DB before going live. Also be sure');
- console.log('to "chown -R" and "chgrp -R" the new DB to the user and group under');
- console.log('which the ZeroTier One instance acting as controller will be running.');
- console.log('The controller must be able to read and write the DB, of course.');
- console.log('');
- console.log('Have fun!');
-
- return process.exit(0);
-});
diff --git a/controller/migrate-sqlite/package.json b/controller/migrate-sqlite/package.json
deleted file mode 100644
index 0dac008f..00000000
--- a/controller/migrate-sqlite/package.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
- "name": "migrate-sqlite",
- "version": "1.0.0",
- "description": "Migrate old SQLite to new JSON filesystem DB for ZeroTier network controller",
- "main": "migrate.js",
- "scripts": {
- "test": "echo \"Error: no test specified\" && exit 1"
- },
- "author": "Adam Ierymenko <adam.ierymenko@zerotier.com>",
- "license": "GPL-3.0",
- "dependencies": {
- "async": "^2.1.4",
- "sqlite3": "^3.1.8"
- }
-}
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-02 23:30:37 +0000