diff options
Diffstat (limited to 'zerotierone/node/NetworkConfig.hpp')
| -rw-r--r-- | zerotierone/node/NetworkConfig.hpp | 641 |
1 files changed, 421 insertions, 220 deletions
diff --git a/zerotierone/node/NetworkConfig.hpp b/zerotierone/node/NetworkConfig.hpp index a548e86..a7ed77b 100644 --- a/zerotierone/node/NetworkConfig.hpp +++ b/zerotierone/node/NetworkConfig.hpp @@ -35,51 +35,26 @@ #include "MulticastGroup.hpp" #include "Address.hpp" #include "CertificateOfMembership.hpp" -#include "Capability.hpp" -#include "Tag.hpp" -#include "Dictionary.hpp" -#include "Identity.hpp" - -/** - * Default maximum time delta for COMs, tags, and capabilities - * - * The current value is two hours, providing ample time for a controller to - * experience fail-over, etc. - */ -#define ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MAX_MAX_DELTA 7200000ULL -/** - * Default minimum credential TTL and maxDelta for COM timestamps - * - * This is just slightly over three minutes and provides three retries for - * all currently online members to refresh. - */ -#define ZT_NETWORKCONFIG_DEFAULT_CREDENTIAL_TIME_MIN_MAX_DELTA 185000ULL +#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF +#include "Dictionary.hpp" +#include <string> +#endif /** * Flag: allow passive bridging (experimental) */ -#define ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING 0x0000000000000001ULL +#define ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING 0x0001 /** * Flag: enable broadcast */ -#define ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST 0x0000000000000002ULL +#define ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST 0x0002 /** - * Flag: enable IPv6 NDP emulation for certain V6 address patterns + * Device is a network preferred relay */ -#define ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION 0x0000000000000004ULL - -/** - * Flag: result of unrecognized MATCH entries in a rules table: match if set, no-match if clear - */ -#define ZT_NETWORKCONFIG_FLAG_RULES_RESULT_OF_UNSUPPORTED_MATCH 0x0000000000000008ULL - -/** - * Flag: disable frame compression - */ -#define ZT_NETWORKCONFIG_FLAG_DISABLE_COMPRESSION 0x0000000000000010ULL +#define ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY 0x0000010000000000ULL /** * Device is an active bridge @@ -87,62 +62,24 @@ #define ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE 0x0000020000000000ULL /** - * Anchors are stable devices on this network that can cache multicast info, etc. + * An anchor is a device that is willing to be one and has been online/stable for a long time on this network */ #define ZT_NETWORKCONFIG_SPECIALIST_TYPE_ANCHOR 0x0000040000000000ULL -/** - * Device can send CIRCUIT_TESTs for this network - */ -#define ZT_NETWORKCONFIG_SPECIALIST_TYPE_CIRCUIT_TESTER 0x0000080000000000ULL - namespace ZeroTier { -// Dictionary capacity needed for max size network config -#define ZT_NETWORKCONFIG_DICT_CAPACITY (4096 + (sizeof(ZT_VirtualNetworkRule) * ZT_MAX_NETWORK_RULES) + (sizeof(Capability) * ZT_MAX_NETWORK_CAPABILITIES) + (sizeof(Tag) * ZT_MAX_NETWORK_TAGS)) - -// Dictionary capacity needed for max size network meta-data -#define ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY 1024 - -// Network config version -#define ZT_NETWORKCONFIG_VERSION 7 +#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF // Fields for meta-data sent with network config requests - -// Network config version -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION "v" -// Protocol version (see Packet.hpp) -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION "pv" -// Software vendor -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_VENDOR "vend" -// Software major version #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION "majv" -// Software minor version #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION "minv" -// Software revision #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION "revv" -// Rules engine revision -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_RULES_ENGINE_REV "revr" -// Maximum number of rules per network this node can accept -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_RULES "mr" -// Maximum number of capabilities this node can accept -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_CAPABILITIES "mc" -// Maximum number of rules per capability this node can accept -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_CAPABILITY_RULES "mcr" -// Maximum number of tags this node can accept -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_TAGS "mt" -// Network join authorization token (if any) -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_AUTH "a" -// Network configuration meta-data flags -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_FLAGS "f" -// Relay policy for this node -#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_RELAY_POLICY "rp" - -// These dictionary keys are short so they don't take up much room. -// By convention we use upper case for binary blobs, but it doesn't really matter. - -// network config version -#define ZT_NETWORKCONFIG_DICT_KEY_VERSION "v" + +// These dictionary keys are short so they don't take up much room in +// netconf response packets. + +// integer(hex)[,integer(hex),...] +#define ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES "et" // network ID #define ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID "nwid" // integer(hex) @@ -151,57 +88,34 @@ namespace ZeroTier { #define ZT_NETWORKCONFIG_DICT_KEY_REVISION "r" // address of member #define ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO "id" -// flags(hex) -#define ZT_NETWORKCONFIG_DICT_KEY_FLAGS "f" // integer(hex) #define ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT "ml" -// network type (hex) -#define ZT_NETWORKCONFIG_DICT_KEY_TYPE "t" +// 0/1 +#define ZT_NETWORKCONFIG_DICT_KEY_PRIVATE "p" // text #define ZT_NETWORKCONFIG_DICT_KEY_NAME "n" -// credential time max delta in ms -#define ZT_NETWORKCONFIG_DICT_KEY_CREDENTIAL_TIME_MAX_DELTA "ctmd" -// binary serialized certificate of membership -#define ZT_NETWORKCONFIG_DICT_KEY_COM "C" -// specialists (binary array of uint64_t) -#define ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS "S" -// routes (binary blob) -#define ZT_NETWORKCONFIG_DICT_KEY_ROUTES "RT" -// static IPs (binary blob) -#define ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS "I" -// rules (binary blob) -#define ZT_NETWORKCONFIG_DICT_KEY_RULES "R" -// capabilities (binary blobs) -#define ZT_NETWORKCONFIG_DICT_KEY_CAPABILITIES "CAP" -// tags (binary blobs) -#define ZT_NETWORKCONFIG_DICT_KEY_TAGS "TAG" -// curve25519 signature -#define ZT_NETWORKCONFIG_DICT_KEY_SIGNATURE "C25519" - -// Legacy fields -- these are obsoleted but are included when older clients query - -// boolean (now a flag) -#define ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD "pb" -// boolean (now a flag) -#define ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD "eb" +// text +#define ZT_NETWORKCONFIG_DICT_KEY_DESC "d" // IP/bits[,IP/bits,...] // Note that IPs that end in all zeroes are routes with no assignment in them. -#define ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD "v4s" +#define ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC "v4s" // IP/bits[,IP/bits,...] // Note that IPs that end in all zeroes are routes with no assignment in them. -#define ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD "v6s" +#define ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC "v6s" +// serialized CertificateOfMembership +#define ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP "com" // 0/1 -#define ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD "p" -// integer(hex)[,integer(hex),...] -#define ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD "et" -// string-serialized CertificateOfMembership -#define ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD "com" +#define ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST "eb" +// 0/1 +#define ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING "pb" // node[,node,...] -#define ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD "ab" +#define ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES "ab" // node;IP/port[,node;IP/port] -#define ZT_NETWORKCONFIG_DICT_KEY_RELAYS_OLD "rl" +#define ZT_NETWORKCONFIG_DICT_KEY_RELAYS "rl" +// IP/metric[,IP/metric,...] +#define ZT_NETWORKCONFIG_DICT_KEY_GATEWAYS "gw" -// End legacy fields +#endif // ZT_SUPPORT_OLD_STYLE_NETCONF /** * Network configuration received from network controller nodes @@ -212,6 +126,58 @@ namespace ZeroTier { class NetworkConfig { public: + /** + * Network preferred relay with optional physical endpoint addresses + * + * This is used by the convenience relays() method. + */ + struct Relay + { + Address address; + InetAddress phy4,phy6; + }; + + /** + * Create an instance of a NetworkConfig for the test network ID + * + * The test network ID is defined as ZT_TEST_NETWORK_ID. This is a + * "fake" network with no real controller and default options. + * + * @param self This node's ZT address + * @return Configuration for test network ID + */ + static inline NetworkConfig createTestNetworkConfig(const Address &self) + { + NetworkConfig nc; + + nc.networkId = ZT_TEST_NETWORK_ID; + nc.timestamp = 1; + nc.revision = 1; + nc.issuedTo = self; + nc.multicastLimit = ZT_MULTICAST_DEFAULT_LIMIT; + nc.flags = ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST; + nc.type = ZT_NETWORK_TYPE_PUBLIC; + + nc.rules[0].t = ZT_NETWORK_RULE_ACTION_ACCEPT; + nc.ruleCount = 1; + + Utils::snprintf(nc.name,sizeof(nc.name),"ZT_TEST_NETWORK"); + + // Make up a V4 IP from 'self' in the 10.0.0.0/8 range -- no + // guarantee of uniqueness but collisions are unlikely. + uint32_t ip = (uint32_t)((self.toInt() & 0x00ffffff) | 0x0a000000); // 10.x.x.x + if ((ip & 0x000000ff) == 0x000000ff) ip ^= 0x00000001; // but not ending in .255 + if ((ip & 0x000000ff) == 0x00000000) ip ^= 0x00000001; // or .0 + nc.staticIps[0] = InetAddress(Utils::hton(ip),8); + + // Assign an RFC4193-compliant IPv6 address -- will never collide + nc.staticIps[1] = InetAddress::makeIpv6rfc4193(ZT_TEST_NETWORK_ID,self.toInt()); + + nc.staticIpCount = 2; + + return nc; + } + NetworkConfig() { memset(this,0,sizeof(NetworkConfig)); @@ -229,21 +195,24 @@ public: } /** - * Write this network config to a dictionary for transport - * - * @param d Dictionary - * @param includeLegacy If true, include legacy fields for old node versions - * @return True if dictionary was successfully created, false if e.g. overflow + * @param etherType Ethernet frame type to check + * @return True if allowed on this network */ - bool toDictionary(Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d,bool includeLegacy) const; - - /** - * Read this network config from a dictionary - * - * @param d Dictionary (non-const since it might be modified during parse, should not be used after call) - * @return True if dictionary was valid and network config successfully initialized - */ - bool fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d); + inline bool permitsEtherType(unsigned int etherType) const + { + unsigned int et = 0; + for(unsigned int i=0;i<ruleCount;++i) { + ZT_VirtualNetworkRuleType rt = (ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f); + if (rt == ZT_NETWORK_RULE_MATCH_ETHERTYPE) { + et = rules[i].v.etherType; + } else if (rt == ZT_NETWORK_RULE_ACTION_ACCEPT) { + if ((!et)||(et == etherType)) + return true; + et = 0; + } + } + return false; + } /** * @return True if passive bridging is allowed (experimental) @@ -256,16 +225,6 @@ public: inline bool enableBroadcast() const throw() { return ((this->flags & ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST) != 0); } /** - * @return True if IPv6 NDP emulation should be allowed for certain "magic" IPv6 address patterns - */ - inline bool ndpEmulation() const throw() { return ((this->flags & ZT_NETWORKCONFIG_FLAG_ENABLE_IPV6_NDP_EMULATION) != 0); } - - /** - * @return True if frames should not be compressed - */ - inline bool disableCompression() const throw() { return ((this->flags & ZT_NETWORKCONFIG_FLAG_DISABLE_COMPRESSION) != 0); } - - /** * @return Network type is public (no access control) */ inline bool isPublic() const throw() { return (this->type == ZT_NETWORK_TYPE_PUBLIC); } @@ -302,16 +261,40 @@ public: } /** - * @param a Address to check - * @return True if address is an anchor + * Get pinned physical address for a given ZeroTier address, if any + * + * @param zt ZeroTier address + * @param af Address family (e.g. AF_INET) or 0 for the first we find of any type + * @return Physical address, if any + */ + inline InetAddress findPinnedAddress(const Address &zt,unsigned int af) const + { + for(unsigned int i=0;i<pinnedCount;++i) { + if (pinned[i].zt == zt) { + if ((af == 0)||((unsigned int)pinned[i].phy.ss_family == af)) + return pinned[i].phy; + } + } + return InetAddress(); + } + + /** + * This gets network preferred relays with their static physical address if one is defined + * + * @return Network-preferred relays for this network (if none, only roots will be used) */ - inline bool isAnchor(const Address &a) const + inline std::vector<Relay> relays() const { + std::vector<Relay> r; for(unsigned int i=0;i<specialistCount;++i) { - if ((a == specialists[i])&&((specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_ANCHOR) != 0)) - return true; + if ((specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY) != 0) { + r.push_back(Relay()); + r.back().address = specialists[i]; + r.back().phy4 = findPinnedAddress(r.back().address,AF_INET); + r.back().phy6 = findPinnedAddress(r.back().address,AF_INET6); + } } - return false; + return r; } /** @@ -330,15 +313,30 @@ public: } /** - * @param byPeer Address to check - * @return True if this peer is allowed to do circuit tests on this network (controller is always true) + * Iterate through relays efficiently + * + * @param ptr Value-result parameter -- start by initializing with zero, then call until return is null + * @return Address of relay or NULL if no more */ - inline bool circuitTestingAllowed(const Address &byPeer) const + Address nextRelay(unsigned int &ptr) const + { + while (ptr < specialistCount) { + if ((specialists[ptr] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY) != 0) { + return Address(specialists[ptr]); + } + ++ptr; + } + return Address(); + } + + /** + * @param zt ZeroTier address + * @return True if this address is a relay + */ + bool isRelay(const Address &zt) const { - if (byPeer.toInt() == ((networkId >> 24) & 0xffffffffffULL)) - return true; for(unsigned int i=0;i<specialistCount;++i) { - if ((byPeer == specialists[i])&&((specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_CIRCUIT_TESTER) != 0)) + if ((zt == specialists[i])&&((specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY) != 0)) return true; } return false; @@ -352,56 +350,270 @@ public: inline bool operator==(const NetworkConfig &nc) const { return (memcmp(this,&nc,sizeof(NetworkConfig)) == 0); } inline bool operator!=(const NetworkConfig &nc) const { return (!(*this == nc)); } - /** - * Add a specialist or mask flags if already present - * - * This masks the existing flags if the specialist is already here or adds - * it otherwise. - * - * @param a Address of specialist - * @param f Flags (OR of specialist role/type flags) - * @return True if successfully masked or added - */ - inline bool addSpecialist(const Address &a,const uint64_t f) + template<unsigned int C> + inline void serialize(Buffer<C> &b) const { - const uint64_t aint = a.toInt(); - for(unsigned int i=0;i<specialistCount;++i) { - if ((specialists[i] & 0xffffffffffULL) == aint) { - specialists[i] |= f; - return true; - } + b.append((uint16_t)1); // version + + b.append((uint64_t)networkId); + b.append((uint64_t)timestamp); + b.append((uint64_t)revision); + issuedTo.appendTo(b); + b.append((uint32_t)multicastLimit); + b.append((uint32_t)flags); + b.append((uint8_t)type); + + unsigned int nl = (unsigned int)strlen(name); + if (nl > 255) nl = 255; // sanity check + b.append((uint8_t)nl); + b.append((const void *)name,nl); + + b.append((uint16_t)specialistCount); + for(unsigned int i=0;i<specialistCount;++i) + b.append((uint64_t)specialists[i]); + + b.append((uint16_t)routeCount); + for(unsigned int i=0;i<routeCount;++i) { + reinterpret_cast<const InetAddress *>(&(routes[i].target))->serialize(b); + reinterpret_cast<const InetAddress *>(&(routes[i].via))->serialize(b); } - if (specialistCount < ZT_MAX_NETWORK_SPECIALISTS) { - specialists[specialistCount++] = f | aint; - return true; + + b.append((uint16_t)staticIpCount); + for(unsigned int i=0;i<staticIpCount;++i) + staticIps[i].serialize(b); + + b.append((uint16_t)pinnedCount); + for(unsigned int i=0;i<pinnedCount;++i) { + pinned[i].zt.appendTo(b); + pinned[i].phy.serialize(b); } - return false; - } - const Capability *capability(const uint32_t id) const - { - for(unsigned int i=0;i<capabilityCount;++i) { - if (capabilities[i].id() == id) - return &(capabilities[i]); + b.append((uint16_t)ruleCount); + for(unsigned int i=0;i<ruleCount;++i) { + b.append((uint8_t)rules[i].t); + switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) { + //case ZT_NETWORK_RULE_ACTION_DROP: + //case ZT_NETWORK_RULE_ACTION_ACCEPT: + default: + b.append((uint8_t)0); + break; + case ZT_NETWORK_RULE_ACTION_TEE: + case ZT_NETWORK_RULE_ACTION_REDIRECT: + case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS: + case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS: + b.append((uint8_t)5); + Address(rules[i].v.zt).appendTo(b); + break; + case ZT_NETWORK_RULE_MATCH_VLAN_ID: + b.append((uint8_t)2); + b.append((uint16_t)rules[i].v.vlanId); + break; + case ZT_NETWORK_RULE_MATCH_VLAN_PCP: + b.append((uint8_t)1); + b.append((uint8_t)rules[i].v.vlanPcp); + break; + case ZT_NETWORK_RULE_MATCH_VLAN_DEI: + b.append((uint8_t)1); + b.append((uint8_t)rules[i].v.vlanDei); + break; + case ZT_NETWORK_RULE_MATCH_ETHERTYPE: + b.append((uint8_t)2); + b.append((uint16_t)rules[i].v.etherType); + break; + case ZT_NETWORK_RULE_MATCH_MAC_SOURCE: + case ZT_NETWORK_RULE_MATCH_MAC_DEST: + b.append((uint8_t)6); + b.append(rules[i].v.mac,6); + break; + case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE: + case ZT_NETWORK_RULE_MATCH_IPV4_DEST: + b.append((uint8_t)5); + b.append(&(rules[i].v.ipv4.ip),4); + b.append((uint8_t)rules[i].v.ipv4.mask); + break; + case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE: + case ZT_NETWORK_RULE_MATCH_IPV6_DEST: + b.append((uint8_t)17); + b.append(rules[i].v.ipv6.ip,16); + b.append((uint8_t)rules[i].v.ipv6.mask); + break; + case ZT_NETWORK_RULE_MATCH_IP_TOS: + b.append((uint8_t)1); + b.append((uint8_t)rules[i].v.ipTos); + break; + case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL: + b.append((uint8_t)1); + b.append((uint8_t)rules[i].v.ipProtocol); + break; + case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE: + case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE: + b.append((uint8_t)4); + b.append((uint16_t)rules[i].v.port[0]); + b.append((uint16_t)rules[i].v.port[1]); + break; + case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS: + b.append((uint8_t)8); + b.append((uint64_t)rules[i].v.characteristics); + break; + case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE: + b.append((uint8_t)4); + b.append((uint16_t)rules[i].v.frameSize[0]); + b.append((uint16_t)rules[i].v.frameSize[1]); + break; + case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE: + b.append((uint8_t)8); + b.append((uint32_t)rules[i].v.tcpseq[0]); + b.append((uint32_t)rules[i].v.tcpseq[1]); + break; + } } - return (Capability *)0; + + this->com.serialize(b); + + b.append((uint16_t)0); // extended bytes, currently 0 since unused } - const Tag *tag(const uint32_t id) const + template<unsigned int C> + inline unsigned int deserialize(const Buffer<C> &b,unsigned int startAt = 0) { - for(unsigned int i=0;i<tagCount;++i) { - if (tags[i].id() == id) - return &(tags[i]); + memset(this,0,sizeof(NetworkConfig)); + + unsigned int p = startAt; + + if (b.template at<uint16_t>(p) != 1) + throw std::invalid_argument("unrecognized version"); + p += 2; + + networkId = b.template at<uint64_t>(p); p += 8; + timestamp = b.template at<uint64_t>(p); p += 8; + revision = b.template at<uint64_t>(p); p += 8; + issuedTo.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH; + multicastLimit = (unsigned int)b.template at<uint32_t>(p); p += 4; + flags = (unsigned int)b.template at<uint32_t>(p); p += 4; + type = (ZT_VirtualNetworkType)b[p++]; + + unsigned int nl = (unsigned int)b[p++]; + memcpy(this->name,b.field(p,nl),std::min(nl,(unsigned int)ZT_MAX_NETWORK_SHORT_NAME_LENGTH)); + p += nl; + // _name will always be null terminated since field size is ZT_MAX_NETWORK_SHORT_NAME_LENGTH + 1 + + specialistCount = (unsigned int)b.template at<uint16_t>(p); p += 2; + if (specialistCount > ZT_MAX_NETWORK_SPECIALISTS) + throw std::invalid_argument("overflow (specialists)"); + for(unsigned int i=0;i<specialistCount;++i) { + specialists[i] = b.template at<uint64_t>(p); p += 8; + } + + routeCount = (unsigned int)b.template at<uint16_t>(p); p += 2; + if (routeCount > ZT_MAX_NETWORK_ROUTES) + throw std::invalid_argument("overflow (routes)"); + for(unsigned int i=0;i<routeCount;++i) { + p += reinterpret_cast<InetAddress *>(&(routes[i].target))->deserialize(b,p); + p += reinterpret_cast<InetAddress *>(&(routes[i].via))->deserialize(b,p); } - return (Tag *)0; + + staticIpCount = (unsigned int)b.template at<uint16_t>(p); p += 2; + if (staticIpCount > ZT_MAX_ZT_ASSIGNED_ADDRESSES) + throw std::invalid_argument("overflow (static IPs)"); + for(unsigned int i=0;i<staticIpCount;++i) { + p += staticIps[i].deserialize(b,p); + } + + pinnedCount = (unsigned int)b.template at<uint16_t>(p); p += 2; + if (pinnedCount > ZT_MAX_NETWORK_PINNED) + throw std::invalid_argument("overflow (static addresses)"); + for(unsigned int i=0;i<pinnedCount;++i) { + pinned[i].zt.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH; + p += pinned[i].phy.deserialize(b,p); + } + + ruleCount = (unsigned int)b.template at<uint16_t>(p); p += 2; + if (ruleCount > ZT_MAX_NETWORK_RULES) + throw std::invalid_argument("overflow (rules)"); + for(unsigned int i=0;i<ruleCount;++i) { + rules[i].t = (uint8_t)b[p++]; + unsigned int rlen = (unsigned int)b[p++]; + switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) { + //case ZT_NETWORK_RULE_ACTION_DROP: + //case ZT_NETWORK_RULE_ACTION_ACCEPT: + default: + break; + case ZT_NETWORK_RULE_ACTION_TEE: + case ZT_NETWORK_RULE_ACTION_REDIRECT: + case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS: + case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS: { + Address tmp; + tmp.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); + rules[i].v.zt = tmp.toInt(); + } break; + case ZT_NETWORK_RULE_MATCH_VLAN_ID: + rules[i].v.vlanId = b.template at<uint16_t>(p); + break; + case ZT_NETWORK_RULE_MATCH_VLAN_PCP: + rules[i].v.vlanPcp = (uint8_t)b[p]; + break; + case ZT_NETWORK_RULE_MATCH_VLAN_DEI: + rules[i].v.vlanDei = (uint8_t)b[p]; + break; + case ZT_NETWORK_RULE_MATCH_ETHERTYPE: + rules[i].v.etherType = b.template at<uint16_t>(p); + break; + case ZT_NETWORK_RULE_MATCH_MAC_SOURCE: + case ZT_NETWORK_RULE_MATCH_MAC_DEST: + memcpy(rules[i].v.mac,b.field(p,6),6); + break; + case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE: + case ZT_NETWORK_RULE_MATCH_IPV4_DEST: + memcpy(&(rules[i].v.ipv4.ip),b.field(p,4),4); + rules[i].v.ipv4.mask = (uint8_t)b[p+4]; + break; + case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE: + case ZT_NETWORK_RULE_MATCH_IPV6_DEST: + memcpy(rules[i].v.ipv6.ip,b.field(p,16),16); + rules[i].v.ipv6.mask = (uint8_t)b[p+16]; + break; + case ZT_NETWORK_RULE_MATCH_IP_TOS: + rules[i].v.ipTos = (uint8_t)b[p]; + break; + case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL: + rules[i].v.ipProtocol = (uint8_t)b[p]; + break; + case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE: + case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE: + rules[i].v.port[0] = b.template at<uint16_t>(p); + rules[i].v.port[1] = b.template at<uint16_t>(p+2); + break; + case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS: + rules[i].v.characteristics = b.template at<uint64_t>(p); + break; + case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE: + rules[i].v.frameSize[0] = b.template at<uint16_t>(p); + rules[i].v.frameSize[1] = b.template at<uint16_t>(p+2); + break; + case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE: + rules[i].v.tcpseq[0] = b.template at<uint32_t>(p); + rules[i].v.tcpseq[1] = b.template at<uint32_t>(p + 4); + break; + } + p += rlen; + } + + p += this->com.deserialize(b,p); + + p += b.template at<uint16_t>(p) + 2; + + return (p - startAt); } +#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF + void fromDictionary(const char *ds,unsigned int dslen); +#endif + /* inline void dump() const { printf("networkId==%.16llx\n",networkId); printf("timestamp==%llu\n",timestamp); - printf("credentialTimeMaxDelta==%llu\n",credentialTimeMaxDelta); printf("revision==%llu\n",revision); printf("issuedTo==%.10llx\n",issuedTo.toInt()); printf("multicastLimit==%u\n",multicastLimit); @@ -411,14 +623,17 @@ public: printf(" specialists[%u]==%.16llx\n",i,specialists[i]); printf("routeCount==%u\n",routeCount); for(unsigned int i=0;i<routeCount;++i) { - printf(" routes[i].target==%s\n",reinterpret_cast<const InetAddress *>(&(routes[i].target))->toString().c_str()); - printf(" routes[i].via==%s\n",reinterpret_cast<const InetAddress *>(&(routes[i].via))->toIpString().c_str()); - printf(" routes[i].flags==%.4x\n",(unsigned int)routes[i].flags); - printf(" routes[i].metric==%u\n",(unsigned int)routes[i].metric); + printf(" routes[i].target==%s\n",reinterpret_cast<const struct sockaddr_storage *>(&(routes[i].target))->toString().c_str()); + printf(" routes[i].via==%s\n",reinterpret_cast<const struct sockaddr_storage *>(&(routes[i].via))->toString().c_str()); } printf("staticIpCount==%u\n",staticIpCount); for(unsigned int i=0;i<staticIpCount;++i) printf(" staticIps[i]==%s\n",staticIps[i].toString().c_str()); + printf("pinnedCount==%u\n",pinnedCount); + for(unsigned int i=0;i<pinnedCount;++i) { + printf(" pinned[i].zt==%s\n",pinned[i].zt->toString().c_str()); + printf(" pinned[i].phy==%s\n",pinned[i].zt->toString().c_str()); + } printf("ruleCount==%u\n",ruleCount); printf("name==%s\n",name); printf("com==%s\n",com.toString().c_str()); @@ -436,11 +651,6 @@ public: uint64_t timestamp; /** - * Max difference between timestamp and tag/capability timestamp - */ - uint64_t credentialTimeMaxDelta; - - /** * Controller-side revision counter for this configuration */ uint64_t revision; @@ -451,14 +661,14 @@ public: Address issuedTo; /** - * Flags (64-bit) + * Maximum number of recipients per multicast (not including active bridges) */ - uint64_t flags; + unsigned int multicastLimit; /** - * Maximum number of recipients per multicast (not including active bridges) + * Flags (32-bit) */ - unsigned int multicastLimit; + unsigned int flags; /** * Number of specialists @@ -486,16 +696,6 @@ public: unsigned int ruleCount; /** - * Number of capabilities - */ - unsigned int capabilityCount; - - /** - * Number of tags - */ - unsigned int tagCount; - - /** * Specialist devices * * For each entry the least significant 40 bits are the device's ZeroTier @@ -514,19 +714,20 @@ public: InetAddress staticIps[ZT_MAX_ZT_ASSIGNED_ADDRESSES]; /** - * Base network rules - */ - ZT_VirtualNetworkRule rules[ZT_MAX_NETWORK_RULES]; - - /** - * Capabilities for this node on this network, in ascending order of capability ID + * Pinned devices with physical address hints + * + * These can be used to specify a physical address where a given device + * can be reached. It's usually used with network relays (specialists). */ - Capability capabilities[ZT_MAX_NETWORK_CAPABILITIES]; + struct { + Address zt; + InetAddress phy; + } pinned[ZT_MAX_NETWORK_PINNED]; /** - * Tags for this node on this network, in ascending order of tag ID + * Rules table */ - Tag tags[ZT_MAX_NETWORK_TAGS]; + ZT_VirtualNetworkRule rules[ZT_MAX_NETWORK_RULES]; /** * Network type (currently just public or private) |