ExternalVendorCode/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-02-07 20:00:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Filter cleanup, prep for filter integration in a few places.

Browse Source
This commit is contained in:
Adam Ierymenko 2016-08-04 12:35:25 -07:00
parent 331382cf2f
commit 8a7753cfe3
4 changed files with 40 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
node/Filter.cpp
View File

@ -66,7 +66,8 @@ bool Filter::run(
const unsigned int vlanId, const unsigned int vlanId,
const ZT_VirtualNetworkRule *rules, const ZT_VirtualNetworkRule *rules,
const unsigned int ruleCount, const unsigned int ruleCount,
const Tag *tags, const uint32_t *tagKeys,
const uint32_t *tagValues,
const unsigned int tagCount, const unsigned int tagCount,
Address &sendCopyOfPacketTo) Address &sendCopyOfPacketTo)
{ {
@ -248,13 +249,13 @@ bool Filter::run(
case ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ALL: case ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ALL:
case ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ANY: case ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ANY:
for(unsigned int i=0;i<tagCount;++i) { // sequential scan is probably fastest since this is going to be <64 entries (usually only one or two) for(unsigned int i=0;i<tagCount;++i) { // sequential scan is probably fastest since this is going to be <64 entries (usually only one or two)
if (tags[i].id() == rules[rn].v.tag.id) { if (tagKeys[i] == rules[rn].v.tag.id) {
if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_RANGE) { if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_RANGE) {
thisRuleMatches = (uint8_t)((tags[i].value() >= rules[rn].v.tag.value[0])&&(tags[i].value() <= rules[rn].v.tag.value[1])); thisRuleMatches = (uint8_t)((tagValues[i] >= rules[rn].v.tag.value[0])&&(tagValues[i] <= rules[rn].v.tag.value[1]));
} else if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ALL) { } else if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ALL) {
thisRuleMatches = (uint8_t)((tags[i].value() & rules[rn].v.tag.value[0]) == rules[rn].v.tag.value[0]); thisRuleMatches = (uint8_t)((tagValues[i] & rules[rn].v.tag.value[0]) == rules[rn].v.tag.value[0]);
} else if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ANY) { } else if (rt == ZT_NETWORK_RULE_MATCH_TAG_VALUE_BITS_ANY) {
thisRuleMatches = (uint8_t)((tags[i].value() & rules[rn].v.tag.value[0]) != 0); thisRuleMatches = (uint8_t)((tagValues[i] & rules[rn].v.tag.value[0]) != 0);
} }
break; break;
} }

11
node/Filter.hpp
View File

@ -27,12 +27,11 @@
#include "../include/ZeroTierOne.h" #include "../include/ZeroTierOne.h"
#include "Address.hpp" #include "Address.hpp"
#include "MAC.hpp" #include "MAC.hpp"
#include "Tag.hpp"
namespace ZeroTier { namespace ZeroTier {
/** /**
* Network packet filter for rules engine * A simple network packet filter with VL1, L2, and basic L3 rule support (and tags!)
*/ */
class Filter class Filter
{ {
@ -55,8 +54,9 @@ public:
* @param vlanId 16-bit VLAN ID * @param vlanId 16-bit VLAN ID
* @param rules Pointer to array of rules * @param rules Pointer to array of rules
* @param ruleCount Number of rules * @param ruleCount Number of rules
* @param tags Tags associated with this node on this network * @param tagKeys Tag keys for tags that may be relevant
* @param tagCount Number of tags * @param tagValues Tag values for tags that may be relevant
* @param tagCount Size of tagKeys[] and tagValues[]
* @param sendCopyOfPacketTo Result parameter: if non-NULL send a copy of this packet to another node * @param sendCopyOfPacketTo Result parameter: if non-NULL send a copy of this packet to another node
* @return True if packet should be accepted for send or receive * @return True if packet should be accepted for send or receive
*/ */
@ -73,7 +73,8 @@ public:
const unsigned int vlanId, const unsigned int vlanId,
const ZT_VirtualNetworkRule *rules, const ZT_VirtualNetworkRule *rules,
const unsigned int ruleCount, const unsigned int ruleCount,
const Tag *tags, const uint32_t *tagKeys,
const uint32_t *tagValues,
const unsigned int tagCount, const unsigned int tagCount,
Address &sendCopyOfPacketTo); Address &sendCopyOfPacketTo);
}; };

71
node/OutboundMulticast.cpp
View File

@ -21,8 +21,9 @@
#include "OutboundMulticast.hpp" #include "OutboundMulticast.hpp"
#include "Switch.hpp" #include "Switch.hpp"
#include "Network.hpp" #include "Network.hpp"
#include "CertificateOfMembership.hpp"
#include "Node.hpp" #include "Node.hpp"
#include "Peer.hpp"
#include "Topology.hpp"
namespace ZeroTier { namespace ZeroTier {
@ -30,7 +31,6 @@ void OutboundMulticast::init(
const RuntimeEnvironment *RR, const RuntimeEnvironment *RR,
uint64_t timestamp, uint64_t timestamp,
uint64_t nwid, uint64_t nwid,
const CertificateOfMembership *com,
unsigned int limit, unsigned int limit,
unsigned int gatherLimit, unsigned int gatherLimit,
const MAC &src, const MAC &src,
@ -48,7 +48,7 @@ void OutboundMulticast::init(
if (src) flags |= 0x04; if (src) flags |= 0x04;
/* /*
TRACE(">>MC %.16llx INIT %.16llx/%s limit %u gatherLimit %u from %s to %s length %u com==%d", TRACE(">>MC %.16llx INIT %.16llx/%s limit %u gatherLimit %u from %s to %s length %u",
(unsigned long long)this, (unsigned long long)this,
nwid, nwid,
dest.toString().c_str(), dest.toString().c_str(),
@ -56,58 +56,35 @@ void OutboundMulticast::init(
gatherLimit, gatherLimit,
(src) ? src.toString().c_str() : MAC(RR->identity.address(),nwid).toString().c_str(), (src) ? src.toString().c_str() : MAC(RR->identity.address(),nwid).toString().c_str(),
dest.toString().c_str(), dest.toString().c_str(),
len, len);
(com) ? 1 : 0);
*/ */
_packetNoCom.setSource(RR->identity.address()); _packet.setSource(RR->identity.address());
_packetNoCom.setVerb(Packet::VERB_MULTICAST_FRAME); _packet.setVerb(Packet::VERB_MULTICAST_FRAME);
_packetNoCom.append((uint64_t)nwid); _packet.append((uint64_t)nwid);
_packetNoCom.append(flags); _packet.append(flags);
if (gatherLimit) _packetNoCom.append((uint32_t)gatherLimit); if (gatherLimit) _packet.append((uint32_t)gatherLimit);
if (src) src.appendTo(_packetNoCom); if (src) src.appendTo(_packet);
dest.mac().appendTo(_packetNoCom); dest.mac().appendTo(_packet);
_packetNoCom.append((uint32_t)dest.adi()); _packet.append((uint32_t)dest.adi());
_packetNoCom.append((uint16_t)etherType); _packet.append((uint16_t)etherType);
_packetNoCom.append(payload,len); _packet.append(payload,len);
_packetNoCom.compress(); _packet.compress();
if (com) {
_haveCom = true;
flags |= 0x01;
_packetWithCom.setSource(RR->identity.address());
_packetWithCom.setVerb(Packet::VERB_MULTICAST_FRAME);
_packetWithCom.append((uint64_t)nwid);
_packetWithCom.append(flags);
com->serialize(_packetWithCom);
if (gatherLimit) _packetWithCom.append((uint32_t)gatherLimit);
if (src) src.appendTo(_packetWithCom);
dest.mac().appendTo(_packetWithCom);
_packetWithCom.append((uint32_t)dest.adi());
_packetWithCom.append((uint16_t)etherType);
_packetWithCom.append(payload,len);
_packetWithCom.compress();
} else _haveCom = false;
} }
void OutboundMulticast::sendOnly(const RuntimeEnvironment *RR,const Address &toAddr) void OutboundMulticast::sendOnly(const RuntimeEnvironment *RR,const Address &toAddr)
{ {
if (_haveCom) { // TODO: apply Filter
SharedPtr<Peer> peer(RR->topology->getPeer(toAddr));
if ( (!peer) || (peer->needsOurNetworkMembershipCertificate(_nwid,RR->node->now(),true)) ) { SharedPtr<Peer> peer(RR->topology->getPeer(toAddr));
//TRACE(">>MC %.16llx -> %s (with COM)",(unsigned long long)this,toAddr.toString().c_str()); if (peer) {
_packetWithCom.newInitializationVector(); // TODO: push creds if needed
_packetWithCom.setDestination(toAddr);
RR->sw->send(_packetWithCom,true,_nwid);
return;
}
} }
//TRACE(">>MC %.16llx -> %s (without COM)",(unsigned long long)this,toAddr.toString().c_str()); //TRACE(">>MC %.16llx -> %s",(unsigned long long)this,toAddr.toString().c_str());
_packetNoCom.newInitializationVector(); _packet.newInitializationVector();
_packetNoCom.setDestination(toAddr); _packet.setDestination(toAddr);
RR->sw->send(_packetNoCom,true,_nwid); RR->sw->send(_packet,true,_nwid);
} }
} // namespace ZeroTier } // namespace ZeroTier

10
node/OutboundMulticast.hpp
View File

@ -56,7 +56,6 @@ public:
* @param RR Runtime environment * @param RR Runtime environment
* @param timestamp Creation time * @param timestamp Creation time
* @param nwid Network ID * @param nwid Network ID
* @param com Certificate of membership or NULL if none available
* @param limit Multicast limit for desired number of packets to send * @param limit Multicast limit for desired number of packets to send
* @param gatherLimit Number to lazily/implicitly gather with this frame or 0 for none * @param gatherLimit Number to lazily/implicitly gather with this frame or 0 for none
* @param src Source MAC address of frame or NULL to imply compute from sender ZT address * @param src Source MAC address of frame or NULL to imply compute from sender ZT address
@ -70,7 +69,6 @@ public:
const RuntimeEnvironment *RR, const RuntimeEnvironment *RR,
uint64_t timestamp, uint64_t timestamp,
uint64_t nwid, uint64_t nwid,
const CertificateOfMembership *com,
unsigned int limit, unsigned int limit,
unsigned int gatherLimit, unsigned int gatherLimit,
const MAC &src, const MAC &src,
@ -127,17 +125,17 @@ public:
if (std::find(_alreadySentTo.begin(),_alreadySentTo.end(),toAddr) == _alreadySentTo.end()) { if (std::find(_alreadySentTo.begin(),_alreadySentTo.end(),toAddr) == _alreadySentTo.end()) {
sendAndLog(RR,toAddr); sendAndLog(RR,toAddr);
return true; return true;
} else return false; } else {
return false;
}
} }
private: private:
uint64_t _timestamp; uint64_t _timestamp;
uint64_t _nwid; uint64_t _nwid;
unsigned int _limit; unsigned int _limit;
Packet _packetNoCom; Packet _packet;
Packet _packetWithCom;
std::vector<Address> _alreadySentTo; std::vector<Address> _alreadySentTo;
bool _haveCom;
}; };
} // namespace ZeroTier } // namespace ZeroTier