ExternalVendorCode/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-02-20 17:52:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Notification of about-to-expire status... almost there.

Browse Source
This commit is contained in:
Adam Ierymenko 2021-07-23 19:05:59 -04:00
parent 5c7e51feaf
commit efe0e8aa7b
No known key found for this signature in database
GPG Key ID: C8877CF2D7A5D7F3
4 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
controller/DB.hpp
View File

@ -35,6 +35,8 @@
#include "../ext/json/json.hpp"
#define ZT_MEMBER_AUTH_TIMEOUT_NOTIFY_BEFORE 10000
namespace ZeroTier
{

10
controller/DBMirrorSet.cpp
View File

@ -240,9 +240,9 @@ void DBMirrorSet::onNetworkMemberDeauthorize(const void *db,uint64_t networkId,u
_listener->onNetworkMemberDeauthorize(this,networkId,memberId);
}
std::vector<std::pair<uint64_t, uint64_t>> DBMirrorSet::membersExpiringSoon()
std::set< std::pair<uint64_t, uint64_t> > DBMirrorSet::membersExpiringSoon()
{
std::vector<std::pair<uint64_t, uint64_t>> soon;
std::set< std::pair<uint64_t, uint64_t> > soon;
std::unique_lock<std::mutex> l(_membersExpiringSoon_l);
int64_t now = OSUtils::now();
for(auto next=_membersExpiringSoon.begin();next!=_membersExpiringSoon.end();) {
@ -259,11 +259,11 @@ std::vector<std::pair<uint64_t, uint64_t>> DBMirrorSet::membersExpiringSoon()
const bool ssoExempt = member["ssoExempt"];
const int64_t authenticationExpiryTime = member["authenticationExpiryTime"];
if ((authenticationExpiryTime == next->first)&&(authorized)&&(!ssoExempt)) {
if ((authenticationExpiryTime - now) > 10000) {
// Stop when we get to entries more than 10s in the future.
if ((authenticationExpiryTime - now) > ZT_MEMBER_AUTH_TIMEOUT_NOTIFY_BEFORE) {
// Stop when we get to entries too far in the future.
break;
} else {
soon.push_back(std::pair<uint64_t, uint64_t>(nwid, memberId));
soon.insert(std::pair<uint64_t, uint64_t>(nwid, memberId));
}
} else {
// Obsolete entry, no longer authorized, or SSO exempt.

4
controller/DBMirrorSet.hpp
View File

@ -60,7 +60,7 @@ public:
_dbs.push_back(db);
}
std::vector<std::pair<uint64_t, uint64_t>> membersExpiringSoon();
std::set< std::pair<uint64_t, uint64_t> > membersExpiringSoon();
void memberExpiring(int64_t expTime, uint64_t nwid, uint64_t memberId);
private:
@ -69,7 +69,7 @@ private:
std::thread _syncCheckerThread;
std::vector< std::shared_ptr< DB > > _dbs;
mutable std::mutex _dbs_l;
std::multimap< int64_t, std::pair<uint64_t, uint64_t> > _membersExpiringSoon;
std::set< std::pair< int64_t, std::pair<uint64_t, uint64_t> > > _membersExpiringSoon;
mutable std::mutex _membersExpiringSoon_l;
};

26
controller/EmbeddedNetworkController.cpp
View File

@ -1366,17 +1366,21 @@ void EmbeddedNetworkController::_request(
std::string memberId = member["id"];
fprintf(stderr, "ssoEnabled && !ssoExempt %s-%s\n", nwids, memberId.c_str());
uint64_t authenticationExpiryTime = (int64_t)OSUtils::jsonInt(member["authenticationExpiryTime"], 0);
fprintf(stderr, "authExpiryTime: %lld\n", authenticationExpiryTime);
if (authenticationExpiryTime < now) {
std::string authenticationURL = _db.getSSOAuthURL(member, _ssoRedirectURL);
if (!authenticationURL.empty()) {
Dictionary<3072> authInfo;
authInfo.add("aU", authenticationURL.c_str());
fprintf(stderr, "sending auth URL: %s\n", authenticationURL.c_str());
DB::cleanMember(member);
_db.save(member,true);
_sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_AUTHENTICATION_REQUIRED, authInfo.data(), authInfo.sizeBytes());
return;
if (authenticationExpiryTime > 0) {
fprintf(stderr, "authExpiryTime: %lld\n", authenticationExpiryTime);
if (authenticationExpiryTime < now) {
std::string authenticationURL = _db.getSSOAuthURL(member, _ssoRedirectURL);
if (!authenticationURL.empty()) {
Dictionary<3072> authInfo;
authInfo.add("aU", authenticationURL.c_str());
fprintf(stderr, "sending auth URL: %s\n", authenticationURL.c_str());
DB::cleanMember(member);
_db.save(member,true);
_sender->ncSendError(nwid,requestPacketId,identity.address(),NetworkController::NC_ERROR_AUTHENTICATION_REQUIRED, authInfo.data(), authInfo.sizeBytes());
return;
}
} else {
_db.memberExpiring(authenticationExpiryTime, nwid, identity.address().toInt());
}
}
}