From f26025058075d91cd69ac892c373fd1d4d7f605d Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 15:39:34 -0800 Subject: [PATCH 1/7] Simplify IP assignment logic in OSXEthernetTap, also fix for GitHub issue #249 --- osdep/OSXEthernetTap.cpp | 45 +++++++++++++--------------------------- 1 file changed, 14 insertions(+), 31 deletions(-) diff --git a/osdep/OSXEthernetTap.cpp b/osdep/OSXEthernetTap.cpp index 6b6f360b3..3e43cf955 100644 --- a/osdep/OSXEthernetTap.cpp +++ b/osdep/OSXEthernetTap.cpp @@ -143,7 +143,7 @@ static inline int _intl_getifmaddrs(struct _intl_ifmaddrs **pif) } free(buf); buf = NULL; - } + } } while (buf == NULL); for (next = buf; next < buf + needed; next += rtm->rtm_msglen) { @@ -475,37 +475,11 @@ bool OSXEthernetTap::enabled() const return _enabled; } -static bool ___removeIp(const std::string &_dev,const InetAddress &ip) -{ - long cpid = (long)vfork(); - if (cpid == 0) { - execl("/sbin/ifconfig","/sbin/ifconfig",_dev.c_str(),"inet",ip.toIpString().c_str(),"-alias",(const char *)0); - _exit(-1); - } else if (cpid > 0) { - int exitcode = -1; - waitpid(cpid,&exitcode,0); - return (exitcode == 0); - } - return false; // never reached, make compiler shut up about return value -} - bool OSXEthernetTap::addIp(const InetAddress &ip) { if (!ip) return false; - std::vector allIps(ips()); - if (std::binary_search(allIps.begin(),allIps.end(),ip)) - return true; - - // Remove and reconfigure if address is the same but netmask is different - for(std::vector::iterator i(allIps.begin());i!=allIps.end();++i) { - if ((i->ipsEqual(ip))&&(i->netmaskBits() != ip.netmaskBits())) { - if (___removeIp(_dev,*i)) - break; - } - } - long cpid = (long)vfork(); if (cpid == 0) { ::execl("/sbin/ifconfig","/sbin/ifconfig",_dev.c_str(),ip.isV4() ? "inet" : "inet6",ip.toString().c_str(),"alias",(const char *)0); @@ -524,9 +498,18 @@ bool OSXEthernetTap::removeIp(const InetAddress &ip) if (!ip) return true; std::vector allIps(ips()); - if (!std::binary_search(allIps.begin(),allIps.end(),ip)) { - if (___removeIp(_dev,ip)) - return true; + for(std::vector::iterator i(allIps.begin());i!=allIps.end();++i) { + if (*i == ip) { + long cpid = (long)vfork(); + if (cpid == 0) { + execl("/sbin/ifconfig","/sbin/ifconfig",_dev.c_str(),"inet",ip.toIpString().c_str(),"-alias",(const char *)0); + _exit(-1); + } else if (cpid > 0) { + int exitcode = -1; + waitpid(cpid,&exitcode,0); + return (exitcode == 0); + } + } } return false; } @@ -564,7 +547,7 @@ std::vector OSXEthernetTap::ips() const freeifaddrs(ifa); std::sort(r.begin(),r.end()); - std::unique(r.begin(),r.end()); + r.erase(std::unique(r.begin(),r.end()),r.end()); return r; } From c21882da9ce3dca08dc3ca096482ff69b7355e13 Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 16:07:02 -0800 Subject: [PATCH 2/7] Put selftest back and turn off tracing in PortMapper. --- osdep/PortMapper.cpp | 2 +- selftest.cpp | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/osdep/PortMapper.cpp b/osdep/PortMapper.cpp index 5c0179312..87c886c2a 100644 --- a/osdep/PortMapper.cpp +++ b/osdep/PortMapper.cpp @@ -28,7 +28,7 @@ #ifdef ZT_USE_MINIUPNPC // Uncomment to dump debug messages -#define ZT_PORTMAPPER_TRACE 1 +//#define ZT_PORTMAPPER_TRACE 1 #include #include diff --git a/selftest.cpp b/selftest.cpp index e68f564cf..4e9219b2e 100644 --- a/selftest.cpp +++ b/selftest.cpp @@ -1096,7 +1096,7 @@ int main(int argc,char **argv) srand((unsigned int)time(0)); - /* + ///* r |= testSqliteNetworkController(); r |= testOther(); r |= testCrypto(); @@ -1106,17 +1106,19 @@ int main(int argc,char **argv) r |= testPhy(); r |= testResolver(); //r |= testHttp(); - */ + //*/ if (r) std::cout << std::endl << "SOMETHING FAILED!" << std::endl; + /* #ifdef ZT_USE_MINIUPNPC std::cout << std::endl; std::cout << "[portmapper] Starting port mapper and waiting forever... use CTRL+C to exit. (enable ZT_PORTMAPPER_TRACE in PortMapper.cpp for output)" << std::endl; PortMapper mapper(12345,"ZeroTier/__selftest"); Thread::sleep(0xffffffff); #endif + */ return r; } From d73edfea5654665a2b491c4570369d6410363db2 Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 16:12:03 -0800 Subject: [PATCH 3/7] GitHub issue #257 --- .../Contents/MacOS/ZeroTier One | Bin 152736 -> 152736 bytes .../Contents/Resources/en.lproj/Window.nib | Bin 3723 -> 3616 bytes .../Contents/_CodeSignature/CodeResources | 4 ++-- .../src/MacGap/en.lproj/Window.xib | 16 ++++++++-------- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/ext/mac-ui-macgap1-wrapper/bin/ZeroTier One.app/Contents/MacOS/ZeroTier One b/ext/mac-ui-macgap1-wrapper/bin/ZeroTier One.app/Contents/MacOS/ZeroTier One index ba15bca9569dfc5ab63846bcca3f8a82c46c8598..8e38b861af65b371afeb86780235a6ab74bc69c0 100755 GIT binary patch delta 781 zcmV+o1M>W!sR^K|34nwFv;w^?6t`hpX&LNQU#A_O3)M{p^3aX?#L_o~fPvvg=pnPr&eP*^HEoxkMvbS7ah??C!>7x=WIx`~oewVlE$!LwtbydYOInS@T-#%|bpuiXe~Vit zt3x)`Ltx7D;w!U>Ebm z0;mozGB7bPFflPOI9f0x1_>&LNQU#76cRptdJwN(SbSo$}BEc(@2bviJFg> z*--*Oe_lh{*!EW*0L~;Qy&uOh;{afE!?I*Nm^z#5endfqqHR*h1O& zhMz_>!Eozt2%v?32_iCHS8a7Pi4NIJ#4bc(d(Txn7f?8p@(nQ`OScBC5tZNXC?6bB z0f>_jvcy3j--snzN*m@H7%Vb_v3h&a-Ko;DfANJJGQf|Q+=p6z=2A#5^Hk8M)PQvdR8 zI+z15BOo?3X(2rN!BvbgC1HjK#RXpd_qp$mH{!#s#cWP51!1t9jCF`M41xxHbt&9M L0@2vB(GZ6L7!XW!sR^K|34nwFv;w^?6s6HTHswmHwW~hA0}CxvJ~H59H@DF(0wxoGF)=nW zGBP+dF&LNQU#A_O3;+yvZjk~1`4ODWiyHD(*SsWV)y>lTNs@hg#7 zNdz=74F(A+hDe6@4FLfG1pows0RUb-guYp>bQ%L**ra%aaot0kE=3q1duYb1C}Z8r z(SJ@!ll#&4mZ$?T`g}`(0UGFkChl1`0@&{*r_BD_alK+hB7MWe{V<6jS_u>h)y{|z z%df@Rs8K2!kM8I6m)v4HEPB8B0ONoGvDI24ij(&ogmyK@A_V3QiD=^)sUlwG;a>&U zy}DwW)Kldeb$1h; zk&TAyZ?h%sOD?ue&BxU}@FO4@Of{(mky)hJv;3&O#LTc%Hz2vKsA&LNQU#76cUg#k}Du#6mhvF4+_5QTap2Xf2YL z*--*Oe?13>qh(CIsExVL=A*-{Us<-pR<4(n8msB`q#4hY7F3<=wIRCX+F{YgezsuL z&S{$1GDjZp=@x!`OU(_X z`LR@Y?IK+_nRMksTAvNLb;?%e%E^`@dWVFx7 z8N2UxL#`efyU!w1Re;$|U) z820)oRImxl(+ z<%nR5Jf~_r*Er*eI#1-|c#t*aaH1IZq6DRwj|GBXITi-JN};4EJ`p_#J%A1ysYr5-i0saqhu#0qhjeE8rDDs6nlm?-%=A_{CU-hTvej zbXu&=NAeh*$Maau`jP&^w-G!djNORjJy?S#Jb-4bMF1QR;vqbYNAOdu!=v2f{enkn z^#1d76$w0t=SB49tn|CwUdw6u+wdG-K*GHarx40+#iFPaFA9R&gsFlcVkaQspT&6SxYRRRa0fvx8gM<{Lfif_jT+m6}q7ix8rru z4*QW%?r_et>g#H2sx4nw>kS;N=ry0?^SK(^@J0ZKkRZr*%eT24esUCViYIwqSAD&+ z!Btmh`C4%l361L~Tldv@U4E+-ZzCa`(0Ac($1%Kz-{Ck<;c0vVpUB6Y#RvEhCqzyLio!UB)4{&_ z$N=MZo?2dYtL(x?I&rqr9O!U5Jnp$GMZ@?-Vb)kx{#sufI&n_KwEM32^mgzhe2mjv z;x?YnQ%f4UyYAL~E?oFT+%r+k89Y9}{?ET5wwQ#-VH(|+z7M_b^}8=f>p>{7D5rt zN_5=VDQ1AZJIOFIoagd9KAqpg^Z5*3zzg|I zo^29SHWibaHd8G&HB%28On|$Ej|uM+aib+fM6?e{A$F0c!rZy;ZLXG zNxFj`qgQPawpiN~TY=4M`OD$HHtM{vG)koD$>SlG9x?g=$J*J*kKUTj~uc+5GNi(!)ZG@Jkm1}Nog|=3E zSbIWyMte4(J+E!nwrbn7z1k7&xOPfAqjhTMv@Y#4?Q31unLb1xrzh&kx?NAxC+Rcw z*}6k7(&y=AdV{`6Z_#(@uj+gBz4|`=fPPRvtY6Zl^x3bvTJ z*$Q?at7Xk>9b3;fvaM_z3v6d?>?O8??Pc$>_t?~_s+fN%zys# zpL1Vr_f^r)c9K)bh_zk%2Ofb64L#8Zu^50saA7K@As2ag6c*;76!XEc7SADwb$A}@ z@d94N@9+|SkC*WZUd3yu7Z@Ax2fTqTco#dd2Or==e2h==kae` z#DDPvZs14U#NAk;5S3`eAdw`R*x@7t$UqWD;*moV$ROe%L&&hTr?0dh%*XO{p31X0 z70b!9c}DOo;ge&|m{D+GFcL8YNf?S@NXBraU<9Ht5~DC0sdxxukcM<*U@XRAJSJcw zGV!ojlQ9KOWFcF4bAq)}{J@z`SDwdLQdTq7Q|Yy)J6%)U3tXOGSutR{vhvr6mK?Fy%}%e?L4O|VZODnqPCXz zYd~N0!#mhoXtr-nH`Y@eQRyl3x%~_4g>PH1Ozjxhj`wEeSw-1?YmVi&e8pBp9d^L} ze`jI5UD%x`Vnb?gz%FqQ--o@x>B_Mx%FBEumOmV|7yD+l=1lYZ-6Gpw?1x)kbi z58+7##o=2M9;=X&r|{3`#Z|%TJ6y;2g=Y7rbm;=i6I`m> z*=SP|8Ak9?d}MH^J~MC&w+qdVKL`0rTdCFK7Vi9la9EX}h`a&!L^8pOKO`83Sfw?H zOBh8cdh;<{5nr9O@^Y`I*c}?1u-f~HUKeU+69{2M4r~xqJA`lqt5D?;Arx^JNfePc z2~Ts5)(%Lm*;;zh9N$C4lb$4o^dh}U9}-LYl78etK8}y)6Zk})$sgvE_+&nXr4vPx zZRNgls$3w?m6yq{%3I{!@(%6a8$+L`vE z!)Q9qrUlfZkJH68KsjAPm(pc)IbBIt(P!wh^f|hYzCw4?J#-)afCdiGkLjoMAU#A6 z)6eM<+CUrWF?yWdv_;wyYz4N3wpF%`wym~fwri@Y_EATx6V*r5S*oSZSF6<;b*Z{W zU9Y~VzNEgaZc^V-x2oIJ?dm?YQ9Y?%P_JsxsMbM?*7|A*+6XN}%h9H5Zq2JzX-l=0 zT3tZftnJkHYX`NH+F9*C+BNOE_Jj7Lc1ydXx6wQ4v3i`IpgZ(LJxL#-{QoUMV zuCLTr>8tfM`g(n%zDa*W->ko_@6a3d@ASKdYUlc(MU5U7+#~wSZ%B` z>Ww#z?Zyscm+`)_*Vu0a4jPAy!^R2YU&aOFs&UJ>WBkOxB&M)7EQa-Fv8*5K&jzqK zmcSe=ktMOwESu%9sVtX0%JSI^HjB+>MXZF)VRP9$=4C!s&irf hash - 7dgumnPDtoIzhi9QoaFhDvCo9ys= + aP0mIANPPnnTMmxYlELioz9ZO1I= optional @@ -82,7 +82,7 @@ hash - 7dgumnPDtoIzhi9QoaFhDvCo9ys= + aP0mIANPPnnTMmxYlELioz9ZO1I= optional diff --git a/ext/mac-ui-macgap1-wrapper/src/MacGap/en.lproj/Window.xib b/ext/mac-ui-macgap1-wrapper/src/MacGap/en.lproj/Window.xib index 2c46b79fd..fa70acaa5 100644 --- a/ext/mac-ui-macgap1-wrapper/src/MacGap/en.lproj/Window.xib +++ b/ext/mac-ui-macgap1-wrapper/src/MacGap/en.lproj/Window.xib @@ -13,22 +13,22 @@ - + - - + + - - - + - + - + + + From be44b15eacc7f34365d86e717e847b86000cbec4 Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 16:15:23 -0800 Subject: [PATCH 4/7] Fix for GitHub issue #252 --- ext/installfiles/linux/DEBIAN/control.in | 1 + 1 file changed, 1 insertion(+) diff --git a/ext/installfiles/linux/DEBIAN/control.in b/ext/installfiles/linux/DEBIAN/control.in index d774b61e9..dab6587f5 100644 --- a/ext/installfiles/linux/DEBIAN/control.in +++ b/ext/installfiles/linux/DEBIAN/control.in @@ -3,6 +3,7 @@ Architecture: __ARCH__ Maintainer: ZeroTier, Inc. Priority: optional Version: __VERSION__ +Installed-Size: 1024 Homepage: https://github.com/zerotier/ZeroTierOne Description: ZeroTier One network virtualization service ZeroTier One is a fast, secure, and easy to use peer to peer network From 944fdfb65e260ed58a91097e42747ccb80c06f6f Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 16:44:32 -0800 Subject: [PATCH 5/7] Low-impact sanity check against GitHub issue #247 -- will likely prevent other weird recursions too. --- service/OneService.cpp | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/service/OneService.cpp b/service/OneService.cpp index 3d0272376..33fb26acb 100644 --- a/service/OneService.cpp +++ b/service/OneService.cpp @@ -340,6 +340,26 @@ public: static BackgroundSoftwareUpdateChecker backgroundSoftwareUpdateChecker; #endif // ZT_AUTO_UPDATE +static bool isBlacklistedLocalInterfaceForZeroTierTraffic(const char *ifn) +{ +#if defined(__linux__) || defined(linux) || defined(__LINUX__) || defined(__linux) + if ((ifn[0] == 'l')&&(ifn[1] == 'o')) return true; // loopback + if ((ifn[0] == 'z')&&(ifn[1] == 't')) return true; // sanity check: zt# + if ((ifn[0] == 't')&&(ifn[1] == 'u')&&(ifn[2] == 'n')) return true; // tun# is probably an OpenVPN tunnel or similar + if ((ifn[0] == 't')&&(ifn[1] == 'a')&&(ifn[2] == 'p')) return true; // tap# is probably an OpenVPN tunnel or similar +#endif + +#ifdef __APPLE__ + if ((ifn[0] == 'l')&&(ifn[1] == 'o')) return true; // loopback + if ((ifn[0] == 'z')&&(ifn[1] == 't')) return true; // sanity check: zt# + if ((ifn[0] == 't')&&(ifn[1] == 'u')&&(ifn[2] == 'n')) return true; // tun# is probably an OpenVPN tunnel or similar + if ((ifn[0] == 't')&&(ifn[1] == 'a')&&(ifn[2] == 'p')) return true; // tap# is probably an OpenVPN tunnel or similar + if ((ifn[0] == 'u')&&(ifn[1] == 't')&&(ifn[2] == 'u')&&(ifn[3] == 'n')) return true; // ... as is utun# +#endif + + return false; +} + static std::string _trimString(const std::string &s) { unsigned long end = (unsigned long)s.length(); @@ -753,7 +773,7 @@ public: if ((getifaddrs(&ifatbl) == 0)&&(ifatbl)) { struct ifaddrs *ifa = ifatbl; while (ifa) { - if ((ifa->ifa_name)&&(ifa->ifa_addr)) { + if ((ifa->ifa_name)&&(ifa->ifa_addr)&&(!isBlacklistedLocalInterfaceForZeroTierTraffic(ifa->ifa_name))) { bool isZT = false; for(std::vector::const_iterator d(ztDevices.begin());d!=ztDevices.end();++d) { if (*d == ifa->ifa_name) { From ceaef19fb70523852441c8dd3ba647fa6ad217b9 Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Mon, 30 Nov 2015 17:20:12 -0800 Subject: [PATCH 6/7] Fix for GitHub issue #260 -- fix for (non-exploitable) crash in network preferred relay code --- node/Peer.hpp | 1 - node/Switch.cpp | 10 ++++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/node/Peer.hpp b/node/Peer.hpp index 7b8d18eae..5816db69f 100644 --- a/node/Peer.hpp +++ b/node/Peer.hpp @@ -263,7 +263,6 @@ public: return (l * (((unsigned int)tsr / (ZT_PEER_DIRECT_PING_DELAY + 1000)) + 1)); } - /** * Update latency with a new direct measurment * diff --git a/node/Switch.cpp b/node/Switch.cpp index 74e2f4c61..bf0d1aff1 100644 --- a/node/Switch.cpp +++ b/node/Switch.cpp @@ -820,10 +820,12 @@ bool Switch::_trySend(const Packet &packet,bool encrypt,uint64_t nwid) for(std::vector< std::pair >::const_iterator r(nconf->relays().begin());r!=nconf->relays().end();++r) { if (r->first != peer->address()) { SharedPtr rp(RR->topology->getPeer(r->first)); - const unsigned int q = rp->relayQuality(now); - if ((rp)&&(q < bestq)) { // SUBTILE: < == don't use these if they are nil quality (unsigned int max), instead use a root - bestq = q; - rp.swap(relay); + if (rp) { + const unsigned int q = rp->relayQuality(now); + if (q < bestq) { // SUBTILE: < == don't use these if they are nil quality (unsigned int max), instead use a root + bestq = q; + rp.swap(relay); + } } } } From a4cfe4cd1650ea7e9aada0b004fd7aade2e43ced Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Tue, 1 Dec 2015 10:19:10 -0800 Subject: [PATCH 7/7] Fix Linux init script to properly specify runlevels. --- ext/installfiles/linux/init.d/zerotier-one | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/ext/installfiles/linux/init.d/zerotier-one b/ext/installfiles/linux/init.d/zerotier-one index c8e7615e1..b0a8aa418 100755 --- a/ext/installfiles/linux/init.d/zerotier-one +++ b/ext/installfiles/linux/init.d/zerotier-one @@ -7,21 +7,20 @@ # networks. See https://www.zerotier.com/ for more information. ### BEGIN INIT INFO -# Provides: zerotier-one -# Required-Start: $local_fs $network -# Required-Stop: $local_fs -# Default-Start: 2345 -# Default-Stop: 90 -# Short-Description: start ZeroTier One -# Description: ZeroTier One provides public and private distributed ethernet \ -# networks. See https://www.zerotier.com/ for more information. +# Provides: zerotier-one +# Required-Start: $local_fs $network +# Required-Stop: $local_fs +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Start ZeroTier One +# Description: ZeroTier One provides public and private distributed ethernet \ +# networks. See https://www.zerotier.com/ for more information. ### END INIT INFO # # This script is written to avoid distro-specific dependencies, so it does not # use the rc bash script libraries found on some systems. It should work on -# just about anything, even systems using Upstart. Upstart native support may -# come in the future. +# just about anything. # zthome=/var/lib/zerotier-one