From 765082fdb68d8847cbd53cb442cbed5006b28d5f Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Tue, 12 Jul 2016 08:29:50 -0700 Subject: Trusted path support, and version bump to 1.1.9 --- include/ZeroTierOne.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) (limited to 'include') diff --git a/include/ZeroTierOne.h b/include/ZeroTierOne.h index d46c64b8..f5523461 100644 --- a/include/ZeroTierOne.h +++ b/include/ZeroTierOne.h @@ -116,6 +116,11 @@ extern "C" { */ #define ZT_MAX_PEER_NETWORK_PATHS 4 +/** + * Maximum number of trusted physical network paths + */ +#define ZT_MAX_TRUSTED_PATHS 16 + /** * Maximum number of hops in a ZeroTier circuit test * @@ -1837,6 +1842,29 @@ void ZT_Node_clusterHandleIncomingMessage(ZT_Node *node,const void *msg,unsigned */ void ZT_Node_clusterStatus(ZT_Node *node,ZT_ClusterStatus *cs); +/** + * Set trusted paths + * + * A trusted path is a physical network (network/bits) over which both + * encryption and authentication can be skipped to improve performance. + * Each trusted path must have a non-zero unique ID that is the same across + * all participating nodes. + * + * We don't recommend using trusted paths at all unless you really *need* + * near-bare-metal performance. Even on a LAN authentication and encryption + * are never a bad thing, and anything that introduces an "escape hatch" + * for encryption should be treated with the utmost care. + * + * Calling with NULL pointers for networks and ids and a count of zero clears + * all trusted paths. + * + * @param node Node instance + * @param networks Array of [count] networks + * @param ids Array of [count] corresponding non-zero path IDs (zero path IDs are ignored) + * @param count Number of trusted paths-- values greater than ZT_MAX_TRUSTED_PATHS are clipped + */ +void ZT_Node_setTrustedPaths(ZT_Node *node,const struct sockaddr_storage *networks,const uint64_t *ids,unsigned int count); + /** * Do things in the background until Node dies * -- cgit v1.2.3 From 96576757552f1b0ce002df3e904419b7bfca62f8 Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Tue, 12 Jul 2016 11:30:22 -0700 Subject: Plumbing through trusted path stuff to OneService. --- include/ZeroTierOne.h | 5 +++++ node/IncomingPacket.cpp | 10 ++++++---- node/Node.cpp | 1 + service/ControlPlane.cpp | 4 +++- service/OneService.cpp | 32 ++++++++++++++++++++++++++++++++ 5 files changed, 47 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/ZeroTierOne.h b/include/ZeroTierOne.h index f5523461..2d7b007b 100644 --- a/include/ZeroTierOne.h +++ b/include/ZeroTierOne.h @@ -892,6 +892,11 @@ typedef struct */ uint64_t lastReceive; + /** + * Is this a trusted path? If so this will be its nonzero ID. + */ + uint64_t trustedPathId; + /** * Is path active? */ diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp index fb4562ab..6e1eb493 100644 --- a/node/IncomingPacket.cpp +++ b/node/IncomingPacket.cpp @@ -43,6 +43,8 @@ namespace ZeroTier { bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,bool deferred) { try { + const Address sourceAddress(source()); + // Check for trusted paths or unencrypted HELLOs (HELLO is the only packet sent in the clear) const unsigned int c = cipher(); bool trusted = false; @@ -52,8 +54,9 @@ bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,bool deferred) // packets are dropped on the floor. if (RR->topology->shouldInboundPathBeTrusted(_remoteAddress,trustedPathId())) { trusted = true; + printf("TRUSTED PATH packet from %s(%s), trusted path ID %llx\n",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),trustedPathId()); } else { - TRACE("dropped packet from %s(%s), cipher set to trusted path mode but path %.16llx@%s is not trusted!",peer->address().toString().c_str(),_remoteAddress.toString().c_str(),trustedPathId(),_remoteAddress.toString().c_str()); + TRACE("dropped packet from %s(%s), cipher set to trusted path mode but path %llx@%s is not trusted!",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),trustedPathId(),_remoteAddress.toString().c_str()); return true; } } else if ((c == ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_NONE)&&(verb() == Packet::VERB_HELLO)) { @@ -71,18 +74,17 @@ bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,bool deferred) } } - const Address sourceAddress(source()); SharedPtr peer(RR->topology->getPeer(sourceAddress)); if (peer) { if (!trusted) { if (!dearmor(peer->key())) { - TRACE("dropped packet from %s(%s), MAC authentication failed (size: %u)",peer->address().toString().c_str(),_remoteAddress.toString().c_str(),size()); + TRACE("dropped packet from %s(%s), MAC authentication failed (size: %u)",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),size()); return true; } } if (!uncompress()) { - TRACE("dropped packet from %s(%s), compressed data invalid",peer->address().toString().c_str(),_remoteAddress.toString().c_str()); + TRACE("dropped packet from %s(%s), compressed data invalid",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str()); return true; } diff --git a/node/Node.cpp b/node/Node.cpp index 058df32d..13085028 100644 --- a/node/Node.cpp +++ b/node/Node.cpp @@ -447,6 +447,7 @@ ZT_PeerList *Node::peers() const p->paths[p->pathCount].lastReceive = path->lastReceived(); p->paths[p->pathCount].active = path->active(_now) ? 1 : 0; p->paths[p->pathCount].preferred = ((bestPath)&&(*path == *bestPath)) ? 1 : 0; + p->paths[p->pathCount].trustedPathId = RR->topology->getOutboundPathTrust(path->address()); ++p->pathCount; } } diff --git a/service/ControlPlane.cpp b/service/ControlPlane.cpp index 0e2b530d..ced36e75 100644 --- a/service/ControlPlane.cpp +++ b/service/ControlPlane.cpp @@ -190,13 +190,15 @@ static std::string _jsonEnumerate(unsigned int depth,const ZT_PeerPhysicalPath * "%s\t\"lastSend\": %llu,\n" "%s\t\"lastReceive\": %llu,\n" "%s\t\"active\": %s,\n" - "%s\t\"preferred\": %s\n" + "%s\t\"preferred\": %s,\n" + "%s\t\"trustedPathId\": %llx\n" "%s}", prefix,_jsonEscape(reinterpret_cast(&(pp[i].address))->toString()).c_str(), prefix,pp[i].lastSend, prefix,pp[i].lastReceive, prefix,(pp[i].active == 0) ? "false" : "true", prefix,(pp[i].preferred == 0) ? "false" : "true", + prefix,pp[i].trustedPathId, prefix); buf.append(json); } diff --git a/service/OneService.cpp b/service/OneService.cpp index c19b266a..bbd15965 100644 --- a/service/OneService.cpp +++ b/service/OneService.cpp @@ -759,6 +759,38 @@ public: for(int i=0;i<3;++i) _portsBE[i] = Utils::hton((uint16_t)_ports[i]); + { + FILE *trustpaths = fopen((_homePath + ZT_PATH_SEPARATOR_S + "trustpaths").c_str(),"r"); + uint64_t ids[ZT_MAX_TRUSTED_PATHS]; + InetAddress addresses[ZT_MAX_TRUSTED_PATHS]; + if (trustpaths) { + char buf[1024]; + unsigned int count = 0; + while ((fgets(buf,sizeof(buf),trustpaths))&&(count < ZT_MAX_TRUSTED_PATHS)) { + int fno = 0; + char *saveptr = (char *)0; + uint64_t trustedPathId = 0; + InetAddress trustedPathNetwork; + for(char *f=Utils::stok(buf,"=\r\n \t",&saveptr);(f);f=Utils::stok((char *)0,"=\r\n \t",&saveptr)) { + if (fno == 0) { + trustedPathId = Utils::hexStrToU64(f); + } else if (fno == 1) { + trustedPathNetwork = InetAddress(f); + } else break; + ++fno; + } + if ( (trustedPathId != 0) && ((trustedPathNetwork.ss_family == AF_INET)||(trustedPathNetwork.ss_family == AF_INET6)) && (trustedPathNetwork.ipScope() != InetAddress::IP_SCOPE_GLOBAL) && (trustedPathNetwork.netmaskBits() > 0) ) { + ids[count] = trustedPathId; + addresses[count] = trustedPathNetwork; + ++count; + } + } + fclose(trustpaths); + if (count) + _node->setTrustedPaths(reinterpret_cast(addresses),ids,count); + } + } + #ifdef ZT_ENABLE_NETWORK_CONTROLLER _controller = new SqliteNetworkController(_node,(_homePath + ZT_PATH_SEPARATOR_S + ZT_CONTROLLER_DB_PATH).c_str(),(_homePath + ZT_PATH_SEPARATOR_S + "circuitTestResults.d").c_str()); _node->setNetconfMaster((void *)_controller); -- cgit v1.2.3