{

if (frameLen < 40)

return false;

pos = 40;

proto = frameData[6];

while (pos <= frameLen) {

switch(proto) {

case 0: // hop-by-hop options

case 43: // routing

case 60: // destination options

case 135: // mobility options

if ((pos + 8) > frameLen)

return false; // invalid!

proto = frameData[pos];

pos += ((unsigned int)frameData[pos + 1] * 8) + 8;

break;

//case 44: // fragment -- we currently can't parse these and they are deprecated in IPv6 anyway

//case 50:

//case 51: // IPSec ESP and AH -- we have to stop here since this is encrypted stuff

default:

return true;

}

}

return false; // overflow == invalid

{

DOZTFILTER_NO_MATCH,

DOZTFILTER_DROP,

DOZTFILTER_REDIRECT,

DOZTFILTER_ACCEPT,

DOZTFILTER_SUPER_ACCEPT

const RuntimeEnvironment *RR,

Trace::RuleResultLog &rrl,

const NetworkConfig &nconf,

const Membership *membership, // can be NULL

const bool inbound,

const Address &ztSource,

Address &ztDest, // MUTABLE -- is changed on REDIRECT actions

const MAC &macSource,

const MAC &macDest,

const uint8_t *const frameData,

const unsigned int frameLen,

const unsigned int etherType,

const unsigned int vlanId,

const ZT_VirtualNetworkRule *rules, // cannot be NULL

const unsigned int ruleCount,

Address &cc, // MUTABLE -- set to TEE destination if TEE action is taken or left alone otherwise

unsigned int &ccLength, // MUTABLE -- set to length of packet payload to TEE

bool &ccWatch, // MUTABLE -- set to true for WATCH target as opposed to normal TEE

uint8_t &qosBucket) // MUTABLE -- set to the value of the argument provided to PRIORITY

{

// Set to true if we are a TEE/REDIRECT/WATCH target

bool superAccept = false;

// The default match state for each set of entries starts as 'true' since an

// ACTION with no MATCH entries preceding it is always taken.

uint8_t thisSetMatches = 1;

rrl.clear();

for(unsigned int rn=0;rn<ruleCount;++rn) {

const ZT_VirtualNetworkRuleType rt = (ZT_VirtualNetworkRuleType)(rules[rn].t & 0x3f);

// First check if this is an ACTION

if ((unsigned int)rt <= (unsigned int)ZT_NETWORK_RULE_ACTION__MAX_ID) {

if (thisSetMatches) {

switch(rt) {

case ZT_NETWORK_RULE_ACTION_PRIORITY:

qosBucket = (rules[rn].v.qosBucket >= 0 || rules[rn].v.qosBucket <= 8) ? rules[rn].v.qosBucket : 4; // 4 = default bucket (no priority)

return DOZTFILTER_ACCEPT;

case ZT_NETWORK_RULE_ACTION_DROP:

return DOZTFILTER_DROP;

case ZT_NETWORK_RULE_ACTION_ACCEPT:

return (superAccept ? DOZTFILTER_SUPER_ACCEPT : DOZTFILTER_ACCEPT); // match, accept packet

// These are initially handled together since preliminary logic is common

case ZT_NETWORK_RULE_ACTION_TEE:

case ZT_NETWORK_RULE_ACTION_WATCH:

case ZT_NETWORK_RULE_ACTION_REDIRECT: {

const Address fwdAddr(rules[rn].v.fwd.address);

if (fwdAddr == ztSource) {

// Skip as no-op since source is target

} else if (fwdAddr == RR->identity.address()) {

if (inbound) {

return DOZTFILTER_SUPER_ACCEPT;

} else {

}

} else if (fwdAddr == ztDest) {

} else {

if (rt == ZT_NETWORK_RULE_ACTION_REDIRECT) {

ztDest = fwdAddr;

return DOZTFILTER_REDIRECT;

} else {

cc = fwdAddr;

ccLength = (rules[rn].v.fwd.length != 0) ? ((frameLen < (unsigned int)rules[rn].v.fwd.length) ? frameLen : (unsigned int)rules[rn].v.fwd.length) : frameLen;

ccWatch = (rt == ZT_NETWORK_RULE_ACTION_WATCH);

}

}

} continue;

case ZT_NETWORK_RULE_ACTION_BREAK:

return DOZTFILTER_NO_MATCH;

// Unrecognized ACTIONs are ignored as no-ops

default:

continue;

}

} else {

// If this is an incoming packet and we are a TEE or REDIRECT target, we should

// super-accept if we accept at all. This will cause us to accept redirected or

// tee'd packets in spite of MAC and ZT addressing checks.

if (inbound) {

switch(rt) {

case ZT_NETWORK_RULE_ACTION_TEE:

case ZT_NETWORK_RULE_ACTION_WATCH:

case ZT_NETWORK_RULE_ACTION_REDIRECT:

if (RR->identity.address() == rules[rn].v.fwd.address)

superAccept = true;

break;

default:

break;

}

}

thisSetMatches = 1; // reset to default true for next batch of entries

continue;

}

}

// Circuit breaker: no need to evaluate an AND if the set's match state

// is currently false since anything AND false is false.

if ((!thisSetMatches)&&(!(rules[rn].t & 0x40))) {

rrl.logSkipped(rn,thisSetMatches);

continue;

}

// If this was not an ACTION evaluate next MATCH and update thisSetMatches with (AND [result])

uint8_t thisRuleMatches = 0;

uint64_t ownershipVerificationMask = 1; // this magic value means it hasn't been computed yet -- this is done lazily the first time it's needed

switch(rt) {

case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:

thisRuleMatches = (uint8_t)(rules[rn].v.zt == ztSource.toInt());

break;

case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:

thisRuleMatches = (uint8_t)(rules[rn].v.zt == ztDest.toInt());

break;

case ZT_NETWORK_RULE_MATCH_VLAN_ID:

thisRuleMatches = (uint8_t)(rules[rn].v.vlanId == (uint16_t)vlanId);

break;

case ZT_NETWORK_RULE_MATCH_VLAN_PCP:

// NOT SUPPORTED YET

thisRuleMatches = (uint8_t)(rules[rn].v.vlanPcp == 0);

break;

case ZT_NETWORK_RULE_MATCH_VLAN_DEI:

// NOT SUPPORTED YET

thisRuleMatches = (uint8_t)(rules[rn].v.vlanDei == 0);

break;

case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:

thisRuleMatches = (uint8_t)(MAC(rules[rn].v.mac,6) == macSource);

break;

case ZT_NETWORK_RULE_MATCH_MAC_DEST:

thisRuleMatches = (uint8_t)(MAC(rules[rn].v.mac,6) == macDest);

break;

case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

thisRuleMatches = (uint8_t)(InetAddress((const void *)&(rules[rn].v.ipv4.ip),4,rules[rn].v.ipv4.mask).containsAddress(InetAddress((const void *)(frameData + 12),4,0)));

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IPV4_DEST:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

thisRuleMatches = (uint8_t)(InetAddress((const void *)&(rules[rn].v.ipv4.ip),4,rules[rn].v.ipv4.mask).containsAddress(InetAddress((const void *)(frameData + 16),4,0)));

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:

if ((etherType == ZT_ETHERTYPE_IPV6)&&(frameLen >= 40)) {

thisRuleMatches = (uint8_t)(InetAddress((const void *)rules[rn].v.ipv6.ip,16,rules[rn].v.ipv6.mask).containsAddress(InetAddress((const void *)(frameData + 8),16,0)));

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IPV6_DEST:

if ((etherType == ZT_ETHERTYPE_IPV6)&&(frameLen >= 40)) {

thisRuleMatches = (uint8_t)(InetAddress((const void *)rules[rn].v.ipv6.ip,16,rules[rn].v.ipv6.mask).containsAddress(InetAddress((const void *)(frameData + 24),16,0)));

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IP_TOS:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

const uint8_t tosMasked = frameData[1] & rules[rn].v.ipTos.mask;

thisRuleMatches = (uint8_t)((tosMasked >= rules[rn].v.ipTos.value[0])&&(tosMasked <= rules[rn].v.ipTos.value[1]));

} else if ((etherType == ZT_ETHERTYPE_IPV6)&&(frameLen >= 40)) {

const uint8_t tosMasked = (((frameData[0] << 4) & 0xf0) | ((frameData[1] >> 4) & 0x0f)) & rules[rn].v.ipTos.mask;

thisRuleMatches = (uint8_t)((tosMasked >= rules[rn].v.ipTos.value[0])&&(tosMasked <= rules[rn].v.ipTos.value[1]));

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

thisRuleMatches = (uint8_t)(rules[rn].v.ipProtocol == frameData[9]);

} else if (etherType == ZT_ETHERTYPE_IPV6) {

unsigned int pos = 0,proto = 0;

if (_ipv6GetPayload(frameData,frameLen,pos,proto)) {

thisRuleMatches = (uint8_t)(rules[rn].v.ipProtocol == (uint8_t)proto);

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_ETHERTYPE:

thisRuleMatches = (uint8_t)(rules[rn].v.etherType == (uint16_t)etherType);

break;

case ZT_NETWORK_RULE_MATCH_ICMP:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

if (frameData[9] == 0x01) { // IP protocol == ICMP

const unsigned int ihl = (frameData[0] & 0xf) * 4;

if (frameLen >= (ihl + 2)) {

if (rules[rn].v.icmp.type == frameData[ihl]) {

if ((rules[rn].v.icmp.flags & 0x01) != 0) {

thisRuleMatches = (uint8_t)(frameData[ihl+1] == rules[rn].v.icmp.code);

} else {

thisRuleMatches = 1;

}

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

} else if (etherType == ZT_ETHERTYPE_IPV6) {

unsigned int pos = 0,proto = 0;

if (_ipv6GetPayload(frameData,frameLen,pos,proto)) {

if ((proto == 0x3a)&&(frameLen >= (pos+2))) {

if (rules[rn].v.icmp.type == frameData[pos]) {

if ((rules[rn].v.icmp.flags & 0x01) != 0) {

thisRuleMatches = (uint8_t)(frameData[pos+1] == rules[rn].v.icmp.code);

} else {

thisRuleMatches = 1;

}

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:

case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

const unsigned int headerLen = 4 * (frameData[0] & 0xf);

int p = -1;

switch(frameData[9]) { // IP protocol number

// All these start with 16-bit source and destination port in that order

case 0x06: // TCP

case 0x11: // UDP

case 0x84: // SCTP

case 0x88: // UDPLite

if (frameLen > (headerLen + 4)) {

unsigned int pos = headerLen + ((rt == ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE) ? 2 : 0);

p = (int)frameData[pos++] << 8;

p |= (int)frameData[pos];

}

break;

}

thisRuleMatches = (p >= 0) ? (uint8_t)((p >= (int)rules[rn].v.port[0])&&(p <= (int)rules[rn].v.port[1])) : (uint8_t)0;

} else if (etherType == ZT_ETHERTYPE_IPV6) {

unsigned int pos = 0,proto = 0;

if (_ipv6GetPayload(frameData,frameLen,pos,proto)) {

int p = -1;

switch(proto) { // IP protocol number

// All these start with 16-bit source and destination port in that order

case 0x06: // TCP

case 0x11: // UDP

case 0x84: // SCTP

case 0x88: // UDPLite

if (frameLen > (pos + 4)) {

if (rt == ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE) pos += 2;

p = (int)frameData[pos++] << 8;

p |= (int)frameData[pos];

}

break;

}

thisRuleMatches = (p > 0) ? (uint8_t)((p >= (int)rules[rn].v.port[0])&&(p <= (int)rules[rn].v.port[1])) : (uint8_t)0;

} else {

thisRuleMatches = 0;

}

} else {

thisRuleMatches = 0;

}

break;

case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS: {

uint64_t cf = (inbound) ? ZT_RULE_PACKET_CHARACTERISTICS_INBOUND : 0ULL;

if (macDest.isMulticast()) cf |= ZT_RULE_PACKET_CHARACTERISTICS_MULTICAST;

if (macDest.isBroadcast()) cf |= ZT_RULE_PACKET_CHARACTERISTICS_BROADCAST;

if (ownershipVerificationMask == 1) {

ownershipVerificationMask = 0;

InetAddress src;

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)) {

src.set((const void *)(frameData + 12),4,0);

} else if ((etherType == ZT_ETHERTYPE_IPV6)&&(frameLen >= 40)) {

// IPv6 NDP requires special handling, since the src and dest IPs in the packet are empty or link-local.

if ( (frameLen >= (40 + 8 + 16)) && (frameData[6] == 0x3a) && ((frameData[40] == 0x87)||(frameData[40] == 0x88)) ) {

if (frameData[40] == 0x87) {

// Neighbor solicitations contain no reliable source address, so we implement a small

// hack by considering them authenticated. Otherwise you would pretty much have to do

// this manually in the rule set for IPv6 to work at all.

ownershipVerificationMask |= ZT_RULE_PACKET_CHARACTERISTICS_SENDER_IP_AUTHENTICATED;

} else {

// Neighbor advertisements on the other hand can absolutely be authenticated.

src.set((const void *)(frameData + 40 + 8),16,0);

}

} else {

// Other IPv6 packets can be handled normally

src.set((const void *)(frameData + 8),16,0);

}

} else if ((etherType == ZT_ETHERTYPE_ARP)&&(frameLen >= 28)) {

src.set((const void *)(frameData + 14),4,0);

}

if (inbound) {

if (membership) {

if ((src)&&(membership->peerOwnsAddress<InetAddress>(nconf,src)))

ownershipVerificationMask |= ZT_RULE_PACKET_CHARACTERISTICS_SENDER_IP_AUTHENTICATED;

if (membership->peerOwnsAddress<MAC>(nconf,macSource))

ownershipVerificationMask |= ZT_RULE_PACKET_CHARACTERISTICS_SENDER_MAC_AUTHENTICATED;

}

} else {

for(unsigned int i=0;i<nconf.certificateOfOwnershipCount;++i) {

if ((src)&&(nconf.certificatesOfOwnership[i].owns(src)))

ownershipVerificationMask |= ZT_RULE_PACKET_CHARACTERISTICS_SENDER_IP_AUTHENTICATED;

if (nconf.certificatesOfOwnership[i].owns(macSource))

ownershipVerificationMask |= ZT_RULE_PACKET_CHARACTERISTICS_SENDER_MAC_AUTHENTICATED;

}

}

}

cf |= ownershipVerificationMask;

if ((etherType == ZT_ETHERTYPE_IPV4)&&(frameLen >= 20)&&(frameData[9] == 0x06)) {

const unsigned int headerLen = 4 * (frameData[0] & 0xf);

cf |= (uint64_t)frameData[headerLen + 13];

cf |= (((uint64_t)(frameData[headerLen + 12] & 0x0f)) << 8);

} else if (etherType == ZT_ETHERTYPE_IPV6) {

unsigned int pos = 0,proto = 0;

if (_ipv6GetPayload(frameData,frameLen,pos,proto)) {

if ((proto == 0x06)&&(frameLen > (pos + 14))) {

cf |= (uint64_t)frameData[pos + 13];

cf |= (((uint64_t)(frameData[pos + 12] & 0x0f)) << 8);

}

}

}

thisRuleMatches = (uint8_t)((cf & rules[rn].v.characteristics) != 0);

} break;

case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:

thisRuleMatches = (uint8_t)((frameLen >= (unsigned int)rules[rn].v.frameSize[0])&&(frameLen <= (unsigned int)rules[rn].v.frameSize[1]));

break;

case ZT_NETWORK_RULE_MATCH_RANDOM:

thisRuleMatches = (uint8_t)((uint32_t)(Utils::random() & 0xffffffffULL) <= rules[rn].v.randomProbability);

break;

case ZT_NETWORK_RULE_MATCH_TAGS_DIFFERENCE:

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_AND:

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_OR:

case ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_XOR:

case ZT_NETWORK_RULE_MATCH_TAGS_EQUAL: {

const Tag *const localTag = std::lower_bound(&(nconf.tags[0]),&(nconf.tags[nconf.tagCount]),rules[rn].v.tag.id,Tag::IdComparePredicate());

if ((localTag != &(nconf.tags[nconf.tagCount]))&&(localTag->id() == rules[rn].v.tag.id)) {

const Tag *const remoteTag = ((membership) ? membership->getTag(nconf,rules[rn].v.tag.id) : (const Tag *)0);

if (remoteTag) {

const uint32_t ltv = localTag->value();

const uint32_t rtv = remoteTag->value();

if (rt == ZT_NETWORK_RULE_MATCH_TAGS_DIFFERENCE) {

const uint32_t diff = (ltv > rtv) ? (ltv - rtv) : (rtv - ltv);

thisRuleMatches = (uint8_t)(diff <= rules[rn].v.tag.value);

} else if (rt == ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_AND) {

thisRuleMatches = (uint8_t)((ltv & rtv) == rules[rn].v.tag.value);

} else if (rt == ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_OR) {

thisRuleMatches = (uint8_t)((ltv | rtv) == rules[rn].v.tag.value);

} else if (rt == ZT_NETWORK_RULE_MATCH_TAGS_BITWISE_XOR) {

thisRuleMatches = (uint8_t)((ltv ^ rtv) == rules[rn].v.tag.value);

} else if (rt == ZT_NETWORK_RULE_MATCH_TAGS_EQUAL) {

thisRuleMatches = (uint8_t)((ltv == rules[rn].v.tag.value)&&(rtv == rules[rn].v.tag.value));

} else { // sanity check, can't really happen

thisRuleMatches = 0;

}

} else {

if ((inbound)&&(!superAccept)) {

thisRuleMatches = 0;

} else {

// Outbound side is not strict since if we have to match both tags and

// we are sending a first packet to a recipient, we probably do not know

// about their tags yet. They will filter on inbound and we will filter

// once we get their tag. If we are a tee/redirect target we are also

// not strict since we likely do not have these tags.

thisRuleMatches = 1;

}

}

} else {

thisRuleMatches = 0;

}

} break;

case ZT_NETWORK_RULE_MATCH_TAG_SENDER:

case ZT_NETWORK_RULE_MATCH_TAG_RECEIVER: {

if (superAccept) {

thisRuleMatches = 1;

} else if ( ((rt == ZT_NETWORK_RULE_MATCH_TAG_SENDER)&&(inbound)) || ((rt == ZT_NETWORK_RULE_MATCH_TAG_RECEIVER)&&(!inbound)) ) {

const Tag *const remoteTag = ((membership) ? membership->getTag(nconf,rules[rn].v.tag.id) : (const Tag *)0);

if (remoteTag) {

thisRuleMatches = (uint8_t)(remoteTag->value() == rules[rn].v.tag.value);

} else {

if (rt == ZT_NETWORK_RULE_MATCH_TAG_RECEIVER) {

// If we are checking the receiver and this is an outbound packet, we

// can't be strict since we may not yet know the receiver's tag.

thisRuleMatches = 1;

} else {

thisRuleMatches = 0;

}

}

} else { // sender and outbound or receiver and inbound

const Tag *const localTag = std::lower_bound(&(nconf.tags[0]),&(nconf.tags[nconf.tagCount]),rules[rn].v.tag.id,Tag::IdComparePredicate());

if ((localTag != &(nconf.tags[nconf.tagCount]))&&(localTag->id() == rules[rn].v.tag.id)) {

thisRuleMatches = (uint8_t)(localTag->value() == rules[rn].v.tag.value);

} else {

thisRuleMatches = 0;

}

}

} break;

case ZT_NETWORK_RULE_MATCH_INTEGER_RANGE: {

uint64_t integer = 0;

const unsigned int bits = (rules[rn].v.intRange.format & 63) + 1;

const unsigned int bytes = ((bits + 8 - 1) / 8); // integer ceiling of division by 8

if ((rules[rn].v.intRange.format & 0x80) == 0) {

// Big-endian

unsigned int idx = rules[rn].v.intRange.idx + (8 - bytes);

const unsigned int eof = idx + bytes;

if (eof <= frameLen) {

while (idx < eof) {

integer <<= 8;

integer |= frameData[idx++];

}

}

integer &= 0xffffffffffffffffULL >> (64 - bits);

} else {

// Little-endian

unsigned int idx = rules[rn].v.intRange.idx;

const unsigned int eof = idx + bytes;

if (eof <= frameLen) {

while (idx < eof) {

integer >>= 8;

integer |= ((uint64_t)frameData[idx++]) << 56;

}

}

integer >>= (64 - bits);

}

thisRuleMatches = (uint8_t)((integer >= rules[rn].v.intRange.start)&&(integer <= (rules[rn].v.intRange.start + (uint64_t)rules[rn].v.intRange.end)));

} break;

// The result of an unsupported MATCH is configurable at the network

// level via a flag.

default:

thisRuleMatches = (uint8_t)((nconf.flags & ZT_NETWORKCONFIG_FLAG_RULES_RESULT_OF_UNSUPPORTED_MATCH) != 0);

break;

}

rrl.log(rn,thisRuleMatches,thisSetMatches);

if ((rules[rn].t & 0x40))

thisSetMatches |= (thisRuleMatches ^ ((rules[rn].t >> 7) & 1));

else thisSetMatches &= (thisRuleMatches ^ ((rules[rn].t >> 7) & 1));

}

return DOZTFILTER_NO_MATCH;

RR(renv),

_uPtr(uptr),

_id(nwid),

_mac(renv->identity.address(),nwid),

_portInitialized(false),

_lastConfigUpdate(0),

_destroyed(false),

_netconfFailure(NETCONF_FAILURE_NONE)

{

for(int i=0;i<ZT_NETWORK_MAX_INCOMING_UPDATES;++i)

_incomingConfigChunks[i].ts = 0;

if (nconf) {

this->setConfiguration(tPtr,*nconf,false);

_lastConfigUpdate = 0; // still want to re-request since it's likely outdated

} else {

uint64_t tmp[2];

tmp[0] = nwid; tmp[1] = 0;

bool got = false;

ScopedPtr< Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> > dict(new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>());

try {

int n = RR->node->stateObjectGet(tPtr,ZT_STATE_OBJECT_NETWORK_CONFIG,tmp,dict->unsafeData(),ZT_NETWORKCONFIG_DICT_CAPACITY - 1);

if (n > 1) {

try {

ScopedPtr<NetworkConfig> nconf(new NetworkConfig());

if (nconf->fromDictionary(*dict)) {

this->setConfiguration(tPtr,*nconf,false);

_lastConfigUpdate = 0; // still want to re-request an update since it's likely outdated

got = true;

}

} catch ( ... ) {}

}

} catch ( ... ) {}

if (!got)

RR->node->stateObjectPut(tPtr,ZT_STATE_OBJECT_NETWORK_CONFIG,tmp,"\n",1);

}

if (!_portInitialized) {

ZT_VirtualNetworkConfig ctmp;

_externalConfig(&ctmp);

RR->node->configureVirtualNetworkPort(tPtr,_id,&_uPtr,ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP,&ctmp);

_portInitialized = true;

}

void *tPtr,

const bool noTee,

const Address &ztSource,

const Address &ztDest,

const MAC &macSource,

const MAC &macDest,

const uint8_t *frameData,

const unsigned int frameLen,

const unsigned int etherType,

const unsigned int vlanId,

uint8_t &qosBucket)

{

Address ztFinalDest(ztDest);

int localCapabilityIndex = -1;

int accept = 0;

Trace::RuleResultLog rrl,crrl;

Address cc;

unsigned int ccLength = 0;

bool ccWatch = false;

Mutex::Lock l1(_memberships_l);

Mutex::Lock l2(_config_l);

Membership *const membership = (ztDest) ? _memberships.get(ztDest) : (Membership *)0;

switch(_doZtFilter(RR,rrl,_config,membership,false,ztSource,ztFinalDest,macSource,macDest,frameData,frameLen,etherType,vlanId,_config.rules,_config.ruleCount,cc,ccLength,ccWatch,qosBucket)) {

case DOZTFILTER_NO_MATCH: {

for(unsigned int c=0;c<_config.capabilityCount;++c) {

ztFinalDest = ztDest; // sanity check, shouldn't be possible if there was no match

Address cc2;

unsigned int ccLength2 = 0;

bool ccWatch2 = false;

switch (_doZtFilter(RR,crrl,_config,membership,false,ztSource,ztFinalDest,macSource,macDest,frameData,frameLen,etherType,vlanId,_config.capabilities[c].rules(),_config.capabilities[c].ruleCount(),cc2,ccLength2,ccWatch2,qosBucket)) {

case DOZTFILTER_NO_MATCH:

case DOZTFILTER_DROP: // explicit DROP in a capability just terminates its evaluation and is an anti-pattern

break;

case DOZTFILTER_REDIRECT: // interpreted as ACCEPT but ztFinalDest will have been changed in _doZtFilter()

case DOZTFILTER_ACCEPT:

case DOZTFILTER_SUPER_ACCEPT: // no difference in behavior on outbound side in capabilities

localCapabilityIndex = (int)c;

accept = 1;

if ((!noTee)&&(cc2)) {

Packet outp(cc2,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)(ccWatch2 ? 0x16 : 0x02));

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,ccLength2);

outp.compress();

RR->sw->send(tPtr,outp,true);

}

break;

}

if (accept)

break;

}

} break;

case DOZTFILTER_DROP:

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(Trace::RuleResultLog *)0,(Capability *)0,ztSource,ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,noTee,false,0);

return false;

case DOZTFILTER_REDIRECT: // interpreted as ACCEPT but ztFinalDest will have been changed in _doZtFilter()

case DOZTFILTER_ACCEPT:

accept = 1;

break;

case DOZTFILTER_SUPER_ACCEPT:

accept = 2;

break;

}

if (accept) {

if (membership)

membership->logSentBytes(frameLen);

if ((!noTee)&&(cc)) {

Packet outp(cc,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)(ccWatch ? 0x16 : 0x02));

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,ccLength);

outp.compress();

RR->sw->send(tPtr,outp,true);

}

if ((ztDest != ztFinalDest)&&(ztFinalDest)) {

Packet outp(ztFinalDest,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)0x04);

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,frameLen);

outp.compress();

RR->sw->send(tPtr,outp,true);

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(localCapabilityIndex >= 0) ? &crrl : (Trace::RuleResultLog *)0,(localCapabilityIndex >= 0) ? &(_config.capabilities[localCapabilityIndex]) : (Capability *)0,ztSource,ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,noTee,false,0);

return false; // DROP locally, since we redirected

} else {

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(localCapabilityIndex >= 0) ? &crrl : (Trace::RuleResultLog *)0,(localCapabilityIndex >= 0) ? &(_config.capabilities[localCapabilityIndex]) : (Capability *)0,ztSource,ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,noTee,false,1);

return true;

}

} else {

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(localCapabilityIndex >= 0) ? &crrl : (Trace::RuleResultLog *)0,(localCapabilityIndex >= 0) ? &(_config.capabilities[localCapabilityIndex]) : (Capability *)0,ztSource,ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,noTee,false,0);

return false;

}

void *tPtr,

const SharedPtr<Peer> &sourcePeer,

const Address &ztDest,

const MAC &macSource,

const MAC &macDest,

const uint8_t *frameData,

const unsigned int frameLen,

const unsigned int etherType,

const unsigned int vlanId)

{

Address ztFinalDest(ztDest);

Trace::RuleResultLog rrl,crrl;

int accept = 0;

Address cc;

unsigned int ccLength = 0;

bool ccWatch = false;

const Capability *c = (Capability *)0;

uint8_t qosBucket = 255; // For incoming packets this is a dummy value

Mutex::Lock l1(_memberships_l);

Mutex::Lock l2(_config_l);

Membership &membership = _memberships[sourcePeer->address()];

switch (_doZtFilter(RR,rrl,_config,&membership,true,sourcePeer->address(),ztFinalDest,macSource,macDest,frameData,frameLen,etherType,vlanId,_config.rules,_config.ruleCount,cc,ccLength,ccWatch,qosBucket)) {

case DOZTFILTER_NO_MATCH: {

Membership::CapabilityIterator mci(membership,_config);

while ((c = mci.next())) {

ztFinalDest = ztDest; // sanity check, should be unmodified if there was no match

Address cc2;

unsigned int ccLength2 = 0;

bool ccWatch2 = false;

switch(_doZtFilter(RR,crrl,_config,&membership,true,sourcePeer->address(),ztFinalDest,macSource,macDest,frameData,frameLen,etherType,vlanId,c->rules(),c->ruleCount(),cc2,ccLength2,ccWatch2,qosBucket)) {

case DOZTFILTER_NO_MATCH:

case DOZTFILTER_DROP: // explicit DROP in a capability just terminates its evaluation and is an anti-pattern

break;

case DOZTFILTER_REDIRECT: // interpreted as ACCEPT but ztDest will have been changed in _doZtFilter()

case DOZTFILTER_ACCEPT:

accept = 1; // ACCEPT

break;

case DOZTFILTER_SUPER_ACCEPT:

accept = 2; // super-ACCEPT

break;

}

if (accept) {

if (cc2) {

Packet outp(cc2,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)(ccWatch2 ? 0x1c : 0x08));

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,ccLength2);

outp.compress();

RR->sw->send(tPtr,outp,true);

}

break;

}

}

} break;

case DOZTFILTER_DROP:

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(Trace::RuleResultLog *)0,(Capability *)0,sourcePeer->address(),ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,false,true,0);

return 0; // DROP

case DOZTFILTER_REDIRECT: // interpreted as ACCEPT but ztFinalDest will have been changed in _doZtFilter()

case DOZTFILTER_ACCEPT:

accept = 1; // ACCEPT

break;

case DOZTFILTER_SUPER_ACCEPT:

accept = 2; // super-ACCEPT

break;

}

if (accept) {

membership.logReceivedBytes(frameLen);

if (cc) {

Packet outp(cc,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)(ccWatch ? 0x1c : 0x08));

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,ccLength);

outp.compress();

RR->sw->send(tPtr,outp,true);

}

if ((ztDest != ztFinalDest)&&(ztFinalDest)) {

Packet outp(ztFinalDest,RR->identity.address(),Packet::VERB_EXT_FRAME);

outp.append(_id);

outp.append((uint8_t)0x0a);

macDest.appendTo(outp);

macSource.appendTo(outp);

outp.append((uint16_t)etherType);

outp.append(frameData,frameLen);

outp.compress();

RR->sw->send(tPtr,outp,true);

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(c) ? &crrl : (Trace::RuleResultLog *)0,c,sourcePeer->address(),ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,false,true,0);

return 0; // DROP locally, since we redirected

}

}

if (_config.remoteTraceTarget)

RR->t->networkFilter(tPtr,*this,rrl,(c) ? &crrl : (Trace::RuleResultLog *)0,c,sourcePeer->address(),ztDest,macSource,macDest,frameData,frameLen,etherType,vlanId,false,true,accept);

return accept;

{

if (_destroyed)

return 0;

const unsigned int start = ptr;

ptr += 8; // skip network ID, which is already obviously known

const unsigned int chunkLen = chunk.at<uint16_t>(ptr); ptr += 2;

const void *chunkData = chunk.field(ptr,chunkLen); ptr += chunkLen;

uint64_t configUpdateId;

{

Mutex::Lock l1(_config_l);

_IncomingConfigChunk *c = (_IncomingConfigChunk *)0;

uint64_t chunkId = 0;

unsigned long totalLength,chunkIndex;

if (ptr < chunk.size()) {

const bool fastPropagate = ((chunk[ptr++] & 0x01) != 0);

configUpdateId = chunk.at<uint64_t>(ptr); ptr += 8;

totalLength = chunk.at<uint32_t>(ptr); ptr += 4;

chunkIndex = chunk.at<uint32_t>(ptr); ptr += 4;

if (((chunkIndex + chunkLen) > totalLength)||(totalLength >= ZT_NETWORKCONFIG_DICT_CAPACITY)) // >= since we need room for a null at the end

return 0;

if ((chunk[ptr] != 1)||(chunk.at<uint16_t>(ptr + 1) != ZT_C25519_SIGNATURE_LEN))

return 0;

const uint8_t *sig = reinterpret_cast<const uint8_t *>(chunk.field(ptr + 3,ZT_C25519_SIGNATURE_LEN));

// We can use the signature, which is unique per chunk, to get a per-chunk ID for local deduplication use

for(unsigned int i=0;i<16;++i)

reinterpret_cast<uint8_t *>(&chunkId)[i & 7] ^= sig[i];

// Find existing or new slot for this update and check if this is a duplicate chunk

for(int i=0;i<ZT_NETWORK_MAX_INCOMING_UPDATES;++i) {

if (_incomingConfigChunks[i].updateId == configUpdateId) {

c = &(_incomingConfigChunks[i]);

for(unsigned long j=0;j<c->haveChunks;++j) {

if (c->haveChunkIds[j] == chunkId)

return 0;

}

break;

} else if ((!c)||(_incomingConfigChunks[i].ts < c->ts)) {

c = &(_incomingConfigChunks[i]);

}

}

// If it's not a duplicate, check chunk signature

const Identity controllerId(RR->topology->getIdentity(tPtr,controller()));

if (!controllerId) // we should always have the controller identity by now, otherwise how would we have queried it the first time?

return 0;

if (!controllerId.verify(chunk.field(start,ptr - start),ptr - start,sig,ZT_C25519_SIGNATURE_LEN))

return 0;

// New properly verified chunks can be flooded "virally" through the network

if (fastPropagate) {

Mutex::Lock l2(_memberships_l);

Address *a = (Address *)0;

Membership *m = (Membership *)0;

Hashtable<Address,Membership>::Iterator i(_memberships);

while (i.next(a,m)) {

if ((*a != source)&&(*a != controller())) {

Packet outp(*a,RR->identity.address(),Packet::VERB_NETWORK_CONFIG);

outp.append(reinterpret_cast<const uint8_t *>(chunk.data()) + start,chunk.size() - start);

RR->sw->send(tPtr,outp,true);

}

}

}

} else if ((source == controller())||(!source)) { // since old chunks aren't signed, only accept from controller itself (or via cluster backplane)

// Legacy support for OK(NETWORK_CONFIG_REQUEST) from older controllers

chunkId = packetId;

configUpdateId = chunkId;

totalLength = chunkLen;

chunkIndex = 0;

if (totalLength >= ZT_NETWORKCONFIG_DICT_CAPACITY)

return 0;

for(int i=0;i<ZT_NETWORK_MAX_INCOMING_UPDATES;++i) {

if ((!c)||(_incomingConfigChunks[i].ts < c->ts))

c = &(_incomingConfigChunks[i]);

}

} else {

// Single-chunk unsigned legacy configs are only allowed from the controller itself

return 0;

}

++c->ts; // newer is higher, that's all we need

if (c->updateId != configUpdateId) {

c->updateId = configUpdateId;

c->haveChunks = 0;

c->haveBytes = 0;

}

if (c->haveChunks >= ZT_NETWORK_MAX_UPDATE_CHUNKS)

return false;

c->haveChunkIds[c->haveChunks++] = chunkId;

memcpy(c->data.unsafeData() + chunkIndex,chunkData,chunkLen);

c->haveBytes += chunkLen;

if (c->haveBytes == totalLength) {

c->data.unsafeData()[c->haveBytes] = (char)0; // ensure null terminated

ScopedPtr<NetworkConfig> nc(new NetworkConfig());

try {

if (nc->fromDictionary(c->data)) {

this->setConfiguration(tPtr,*nc,true);

return configUpdateId;

}

} catch ( ... ) {}

}

}

return 0;

{

if (_destroyed)

return 0;

// _lock is NOT locked when this is called

try {

if ((nconf.issuedTo != RR->identity.address())||(nconf.networkId != _id))

return 0; // invalid config that is not for us or not for this network

if (_config == nconf)

return 1; // OK config, but duplicate of what we already have

ZT_VirtualNetworkConfig ctmp;

bool oldPortInitialized;

{ // do things that require lock here, but unlock before calling callbacks

Mutex::Lock l1(_config_l);

_config = nconf;

_lastConfigUpdate = RR->node->now();

_netconfFailure = NETCONF_FAILURE_NONE;

oldPortInitialized = _portInitialized;

_portInitialized = true;

_externalConfig(&ctmp);

}

RR->node->configureVirtualNetworkPort(tPtr,_id,&_uPtr,(oldPortInitialized) ? ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE : ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP,&ctmp);

if (saveToDisk) {

try {

ScopedPtr< Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> > d(new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>());

if (nconf.toDictionary(*d,false)) {

uint64_t tmp[2];

tmp[0] = _id; tmp[1] = 0;