/* * ZeroTier One - Network Virtualization Everywhere * Copyright (C) 2011-2017 ZeroTier, Inc. https://www.zerotier.com/ * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . * * -- * * You can be released from the requirements of the license by purchasing * a commercial license. Buying such a license is mandatory as soon as you * develop commercial closed-source software that incorporates or links * directly against ZeroTier software without disclosing the source code * of your own application. */ #ifndef ZT_BINDER_HPP #define ZT_BINDER_HPP #include "../node/Constants.hpp" #include #include #include #include #ifdef __WINDOWS__ #include #include #include #include #include #else #include #include #include #include #include #ifdef __LINUX__ #include #include #endif #endif #include #include #include #include #include #include #include "../node/NonCopyable.hpp" #include "../node/InetAddress.hpp" #include "../node/Mutex.hpp" #include "../node/Utils.hpp" #include "Phy.hpp" #include "OSUtils.hpp" // Period between refreshes of bindings #define ZT_BINDER_REFRESH_PERIOD 30000 namespace ZeroTier { /** * Enumerates local devices and binds to all potential ZeroTier path endpoints * * This replaces binding to wildcard (0.0.0.0 and ::0) with explicit binding * as part of the path to default gateway support. Under the hood it uses * different queries on different OSes to enumerate devices, and also exposes * device enumeration and endpoint IP data for use elsewhere. * * On OSes that do not support local port enumeration or where this is not * meaningful, this degrades to binding to wildcard. */ class Binder : NonCopyable { private: struct _Binding { _Binding() : udpSock((PhySocket *)0), tcpListenSock((PhySocket *)0), address() {} PhySocket *udpSock; PhySocket *tcpListenSock; InetAddress address; }; public: Binder() {} /** * Close all bound ports, should be called on shutdown * * @param phy Physical interface */ template void closeAll(Phy &phy) { Mutex::Lock _l(_lock); for(std::vector<_Binding>::iterator b(_bindings.begin());b!=_bindings.end();++b) { phy.close(b->udpSock,false); phy.close(b->tcpListenSock,false); } } /** * Scan local devices and addresses and rebind TCP and UDP * * This should be called after wake from sleep, on detected network device * changes, on startup, or periodically (e.g. every 30-60s). * * @param phy Physical interface * @param ports Ports to bind on all interfaces * @param ignoreInterfacesByName Ignore these interfaces by name * @param ignoreInterfacesByNamePrefix Ignore these interfaces by name-prefix (starts-with, e.g. zt ignores zt*) * @param ignoreInterfacesByAddress Ignore these interfaces by address * @tparam PHY_HANDLER_TYPE Type for Phy<> template * @tparam INTERFACE_CHECKER Type for class containing shouldBindInterface() method */ template void refresh(Phy &phy,unsigned int *ports,unsigned int portCount,INTERFACE_CHECKER &ifChecker) { std::map localIfAddrs; PhySocket *udps,*tcps; Mutex::Lock _l(_lock); #ifdef __WINDOWS__ char aabuf[32768]; ULONG aalen = sizeof(aabuf); if (GetAdaptersAddresses(AF_UNSPEC,GAA_FLAG_SKIP_ANYCAST|GAA_FLAG_SKIP_MULTICAST|GAA_FLAG_SKIP_DNS_SERVER,(void *)0,reinterpret_cast(aabuf),&aalen) == NO_ERROR) { PIP_ADAPTER_ADDRESSES a = reinterpret_cast(aabuf); while (a) { PIP_ADAPTER_UNICAST_ADDRESS ua = a->FirstUnicastAddress; while (ua) { InetAddress ip(ua->Address.lpSockaddr); if (ifChecker.shouldBindInterface("",ip)) { switch(ip.ipScope()) { default: break; case InetAddress::IP_SCOPE_PSEUDOPRIVATE: case InetAddress::IP_SCOPE_GLOBAL: case InetAddress::IP_SCOPE_SHARED: case InetAddress::IP_SCOPE_PRIVATE: for(int x=0;x(ip,std::string())); } break; } } ua = ua->Next; } a = a->Next; } } #else // not __WINDOWS__ /* On Linux we use an alternative method if available since getifaddrs() * gets very slow when there are lots of network namespaces. This won't * work unless /proc/PID/net/if_inet6 exists and it may not on some * embedded systems, so revert to getifaddrs() there. */ #ifdef __LINUX__ char fn[256],tmp[256]; std::set ifnames; const unsigned long pid = (unsigned long)getpid(); // Get all device names Utils::snprintf(fn,sizeof(fn),"/proc/%lu/net/dev",pid); FILE *procf = fopen(fn,"r"); if (procf) { while (fgets(tmp,sizeof(tmp),procf)) { tmp[255] = 0; char *saveptr = (char *)0; for(char *f=Utils::stok(tmp," \t\r\n:|",&saveptr);(f);f=Utils::stok((char *)0," \t\r\n:|",&saveptr)) { if ((strcmp(f,"Inter-") != 0)&&(strcmp(f,"face") != 0)&&(f[0] != 0)) ifnames.insert(f); break; // we only want the first field } } fclose(procf); } // Get IPv6 addresses (and any device names we don't already know) Utils::snprintf(fn,sizeof(fn),"/proc/%lu/net/if_inet6",pid); procf = fopen(fn,"r"); if (procf) { while (fgets(tmp,sizeof(tmp),procf)) { tmp[255] = 0; char *saveptr = (char *)0; unsigned char ipbits[16]; memset(ipbits,0,sizeof(ipbits)); char *devname = (char *)0; int n = 0; for(char *f=Utils::stok(tmp," \t\r\n",&saveptr);(f);f=Utils::stok((char *)0," \t\r\n",&saveptr)) { switch(n++) { case 0: // IP in hex Utils::unhex(f,32,ipbits,16); break; case 5: // device name devname = f; break; } } if (devname) { ifnames.insert(devname); InetAddress ip(ipbits,16,0); if (ifChecker.shouldBindInterface(devname,ip)) { switch(ip.ipScope()) { default: break; case InetAddress::IP_SCOPE_PSEUDOPRIVATE: case InetAddress::IP_SCOPE_GLOBAL: case InetAddress::IP_SCOPE_SHARED: case InetAddress::IP_SCOPE_PRIVATE: for(int x=0;x(ip,std::string(devname))); } break; } } } } fclose(procf); } // Get IPv4 addresses for each device if (ifnames.size() > 0) { const int controlfd = (int)socket(AF_INET,SOCK_DGRAM,0); struct ifconf configuration; configuration.ifc_len = 0; configuration.ifc_buf = nullptr; if (controlfd < 0) goto ip4_address_error; if (ioctl(controlfd, SIOCGIFCONF, &configuration) < 0) goto ip4_address_error; configuration.ifc_buf = (char*)malloc(configuration.ifc_len); if (ioctl(controlfd, SIOCGIFCONF, &configuration) < 0) goto ip4_address_error; for (int i=0; i < (int)(configuration.ifc_len / sizeof(ifreq)); i ++) { struct ifreq& request = configuration.ifc_req[i]; struct sockaddr* addr = &request.ifr_ifru.ifru_addr; if (addr->sa_family != AF_INET) continue; std::string ifname = request.ifr_ifrn.ifrn_name; // name can either be just interface name or interface name followed by ':' and arbitrary label if (ifname.find(':') != std::string::npos) ifname = ifname.substr(0, ifname.find(':')); InetAddress ip(&(((struct sockaddr_in *)addr)->sin_addr),4,0); if (ifChecker.shouldBindInterface(ifname.c_str(), ip)) { switch(ip.ipScope()) { default: break; case InetAddress::IP_SCOPE_PSEUDOPRIVATE: case InetAddress::IP_SCOPE_GLOBAL: case InetAddress::IP_SCOPE_SHARED: case InetAddress::IP_SCOPE_PRIVATE: for(int x=0;x(ip,ifname)); } break; } } } ip4_address_error: free(configuration.ifc_buf); if (controlfd > 0) close(controlfd); } const bool gotViaProc = (localIfAddrs.size() > 0); #else const bool gotViaProc = false; #endif if (!gotViaProc) { struct ifaddrs *ifatbl = (struct ifaddrs *)0; struct ifaddrs *ifa; if ((getifaddrs(&ifatbl) == 0)&&(ifatbl)) { ifa = ifatbl; while (ifa) { if ((ifa->ifa_name)&&(ifa->ifa_addr)) { InetAddress ip = *(ifa->ifa_addr); if (ifChecker.shouldBindInterface(ifa->ifa_name,ip)) { switch(ip.ipScope()) { default: break; case InetAddress::IP_SCOPE_PSEUDOPRIVATE: case InetAddress::IP_SCOPE_GLOBAL: case InetAddress::IP_SCOPE_SHARED: case InetAddress::IP_SCOPE_PRIVATE: for(int x=0;x(ip,std::string(ifa->ifa_name))); } break; } } } ifa = ifa->ifa_next; } freeifaddrs(ifatbl); } } #endif // Default to binding to wildcard if we can't enumerate addresses if (localIfAddrs.empty()) { for(int x=0;x(InetAddress((uint32_t)0,ports[x]),std::string())); localIfAddrs.insert(std::pair(InetAddress((const void *)"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0",16,ports[x]),std::string())); } } std::vector<_Binding> newBindings; // Save bindings that are still valid, close those that are not for(std::vector<_Binding>::iterator b(_bindings.begin());b!=_bindings.end();++b) { if (localIfAddrs.find(b->address) != localIfAddrs.end()) { newBindings.push_back(*b); } else { phy.close(b->udpSock,false); phy.close(b->tcpListenSock,false); } } // Create new bindings for those not already bound for(std::map::const_iterator ii(localIfAddrs.begin());ii!=localIfAddrs.end();++ii) { typename std::vector<_Binding>::const_iterator bi(newBindings.begin()); while (bi != newBindings.end()) { if (bi->address == ii->first) break; ++bi; } if (bi == newBindings.end()) { udps = phy.udpBind(reinterpret_cast(&(ii->first)),(void *)0,ZT_UDP_DESIRED_BUF_SIZE); tcps = phy.tcpListen(reinterpret_cast(&(ii->first)),(void *)0); if ((udps)&&(tcps)) { #ifdef __LINUX__ // Bind Linux sockets to their device so routes tha we manage do not override physical routes (wish all platforms had this!) if (ii->second.length() > 0) { char tmp[256]; Utils::scopy(tmp,sizeof(tmp),ii->second.c_str()); int fd = (int)Phy::getDescriptor(udps); if (fd >= 0) setsockopt(fd,SOL_SOCKET,SO_BINDTODEVICE,tmp,strlen(tmp)); fd = (int)Phy::getDescriptor(tcps); if (fd >= 0) setsockopt(fd,SOL_SOCKET,SO_BINDTODEVICE,tmp,strlen(tmp)); } #endif // __LINUX__ newBindings.push_back(_Binding()); newBindings.back().udpSock = udps; newBindings.back().tcpListenSock = tcps; newBindings.back().address = ii->first; } } } _bindings.swap(newBindings); } /** * Send a UDP packet from the specified local interface, or all * * Unfortunately even by examining the routing table there is no ultimately * robust way to tell where we might reach another host that works in all * environments. As a result, we send packets with null (wildcard) local * addresses from *every* bound interface. * * These are typically initial HELLOs, path probes, etc., since normal * conversations will have a local endpoint address. So the cost is low and * if the peer is not reachable via that route then the packet will go * nowhere and nothing will happen. * * It will of course only send via interface bindings of the same socket * family. No point in sending V4 via V6 or vice versa. * * In any case on most hosts there's only one or two interfaces that we * will use, so none of this is particularly costly. * * @param local Local interface address or null address for 'all' * @param remote Remote address * @param data Data to send * @param len Length of data * @param v4ttl If non-zero, send this packet with the specified IP TTL (IPv4 only) * @return -1 == local doesn't match any bound address, 0 == send failure, 1 == send successful */ template inline int udpSend(Phy &phy,const InetAddress &local,const InetAddress &remote,const void *data,unsigned int len,unsigned int v4ttl = 0) const { PhySocket *s; typename std::vector<_Binding>::const_iterator i; int result; Mutex::Lock _l(_lock); if (remote.ss_family == AF_INET) { if (local) { for(i=_bindings.begin();i!=_bindings.end();++i) { if ( (i->address.ss_family == AF_INET) && (reinterpret_cast(&(i->address))->sin_port == reinterpret_cast(&local)->sin_port) && (reinterpret_cast(&(i->address))->sin_addr.s_addr == reinterpret_cast(&local)->sin_addr.s_addr) ) { s = i->udpSock; goto Binder_send_packet; } } } else { for(i=_bindings.begin();i!=_bindings.end();++i) { if (i->address.ss_family == AF_INET) { s = i->udpSock; goto Binder_send_packet; } } } } else { if (local) { for(i=_bindings.begin();i!=_bindings.end();++i) { if ( (i->address.ss_family == AF_INET6) && (reinterpret_cast(&(i->address))->sin6_port == reinterpret_cast(&local)->sin6_port) && (!memcmp(reinterpret_cast(&(i->address))->sin6_addr.s6_addr,reinterpret_cast(&local)->sin6_addr.s6_addr,16)) ) { s = i->udpSock; goto Binder_send_packet; } } } else { for(i=_bindings.begin();i!=_bindings.end();++i) { if (i->address.ss_family == AF_INET6) { s = i->udpSock; goto Binder_send_packet; } } } } return -1; Binder_send_packet: if (v4ttl) phy.setIp4UdpTtl(s,v4ttl); result = (int)phy.udpSend(s,reinterpret_cast(&remote),data,len); if (v4ttl) phy.setIp4UdpTtl(s,255); return result; } /** * @return All currently bound local interface addresses */ inline std::vector allBoundLocalInterfaceAddresses() const { std::vector aa; Mutex::Lock _l(_lock); for(std::vector<_Binding>::const_iterator b(_bindings.begin());b!=_bindings.end();++b) aa.push_back(b->address); return aa; } /** * @param addr Address to check * @return True if this is a bound local interface address */ inline bool isBoundLocalInterfaceAddress(const InetAddress &addr) const { Mutex::Lock _l(_lock); for(std::vector<_Binding>::const_iterator b(_bindings.begin());b!=_bindings.end();++b) { if (b->address == addr) return true; } return false; } private: std::vector<_Binding> _bindings; Mutex _lock; }; } // namespace ZeroTier #endif