summaryrefslogtreecommitdiff
path: root/service
diff options
context:
space:
mode:
Diffstat (limited to 'service')
-rw-r--r--service/ControlPlane.cpp2
-rw-r--r--service/OneService.cpp369
-rw-r--r--service/OneService.hpp5
-rw-r--r--service/SoftwareUpdater.cpp397
-rw-r--r--service/SoftwareUpdater.hpp215
5 files changed, 680 insertions, 308 deletions
diff --git a/service/ControlPlane.cpp b/service/ControlPlane.cpp
index 3bdfdf1b..86158a91 100644
--- a/service/ControlPlane.cpp
+++ b/service/ControlPlane.cpp
@@ -515,7 +515,7 @@ unsigned int ControlPlane::handleRequest(
_svc->getNetworkSettings(nws->networks[i].nwid,localSettings);
try {
- nlohmann::json j(nlohmann::json::parse(body));
+ nlohmann::json j(OSUtils::jsonParse(body));
if (j.is_object()) {
nlohmann::json &allowManaged = j["allowManaged"];
if (allowManaged.is_boolean()) localSettings.allowManaged = (bool)allowManaged;
diff --git a/service/OneService.cpp b/service/OneService.cpp
index 3a7edacb..0fd8496d 100644
--- a/service/OneService.cpp
+++ b/service/OneService.cpp
@@ -52,6 +52,7 @@
#include "ControlPlane.hpp"
#include "ClusterGeoIpService.hpp"
#include "ClusterDefinition.hpp"
+#include "SoftwareUpdater.hpp"
#ifdef ZT_USE_SYSTEM_HTTP_PARSER
#include <http_parser.h>
@@ -148,261 +149,6 @@ namespace ZeroTier {
namespace {
-static uint64_t _jI(const json &jv,const uint64_t dfl)
-{
- if (jv.is_number()) {
- return (uint64_t)jv;
- } else if (jv.is_string()) {
- std::string s = jv;
- return Utils::strToU64(s.c_str());
- } else if (jv.is_boolean()) {
- return ((bool)jv ? 1ULL : 0ULL);
- }
- return dfl;
-}
-static bool _jB(const json &jv,const bool dfl)
-{
- if (jv.is_boolean()) {
- return (bool)jv;
- } else if (jv.is_number()) {
- return ((uint64_t)jv > 0ULL);
- } else if (jv.is_string()) {
- std::string s = jv;
- if (s.length() > 0) {
- switch(s[0]) {
- case 't':
- case 'T':
- case '1':
- return true;
- }
- }
- return false;
- }
- return dfl;
-}
-static std::string _jS(const json &jv,const char *dfl)
-{
- if (jv.is_string()) {
- return jv;
- } else if (jv.is_number()) {
- char tmp[64];
- Utils::snprintf(tmp,sizeof(tmp),"%llu",(uint64_t)jv);
- return tmp;
- } else if (jv.is_boolean()) {
- return ((bool)jv ? std::string("1") : std::string("0"));
- }
- return std::string((dfl) ? dfl : "");
-}
-
-#ifdef ZT_AUTO_UPDATE
-#define ZT_AUTO_UPDATE_MAX_HTTP_RESPONSE_SIZE (1024 * 1024 * 64)
-#define ZT_AUTO_UPDATE_CHECK_PERIOD 21600000
-class BackgroundSoftwareUpdateChecker
-{
-public:
- bool isValidSigningIdentity(const Identity &id)
- {
- return (
- /* 0001 - 0004 : obsolete, used in old versions */
- /* 0005 */ (id == Identity("ba57ea350e:0:9d4be6d7f86c5660d5ee1951a3d759aa6e12a84fc0c0b74639500f1dbc1a8c566622e7d1c531967ebceb1e9d1761342f88324a8ba520c93c35f92f35080fa23f"))
- /* 0006 */ ||(id == Identity("5067b21b83:0:8af477730f5055c48135b84bed6720a35bca4c0e34be4060a4c636288b1ec22217eb22709d610c66ed464c643130c51411bbb0294eef12fbe8ecc1a1e2c63a7a"))
- /* 0007 */ ||(id == Identity("4f5e97a8f1:0:57880d056d7baeb04bbc057d6f16e6cb41388570e87f01492fce882485f65a798648595610a3ad49885604e7fb1db2dd3c2c534b75e42c3c0b110ad07b4bb138"))
- /* 0008 */ ||(id == Identity("580bbb8e15:0:ad5ef31155bebc6bc413991992387e083fed26d699997ef76e7c947781edd47d1997161fa56ba337b1a2b44b129fd7c7197ce5185382f06011bc88d1363b4ddd"))
- );
- }
-
- void doUpdateCheck()
- {
- std::string url(OneService::autoUpdateUrl());
- if ((url.length() <= 7)||(url.substr(0,7) != "http://"))
- return;
-
- std::string httpHost;
- std::string httpPath;
- {
- std::size_t slashIdx = url.substr(7).find_first_of('/');
- if (slashIdx == std::string::npos) {
- httpHost = url.substr(7);
- httpPath = "/";
- } else {
- httpHost = url.substr(7,slashIdx);
- httpPath = url.substr(slashIdx + 7);
- }
- }
- if (httpHost.length() == 0)
- return;
-
- std::vector<InetAddress> ips(OSUtils::resolve(httpHost.c_str()));
- for(std::vector<InetAddress>::iterator ip(ips.begin());ip!=ips.end();++ip) {
- if (!ip->port())
- ip->setPort(80);
- std::string nfoPath = httpPath + "LATEST.nfo";
- std::map<std::string,std::string> requestHeaders,responseHeaders;
- std::string body;
- requestHeaders["Host"] = httpHost;
- unsigned int scode = Http::GET(ZT_AUTO_UPDATE_MAX_HTTP_RESPONSE_SIZE,60000,reinterpret_cast<const struct sockaddr *>(&(*ip)),nfoPath.c_str(),requestHeaders,responseHeaders,body);
- //fprintf(stderr,"UPDATE %s %s %u %lu\n",ip->toString().c_str(),nfoPath.c_str(),scode,body.length());
- if ((scode == 200)&&(body.length() > 0)) {
- /* NFO fields:
- *
- * file=<filename>
- * signedBy=<signing identity>
- * ed25519=<ed25519 ECC signature of archive in hex>
- * vMajor=<major version>
- * vMinor=<minor version>
- * vRevision=<revision> */
- Dictionary<4096> nfo(body.c_str());
- char tmp[2048];
-
- if (nfo.get("vMajor",tmp,sizeof(tmp)) <= 0) return;
- const unsigned int vMajor = Utils::strToUInt(tmp);
- if (nfo.get("vMinor",tmp,sizeof(tmp)) <= 0) return;
- const unsigned int vMinor = Utils::strToUInt(tmp);
- if (nfo.get("vRevision",tmp,sizeof(tmp)) <= 0) return;
- const unsigned int vRevision = Utils::strToUInt(tmp);
- if (Utils::compareVersion(vMajor,vMinor,vRevision,ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION) <= 0) {
- //fprintf(stderr,"UPDATE %u.%u.%u is not newer than our version\n",vMajor,vMinor,vRevision);
- return;
- }
-
- if (nfo.get("signedBy",tmp,sizeof(tmp)) <= 0) return;
- Identity signedBy;
- if ((!signedBy.fromString(tmp))||(!isValidSigningIdentity(signedBy))) {
- //fprintf(stderr,"UPDATE invalid signedBy or not authorized signing identity.\n");
- return;
- }
-
- if (nfo.get("file",tmp,sizeof(tmp)) <= 0) return;
- std::string filePath(tmp);
- if ((!filePath.length())||(filePath.find("..") != std::string::npos))
- return;
- filePath = httpPath + filePath;
-
- std::string fileData;
- if (Http::GET(ZT_AUTO_UPDATE_MAX_HTTP_RESPONSE_SIZE,60000,reinterpret_cast<const struct sockaddr *>(&(*ip)),filePath.c_str(),requestHeaders,responseHeaders,fileData) != 200) {
- //fprintf(stderr,"UPDATE GET %s failed\n",filePath.c_str());
- return;
- }
-
- if (nfo.get("ed25519",tmp,sizeof(tmp)) <= 0) return;
- std::string ed25519(Utils::unhex(tmp));
- if ((ed25519.length() == 0)||(!signedBy.verify(fileData.data(),(unsigned int)fileData.length(),ed25519.data(),(unsigned int)ed25519.length()))) {
- //fprintf(stderr,"UPDATE %s failed signature check!\n",filePath.c_str());
- return;
- }
-
- /* --------------------------------------------------------------- */
- /* We made it! Begin OS-specific installation code. */
-
-#ifdef __APPLE__
- /* OSX version is in the form of a MacOSX .pkg file, so we will
- * launch installer (normally in /usr/sbin) to install it. It will
- * then turn around and shut down the service, update files, and
- * relaunch. */
- {
- char bashp[128],pkgp[128];
- Utils::snprintf(bashp,sizeof(bashp),"/tmp/ZeroTierOne-update-%u.%u.%u.sh",vMajor,vMinor,vRevision);
- Utils::snprintf(pkgp,sizeof(pkgp),"/tmp/ZeroTierOne-update-%u.%u.%u.pkg",vMajor,vMinor,vRevision);
- FILE *pkg = fopen(pkgp,"w");
- if ((!pkg)||(fwrite(fileData.data(),fileData.length(),1,pkg) != 1)) {
- fclose(pkg);
- unlink(bashp);
- unlink(pkgp);
- fprintf(stderr,"UPDATE error writing %s\n",pkgp);
- return;
- }
- fclose(pkg);
- FILE *bash = fopen(bashp,"w");
- if (!bash) {
- fclose(pkg);
- unlink(bashp);
- unlink(pkgp);
- fprintf(stderr,"UPDATE error writing %s\n",bashp);
- return;
- }
- fprintf(bash,
- "#!/bin/bash\n"
- "export PATH=/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin\n"
- "sleep 1\n"
- "installer -pkg \"%s\" -target /\n"
- "sleep 1\n"
- "rm -f \"%s\" \"%s\"\n"
- "exit 0\n",
- pkgp,
- pkgp,
- bashp);
- fclose(bash);
- long pid = (long)vfork();
- if (pid == 0) {
- setsid(); // detach from parent so that shell isn't killed when parent is killed
- signal(SIGHUP,SIG_IGN);
- signal(SIGTERM,SIG_IGN);
- signal(SIGQUIT,SIG_IGN);
- execl("/bin/bash","/bin/bash",bashp,(char *)0);
- exit(0);
- }
- }
-#endif // __APPLE__
-
-#ifdef __WINDOWS__
- /* Windows version comes in the form of .MSI package that
- * takes care of everything. */
- {
- char tempp[512],batp[512],msip[512],cmdline[512];
- if (GetTempPathA(sizeof(tempp),tempp) <= 0)
- return;
- CreateDirectoryA(tempp,(LPSECURITY_ATTRIBUTES)0);
- Utils::snprintf(batp,sizeof(batp),"%s\\ZeroTierOne-update-%u.%u.%u.bat",tempp,vMajor,vMinor,vRevision);
- Utils::snprintf(msip,sizeof(msip),"%s\\ZeroTierOne-update-%u.%u.%u.msi",tempp,vMajor,vMinor,vRevision);
- FILE *msi = fopen(msip,"wb");
- if ((!msi)||(fwrite(fileData.data(),(size_t)fileData.length(),1,msi) != 1)) {
- fclose(msi);
- return;
- }
- fclose(msi);
- FILE *bat = fopen(batp,"wb");
- if (!bat)
- return;
- fprintf(bat,
- "TIMEOUT.EXE /T 1 /NOBREAK\r\n"
- "NET.EXE STOP \"ZeroTierOneService\"\r\n"
- "TIMEOUT.EXE /T 1 /NOBREAK\r\n"
- "MSIEXEC.EXE /i \"%s\" /qn\r\n"
- "TIMEOUT.EXE /T 1 /NOBREAK\r\n"
- "NET.EXE START \"ZeroTierOneService\"\r\n"
- "DEL \"%s\"\r\n"
- "DEL \"%s\"\r\n",
- msip,
- msip,
- batp);
- fclose(bat);
- STARTUPINFOA si;
- PROCESS_INFORMATION pi;
- memset(&si,0,sizeof(si));
- memset(&pi,0,sizeof(pi));
- Utils::snprintf(cmdline,sizeof(cmdline),"CMD.EXE /c \"%s\"",batp);
- CreateProcessA(NULL,cmdline,NULL,NULL,FALSE,CREATE_NO_WINDOW|CREATE_NEW_PROCESS_GROUP,NULL,NULL,&si,&pi);
- }
-#endif // __WINDOWS__
-
- /* --------------------------------------------------------------- */
-
- return;
- } // else try to fetch from next IP address
- }
- }
-
- void threadMain()
- throw()
- {
- try {
- this->doUpdateCheck();
- } catch ( ... ) {}
- }
-};
-static BackgroundSoftwareUpdateChecker backgroundSoftwareUpdateChecker;
-#endif // ZT_AUTO_UPDATE
-
static std::string _trimString(const std::string &s)
{
unsigned long end = (unsigned long)s.length();
@@ -517,6 +263,8 @@ public:
EmbeddedNetworkController *_controller;
Phy<OneServiceImpl *> _phy;
Node *_node;
+ SoftwareUpdater *_updater;
+ bool _updateAutoApply;
unsigned int _primaryPort;
// Local configuration and memo-ized static path definitions
@@ -619,6 +367,8 @@ public:
,_controller((EmbeddedNetworkController *)0)
,_phy(this,false,true)
,_node((Node *)0)
+ ,_updater((SoftwareUpdater *)0)
+ ,_updateAutoApply(false)
,_primaryPort(port)
,_controlPlane((ControlPlane *)0)
,_lastDirectReceiveFromGlobal(0)
@@ -743,7 +493,7 @@ public:
std::string lcbuf;
if (OSUtils::readFile((_homePath + ZT_PATH_SEPARATOR_S + "local.conf").c_str(),lcbuf)) {
try {
- _localConfig = json::parse(lcbuf);
+ _localConfig = OSUtils::jsonParse(lcbuf);
if (!_localConfig.is_object()) {
fprintf(stderr,"WARNING: unable to parse local.conf (root element is not a JSON object)" ZT_EOL_S);
}
@@ -756,11 +506,11 @@ public:
json &physical = _localConfig["physical"];
if (physical.is_object()) {
for(json::iterator phy(physical.begin());phy!=physical.end();++phy) {
- InetAddress net(_jS(phy.key(),""));
+ InetAddress net(OSUtils::jsonString(phy.key(),""));
if (net) {
if (phy.value().is_object()) {
uint64_t tpid;
- if ((tpid = _jI(phy.value()["trustedPathId"],0ULL)) != 0ULL) {
+ if ((tpid = OSUtils::jsonInt(phy.value()["trustedPathId"],0ULL)) != 0ULL) {
if ( ((net.ss_family == AF_INET)||(net.ss_family == AF_INET6)) && (trustedPathCount < ZT_MAX_TRUSTED_PATHS) && (net.ipScope() != InetAddress::IP_SCOPE_GLOBAL) && (net.netmaskBits() > 0) ) {
trustedPathIds[trustedPathCount] = tpid;
trustedPathNetworks[trustedPathCount] = net;
@@ -875,7 +625,15 @@ public:
for(int i=0;i<3;++i)
_portsBE[i] = Utils::hton((uint16_t)_ports[i]);
- _controller = new EmbeddedNetworkController(_node,(_homePath + ZT_PATH_SEPARATOR_S + ZT_CONTROLLER_DB_PATH).c_str(),(FILE *)0);
+ // Check for legacy controller.db and terminate if present to prevent nasty surprises for DIY controller folks
+ if (OSUtils::fileExists((_homePath + ZT_PATH_SEPARATOR_S "controller.db").c_str())) {
+ Mutex::Lock _l(_termReason_m);
+ _termReason = ONE_UNRECOVERABLE_ERROR;
+ _fatalErrorMessage = "controller.db is present in our home path! run migrate-sqlite to migrate to new controller.d format.";
+ return _termReason;
+ }
+
+ _controller = new EmbeddedNetworkController(_node,(_homePath + ZT_PATH_SEPARATOR_S ZT_CONTROLLER_DB_PATH).c_str(),(FILE *)0);
_node->setNetconfMaster((void *)_controller);
#ifdef ZT_ENABLE_CLUSTER
@@ -946,10 +704,8 @@ public:
uint64_t lastTapMulticastGroupCheck = 0;
uint64_t lastTcpFallbackResolve = 0;
uint64_t lastBindRefresh = 0;
- uint64_t lastLocalInterfaceAddressCheck = (OSUtils::now() - ZT_LOCAL_INTERFACE_CHECK_INTERVAL) + 15000; // do this in 15s to give portmapper time to configure and other things time to settle
-#ifdef ZT_AUTO_UPDATE
- uint64_t lastSoftwareUpdateCheck = 0;
-#endif // ZT_AUTO_UPDATE
+ uint64_t lastUpdateCheck = clockShouldBe;
+ uint64_t lastLocalInterfaceAddressCheck = (clockShouldBe - ZT_LOCAL_INTERFACE_CHECK_INTERVAL) + 15000; // do this in 15s to give portmapper time to configure and other things time to settle
for(;;) {
_run_m.lock();
if (!_run) {
@@ -971,6 +727,13 @@ public:
restarted = true;
}
+ // Check for updates (if enabled)
+ if ((_updater)&&((now - lastUpdateCheck) > 10000)) {
+ lastUpdateCheck = now;
+ if (_updater->check(now) && _updateAutoApply)
+ _updater->apply();
+ }
+
// Refresh bindings in case device's interfaces have changed, and also sync routes to update any shadow routes (e.g. shadow default)
if (((now - lastBindRefresh) >= ZT_BINDER_REFRESH_PERIOD)||(restarted)) {
lastBindRefresh = now;
@@ -994,13 +757,6 @@ public:
dl = _nextBackgroundTaskDeadline;
}
-#ifdef ZT_AUTO_UPDATE
- if ((now - lastSoftwareUpdateCheck) >= ZT_AUTO_UPDATE_CHECK_PERIOD) {
- lastSoftwareUpdateCheck = now;
- Thread::start(&backgroundSoftwareUpdateChecker);
- }
-#endif // ZT_AUTO_UPDATE
-
if ((now - lastTcpFallbackResolve) >= ZT_TCP_FALLBACK_RERESOLVE_DELAY) {
lastTcpFallbackResolve = now;
_tcpFallbackResolver.resolveNow();
@@ -1070,6 +826,8 @@ public:
delete _controlPlane;
_controlPlane = (ControlPlane *)0;
+ delete _updater;
+ _updater = (SoftwareUpdater *)0;
delete _node;
_node = (Node *)0;
@@ -1163,7 +921,7 @@ public:
if ((nstr.length() == ZT_ADDRESS_LENGTH_HEX)&&(v.value().is_object())) {
const Address ztaddr(nstr.c_str());
if (ztaddr) {
- const std::string rstr(_jS(v.value()["role"],""));
+ const std::string rstr(OSUtils::jsonString(v.value()["role"],""));
_node->setRole(ztaddr.toInt(),((rstr == "upstream")||(rstr == "UPSTREAM")) ? ZT_PEER_ROLE_UPSTREAM : ZT_PEER_ROLE_LEAF);
const uint64_t ztaddr2 = ztaddr.toInt();
@@ -1175,7 +933,7 @@ public:
json &tryAddrs = v.value()["try"];
if (tryAddrs.is_array()) {
for(unsigned long i=0;i<tryAddrs.size();++i) {
- const InetAddress ip(_jS(tryAddrs[i],""));
+ const InetAddress ip(OSUtils::jsonString(tryAddrs[i],""));
if (ip.ss_family == AF_INET)
v4h.push_back(ip);
else if (ip.ss_family == AF_INET6)
@@ -1185,7 +943,7 @@ public:
json &blAddrs = v.value()["blacklist"];
if (blAddrs.is_array()) {
for(unsigned long i=0;i<blAddrs.size();++i) {
- const InetAddress ip(_jS(tryAddrs[i],""));
+ const InetAddress ip(OSUtils::jsonString(tryAddrs[i],""));
if (ip.ss_family == AF_INET)
v4b.push_back(ip);
else if (ip.ss_family == AF_INET6)
@@ -1207,10 +965,10 @@ public:
json &physical = _localConfig["physical"];
if (physical.is_object()) {
for(json::iterator phy(physical.begin());phy!=physical.end();++phy) {
- const InetAddress net(_jS(phy.key(),""));
+ const InetAddress net(OSUtils::jsonString(phy.key(),""));
if ((net)&&(net.netmaskBits() > 0)) {
if (phy.value().is_object()) {
- if (_jB(phy.value()["blacklist"],false)) {
+ if (OSUtils::jsonBool(phy.value()["blacklist"],false)) {
if (net.ss_family == AF_INET)
_globalV4Blacklist.push_back(net);
else if (net.ss_family == AF_INET6)
@@ -1225,17 +983,31 @@ public:
_interfacePrefixBlacklist.clear();
json &settings = _localConfig["settings"];
if (settings.is_object()) {
- const std::string rp(_jS(settings["relayPolicy"],""));
+ const std::string rp(OSUtils::jsonString(settings["relayPolicy"],""));
if ((rp == "always")||(rp == "ALWAYS"))
_node->setRelayPolicy(ZT_RELAY_POLICY_ALWAYS);
else if ((rp == "never")||(rp == "NEVER"))
_node->setRelayPolicy(ZT_RELAY_POLICY_NEVER);
else _node->setRelayPolicy(ZT_RELAY_POLICY_TRUSTED);
+ const std::string up(OSUtils::jsonString(settings["softwareUpdate"],ZT_SOFTWARE_UPDATE_DEFAULT));
+ const bool udist = OSUtils::jsonBool(settings["softwareUpdateDist"],false);
+ if (((up == "apply")||(up == "download"))||(udist)) {
+ if (!_updater)
+ _updater = new SoftwareUpdater(*_node,_homePath);
+ _updateAutoApply = (up == "apply");
+ _updater->setUpdateDistribution(udist);
+ _updater->setChannel(OSUtils::jsonString(settings["softwareUpdateChannel"],ZT_SOFTWARE_UPDATE_DEFAULT_CHANNEL));
+ } else {
+ delete _updater;
+ _updater = (SoftwareUpdater *)0;
+ _updateAutoApply = false;
+ }
+
json &ignoreIfs = settings["interfacePrefixBlacklist"];
if (ignoreIfs.is_array()) {
for(unsigned long i=0;i<ignoreIfs.size();++i) {
- const std::string tmp(_jS(ignoreIfs[i],""));
+ const std::string tmp(OSUtils::jsonString(ignoreIfs[i],""));
if (tmp.length() > 0)
_interfacePrefixBlacklist.push_back(tmp);
}
@@ -1244,7 +1016,7 @@ public:
json &amf = settings["allowManagementFrom"];
if (amf.is_array()) {
for(unsigned long i=0;i<amf.size();++i) {
- const InetAddress nw(_jS(amf[i],""));
+ const InetAddress nw(OSUtils::jsonString(amf[i],""));
if (nw)
_allowManagementFrom.push_back(nw);
}
@@ -1666,6 +1438,16 @@ public:
case ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE:
memcpy(&(n.config),nwc,sizeof(ZT_VirtualNetworkConfig));
if (n.tap) { // sanity check
+#ifdef __WINDOWS__
+ // wait for up to 5 seconds for the WindowsEthernetTap to actually be initialized
+ //
+ // without WindowsEthernetTap::isInitialized() returning true, the won't actually
+ // be online yet and setting managed routes on it will fail.
+ const int MAX_SLEEP_COUNT = 500;
+ for (int i = 0; !n.tap->isInitialized() && i < MAX_SLEEP_COUNT; i++) {
+ Sleep(10);
+ }
+#endif
syncManagedStuff(n,true,true);
} else {
_nets.erase(nwid);
@@ -1717,6 +1499,13 @@ public:
}
} break;
+ case ZT_EVENT_USER_MESSAGE: {
+ const ZT_UserMessage *um = reinterpret_cast<const ZT_UserMessage *>(metaData);
+ if ((um->typeId == ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE)&&(_updater)) {
+ _updater->handleSoftwareUpdateUserMessage(um->origin,um->data,um->length);
+ }
+ } break;
+
default:
break;
}
@@ -2235,30 +2024,6 @@ std::string OneService::platformDefaultHomePath()
return OSUtils::platformDefaultHomePath();
}
-std::string OneService::autoUpdateUrl()
-{
-#ifdef ZT_AUTO_UPDATE
-
-/*
-#if defined(__LINUX__) && ( defined(__i386__) || defined(__x86_64) || defined(__x86_64__) || defined(__amd64) || defined(__i386) )
- if (sizeof(void *) == 8)
- return "http://download.zerotier.com/ZeroTierOneInstaller-linux-x64-LATEST.nfo";
- else return "http://download.zerotier.com/ZeroTierOneInstaller-linux-x86-LATEST.nfo";
-#endif
-*/
-
-#if defined(__APPLE__) && ( defined(__i386__) || defined(__x86_64) || defined(__x86_64__) || defined(__amd64) || defined(__i386) )
- return "http://download.zerotier.com/update/mac_intel/";
-#endif
-
-#ifdef __WINDOWS__
- return "http://download.zerotier.com/update/win_intel/";
-#endif
-
-#endif // ZT_AUTO_UPDATE
- return std::string();
-}
-
OneService *OneService::newInstance(const char *hp,unsigned int port) { return new OneServiceImpl(hp,port); }
OneService::~OneService() {}
diff --git a/service/OneService.hpp b/service/OneService.hpp
index aebc051b..7aa3b361 100644
--- a/service/OneService.hpp
+++ b/service/OneService.hpp
@@ -82,11 +82,6 @@ public:
static std::string platformDefaultHomePath();
/**
- * @return Auto-update URL or empty string if auto-updates unsupported or not enabled
- */
- static std::string autoUpdateUrl();
-
- /**
* Create a new instance of the service
*
* Once created, you must call the run() method to actually start
diff --git a/service/SoftwareUpdater.cpp b/service/SoftwareUpdater.cpp
new file mode 100644
index 00000000..c650ce42
--- /dev/null
+++ b/service/SoftwareUpdater.cpp
@@ -0,0 +1,397 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2016 ZeroTier, Inc. https://www.zerotier.com/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+
+#include "../node/Constants.hpp"
+#include "../version.h"
+
+#ifdef __WINDOWS__
+#include <WinSock2.h>
+#include <Windows.h>
+#include <ShlObj.h>
+#include <netioapi.h>
+#include <iphlpapi.h>
+#else
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <ifaddrs.h>
+#endif
+
+#include "SoftwareUpdater.hpp"
+
+#include "../node/Utils.hpp"
+#include "../node/SHA512.hpp"
+#include "../node/Buffer.hpp"
+#include "../node/Node.hpp"
+
+#include "../osdep/OSUtils.hpp"
+
+#ifndef ZT_BUILD_ARCHITECTURE
+#define ZT_BUILD_ARCHITECTURE 0
+#endif
+#ifndef ZT_BUILD_PLATFORM
+#define ZT_BUILD_PLATFORM 0
+#endif
+
+namespace ZeroTier {
+
+SoftwareUpdater::SoftwareUpdater(Node &node,const std::string &homePath) :
+ _node(node),
+ _lastCheckTime(0),
+ _homePath(homePath),
+ _channel(ZT_SOFTWARE_UPDATE_DEFAULT_CHANNEL),
+ _distLog((FILE *)0),
+ _latestValid(false),
+ _downloadLength(0)
+{
+ // Check for a cached newer update. If there's a cached update that is not newer or looks bad, delete.
+ try {
+ std::string buf;
+ if (OSUtils::readFile((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_META_FILENAME).c_str(),buf)) {
+ nlohmann::json meta = OSUtils::jsonParse(buf);
+ buf = std::string();
+ const unsigned int rvMaj = (unsigned int)OSUtils::jsonInt(meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_MAJOR],0);
+ const unsigned int rvMin = (unsigned int)OSUtils::jsonInt(meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_MINOR],0);
+ const unsigned int rvRev = (unsigned int)OSUtils::jsonInt(meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_REVISION],0);
+ const unsigned int rvBld = (unsigned int)OSUtils::jsonInt(meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_BUILD],0);
+ if ((Utils::compareVersion(rvMaj,rvMin,rvRev,rvBld,ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION,ZEROTIER_ONE_VERSION_BUILD) > 0)&&
+ (OSUtils::readFile((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_BIN_FILENAME).c_str(),buf))) {
+ if ((uint64_t)buf.length() == OSUtils::jsonInt(meta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIZE],0)) {
+ _latestMeta = meta;
+ _latestValid = true;
+ //printf("CACHED UPDATE IS NEWER AND LOOKS GOOD\n");
+ }
+ }
+ }
+ } catch ( ... ) {} // exceptions indicate invalid cached update
+ if (!_latestValid) {
+ OSUtils::rm((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_META_FILENAME).c_str());
+ OSUtils::rm((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_BIN_FILENAME).c_str());
+ }
+}
+
+SoftwareUpdater::~SoftwareUpdater()
+{
+ if (_distLog)
+ fclose(_distLog);
+}
+
+void SoftwareUpdater::setUpdateDistribution(bool distribute)
+{
+ _dist.clear();
+ if (distribute) {
+ _distLog = fopen((_homePath + ZT_PATH_SEPARATOR_S "update-dist.log").c_str(),"a");
+ std::string udd(_homePath + ZT_PATH_SEPARATOR_S "update-dist.d");
+ std::vector<std::string> ud(OSUtils::listDirectory(udd.c_str()));
+ for(std::vector<std::string>::iterator u(ud.begin());u!=ud.end();++u) {
+ // Each update has a companion .json file describing it. Other files are ignored.
+ if ((u->length() > 5)&&(u->substr(u->length() - 5,5) == ".json")) {
+ std::string buf;
+ if (OSUtils::readFile((udd + ZT_PATH_SEPARATOR_S + *u).c_str(),buf)) {
+ try {
+ _D d;
+ d.meta = OSUtils::jsonParse(buf);
+ std::string metaHash = OSUtils::jsonBinFromHex(d.meta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_HASH]);
+ std::string binPath(udd + ZT_PATH_SEPARATOR_S + u->substr(0,u->length() - 5));
+ if ((metaHash.length() == ZT_SHA512_DIGEST_LEN)&&(OSUtils::readFile(binPath.c_str(),d.bin))) {
+ uint8_t sha512[ZT_SHA512_DIGEST_LEN];
+ SHA512::hash(sha512,d.bin.data(),(unsigned int)d.bin.length());
+ if (!memcmp(sha512,metaHash.data(),ZT_SHA512_DIGEST_LEN)) { // double check that hash in JSON is correct
+ d.meta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIZE] = d.bin.length(); // override with correct value -- setting this in meta json is optional
+ _dist[Array<uint8_t,16>(sha512)] = d;
+ if (_distLog) {
+ fprintf(_distLog,".......... INIT: DISTRIBUTING %s (%u bytes)" ZT_EOL_S,binPath.c_str(),(unsigned int)d.bin.length());
+ fflush(_distLog);
+ }
+ }
+ }
+ } catch ( ... ) {} // ignore bad meta JSON, etc.
+ }
+ }
+ }
+ } else {
+ if (_distLog) {
+ fclose(_distLog);
+ _distLog = (FILE *)0;
+ }
+ }
+}
+
+void SoftwareUpdater::handleSoftwareUpdateUserMessage(uint64_t origin,const void *data,unsigned int len)
+{
+ if (!len) return;
+ try {
+ const MessageVerb v = (MessageVerb)reinterpret_cast<const uint8_t *>(data)[0];
+ switch(v) {
+ case VERB_GET_LATEST:
+ case VERB_LATEST: {
+ nlohmann::json req = OSUtils::jsonParse(std::string(reinterpret_cast<const char *>(data) + 1,len - 1));
+ if (req.is_object()) {
+ const unsigned int rvMaj = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_VERSION_MAJOR],0);
+ const unsigned int rvMin = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_VERSION_MINOR],0);
+ const unsigned int rvRev = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_VERSION_REVISION],0);
+ const unsigned int rvBld = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_VERSION_BUILD],0);
+ const unsigned int rvPlatform = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_PLATFORM],0);
+ const unsigned int rvArch = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_ARCHITECTURE],0);
+ const unsigned int rvVendor = (unsigned int)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_VENDOR],0);
+ const std::string rvChannel(OSUtils::jsonString(req[ZT_SOFTWARE_UPDATE_JSON_CHANNEL],""));
+ if (v == VERB_GET_LATEST) {
+
+ if (_dist.size() > 0) {
+ const nlohmann::json *latest = (const nlohmann::json *)0;
+ const std::string expectedSigner = OSUtils::jsonString(req[ZT_SOFTWARE_UPDATE_JSON_EXPECT_SIGNED_BY],"");
+ unsigned int bestVMaj = rvMaj;
+ unsigned int bestVMin = rvMin;
+ unsigned int bestVRev = rvRev;
+ unsigned int bestVBld = rvBld;
+ for(std::map< Array<uint8_t,16>,_D >::const_iterator d(_dist.begin());d!=_dist.end();++d) {
+ if ((OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_PLATFORM],0) == rvPlatform)&&
+ (OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_ARCHITECTURE],0) == rvArch)&&
+ (OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_VENDOR],0) == rvVendor)&&
+ (OSUtils::jsonString(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_CHANNEL],"") == rvChannel)&&
+ (OSUtils::jsonString(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIGNED_BY],"") == expectedSigner)) {
+ const unsigned int dvMaj = (unsigned int)OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_MAJOR],0);
+ const unsigned int dvMin = (unsigned int)OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_MINOR],0);
+ const unsigned int dvRev = (unsigned int)OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_REVISION],0);
+ const unsigned int dvBld = (unsigned int)OSUtils::jsonInt(d->second.meta[ZT_SOFTWARE_UPDATE_JSON_VERSION_BUILD],0);
+ if (Utils::compareVersion(dvMaj,dvMin,dvRev,dvBld,bestVMaj,bestVMin,bestVRev,bestVBld) > 0) {
+ latest = &(d->second.meta);
+ bestVMaj = dvMaj;
+ bestVMin = dvMin;
+ bestVRev = dvRev;
+ bestVBld = dvBld;
+ }
+ }
+ }
+ if (latest) {
+ std::string lj;
+ lj.push_back((char)VERB_LATEST);
+ lj.append(OSUtils::jsonDump(*latest));
+ _node.sendUserMessage(origin,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,lj.data(),(unsigned int)lj.length());
+ if (_distLog) {
+ fprintf(_distLog,"%.10llx GET_LATEST %u.%u.%u_%u platform %u arch %u vendor %u channel %s -> LATEST %u.%u.%u_%u" ZT_EOL_S,(unsigned long long)origin,rvMaj,rvMin,rvRev,rvBld,rvPlatform,rvArch,rvVendor,rvChannel.c_str(),bestVMaj,bestVMin,bestVRev,bestVBld);
+ fflush(_distLog);
+ }
+ }
+ } // else no reply, since we have nothing to distribute
+
+ } else { // VERB_LATEST
+
+ if ((origin == ZT_SOFTWARE_UPDATE_SERVICE)&&
+ (Utils::compareVersion(rvMaj,rvMin,rvRev,rvBld,ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION,ZEROTIER_ONE_VERSION_BUILD) > 0)&&
+ (OSUtils::jsonString(req[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIGNED_BY],"") == ZT_SOFTWARE_UPDATE_SIGNING_AUTHORITY)) {
+ const unsigned long len = (unsigned long)OSUtils::jsonInt(req[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIZE],0);
+ const std::string hash = OSUtils::jsonBinFromHex(req[ZT_SOFTWARE_UPDATE_JSON_UPDATE_HASH]);
+ if ((len <= ZT_SOFTWARE_UPDATE_MAX_SIZE)&&(hash.length() >= 16)) {
+ if (_latestMeta != req) {
+ _latestMeta = req;
+ _latestValid = false;
+
+ OSUtils::rm((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_META_FILENAME).c_str());
+ OSUtils::rm((_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_BIN_FILENAME).c_str());
+
+ _download = std::string();
+ memcpy(_downloadHashPrefix.data,hash.data(),16);
+ _downloadLength = len;
+ }
+
+ if ((_downloadLength > 0)&&(_download.length() < _downloadLength)) {
+ Buffer<128> gd;
+ gd.append((uint8_t)VERB_GET_DATA);
+ gd.append(_downloadHashPrefix.data,16);
+ gd.append((uint32_t)_download.length());
+ _node.sendUserMessage(ZT_SOFTWARE_UPDATE_SERVICE,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,gd.data(),gd.size());
+ //printf(">> GET_DATA @%u\n",(unsigned int)_download.length());
+ }
+ }
+ }
+
+ }
+ }
+ } break;
+
+ case VERB_GET_DATA:
+ if ((len >= 21)&&(_dist.size() > 0)) {
+ unsigned long idx = (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 17) << 24;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 18) << 16;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 19) << 8;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 20);
+ //printf("<< GET_DATA @%u from %.10llx for %s\n",(unsigned int)idx,origin,Utils::hex(reinterpret_cast<const uint8_t *>(data) + 1,16).c_str());
+ std::map< Array<uint8_t,16>,_D >::iterator d(_dist.find(Array<uint8_t,16>(reinterpret_cast<const uint8_t *>(data) + 1)));
+ if ((d != _dist.end())&&(idx < (unsigned long)d->second.bin.length())) {
+ Buffer<ZT_SOFTWARE_UPDATE_CHUNK_SIZE + 128> buf;
+ buf.append((uint8_t)VERB_DATA);
+ buf.append(reinterpret_cast<const uint8_t *>(data) + 1,16);
+ buf.append((uint32_t)idx);
+ buf.append(d->second.bin.data() + idx,std::min((unsigned long)ZT_SOFTWARE_UPDATE_CHUNK_SIZE,(unsigned long)(d->second.bin.length() - idx)));
+ _node.sendUserMessage(origin,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,buf.data(),buf.size());
+ //printf(">> DATA @%u\n",(unsigned int)idx);
+ }
+ }
+ break;
+
+ case VERB_DATA:
+ if ((len >= 21)&&(_downloadLength > 0)&&(!memcmp(_downloadHashPrefix.data,reinterpret_cast<const uint8_t *>(data) + 1,16))) {
+ unsigned long idx = (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 17) << 24;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 18) << 16;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 19) << 8;
+ idx |= (unsigned long)*(reinterpret_cast<const uint8_t *>(data) + 20);
+ //printf("<< DATA @%u / %u bytes (we now have %u bytes)\n",(unsigned int)idx,(unsigned int)(len - 21),(unsigned int)_download.length());
+ if (idx == (unsigned long)_download.length()) {
+ _download.append(reinterpret_cast<const char *>(data) + 21,len - 21);
+ if (_download.length() < _downloadLength) {
+ Buffer<128> gd;
+ gd.append((uint8_t)VERB_GET_DATA);
+ gd.append(_downloadHashPrefix.data,16);
+ gd.append((uint32_t)_download.length());
+ _node.sendUserMessage(ZT_SOFTWARE_UPDATE_SERVICE,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,gd.data(),gd.size());
+ //printf(">> GET_DATA @%u\n",(unsigned int)_download.length());
+ }
+ }
+ }
+ break;
+
+ default:
+ break;
+ }
+ } catch ( ... ) {
+ // Discard bad messages
+ }
+}
+
+bool SoftwareUpdater::check(const uint64_t now)
+{
+ if ((now - _lastCheckTime) >= ZT_SOFTWARE_UPDATE_CHECK_PERIOD) {
+ _lastCheckTime = now;
+ char tmp[512];
+ const unsigned int len = Utils::snprintf(tmp,sizeof(tmp),
+ "%c{\"" ZT_SOFTWARE_UPDATE_JSON_VERSION_MAJOR "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_VERSION_MINOR "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_VERSION_REVISION "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_VERSION_BUILD "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_EXPECT_SIGNED_BY "\":\"%s\","
+ "\"" ZT_SOFTWARE_UPDATE_JSON_PLATFORM "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_ARCHITECTURE "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_VENDOR "\":%d,"
+ "\"" ZT_SOFTWARE_UPDATE_JSON_CHANNEL "\":\"%s\"}",
+ (char)VERB_GET_LATEST,
+ ZEROTIER_ONE_VERSION_MAJOR,
+ ZEROTIER_ONE_VERSION_MINOR,
+ ZEROTIER_ONE_VERSION_REVISION,
+ ZEROTIER_ONE_VERSION_BUILD,
+ ZT_SOFTWARE_UPDATE_SIGNING_AUTHORITY,
+ ZT_BUILD_PLATFORM,
+ ZT_BUILD_ARCHITECTURE,
+ (int)ZT_VENDOR_ZEROTIER,
+ _channel.c_str());
+ _node.sendUserMessage(ZT_SOFTWARE_UPDATE_SERVICE,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,tmp,len);
+ //printf(">> GET_LATEST\n");
+ }
+
+ if (_latestValid)
+ return true;
+
+ if (_downloadLength > 0) {
+ if (_download.length() >= _downloadLength) {
+ // This is the very important security validation part that makes sure
+ // this software update doesn't have cooties.
+
+ const std::string metaPath(_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_META_FILENAME);
+ const std::string binPath(_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_BIN_FILENAME);
+
+ try {
+ // (1) Check the hash itself to make sure the image is basically okay
+ uint8_t sha512[ZT_SHA512_DIGEST_LEN];
+ SHA512::hash(sha512,_download.data(),(unsigned int)_download.length());
+ if (Utils::hex(sha512,ZT_SHA512_DIGEST_LEN) == OSUtils::jsonString(_latestMeta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_HASH],"~")) {
+ // (2) Check signature by signing authority
+ std::string sig(OSUtils::jsonBinFromHex(_latestMeta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIGNATURE]));
+ if (Identity(ZT_SOFTWARE_UPDATE_SIGNING_AUTHORITY).verify(_download.data(),(unsigned int)_download.length(),sig.data(),(unsigned int)sig.length())) {
+ // (3) Try to save file, and if so we are good.
+ if (OSUtils::writeFile(metaPath.c_str(),OSUtils::jsonDump(_latestMeta)) && OSUtils::writeFile(binPath.c_str(),_download)) {
+ OSUtils::lockDownFile(metaPath.c_str(),false);
+ OSUtils::lockDownFile(binPath.c_str(),false);
+ _latestValid = true;
+ //printf("VALID UPDATE\n%s\n",OSUtils::jsonDump(_latestMeta).c_str());
+ _download = std::string();
+ _downloadLength = 0;
+ return true;
+ }
+ }
+ }
+ } catch ( ... ) {} // any exception equals verification failure
+
+ // If we get here, checks failed.
+ //printf("INVALID UPDATE (!!!)\n%s\n",OSUtils::jsonDump(_latestMeta).c_str());
+ OSUtils::rm(metaPath.c_str());
+ OSUtils::rm(binPath.c_str());
+ _latestMeta = nlohmann::json();
+ _latestValid = false;
+ _download = std::string();
+ _downloadLength = 0;
+ } else {
+ Buffer<128> gd;
+ gd.append((uint8_t)VERB_GET_DATA);
+ gd.append(_downloadHashPrefix.data,16);
+ gd.append((uint32_t)_download.length());
+ _node.sendUserMessage(ZT_SOFTWARE_UPDATE_SERVICE,ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE,gd.data(),gd.size());
+ //printf(">> GET_DATA @%u\n",(unsigned int)_download.length());
+ }
+ }
+
+ return false;
+}
+
+void SoftwareUpdater::apply()
+{
+ std::string updatePath(_homePath + ZT_PATH_SEPARATOR_S ZT_SOFTWARE_UPDATE_BIN_FILENAME);
+ if ((_latestMeta.is_object())&&(_latestValid)&&(OSUtils::fileExists(updatePath.c_str(),false))) {
+#ifdef __WINDOWS__
+ std::string cmdArgs(OSUtils::jsonString(_latestMeta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_EXEC_ARGS],""));
+ if (cmdArgs.length() > 0) {
+ updatePath.push_back(' ');
+ updatePath.append(cmdArgs);
+ }
+ STARTUPINFOA si;
+ PROCESS_INFORMATION pi;
+ memset(&si,0,sizeof(si));
+ memset(&pi,0,sizeof(pi));
+ CreateProcessA(NULL,const_cast<LPSTR>(updatePath.c_str()),NULL,NULL,FALSE,CREATE_NO_WINDOW|CREATE_NEW_PROCESS_GROUP,NULL,NULL,&si,&pi);
+#else
+ char *argv[256];
+ unsigned long ac = 0;
+ argv[ac++] = const_cast<char *>(updatePath.c_str());
+ std::vector<std::string> argsSplit(OSUtils::split(OSUtils::jsonString(_latestMeta[ZT_SOFTWARE_UPDATE_JSON_UPDATE_EXEC_ARGS],"").c_str()," ","\\","\""));
+ for(std::vector<std::string>::iterator a(argsSplit.begin());a!=argsSplit.end();++a) {
+ argv[ac] = const_cast<char *>(a->c_str());
+ if (++ac == 255) break;
+ }
+ argv[ac] = (char *)0;
+ chmod(updatePath.c_str(),0700);
+ execv(updatePath.c_str(),argv);
+#endif
+ }
+}
+
+} // namespace ZeroTier
diff --git a/service/SoftwareUpdater.hpp b/service/SoftwareUpdater.hpp
new file mode 100644
index 00000000..e6e6b0c7
--- /dev/null
+++ b/service/SoftwareUpdater.hpp
@@ -0,0 +1,215 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2016 ZeroTier, Inc. https://www.zerotier.com/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef ZT_SOFTWAREUPDATER_HPP
+#define ZT_SOFTWAREUPDATER_HPP
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <vector>
+#include <map>
+#include <string>
+
+#include "../include/ZeroTierOne.h"
+
+#include "../node/Identity.hpp"
+#include "../node/Array.hpp"
+#include "../node/Packet.hpp"
+
+#include "../ext/json/json.hpp"
+
+/**
+ * VERB_USER_MESSAGE type ID for software update messages
+ */
+#define ZT_SOFTWARE_UPDATE_USER_MESSAGE_TYPE 100
+
+/**
+ * ZeroTier address of node that provides software updates
+ */
+#define ZT_SOFTWARE_UPDATE_SERVICE 0xb1d366e81fULL
+
+/**
+ * ZeroTier identity that must be used to sign software updates
+ *
+ * df24360f3e - update-signing-key-0010 generated Fri Jan 13th, 2017 at 4:05pm PST
+ */
+#define ZT_SOFTWARE_UPDATE_SIGNING_AUTHORITY "df24360f3e:0:06072642959c8dfb68312904d74d90197c8a7692697caa1b3fd769eca714f4370fab462fcee6ebcb5fffb63bc5af81f28a2514b2cd68daabb42f7352c06f21db"
+
+/**
+ * Chunk size for in-band downloads (can be changed, designed to always fit in one UDP packet easily)
+ */
+#define ZT_SOFTWARE_UPDATE_CHUNK_SIZE (ZT_PROTO_MAX_PACKET_LENGTH - 128)
+
+/**
+ * Sanity limit for the size of an update binary image
+ */
+#define ZT_SOFTWARE_UPDATE_MAX_SIZE (1024 * 1024 * 256)
+
+/**
+ * How often (ms) do we check?
+ */
+//#define ZT_SOFTWARE_UPDATE_CHECK_PERIOD (60 * 60 * 1000)
+#define ZT_SOFTWARE_UPDATE_CHECK_PERIOD 5000
+
+/**
+ * Default update channel
+ */
+#define ZT_SOFTWARE_UPDATE_DEFAULT_CHANNEL "release"
+
+/**
+ * Filename for latest update's meta JSON
+ */
+#define ZT_SOFTWARE_UPDATE_META_FILENAME "latest-update.json"
+
+/**
+ * Filename for latest update's binary image
+ */
+#define ZT_SOFTWARE_UPDATE_BIN_FILENAME "latest-update.exe"
+
+#define ZT_SOFTWARE_UPDATE_JSON_VERSION_MAJOR "versionMajor"
+#define ZT_SOFTWARE_UPDATE_JSON_VERSION_MINOR "versionMinor"
+#define ZT_SOFTWARE_UPDATE_JSON_VERSION_REVISION "versionRev"
+#define ZT_SOFTWARE_UPDATE_JSON_VERSION_BUILD "versionBuild"
+#define ZT_SOFTWARE_UPDATE_JSON_PLATFORM "platform"
+#define ZT_SOFTWARE_UPDATE_JSON_ARCHITECTURE "arch"
+#define ZT_SOFTWARE_UPDATE_JSON_VENDOR "vendor"
+#define ZT_SOFTWARE_UPDATE_JSON_CHANNEL "channel"
+#define ZT_SOFTWARE_UPDATE_JSON_EXPECT_SIGNED_BY "expectedSigner"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIGNED_BY "updateSigner"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIGNATURE "updateSig"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_HASH "updateHash"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_SIZE "updateSize"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_EXEC_ARGS "updateExecArgs"
+#define ZT_SOFTWARE_UPDATE_JSON_UPDATE_URL "updateUrl"
+
+namespace ZeroTier {
+
+class Node;
+
+/**
+ * This class handles retrieving and executing updates, or serving them
+ */
+class SoftwareUpdater
+{
+public:
+ /**
+ * Each message begins with an 8-bit message verb
+ */
+ enum MessageVerb
+ {
+ /**
+ * Payload: JSON containing current system platform, version, etc.
+ */
+ VERB_GET_LATEST = 1,
+
+ /**
+ * Payload: JSON describing latest update for this target. (No response is sent if there is none.)
+ */
+ VERB_LATEST = 2,
+
+ /**
+ * Payload:
+ * <[16] first 128 bits of hash of data object>
+ * <[4] 32-bit index of chunk to get>
+ */
+ VERB_GET_DATA = 3,
+
+ /**
+ * Payload:
+ * <[16] first 128 bits of hash of data object>
+ * <[4] 32-bit index of chunk>
+ * <[...] chunk data>
+ */
+ VERB_DATA = 4
+ };
+
+ SoftwareUpdater(Node &node,const std::string &homePath);
+ ~SoftwareUpdater();
+
+ /**
+ * Set whether or not we will distribute updates
+ *
+ * @param distribute If true, scan update-dist.d now and distribute updates found there -- if false, clear and stop distributing
+ */
+ void setUpdateDistribution(bool distribute);
+
+ /**
+ * Handle a software update user message
+ *
+ * @param origin ZeroTier address of message origin
+ * @param data Message payload
+ * @param len Length of message
+ */
+ void handleSoftwareUpdateUserMessage(uint64_t origin,const void *data,unsigned int len);
+
+ /**
+ * Check for updates and do other update-related housekeeping
+ *
+ * It should be called about every 10 seconds.
+ *
+ * @return True if we've downloaded and verified an update
+ */
+ bool check(const uint64_t now);
+
+ /**
+ * @return Meta-data for downloaded update or NULL if none
+ */
+ inline const nlohmann::json &pending() const { return _latestMeta; }
+
+ /**
+ * Apply any ready update now
+ *
+ * Depending on the platform this function may never return and may forcibly
+ * exit the process. It does nothing if no update is ready.
+ */
+ void apply();
+
+ /**
+ * Set software update channel
+ *
+ * @param channel 'release', 'beta', etc.
+ */
+ inline void setChannel(const std::string &channel) { _channel = channel; }
+
+private:
+ Node &_node;
+ uint64_t _lastCheckTime;
+ std::string _homePath;
+ std::string _channel;
+ FILE *_distLog;
+
+ // Offered software updates if we are an update host (we have update-dist.d and update hosting is enabled)
+ struct _D
+ {
+ nlohmann::json meta;
+ std::string bin;
+ };
+ std::map< Array<uint8_t,16>,_D > _dist; // key is first 16 bytes of hash
+
+ nlohmann::json _latestMeta;
+ bool _latestValid;
+
+ std::string _download;
+ Array<uint8_t,16> _downloadHashPrefix;
+ unsigned long _downloadLength;
+};
+
+} // namespace ZeroTier
+
+#endif
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-06 20:23:43 +0000