ExternalVendorCode/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-02-11 21:45:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

RedisNetworkConfigMaster in its own folder. Also fix some hex/decimal Redis database confusion.

Browse Source
This commit is contained in:
Adam Ierymenko 2015-02-24 14:17:57 -08:00
parent 78fc62d967
commit b6fba5934a
4 changed files with 124 additions and 200 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

228
netconf/RedisNetworkConfigMaster.cpp
View File

@ -25,11 +25,6 @@
* LLC. Start here: http://www.zerotier.com/ * LLC. Start here: http://www.zerotier.com/
*/ */
#include "Constants.hpp"
#include "NetworkConfigMaster.hpp"
#ifdef ZT_ENABLE_NETCONF_MASTER
#include <stdint.h> #include <stdint.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
@ -40,47 +35,41 @@
#include <algorithm> #include <algorithm>
#include <utility> #include <utility>
#include <stdexcept>
#include "RuntimeEnvironment.hpp" #include "RedisNetworkConfigMaster.hpp"
#include "Switch.hpp" #include "../node/Utils.hpp"
#include "Packet.hpp" #include "../node/CertificateOfMembership.hpp"
#include "NetworkConfig.hpp" #include "../node/NetworkConfig.hpp"
#include "Utils.hpp"
#include "Node.hpp"
#include "Logger.hpp"
#include "Topology.hpp"
#include "Peer.hpp"
#include "CertificateOfMembership.hpp"
// Redis timeout in seconds
#define ZT_NETCONF_REDIS_TIMEOUT 10
namespace ZeroTier { namespace ZeroTier {
NetworkConfigMaster::NetworkConfigMaster( RedisNetworkConfigMaster::RedisNetworkConfigMaster(
const RuntimeEnvironment *renv, const Identity &signingId,
const char *redisHost, const char *redisHost,
unsigned int redisPort, unsigned int redisPort,
const char *redisPassword, const char *redisPassword,
unsigned int redisDatabaseNumber) : unsigned int redisDatabaseNumber) :
_lock(), _lock(),
_signingId(signingId),
_redisHost(redisHost), _redisHost(redisHost),
_redisPassword((redisPassword) ? redisPassword : ""), _redisPassword((redisPassword) ? redisPassword : ""),
_redisPort(redisPort), _redisPort(redisPort),
_redisDatabaseNumber(redisDatabaseNumber), _redisDatabaseNumber(redisDatabaseNumber),
RR(renv),
_rc((redisContext *)0) _rc((redisContext *)0)
{ {
if (!_signingId.hasPrivate())
throw std::runtime_error("RedisNetworkConfigMaster signing identity must have a private key");
} }
NetworkConfigMaster::~NetworkConfigMaster() RedisNetworkConfigMaster::~RedisNetworkConfigMaster()
{ {
Mutex::Lock _l(_lock); Mutex::Lock _l(_lock);
if (_rc) if (_rc)
redisFree(_rc); redisFree(_rc);
} }
void NetworkConfigMaster::doNetworkConfigRequest(const InetAddress &fromAddr,uint64_t packetId,const Address &member,uint64_t nwid,const Dictionary &metaData,uint64_t haveTimestamp) NetworkConfigMaster::ResultCode RedisNetworkConfigMaster::doNetworkConfigRequest(const InetAddress &fromAddr,uint64_t packetId,const Identity &member,uint64_t nwid,const Dictionary &metaData,uint64_t haveTimestamp,Dictionary &netconf)
{ {
char memberKey[128],nwids[24],addrs[16],nwKey[128],revKey[128]; char memberKey[128],nwids[24],addrs[16],nwKey[128],revKey[128];
Dictionary memberRecord; Dictionary memberRecord;
@ -89,101 +78,78 @@ void NetworkConfigMaster::doNetworkConfigRequest(const InetAddress &fromAddr,uin
Mutex::Lock _l(_lock); Mutex::Lock _l(_lock);
Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid); Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.toInt()); Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.address().toInt());
Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs); Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs);
Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids); Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids);
Utils::snprintf(revKey,sizeof(revKey),"zt1:network:%s:revision",nwids); Utils::snprintf(revKey,sizeof(revKey),"zt1:network:%s:revision",nwids);
TRACE("netconf: %s : %s if > %llu",nwids,addrs,(unsigned long long)haveTimestamp); //TRACE("netconf: %s : %s if > %llu",nwids,addrs,(unsigned long long)haveTimestamp);
// Check to make sure network itself exists and is valid // Check to make sure network itself exists and is valid
if (!_hget(nwKey,"id",tmps2)) { if (!_hget(nwKey,"id",tmps2)) {
LOG("netconf: Redis error retrieving %s/id",nwKey); netconf["error"] = "Redis error retrieving network record";
return; return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
}
if (tmps2 != nwids) {
TRACE("netconf: network %s not found",nwids);
Packet outp(member,RR->identity.address(),Packet::VERB_ERROR);
outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
outp.append(packetId);
outp.append((unsigned char)Packet::ERROR_OBJ_NOT_FOUND);
outp.append(nwid);
RR->sw->send(outp,true);
return;
} }
if (tmps2 != nwids)
return NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND;
// Get network revision // Get network revision
if (!_get(revKey,revision)) { if (!_get(revKey,revision)) {
LOG("netconf: Redis error retrieving %s",revKey); netconf["error"] = "Redis error retrieving network revision";
return; return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
} }
if (!revision.length()) if (!revision.length())
revision = "0"; revision = "0";
// Get network member record for this peer // Get network member record for this peer
if (!_hgetall(memberKey,memberRecord)) { if (!_hgetall(memberKey,memberRecord)) {
LOG("netconf: Redis error retrieving %s",memberKey); netconf["error"] = "Redis error retrieving member record";
return; return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
} }
// If there is no member record, init a new one -- for public networks this // If there is no member record, init a new one -- for public networks this
// auto-authorizes, and for private nets it makes the peer show up in the UI // auto-authorizes, and for private nets it makes the peer show up in the UI
// so the admin can authorize or delete/hide it. // so the admin can authorize or delete/hide it.
if ((memberRecord.size() == 0)||(memberRecord.get("id","") != addrs)||(memberRecord.get("nwid","") != nwids)) { if ((memberRecord.size() == 0)||(memberRecord.get("id","") != addrs)||(memberRecord.get("nwid","") != nwids)) {
if (!_initNewMember(nwid,member,metaData,memberRecord)) if (!_initNewMember(nwid,member,metaData,memberRecord)) {
return; netconf["error"] = "_initNewMember() failed";
return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
}
} }
if (memberRecord.getBoolean("authorized")) { if (memberRecord.getBoolean("authorized")) {
// Get current netconf and netconf timestamp // Get current netconf and netconf timestamp
uint64_t ts = memberRecord.getHexUInt("netconfTimestamp",0); uint64_t ts = memberRecord.getUInt("netconfTimestamp",0);
std::string netconf(memberRecord.get("netconf","")); std::string netconfStr(memberRecord.get("netconf",""));
netconf.fromString(netconfStr);
// Update statistics for this node // Update statistics for this node
Dictionary upd; Dictionary upd;
upd.setHex("netconfClientTimestamp",haveTimestamp); upd.set("netconfClientTimestamp",haveTimestamp);
if (fromAddr) if (fromAddr)
upd.set("lastAt",fromAddr.toString()); upd.set("lastAt",fromAddr.toString());
upd.setHex("lastSeen",Utils::now()); upd.set("lastSeen",Utils::now());
_hmset(memberKey,upd); _hmset(memberKey,upd);
// Attempt to generate netconf for this node if there isn't // Attempt to generate netconf for this node if there isn't
// one or it's not in step with the network's revision. // one or it's not in step with the network's revision.
if (((ts == 0)||(netconf.length() == 0))||(memberRecord.get("netconfRevision","") != revision)) { if (((ts == 0)||(netconfStr.length() == 0))||(memberRecord.get("netconfRevision","") != revision)) {
if (!_generateNetconf(nwid,member,metaData,netconf,ts)) std::string errorMessage;
return; if (!_generateNetconf(nwid,member,metaData,netconf,ts,errorMessage)) {
netconf["error"] = errorMessage;
return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
}
} }
// If the netconf we have (or just generated) is newer than what if (ts > haveTimestamp)
// the client reports that it has, send it. Otherwise we just return NetworkConfigMaster::NETCONF_QUERY_OK;
// ignore the message since the client is up to date. else return NetworkConfigMaster::NETCONF_QUERY_OK_BUT_NOT_NEWER;
if (ts > haveTimestamp) {
TRACE("netconf: sending %u bytes of netconf data to %s",netconf.length(),addrs);
Packet outp(member,RR->identity.address(),Packet::VERB_OK);
outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
outp.append(packetId);
outp.append(nwid);
outp.append((uint16_t)netconf.length());
outp.append(netconf.data(),netconf.length());
outp.compress();
if (outp.size() > ZT_PROTO_MAX_PACKET_LENGTH) { // sanity check -- this would be weird
TRACE("netconf: compressed packet exceeds ZT_PROTO_MAX_PACKET_LENGTH!");
return;
}
RR->sw->send(outp,true);
}
} else { } else {
TRACE("netconf: access denied for %s on %s",addrs,nwids); return NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED;
Packet outp(member,RR->identity.address(),Packet::VERB_ERROR);
outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
outp.append(packetId);
outp.append((unsigned char)Packet::ERROR_NETWORK_ACCESS_DENIED_);
outp.append(nwid);
RR->sw->send(outp,true);
} }
} }
bool NetworkConfigMaster::_reconnect() bool RedisNetworkConfigMaster::_reconnect()
{ {
struct timeval tv; struct timeval tv;
@ -207,7 +173,7 @@ bool NetworkConfigMaster::_reconnect()
return true; return true;
} }
bool NetworkConfigMaster::_hgetall(const char *key,Dictionary &hdata) bool RedisNetworkConfigMaster::_hgetall(const char *key,Dictionary &hdata)
{ {
if (!_rc) { if (!_rc) {
if (!_reconnect()) if (!_reconnect())
@ -242,7 +208,7 @@ bool NetworkConfigMaster::_hgetall(const char *key,Dictionary &hdata)
return true; return true;
} }
bool NetworkConfigMaster::_hmset(const char *key,const Dictionary &hdata) bool RedisNetworkConfigMaster::_hmset(const char *key,const Dictionary &hdata)
{ {
const char *hargv[1024]; const char *hargv[1024];
@ -281,7 +247,7 @@ bool NetworkConfigMaster::_hmset(const char *key,const Dictionary &hdata)
return true; return true;
} }
bool NetworkConfigMaster::_hget(const char *key,const char *hashKey,std::string &value) bool RedisNetworkConfigMaster::_hget(const char *key,const char *hashKey,std::string &value)
{ {
if (!_rc) { if (!_rc) {
if (!_reconnect()) if (!_reconnect())
@ -304,7 +270,7 @@ bool NetworkConfigMaster::_hget(const char *key,const char *hashKey,std::string
return true; return true;
} }
bool NetworkConfigMaster::_hset(const char *key,const char *hashKey,const char *value) bool RedisNetworkConfigMaster::_hset(const char *key,const char *hashKey,const char *value)
{ {
if (!_rc) { if (!_rc) {
if (!_reconnect()) if (!_reconnect())
@ -328,7 +294,7 @@ bool NetworkConfigMaster::_hset(const char *key,const char *hashKey,const char *
return true; return true;
} }
bool NetworkConfigMaster::_get(const char *key,std::string &value) bool RedisNetworkConfigMaster::_get(const char *key,std::string &value)
{ {
if (!_rc) { if (!_rc) {
if (!_reconnect()) if (!_reconnect())
@ -351,7 +317,7 @@ bool NetworkConfigMaster::_get(const char *key,std::string &value)
return true; return true;
} }
bool NetworkConfigMaster::_smembers(const char *key,std::vector<std::string> &sdata) bool RedisNetworkConfigMaster::_smembers(const char *key,std::vector<std::string> &sdata)
{ {
if (!_rc) { if (!_rc) {
if (!_reconnect()) if (!_reconnect())
@ -376,22 +342,22 @@ bool NetworkConfigMaster::_smembers(const char *key,std::vector<std::string> &sd
return true; return true;
} }
bool NetworkConfigMaster::_initNewMember(uint64_t nwid,const Address &member,const Dictionary &metaData,Dictionary &memberRecord) bool RedisNetworkConfigMaster::_initNewMember(uint64_t nwid,const Identity &member,const Dictionary &metaData,Dictionary &memberRecord)
{ {
char memberKey[256],nwids[24],addrs[16],nwKey[256]; char memberKey[256],nwids[24],addrs[16],nwKey[256];
Dictionary networkRecord; Dictionary networkRecord;
Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid); Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.toInt()); Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.address().toInt());
Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs); Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs);
Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids); Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids);
if (!_hgetall(nwKey,networkRecord)) { if (!_hgetall(nwKey,networkRecord)) {
LOG("netconf: Redis error retrieving %s",nwKey); //LOG("netconf: Redis error retrieving %s",nwKey);
return false; return false;
} }
if (networkRecord.get("id","") != nwids) { if (networkRecord.get("id","") != nwids) {
TRACE("netconf: network %s not found (initNewMember)",nwids); //TRACE("netconf: network %s not found (initNewMember)",nwids);
return false; return false;
} }
@ -399,51 +365,47 @@ bool NetworkConfigMaster::_initNewMember(uint64_t nwid,const Address &member,con
memberRecord["id"] = addrs; memberRecord["id"] = addrs;
memberRecord["nwid"] = nwids; memberRecord["nwid"] = nwids;
memberRecord["authorized"] = (networkRecord.getBoolean("private",true) ? "0" : "1"); // auto-authorize on public networks memberRecord["authorized"] = (networkRecord.getBoolean("private",true) ? "0" : "1"); // auto-authorize on public networks
memberRecord.setHex("firstSeen",Utils::now()); memberRecord.set("firstSeen",Utils::now());
{ memberRecord["identity"] = member.toString(false);
SharedPtr<Peer> peer(RR->topology->getPeer(member));
if (peer)
memberRecord["identity"] = peer->identity().toString(false);
}
if (!_hmset(memberKey,memberRecord)) { if (!_hmset(memberKey,memberRecord)) {
LOG("netconf: Redis error storing %s for new member %s",memberKey,addrs); //LOG("netconf: Redis error storing %s for new member %s",memberKey,addrs);
return false; return false;
} }
return true; return true;
} }
bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,const Dictionary &metaData,std::string &netconf,uint64_t &ts) bool RedisNetworkConfigMaster::_generateNetconf(uint64_t nwid,const Identity &member,const Dictionary &metaData,Dictionary &netconf,uint64_t &ts,std::string &errorMessage)
{ {
char memberKey[256],nwids[24],addrs[16],tss[24],nwKey[256],revKey[128],abKey[128],ipaKey[128]; char memberKey[256],nwids[24],addrs[16],tss[24],nwKey[256],revKey[128],abKey[128],ipaKey[128];
Dictionary networkRecord,memberRecord,nc; Dictionary networkRecord,memberRecord;
std::string revision; std::string revision;
Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs); Utils::snprintf(memberKey,sizeof(memberKey),"zt1:network:%s:member:%s:~",nwids,addrs);
Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid); Utils::snprintf(nwids,sizeof(nwids),"%.16llx",(unsigned long long)nwid);
Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.toInt()); Utils::snprintf(addrs,sizeof(addrs),"%.10llx",(unsigned long long)member.address().toInt());
Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids); Utils::snprintf(nwKey,sizeof(nwKey),"zt1:network:%s:~",nwids);
Utils::snprintf(revKey,sizeof(revKey),"zt1:network:%s:revision",nwids); Utils::snprintf(revKey,sizeof(revKey),"zt1:network:%s:revision",nwids);
Utils::snprintf(abKey,sizeof(revKey),"zt1:network:%s:activeBridges",nwids); Utils::snprintf(abKey,sizeof(revKey),"zt1:network:%s:activeBridges",nwids);
Utils::snprintf(ipaKey,sizeof(revKey),"zt1:network:%s:ipAssignments",nwids); Utils::snprintf(ipaKey,sizeof(revKey),"zt1:network:%s:ipAssignments",nwids);
if (!_hgetall(nwKey,networkRecord)) { if (!_hgetall(nwKey,networkRecord)) {
LOG("netconf: Redis error retrieving %s",nwKey); errorMessage = "Redis error retrieving network record";
return false; return false;
} }
if (networkRecord.get("id","") != nwids) { if (networkRecord.get("id","") != nwids) {
TRACE("netconf: network %s not found (generateNetconf)",nwids); errorMessage = "network IDs do not match in database";
return false; return false;
} }
if (!_hgetall(memberKey,memberRecord)) { if (!_hgetall(memberKey,memberRecord)) {
LOG("netconf: Redis error retrieving %s",memberKey); errorMessage = "Redis error retrieving member record";
return false; return false;
} }
if (!_get(revKey,revision)) { if (!_get(revKey,revision)) {
LOG("netconf: Redis error retrieving %s",revKey); errorMessage = "Redis error retrieving network revision";
return false; return false;
} }
if (!revision.length()) if (!revision.length())
@ -454,28 +416,28 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
Utils::snprintf(tss,sizeof(tss),"%llx",ts); Utils::snprintf(tss,sizeof(tss),"%llx",ts);
// Core configuration // Core configuration
nc[ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP] = tss; netconf[ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP] = tss;
nc[ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID] = nwids; netconf[ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID] = nwids;
nc[ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO] = addrs; netconf[ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO] = addrs;
nc[ZT_NETWORKCONFIG_DICT_KEY_PRIVATE] = isPrivate ? "1" : "0"; netconf[ZT_NETWORKCONFIG_DICT_KEY_PRIVATE] = isPrivate ? "1" : "0";
nc[ZT_NETWORKCONFIG_DICT_KEY_NAME] = networkRecord.get("name",nwids); netconf[ZT_NETWORKCONFIG_DICT_KEY_NAME] = networkRecord.get("name",nwids);
nc[ZT_NETWORKCONFIG_DICT_KEY_DESC] = networkRecord.get("desc",""); netconf[ZT_NETWORKCONFIG_DICT_KEY_DESC] = networkRecord.get("desc","");
nc[ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST] = networkRecord.getBoolean("enableBroadcast",true) ? "1" : "0"; netconf[ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST] = networkRecord.getBoolean("enableBroadcast",true) ? "1" : "0";
nc[ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING] = networkRecord.getBoolean("allowPassiveBridging",false) ? "1" : "0"; netconf[ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING] = networkRecord.getBoolean("allowPassiveBridging",false) ? "1" : "0";
nc[ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES] = networkRecord.get("etherTypes",""); netconf[ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES] = networkRecord.get("etherTypes",""); // these are stored as hex comma-delimited list
// Multicast options // Multicast options
nc[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_RATES] = networkRecord.get("multicastRates",""); netconf[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_RATES] = networkRecord.get("multicastRates","");
uint64_t ml = networkRecord.getHexUInt("multicastLimit",0); uint64_t ml = networkRecord.getHexUInt("multicastLimit",0);
if (ml > 0) if (ml > 0)
nc.setHex(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,ml); netconf.setHex(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,ml);
// Active bridge configuration // Active bridge configuration
{ {
std::string activeBridgeList; std::string activeBridgeList;
std::vector<std::string> activeBridgeSet; std::vector<std::string> activeBridgeSet;
if (!_smembers(abKey,activeBridgeSet)) { if (!_smembers(abKey,activeBridgeSet)) {
LOG("netconf: Redis error retrieving set %s",abKey); errorMessage = "Redis error retrieving active bridge set";
return false; return false;
} }
std::sort(activeBridgeSet.begin(),activeBridgeSet.end()); std::sort(activeBridgeSet.begin(),activeBridgeSet.end());
@ -487,7 +449,7 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
} }
} }
if (activeBridgeList.length() > 0) if (activeBridgeList.length() > 0)
nc[ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES] = activeBridgeList; netconf[ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES] = activeBridgeList;
} }
// IP address assignment and auto-assign using the ZeroTier-internal mechanism (not DHCP, etc.) // IP address assignment and auto-assign using the ZeroTier-internal mechanism (not DHCP, etc.)
@ -524,7 +486,7 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
uint32_t invmask = ~pmask; // netmask over "random" part uint32_t invmask = ~pmask; // netmask over "random" part
// Begin exploring the IP space by generating an IP from the ZeroTier address // Begin exploring the IP space by generating an IP from the ZeroTier address
uint32_t first = (((uint32_t)(member.toInt() & 0xffffffffULL)) & invmask) | (pnet & pmask); uint32_t first = (((uint32_t)(member.address().toInt() & 0xffffffffULL)) & invmask) | (pnet & pmask);
if ((first & 0xff) == 0) if ((first & 0xff) == 0)
first |= 1; first |= 1;
else if ((first & 0xff) == 0xff) else if ((first & 0xff) == 0xff)
@ -544,10 +506,10 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
// Is 'ip' already assigned to another node? // Is 'ip' already assigned to another node?
std::string assignment; std::string assignment;
if (!_hget(ipaKey,ip.toString().c_str(),assignment)) { if (!_hget(ipaKey,ip.toString().c_str(),assignment)) {
LOG("netconf: Redis error checking IP allocation in %s",ipaKey); errorMessage = "Redis error while checking IP allocation";
return false; return false;
} }
if ((assignment.length() != 10)||(assignment == member.toString())) { if ((assignment.length() != 10)||(assignment == member.address().toString())) {
gotone = true; gotone = true;
break; // not taken! break; // not taken!
} }
@ -570,13 +532,16 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
// If we got one, add to IP list and claim in database // If we got one, add to IP list and claim in database
if (gotone) { if (gotone) {
ip4s.push_back(ip); ip4s.push_back(ip);
_hset(ipaKey,ip.toString().c_str(),member.toString().c_str()); _hset(ipaKey,ip.toString().c_str(),member.address().toString().c_str());
if (ipAssignments.length() > 0) if (ipAssignments.length() > 0)
ipAssignments.push_back(','); ipAssignments.push_back(',');
ipAssignments.append(ip.toString()); ipAssignments.append(ip.toString());
_hset(memberKey,"ipAssignments",ipAssignments.c_str()); _hset(memberKey,"ipAssignments",ipAssignments.c_str());
} else { } else {
LOG("netconf: failed to allocate IP in %s for %s in network %s, need a larger pool!",v4AssignPool.toString().c_str(),addrs,nwids); char tmp[1024];
Utils::snprintf(tmp,sizeof(tmp),"failed to allocate IP in %s for %s in network %s, need a larger pool!",v4AssignPool.toString().c_str(),addrs,nwids);
errorMessage = tmp;
return false;
} }
} }
} }
@ -589,7 +554,7 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
v4s.append(i->toString()); v4s.append(i->toString());
} }
if (v4s.length()) if (v4s.length())
nc[ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC] = v4s; netconf[ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC] = v4s;
} }
if (networkRecord.get("v6AssignMode","") == "zt") { if (networkRecord.get("v6AssignMode","") == "zt") {
@ -602,38 +567,35 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
v6s.append(i->toString()); v6s.append(i->toString());
} }
if (v6s.length()) if (v6s.length())
nc[ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC] = v6s; netconf[ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC] = v6s;
} }
} }
// If this is a private network, generate a signed certificate of membership // If this is a private network, generate a signed certificate of membership
if (isPrivate) { if (isPrivate) {
CertificateOfMembership com(Utils::strToU64(revision.c_str()),1,nwid,member); CertificateOfMembership com(Utils::strToU64(revision.c_str()),1,nwid,member.address());
if (com.sign(RR->identity)) // basically can't fail unless our identity is invalid if (com.sign(_signingId)) // basically can't fail unless our identity is invalid
nc[ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP] = com.toString(); netconf[ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP] = com.toString();
else { else {
LOG("netconf: failure signing certificate (identity problem?)"); errorMessage = "unable to sign COM";
return false; return false;
} }
} }
// Sign netconf dictionary itself // Sign netconf dictionary itself
if (!nc.sign(RR->identity)) { if (!netconf.sign(_signingId)) {
LOG("netconf: failure signing dictionary (identity problem?)"); errorMessage = "unable to sign netconf dictionary";
return false; return false;
} }
// Convert to string-serialized form into result paramter
netconf = nc.toString();
// Record new netconf in database for re-use on subsequent repeat queries // Record new netconf in database for re-use on subsequent repeat queries
{ {
Dictionary upd; Dictionary upd;
upd["netconf"] = netconf; upd["netconf"] = netconf.toString();
upd["netconfTimestamp"] = tss; upd.set("netconfTimestamp",ts);
upd["netconfRevision"] = revision; upd["netconfRevision"] = revision;
if (!_hmset(memberKey,upd)) { if (!_hmset(memberKey,upd)) {
LOG("netconf: Redis error writing to key %s",memberKey); errorMessage = "Redis error updating network record with new netconf dictionary";
return false; return false;
} }
} }
@ -642,5 +604,3 @@ bool NetworkConfigMaster::_generateNetconf(uint64_t nwid,const Address &member,c
} }
} // namespace ZeroTier } // namespace ZeroTier
#endif // ZT_ENABLE_NETCONF_MASTER

80
netconf/RedisNetworkConfigMaster.hpp
View File

@ -25,84 +25,45 @@
* LLC. Start here: http://www.zerotier.com/ * LLC. Start here: http://www.zerotier.com/
*/ */
#ifndef ZT_NETWORKCONFIGMASTER_HPP #ifndef ZT_REDISNETWORKCONFIGMASTER_HPP
#define ZT_NETWORKCONFIGMASTER_HPP #define ZT_REDISNETWORKCONFIGMASTER_HPP
#include "Constants.hpp"
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_HOST "netconf.redisHost"
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_PORT "netconf.redisPort"
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_PORT_DEFAULT 6379
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_AUTH "netconf.redisAuth"
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_DBNUM "netconf.redisDatabaseNumber"
#define ZT_LOCAL_CONFIG_NETCONF_REDIS_DBNUM_DEFAULT 0
#ifdef ZT_ENABLE_NETCONF_MASTER
#include <stdint.h> #include <stdint.h>
#include <string> #include <string>
#include <map> #include <map>
#include <vector> #include <vector>
#include "Address.hpp" #include "../node/Constants.hpp"
#include "Dictionary.hpp" #include "../node/NetworkConfigMaster.hpp"
#include "Mutex.hpp" #include "../node/Mutex.hpp"
#include "InetAddress.hpp"
#include <hiredis/hiredis.h> #include <hiredis/hiredis.h>
// Redis timeout in seconds
#define ZT_NETCONF_REDIS_TIMEOUT 10
namespace ZeroTier { namespace ZeroTier {
class RuntimeEnvironment; class RedisNetworkConfigMaster : public NetworkConfigMaster
/**
* Network configuration master -- responds to NETCONF requests
*
* This requires the 'hiredis' C library to build.
*/
class NetworkConfigMaster
{ {
public: public:
/** RedisNetworkConfigMaster(
* Create netconf master const Identity &signingId,
*
* This doesn't connect to Redis until the first request is received.
*
* @param renv Runtime environment
* @param redisHost Hostname or IP of Redis server
* @param redisPort Redis IP port number
* @param redisPassword Redis AUTH password or NULL if none
* @param redisDatabaseNumber Redis database number (usually 0)
*/
NetworkConfigMaster(
const RuntimeEnvironment *renv,
const char *redisHost, const char *redisHost,
unsigned int redisPort, unsigned int redisPort,
const char *redisPassword, const char *redisPassword,
unsigned int redisDatabaseNumber); unsigned int redisDatabaseNumber);
~NetworkConfigMaster(); virtual ~RedisNetworkConfigMaster();
/** virtual NetworkConfigMaster::ResultCode doNetworkConfigRequest(
* Handle a network config request, sending replies if necessary
*
* This is a blocking call, so rate is limited by Redis. It will fail
* and log its failure if the Redis server is not available or times out.
*
* @param fromAddr Originating IP address
* @param packetId 64-bit packet ID
* @param member Originating peer ZeroTier address
* @param nwid 64-bit network ID
* @param metaData Meta-data bundled with request (empty if none)
* @param haveTimestamp Timestamp requesting peer has or 0 if none or not included
*/
void doNetworkConfigRequest(
const InetAddress &fromAddr, const InetAddress &fromAddr,
uint64_t packetId, uint64_t packetId,
const Address &member, const Identity &member,
uint64_t nwid, uint64_t nwid,
const Dictionary &metaData, const Dictionary &metaData,
uint64_t haveTimestamp); uint64_t haveTimestamp,
Dictionary &netconf);
private: private:
// These assume _lock is locked // These assume _lock is locked
@ -114,22 +75,21 @@ private:
bool _get(const char *key,std::string &value); bool _get(const char *key,std::string &value);
bool _smembers(const char *key,std::vector<std::string> &sdata); bool _smembers(const char *key,std::vector<std::string> &sdata);
bool _initNewMember(uint64_t nwid,const Address &member,const Dictionary &metaData,Dictionary &memberRecord); bool _initNewMember(uint64_t nwid,const Identity &member,const Dictionary &metaData,Dictionary &memberRecord);
bool _generateNetconf(uint64_t nwid,const Address &member,const Dictionary &metaData,std::string &netconf,uint64_t &ts); bool _generateNetconf(uint64_t nwid,const Identity &member,const Dictionary &metaData,Dictionary &netconf,uint64_t &ts,std::string &errorMessage);
Mutex _lock; Mutex _lock;
Identity _signingId;
std::string _redisHost; std::string _redisHost;
std::string _redisPassword; std::string _redisPassword;
unsigned int _redisPort; unsigned int _redisPort;
unsigned int _redisDatabaseNumber; unsigned int _redisDatabaseNumber;
const RuntimeEnvironment *RR;
redisContext *_rc; redisContext *_rc;
}; };
} // namespace ZeroTier } // namespace ZeroTier
#endif // ZT_ENABLE_NETCONF_MASTER
#endif #endif

4
node/IncomingPacket.cpp
View File

@ -632,7 +632,7 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
if (RR->netconfMaster) { if (RR->netconfMaster) {
Dictionary netconf; Dictionary netconf;
switch(RR->netconfMaster->doNetworkConfigRequest(_remoteAddress,packetId(),source(),nwid,metaData,haveTimestamp,netconf)) { switch(RR->netconfMaster->doNetworkConfigRequest(_remoteAddress,packetId(),peer->identity(),nwid,metaData,haveTimestamp,netconf)) {
case NetworkConfigMaster::NETCONF_QUERY_OK: { case NetworkConfigMaster::NETCONF_QUERY_OK: {
std::string netconfStr(netconf.toString()); std::string netconfStr(netconf.toString());
if (netconfStr.length() > 0xffff) { // sanity check since field ix 16-bit if (netconfStr.length() > 0xffff) { // sanity check since field ix 16-bit
@ -652,6 +652,8 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
} }
} }
} break; } break;
case NetworkConfigMaster::NETCONF_QUERY_OK_BUT_NOT_NEWER: // nothing to do -- netconf has not changed
break;
case NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND: { case NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND: {
Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR); Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST); outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);

12
node/NetworkConfigMaster.hpp
View File

@ -34,6 +34,7 @@
#include "InetAddress.hpp" #include "InetAddress.hpp"
#include "Dictionary.hpp" #include "Dictionary.hpp"
#include "Address.hpp" #include "Address.hpp"
#include "Identity.hpp"
namespace ZeroTier { namespace ZeroTier {
@ -51,9 +52,10 @@ public:
enum ResultCode enum ResultCode
{ {
NETCONF_QUERY_OK = 0, NETCONF_QUERY_OK = 0,
NETCONF_QUERY_OBJECT_NOT_FOUND = 1, NETCONF_QUERY_OK_BUT_NOT_NEWER = 1,
NETCONF_QUERY_ACCESS_DENIED = 2, NETCONF_QUERY_OBJECT_NOT_FOUND = 2,
NETCONF_QUERY_INTERNAL_SERVER_ERROR = 3 NETCONF_QUERY_ACCESS_DENIED = 3,
NETCONF_QUERY_INTERNAL_SERVER_ERROR = 4
}; };
NetworkConfigMaster() {} NetworkConfigMaster() {}
@ -70,7 +72,7 @@ public:
* *
* @param fromAddr Originating IP address * @param fromAddr Originating IP address
* @param packetId 64-bit packet ID * @param packetId 64-bit packet ID
* @param member Originating peer ZeroTier address * @param member Originating peer ZeroTier identity
* @param nwid 64-bit network ID * @param nwid 64-bit network ID
* @param metaData Meta-data bundled with request (empty if none) * @param metaData Meta-data bundled with request (empty if none)
* @param haveTimestamp Timestamp sent by requesting peer or 0 if none * @param haveTimestamp Timestamp sent by requesting peer or 0 if none
@ -80,7 +82,7 @@ public:
virtual NetworkConfigMaster::ResultCode doNetworkConfigRequest( virtual NetworkConfigMaster::ResultCode doNetworkConfigRequest(
const InetAddress &fromAddr, const InetAddress &fromAddr,
uint64_t packetId, uint64_t packetId,
const Address &member, const Identity &member,
uint64_t nwid, uint64_t nwid,
const Dictionary &metaData, const Dictionary &metaData,
uint64_t haveTimestamp, uint64_t haveTimestamp,