mirror of
https://github.com/cwinfo/yggdrasil-go.git
synced 2024-11-10 06:20:26 +00:00
commit
1a1e0553aa
@ -12,11 +12,16 @@ This only matters if it's high enough to make you the root of the tree.
|
|||||||
*/
|
*/
|
||||||
package main
|
package main
|
||||||
|
|
||||||
import "encoding/hex"
|
import (
|
||||||
import "flag"
|
"encoding/hex"
|
||||||
import "fmt"
|
"flag"
|
||||||
import "runtime"
|
"fmt"
|
||||||
import . "github.com/yggdrasil-network/yggdrasil-go/src/yggdrasil"
|
"net"
|
||||||
|
"runtime"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
)
|
||||||
|
|
||||||
var doSig = flag.Bool("sig", false, "generate new signing keys instead")
|
var doSig = flag.Bool("sig", false, "generate new signing keys instead")
|
||||||
|
|
||||||
@ -82,12 +87,7 @@ func isBetter(oldID, newID []byte) bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func doBoxKeys(out chan<- keySet, in <-chan []byte) {
|
func doBoxKeys(out chan<- keySet, in <-chan []byte) {
|
||||||
c := Core{}
|
var bestID crypto.NodeID
|
||||||
pub, _ := c.DEBUG_newBoxKeys()
|
|
||||||
bestID := c.DEBUG_getNodeID(pub)
|
|
||||||
for idx := range bestID {
|
|
||||||
bestID[idx] = 0
|
|
||||||
}
|
|
||||||
for {
|
for {
|
||||||
select {
|
select {
|
||||||
case newBestID := <-in:
|
case newBestID := <-in:
|
||||||
@ -95,22 +95,20 @@ func doBoxKeys(out chan<- keySet, in <-chan []byte) {
|
|||||||
copy(bestID[:], newBestID)
|
copy(bestID[:], newBestID)
|
||||||
}
|
}
|
||||||
default:
|
default:
|
||||||
pub, priv := c.DEBUG_newBoxKeys()
|
pub, priv := crypto.NewBoxKeys()
|
||||||
id := c.DEBUG_getNodeID(pub)
|
id := crypto.GetNodeID(pub)
|
||||||
if !isBetter(bestID[:], id[:]) {
|
if !isBetter(bestID[:], id[:]) {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
bestID = id
|
bestID = *id
|
||||||
ip := c.DEBUG_addrForNodeID(id)
|
ip := net.IP(address.AddrForNodeID(id)[:]).String()
|
||||||
out <- keySet{priv[:], pub[:], id[:], ip}
|
out <- keySet{priv[:], pub[:], id[:], ip}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func doSigKeys(out chan<- keySet, in <-chan []byte) {
|
func doSigKeys(out chan<- keySet, in <-chan []byte) {
|
||||||
c := Core{}
|
var bestID crypto.TreeID
|
||||||
pub, _ := c.DEBUG_newSigKeys()
|
|
||||||
bestID := c.DEBUG_getTreeID(pub)
|
|
||||||
for idx := range bestID {
|
for idx := range bestID {
|
||||||
bestID[idx] = 0
|
bestID[idx] = 0
|
||||||
}
|
}
|
||||||
@ -122,12 +120,12 @@ func doSigKeys(out chan<- keySet, in <-chan []byte) {
|
|||||||
}
|
}
|
||||||
default:
|
default:
|
||||||
}
|
}
|
||||||
pub, priv := c.DEBUG_newSigKeys()
|
pub, priv := crypto.NewSigKeys()
|
||||||
id := c.DEBUG_getTreeID(pub)
|
id := crypto.GetTreeID(pub)
|
||||||
if !isBetter(bestID[:], id[:]) {
|
if !isBetter(bestID[:], id[:]) {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
bestID = id
|
bestID = *id
|
||||||
out <- keySet{priv[:], pub[:], id[:], ""}
|
out <- keySet{priv[:], pub[:], id[:], ""}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -1,21 +1,26 @@
|
|||||||
package yggdrasil
|
package address
|
||||||
|
|
||||||
|
import "github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
|
||||||
// address represents an IPv6 address in the yggdrasil address range.
|
// address represents an IPv6 address in the yggdrasil address range.
|
||||||
type address [16]byte
|
type Address [16]byte
|
||||||
|
|
||||||
// subnet represents an IPv6 /64 subnet in the yggdrasil subnet range.
|
// subnet represents an IPv6 /64 subnet in the yggdrasil subnet range.
|
||||||
type subnet [8]byte
|
type Subnet [8]byte
|
||||||
|
|
||||||
// address_prefix is the prefix used for all addresses and subnets in the network.
|
// address_prefix is the prefix used for all addresses and subnets in the network.
|
||||||
// The current implementation requires this to be a muliple of 8 bits + 7 bits.
|
// The current implementation requires this to be a muliple of 8 bits + 7 bits.
|
||||||
// The 8th bit of the last byte is used to signal nodes (0) or /64 prefixes (1).
|
// The 8th bit of the last byte is used to signal nodes (0) or /64 prefixes (1).
|
||||||
// Nodes that configure this differently will be unable to communicate with eachother, though routing and the DHT machinery *should* still work.
|
// Nodes that configure this differently will be unable to communicate with eachother, though routing and the DHT machinery *should* still work.
|
||||||
var address_prefix = [...]byte{0x02}
|
func GetPrefix() [1]byte {
|
||||||
|
return [...]byte{0x02}
|
||||||
|
}
|
||||||
|
|
||||||
// isValid returns true if an address falls within the range used by nodes in the network.
|
// isValid returns true if an address falls within the range used by nodes in the network.
|
||||||
func (a *address) isValid() bool {
|
func (a *Address) IsValid() bool {
|
||||||
for idx := range address_prefix {
|
prefix := GetPrefix()
|
||||||
if (*a)[idx] != address_prefix[idx] {
|
for idx := range prefix {
|
||||||
|
if (*a)[idx] != prefix[idx] {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -23,28 +28,29 @@ func (a *address) isValid() bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// isValid returns true if a prefix falls within the range usable by the network.
|
// isValid returns true if a prefix falls within the range usable by the network.
|
||||||
func (s *subnet) isValid() bool {
|
func (s *Subnet) IsValid() bool {
|
||||||
l := len(address_prefix)
|
prefix := GetPrefix()
|
||||||
for idx := range address_prefix[:l-1] {
|
l := len(prefix)
|
||||||
if (*s)[idx] != address_prefix[idx] {
|
for idx := range prefix[:l-1] {
|
||||||
|
if (*s)[idx] != prefix[idx] {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return (*s)[l-1] == address_prefix[l-1]|0x01
|
return (*s)[l-1] == prefix[l-1]|0x01
|
||||||
}
|
}
|
||||||
|
|
||||||
// address_addrForNodeID takes a *NodeID as an argument and returns an *address.
|
// address_addrForNodeID takes a *NodeID as an argument and returns an *address.
|
||||||
// This subnet begins with the address prefix, with the last bit set to 0 to indicate an address.
|
// This subnet begins with the address prefix, with the last bit set to 0 to indicate an address.
|
||||||
// The following 8 bits are set to the number of leading 1 bits in the NodeID.
|
// The following 8 bits are set to the number of leading 1 bits in the NodeID.
|
||||||
// The NodeID, excluding the leading 1 bits and the first leading 0 bit, is truncated to the appropriate length and makes up the remainder of the address.
|
// The NodeID, excluding the leading 1 bits and the first leading 0 bit, is truncated to the appropriate length and makes up the remainder of the address.
|
||||||
func address_addrForNodeID(nid *NodeID) *address {
|
func AddrForNodeID(nid *crypto.NodeID) *Address {
|
||||||
// 128 bit address
|
// 128 bit address
|
||||||
// Begins with prefix
|
// Begins with prefix
|
||||||
// Next bit is a 0
|
// Next bit is a 0
|
||||||
// Next 7 bits, interpreted as a uint, are # of leading 1s in the NodeID
|
// Next 7 bits, interpreted as a uint, are # of leading 1s in the NodeID
|
||||||
// Leading 1s and first leading 0 of the NodeID are truncated off
|
// Leading 1s and first leading 0 of the NodeID are truncated off
|
||||||
// The rest is appended to the IPv6 address (truncated to 128 bits total)
|
// The rest is appended to the IPv6 address (truncated to 128 bits total)
|
||||||
var addr address
|
var addr Address
|
||||||
var temp []byte
|
var temp []byte
|
||||||
done := false
|
done := false
|
||||||
ones := byte(0)
|
ones := byte(0)
|
||||||
@ -67,9 +73,10 @@ func address_addrForNodeID(nid *NodeID) *address {
|
|||||||
temp = append(temp, bits)
|
temp = append(temp, bits)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
copy(addr[:], address_prefix[:])
|
prefix := GetPrefix()
|
||||||
addr[len(address_prefix)] = ones
|
copy(addr[:], prefix[:])
|
||||||
copy(addr[len(address_prefix)+1:], temp)
|
addr[len(prefix)] = ones
|
||||||
|
copy(addr[len(prefix)+1:], temp)
|
||||||
return &addr
|
return &addr
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -77,14 +84,15 @@ func address_addrForNodeID(nid *NodeID) *address {
|
|||||||
// This subnet begins with the address prefix, with the last bit set to 1 to indicate a prefix.
|
// This subnet begins with the address prefix, with the last bit set to 1 to indicate a prefix.
|
||||||
// The following 8 bits are set to the number of leading 1 bits in the NodeID.
|
// The following 8 bits are set to the number of leading 1 bits in the NodeID.
|
||||||
// The NodeID, excluding the leading 1 bits and the first leading 0 bit, is truncated to the appropriate length and makes up the remainder of the subnet.
|
// The NodeID, excluding the leading 1 bits and the first leading 0 bit, is truncated to the appropriate length and makes up the remainder of the subnet.
|
||||||
func address_subnetForNodeID(nid *NodeID) *subnet {
|
func SubnetForNodeID(nid *crypto.NodeID) *Subnet {
|
||||||
// Exactly as the address version, with two exceptions:
|
// Exactly as the address version, with two exceptions:
|
||||||
// 1) The first bit after the fixed prefix is a 1 instead of a 0
|
// 1) The first bit after the fixed prefix is a 1 instead of a 0
|
||||||
// 2) It's truncated to a subnet prefix length instead of 128 bits
|
// 2) It's truncated to a subnet prefix length instead of 128 bits
|
||||||
addr := *address_addrForNodeID(nid)
|
addr := *AddrForNodeID(nid)
|
||||||
var snet subnet
|
var snet Subnet
|
||||||
copy(snet[:], addr[:])
|
copy(snet[:], addr[:])
|
||||||
snet[len(address_prefix)-1] |= 0x01
|
prefix := GetPrefix()
|
||||||
|
snet[len(prefix)-1] |= 0x01
|
||||||
return &snet
|
return &snet
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -92,17 +100,18 @@ func address_subnetForNodeID(nid *NodeID) *subnet {
|
|||||||
// The first is a NodeID with all the bits known from the address set to their correct values.
|
// The first is a NodeID with all the bits known from the address set to their correct values.
|
||||||
// The second is a bitmask with 1 bit set for each bit that was known from the address.
|
// The second is a bitmask with 1 bit set for each bit that was known from the address.
|
||||||
// This is used to look up NodeIDs in the DHT and tell if they match an address.
|
// This is used to look up NodeIDs in the DHT and tell if they match an address.
|
||||||
func (a *address) getNodeIDandMask() (*NodeID, *NodeID) {
|
func (a *Address) GetNodeIDandMask() (*crypto.NodeID, *crypto.NodeID) {
|
||||||
// Mask is a bitmask to mark the bits visible from the address
|
// Mask is a bitmask to mark the bits visible from the address
|
||||||
// This means truncated leading 1s, first leading 0, and visible part of addr
|
// This means truncated leading 1s, first leading 0, and visible part of addr
|
||||||
var nid NodeID
|
var nid crypto.NodeID
|
||||||
var mask NodeID
|
var mask crypto.NodeID
|
||||||
ones := int(a[len(address_prefix)])
|
prefix := GetPrefix()
|
||||||
|
ones := int(a[len(prefix)])
|
||||||
for idx := 0; idx < ones; idx++ {
|
for idx := 0; idx < ones; idx++ {
|
||||||
nid[idx/8] |= 0x80 >> byte(idx%8)
|
nid[idx/8] |= 0x80 >> byte(idx%8)
|
||||||
}
|
}
|
||||||
nidOffset := ones + 1
|
nidOffset := ones + 1
|
||||||
addrOffset := 8*len(address_prefix) + 8
|
addrOffset := 8*len(prefix) + 8
|
||||||
for idx := addrOffset; idx < 8*len(a); idx++ {
|
for idx := addrOffset; idx < 8*len(a); idx++ {
|
||||||
bits := a[idx/8] & (0x80 >> byte(idx%8))
|
bits := a[idx/8] & (0x80 >> byte(idx%8))
|
||||||
bits <<= byte(idx % 8)
|
bits <<= byte(idx % 8)
|
||||||
@ -110,7 +119,7 @@ func (a *address) getNodeIDandMask() (*NodeID, *NodeID) {
|
|||||||
bits >>= byte(nidIdx % 8)
|
bits >>= byte(nidIdx % 8)
|
||||||
nid[nidIdx/8] |= bits
|
nid[nidIdx/8] |= bits
|
||||||
}
|
}
|
||||||
maxMask := 8*(len(a)-len(address_prefix)-1) + ones + 1
|
maxMask := 8*(len(a)-len(prefix)-1) + ones + 1
|
||||||
for idx := 0; idx < maxMask; idx++ {
|
for idx := 0; idx < maxMask; idx++ {
|
||||||
mask[idx/8] |= 0x80 >> byte(idx%8)
|
mask[idx/8] |= 0x80 >> byte(idx%8)
|
||||||
}
|
}
|
||||||
@ -121,16 +130,17 @@ func (a *address) getNodeIDandMask() (*NodeID, *NodeID) {
|
|||||||
// The first is a NodeID with all the bits known from the address set to their correct values.
|
// The first is a NodeID with all the bits known from the address set to their correct values.
|
||||||
// The second is a bitmask with 1 bit set for each bit that was known from the subnet.
|
// The second is a bitmask with 1 bit set for each bit that was known from the subnet.
|
||||||
// This is used to look up NodeIDs in the DHT and tell if they match a subnet.
|
// This is used to look up NodeIDs in the DHT and tell if they match a subnet.
|
||||||
func (s *subnet) getNodeIDandMask() (*NodeID, *NodeID) {
|
func (s *Subnet) GetNodeIDandMask() (*crypto.NodeID, *crypto.NodeID) {
|
||||||
// As with the address version, but visible parts of the subnet prefix instead
|
// As with the address version, but visible parts of the subnet prefix instead
|
||||||
var nid NodeID
|
var nid crypto.NodeID
|
||||||
var mask NodeID
|
var mask crypto.NodeID
|
||||||
ones := int(s[len(address_prefix)])
|
prefix := GetPrefix()
|
||||||
|
ones := int(s[len(prefix)])
|
||||||
for idx := 0; idx < ones; idx++ {
|
for idx := 0; idx < ones; idx++ {
|
||||||
nid[idx/8] |= 0x80 >> byte(idx%8)
|
nid[idx/8] |= 0x80 >> byte(idx%8)
|
||||||
}
|
}
|
||||||
nidOffset := ones + 1
|
nidOffset := ones + 1
|
||||||
addrOffset := 8*len(address_prefix) + 8
|
addrOffset := 8*len(prefix) + 8
|
||||||
for idx := addrOffset; idx < 8*len(s); idx++ {
|
for idx := addrOffset; idx < 8*len(s); idx++ {
|
||||||
bits := s[idx/8] & (0x80 >> byte(idx%8))
|
bits := s[idx/8] & (0x80 >> byte(idx%8))
|
||||||
bits <<= byte(idx % 8)
|
bits <<= byte(idx % 8)
|
||||||
@ -138,7 +148,7 @@ func (s *subnet) getNodeIDandMask() (*NodeID, *NodeID) {
|
|||||||
bits >>= byte(nidIdx % 8)
|
bits >>= byte(nidIdx % 8)
|
||||||
nid[nidIdx/8] |= bits
|
nid[nidIdx/8] |= bits
|
||||||
}
|
}
|
||||||
maxMask := 8*(len(s)-len(address_prefix)-1) + ones + 1
|
maxMask := 8*(len(s)-len(prefix)-1) + ones + 1
|
||||||
for idx := 0; idx < maxMask; idx++ {
|
for idx := 0; idx < maxMask; idx++ {
|
||||||
mask[idx/8] |= 0x80 >> byte(idx%8)
|
mask[idx/8] |= 0x80 >> byte(idx%8)
|
||||||
}
|
}
|
187
src/crypto/crypto.go
Normal file
187
src/crypto/crypto.go
Normal file
@ -0,0 +1,187 @@
|
|||||||
|
package crypto
|
||||||
|
|
||||||
|
/*
|
||||||
|
|
||||||
|
This part of the package wraps crypto operations needed elsewhere
|
||||||
|
|
||||||
|
In particular, it exposes key generation for ed25519 and nacl box
|
||||||
|
|
||||||
|
It also defines NodeID and TreeID as hashes of keys, and wraps hash functions
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/sha512"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ed25519"
|
||||||
|
"golang.org/x/crypto/nacl/box"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
|
)
|
||||||
|
|
||||||
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
|
// NodeID and TreeID
|
||||||
|
|
||||||
|
const NodeIDLen = sha512.Size
|
||||||
|
const TreeIDLen = sha512.Size
|
||||||
|
const handleLen = 8
|
||||||
|
|
||||||
|
type NodeID [NodeIDLen]byte
|
||||||
|
type TreeID [TreeIDLen]byte
|
||||||
|
type Handle [handleLen]byte
|
||||||
|
|
||||||
|
func GetNodeID(pub *BoxPubKey) *NodeID {
|
||||||
|
h := sha512.Sum512(pub[:])
|
||||||
|
return (*NodeID)(&h)
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetTreeID(pub *SigPubKey) *TreeID {
|
||||||
|
h := sha512.Sum512(pub[:])
|
||||||
|
return (*TreeID)(&h)
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewHandle() *Handle {
|
||||||
|
var h Handle
|
||||||
|
_, err := rand.Read(h[:])
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
return &h
|
||||||
|
}
|
||||||
|
|
||||||
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
|
// Signatures
|
||||||
|
|
||||||
|
const SigPubKeyLen = ed25519.PublicKeySize
|
||||||
|
const SigPrivKeyLen = ed25519.PrivateKeySize
|
||||||
|
const SigLen = ed25519.SignatureSize
|
||||||
|
|
||||||
|
type SigPubKey [SigPubKeyLen]byte
|
||||||
|
type SigPrivKey [SigPrivKeyLen]byte
|
||||||
|
type SigBytes [SigLen]byte
|
||||||
|
|
||||||
|
func NewSigKeys() (*SigPubKey, *SigPrivKey) {
|
||||||
|
var pub SigPubKey
|
||||||
|
var priv SigPrivKey
|
||||||
|
pubSlice, privSlice, err := ed25519.GenerateKey(rand.Reader)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
copy(pub[:], pubSlice)
|
||||||
|
copy(priv[:], privSlice)
|
||||||
|
return &pub, &priv
|
||||||
|
}
|
||||||
|
|
||||||
|
func Sign(priv *SigPrivKey, msg []byte) *SigBytes {
|
||||||
|
var sig SigBytes
|
||||||
|
sigSlice := ed25519.Sign(priv[:], msg)
|
||||||
|
copy(sig[:], sigSlice)
|
||||||
|
return &sig
|
||||||
|
}
|
||||||
|
|
||||||
|
func Verify(pub *SigPubKey, msg []byte, sig *SigBytes) bool {
|
||||||
|
// Should sig be an array instead of a slice?...
|
||||||
|
// It's fixed size, but
|
||||||
|
return ed25519.Verify(pub[:], msg, sig[:])
|
||||||
|
}
|
||||||
|
|
||||||
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
|
// NaCl-like crypto "box" (curve25519+xsalsa20+poly1305)
|
||||||
|
|
||||||
|
const BoxPubKeyLen = 32
|
||||||
|
const BoxPrivKeyLen = 32
|
||||||
|
const BoxSharedKeyLen = 32
|
||||||
|
const BoxNonceLen = 24
|
||||||
|
const BoxOverhead = box.Overhead
|
||||||
|
|
||||||
|
type BoxPubKey [BoxPubKeyLen]byte
|
||||||
|
type BoxPrivKey [BoxPrivKeyLen]byte
|
||||||
|
type BoxSharedKey [BoxSharedKeyLen]byte
|
||||||
|
type BoxNonce [BoxNonceLen]byte
|
||||||
|
|
||||||
|
func NewBoxKeys() (*BoxPubKey, *BoxPrivKey) {
|
||||||
|
pubBytes, privBytes, err := box.GenerateKey(rand.Reader)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
pub := (*BoxPubKey)(pubBytes)
|
||||||
|
priv := (*BoxPrivKey)(privBytes)
|
||||||
|
return pub, priv
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetSharedKey(myPrivKey *BoxPrivKey,
|
||||||
|
othersPubKey *BoxPubKey) *BoxSharedKey {
|
||||||
|
var shared [BoxSharedKeyLen]byte
|
||||||
|
priv := (*[BoxPrivKeyLen]byte)(myPrivKey)
|
||||||
|
pub := (*[BoxPubKeyLen]byte)(othersPubKey)
|
||||||
|
box.Precompute(&shared, pub, priv)
|
||||||
|
return (*BoxSharedKey)(&shared)
|
||||||
|
}
|
||||||
|
|
||||||
|
func BoxOpen(shared *BoxSharedKey,
|
||||||
|
boxed []byte,
|
||||||
|
nonce *BoxNonce) ([]byte, bool) {
|
||||||
|
out := util.GetBytes()
|
||||||
|
s := (*[BoxSharedKeyLen]byte)(shared)
|
||||||
|
n := (*[BoxNonceLen]byte)(nonce)
|
||||||
|
unboxed, success := box.OpenAfterPrecomputation(out, boxed, n, s)
|
||||||
|
return unboxed, success
|
||||||
|
}
|
||||||
|
|
||||||
|
func BoxSeal(shared *BoxSharedKey, unboxed []byte, nonce *BoxNonce) ([]byte, *BoxNonce) {
|
||||||
|
if nonce == nil {
|
||||||
|
nonce = NewBoxNonce()
|
||||||
|
}
|
||||||
|
nonce.Increment()
|
||||||
|
out := util.GetBytes()
|
||||||
|
s := (*[BoxSharedKeyLen]byte)(shared)
|
||||||
|
n := (*[BoxNonceLen]byte)(nonce)
|
||||||
|
boxed := box.SealAfterPrecomputation(out, unboxed, n, s)
|
||||||
|
return boxed, nonce
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewBoxNonce() *BoxNonce {
|
||||||
|
var nonce BoxNonce
|
||||||
|
_, err := rand.Read(nonce[:])
|
||||||
|
for ; err == nil && nonce[0] == 0xff; _, err = rand.Read(nonce[:]) {
|
||||||
|
// Make sure nonce isn't too high
|
||||||
|
// This is just to make rollover unlikely to happen
|
||||||
|
// Rollover is fine, but it may kill the session and force it to reopen
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
return &nonce
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *BoxNonce) Increment() {
|
||||||
|
oldNonce := *n
|
||||||
|
n[len(n)-1] += 2
|
||||||
|
for i := len(n) - 2; i >= 0; i-- {
|
||||||
|
if n[i+1] < oldNonce[i+1] {
|
||||||
|
n[i] += 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Used to subtract one nonce from another, staying in the range +- 64.
|
||||||
|
// This is used by the nonce progression machinery to advance the bitmask of recently received packets (indexed by nonce), or to check the appropriate bit of the bitmask.
|
||||||
|
// It's basically part of the machinery that prevents replays and duplicate packets.
|
||||||
|
func (n *BoxNonce) Minus(m *BoxNonce) int64 {
|
||||||
|
diff := int64(0)
|
||||||
|
for idx := range n {
|
||||||
|
diff *= 256
|
||||||
|
diff += int64(n[idx]) - int64(m[idx])
|
||||||
|
if diff > 64 {
|
||||||
|
diff = 64
|
||||||
|
}
|
||||||
|
if diff < -64 {
|
||||||
|
diff = -64
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return diff
|
||||||
|
}
|
@ -1,21 +1,21 @@
|
|||||||
package yggdrasil
|
package util
|
||||||
|
|
||||||
// These are misc. utility functions that didn't really fit anywhere else
|
// These are misc. utility functions that didn't really fit anywhere else
|
||||||
|
|
||||||
import "runtime"
|
import "runtime"
|
||||||
|
|
||||||
// A wrapper around runtime.Gosched() so it doesn't need to be imported elsewhere.
|
// A wrapper around runtime.Gosched() so it doesn't need to be imported elsewhere.
|
||||||
func util_yield() {
|
func Yield() {
|
||||||
runtime.Gosched()
|
runtime.Gosched()
|
||||||
}
|
}
|
||||||
|
|
||||||
// A wrapper around runtime.LockOSThread() so it doesn't need to be imported elsewhere.
|
// A wrapper around runtime.LockOSThread() so it doesn't need to be imported elsewhere.
|
||||||
func util_lockthread() {
|
func LockThread() {
|
||||||
runtime.LockOSThread()
|
runtime.LockOSThread()
|
||||||
}
|
}
|
||||||
|
|
||||||
// A wrapper around runtime.UnlockOSThread() so it doesn't need to be imported elsewhere.
|
// A wrapper around runtime.UnlockOSThread() so it doesn't need to be imported elsewhere.
|
||||||
func util_unlockthread() {
|
func UnlockThread() {
|
||||||
runtime.UnlockOSThread()
|
runtime.UnlockOSThread()
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -23,15 +23,12 @@ func util_unlockthread() {
|
|||||||
// It's used like a sync.Pool, but with a fixed size and typechecked without type casts to/from interface{} (which were making the profiles look ugly).
|
// It's used like a sync.Pool, but with a fixed size and typechecked without type casts to/from interface{} (which were making the profiles look ugly).
|
||||||
var byteStore chan []byte
|
var byteStore chan []byte
|
||||||
|
|
||||||
// Initializes the byteStore
|
func init() {
|
||||||
func util_initByteStore() {
|
byteStore = make(chan []byte, 32)
|
||||||
if byteStore == nil {
|
|
||||||
byteStore = make(chan []byte, 32)
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets an empty slice from the byte store, if one is available, or else returns a new nil slice.
|
// Gets an empty slice from the byte store, if one is available, or else returns a new nil slice.
|
||||||
func util_getBytes() []byte {
|
func GetBytes() []byte {
|
||||||
select {
|
select {
|
||||||
case bs := <-byteStore:
|
case bs := <-byteStore:
|
||||||
return bs[:0]
|
return bs[:0]
|
||||||
@ -41,7 +38,7 @@ func util_getBytes() []byte {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Puts a slice in the store, if there's room, or else returns and lets the slice get collected.
|
// Puts a slice in the store, if there's room, or else returns and lets the slice get collected.
|
||||||
func util_putBytes(bs []byte) {
|
func PutBytes(bs []byte) {
|
||||||
select {
|
select {
|
||||||
case byteStore <- bs:
|
case byteStore <- bs:
|
||||||
default:
|
default:
|
@ -14,6 +14,8 @@ import (
|
|||||||
"sync/atomic"
|
"sync/atomic"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
||||||
)
|
)
|
||||||
|
|
||||||
@ -314,7 +316,7 @@ func (a *admin) init(c *Core, listenaddr string) {
|
|||||||
"box_pub_key": hex.EncodeToString(dinfo.key[:]),
|
"box_pub_key": hex.EncodeToString(dinfo.key[:]),
|
||||||
"coords": fmt.Sprintf("%v", dinfo.coords),
|
"coords": fmt.Sprintf("%v", dinfo.coords),
|
||||||
}
|
}
|
||||||
addr := net.IP(address_addrForNodeID(getNodeID(&dinfo.key))[:]).String()
|
addr := net.IP(address.AddrForNodeID(crypto.GetNodeID(&dinfo.key))[:]).String()
|
||||||
infos[addr] = info
|
infos[addr] = info
|
||||||
}
|
}
|
||||||
return admin_info{"nodes": infos}, nil
|
return admin_info{"nodes": infos}, nil
|
||||||
@ -553,7 +555,7 @@ func (a *admin) startTunWithMTU(ifname string, iftapmode bool, ifmtu int) error
|
|||||||
_ = a.core.router.tun.close()
|
_ = a.core.router.tun.close()
|
||||||
// Then reconfigure and start it
|
// Then reconfigure and start it
|
||||||
addr := a.core.router.addr
|
addr := a.core.router.addr
|
||||||
straddr := fmt.Sprintf("%s/%v", net.IP(addr[:]).String(), 8*len(address_prefix)-1)
|
straddr := fmt.Sprintf("%s/%v", net.IP(addr[:]).String(), 8*len(address.GetPrefix())-1)
|
||||||
if ifname != "none" {
|
if ifname != "none" {
|
||||||
err := a.core.router.tun.setup(ifname, iftapmode, straddr, ifmtu)
|
err := a.core.router.tun.setup(ifname, iftapmode, straddr, ifmtu)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -607,7 +609,7 @@ func (a *admin) getData_getPeers() []admin_nodeInfo {
|
|||||||
sort.Slice(ps, func(i, j int) bool { return ps[i] < ps[j] })
|
sort.Slice(ps, func(i, j int) bool { return ps[i] < ps[j] })
|
||||||
for _, port := range ps {
|
for _, port := range ps {
|
||||||
p := ports[port]
|
p := ports[port]
|
||||||
addr := *address_addrForNodeID(getNodeID(&p.box))
|
addr := *address.AddrForNodeID(crypto.GetNodeID(&p.box))
|
||||||
info := admin_nodeInfo{
|
info := admin_nodeInfo{
|
||||||
{"ip", net.IP(addr[:]).String()},
|
{"ip", net.IP(addr[:]).String()},
|
||||||
{"port", port},
|
{"port", port},
|
||||||
@ -632,7 +634,7 @@ func (a *admin) getData_getSwitchPeers() []admin_nodeInfo {
|
|||||||
if !isIn {
|
if !isIn {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
addr := *address_addrForNodeID(getNodeID(&peer.box))
|
addr := *address.AddrForNodeID(crypto.GetNodeID(&peer.box))
|
||||||
coords := elem.locator.getCoords()
|
coords := elem.locator.getCoords()
|
||||||
info := admin_nodeInfo{
|
info := admin_nodeInfo{
|
||||||
{"ip", net.IP(addr[:]).String()},
|
{"ip", net.IP(addr[:]).String()},
|
||||||
@ -690,7 +692,7 @@ func (a *admin) getData_getDHT() []admin_nodeInfo {
|
|||||||
return dht_ordered(&a.core.dht.nodeID, dhtInfos[i].getNodeID(), dhtInfos[j].getNodeID())
|
return dht_ordered(&a.core.dht.nodeID, dhtInfos[i].getNodeID(), dhtInfos[j].getNodeID())
|
||||||
})
|
})
|
||||||
for _, v := range dhtInfos {
|
for _, v := range dhtInfos {
|
||||||
addr := *address_addrForNodeID(v.getNodeID())
|
addr := *address.AddrForNodeID(v.getNodeID())
|
||||||
info := admin_nodeInfo{
|
info := admin_nodeInfo{
|
||||||
{"ip", net.IP(addr[:]).String()},
|
{"ip", net.IP(addr[:]).String()},
|
||||||
{"coords", fmt.Sprint(v.coords)},
|
{"coords", fmt.Sprint(v.coords)},
|
||||||
@ -740,7 +742,7 @@ func (a *admin) getAllowedEncryptionPublicKeys() []string {
|
|||||||
func (a *admin) addAllowedEncryptionPublicKey(bstr string) (err error) {
|
func (a *admin) addAllowedEncryptionPublicKey(bstr string) (err error) {
|
||||||
boxBytes, err := hex.DecodeString(bstr)
|
boxBytes, err := hex.DecodeString(bstr)
|
||||||
if err == nil {
|
if err == nil {
|
||||||
var box boxPubKey
|
var box crypto.BoxPubKey
|
||||||
copy(box[:], boxBytes)
|
copy(box[:], boxBytes)
|
||||||
a.core.peers.addAllowedEncryptionPublicKey(&box)
|
a.core.peers.addAllowedEncryptionPublicKey(&box)
|
||||||
}
|
}
|
||||||
@ -752,7 +754,7 @@ func (a *admin) addAllowedEncryptionPublicKey(bstr string) (err error) {
|
|||||||
func (a *admin) removeAllowedEncryptionPublicKey(bstr string) (err error) {
|
func (a *admin) removeAllowedEncryptionPublicKey(bstr string) (err error) {
|
||||||
boxBytes, err := hex.DecodeString(bstr)
|
boxBytes, err := hex.DecodeString(bstr)
|
||||||
if err == nil {
|
if err == nil {
|
||||||
var box boxPubKey
|
var box crypto.BoxPubKey
|
||||||
copy(box[:], boxBytes)
|
copy(box[:], boxBytes)
|
||||||
a.core.peers.removeAllowedEncryptionPublicKey(&box)
|
a.core.peers.removeAllowedEncryptionPublicKey(&box)
|
||||||
}
|
}
|
||||||
@ -761,7 +763,7 @@ func (a *admin) removeAllowedEncryptionPublicKey(bstr string) (err error) {
|
|||||||
|
|
||||||
// Send a DHT ping to the node with the provided key and coords, optionally looking up the specified target NodeID.
|
// Send a DHT ping to the node with the provided key and coords, optionally looking up the specified target NodeID.
|
||||||
func (a *admin) admin_dhtPing(keyString, coordString, targetString string) (dhtRes, error) {
|
func (a *admin) admin_dhtPing(keyString, coordString, targetString string) (dhtRes, error) {
|
||||||
var key boxPubKey
|
var key crypto.BoxPubKey
|
||||||
if keyBytes, err := hex.DecodeString(keyString); err != nil {
|
if keyBytes, err := hex.DecodeString(keyString); err != nil {
|
||||||
return dhtRes{}, err
|
return dhtRes{}, err
|
||||||
} else {
|
} else {
|
||||||
@ -792,7 +794,7 @@ func (a *admin) admin_dhtPing(keyString, coordString, targetString string) (dhtR
|
|||||||
} else if len(targetBytes) != len(target) {
|
} else if len(targetBytes) != len(target) {
|
||||||
return dhtRes{}, errors.New("Incorrect target NodeID length")
|
return dhtRes{}, errors.New("Incorrect target NodeID length")
|
||||||
} else {
|
} else {
|
||||||
target = NodeID{}
|
var target crypto.NodeID
|
||||||
copy(target[:], targetBytes)
|
copy(target[:], targetBytes)
|
||||||
}
|
}
|
||||||
rq := dhtReqKey{info.key, target}
|
rq := dhtReqKey{info.key, target}
|
||||||
@ -818,7 +820,7 @@ func (a *admin) admin_dhtPing(keyString, coordString, targetString string) (dhtR
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (a *admin) admin_getNodeInfo(keyString, coordString string, nocache bool) (nodeinfoPayload, error) {
|
func (a *admin) admin_getNodeInfo(keyString, coordString string, nocache bool) (nodeinfoPayload, error) {
|
||||||
var key boxPubKey
|
var key crypto.BoxPubKey
|
||||||
if keyBytes, err := hex.DecodeString(keyString); err != nil {
|
if keyBytes, err := hex.DecodeString(keyString); err != nil {
|
||||||
return nodeinfoPayload{}, err
|
return nodeinfoPayload{}, err
|
||||||
} else {
|
} else {
|
||||||
|
@ -7,6 +7,9 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"sort"
|
"sort"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
)
|
)
|
||||||
|
|
||||||
// This module implements crypto-key routing, similar to Wireguard, where we
|
// This module implements crypto-key routing, similar to Wireguard, where we
|
||||||
@ -17,15 +20,15 @@ type cryptokey struct {
|
|||||||
enabled bool
|
enabled bool
|
||||||
ipv4routes []cryptokey_route
|
ipv4routes []cryptokey_route
|
||||||
ipv6routes []cryptokey_route
|
ipv6routes []cryptokey_route
|
||||||
ipv4cache map[address]cryptokey_route
|
ipv4cache map[address.Address]cryptokey_route
|
||||||
ipv6cache map[address]cryptokey_route
|
ipv6cache map[address.Address]cryptokey_route
|
||||||
ipv4sources []net.IPNet
|
ipv4sources []net.IPNet
|
||||||
ipv6sources []net.IPNet
|
ipv6sources []net.IPNet
|
||||||
}
|
}
|
||||||
|
|
||||||
type cryptokey_route struct {
|
type cryptokey_route struct {
|
||||||
subnet net.IPNet
|
subnet net.IPNet
|
||||||
destination boxPubKey
|
destination crypto.BoxPubKey
|
||||||
}
|
}
|
||||||
|
|
||||||
// Initialise crypto-key routing. This must be done before any other CKR calls.
|
// Initialise crypto-key routing. This must be done before any other CKR calls.
|
||||||
@ -33,8 +36,8 @@ func (c *cryptokey) init(core *Core) {
|
|||||||
c.core = core
|
c.core = core
|
||||||
c.ipv4routes = make([]cryptokey_route, 0)
|
c.ipv4routes = make([]cryptokey_route, 0)
|
||||||
c.ipv6routes = make([]cryptokey_route, 0)
|
c.ipv6routes = make([]cryptokey_route, 0)
|
||||||
c.ipv4cache = make(map[address]cryptokey_route, 0)
|
c.ipv4cache = make(map[address.Address]cryptokey_route, 0)
|
||||||
c.ipv6cache = make(map[address]cryptokey_route, 0)
|
c.ipv6cache = make(map[address.Address]cryptokey_route, 0)
|
||||||
c.ipv4sources = make([]net.IPNet, 0)
|
c.ipv4sources = make([]net.IPNet, 0)
|
||||||
c.ipv6sources = make([]net.IPNet, 0)
|
c.ipv6sources = make([]net.IPNet, 0)
|
||||||
}
|
}
|
||||||
@ -52,7 +55,7 @@ func (c *cryptokey) isEnabled() bool {
|
|||||||
// Check whether the given address (with the address length specified in bytes)
|
// Check whether the given address (with the address length specified in bytes)
|
||||||
// matches either the current node's address, the node's routed subnet or the
|
// matches either the current node's address, the node's routed subnet or the
|
||||||
// list of subnets specified in IPv4Sources/IPv6Sources.
|
// list of subnets specified in IPv4Sources/IPv6Sources.
|
||||||
func (c *cryptokey) isValidSource(addr address, addrlen int) bool {
|
func (c *cryptokey) isValidSource(addr address.Address, addrlen int) bool {
|
||||||
ip := net.IP(addr[:addrlen])
|
ip := net.IP(addr[:addrlen])
|
||||||
|
|
||||||
if addrlen == net.IPv6len {
|
if addrlen == net.IPv6len {
|
||||||
@ -143,7 +146,7 @@ func (c *cryptokey) addRoute(cidr string, dest string) error {
|
|||||||
|
|
||||||
// Build our references to the routing table and cache
|
// Build our references to the routing table and cache
|
||||||
var routingtable *[]cryptokey_route
|
var routingtable *[]cryptokey_route
|
||||||
var routingcache *map[address]cryptokey_route
|
var routingcache *map[address.Address]cryptokey_route
|
||||||
|
|
||||||
// Check if the prefix is IPv4 or IPv6
|
// Check if the prefix is IPv4 or IPv6
|
||||||
if prefixsize == net.IPv6len*8 {
|
if prefixsize == net.IPv6len*8 {
|
||||||
@ -157,11 +160,11 @@ func (c *cryptokey) addRoute(cidr string, dest string) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Is the route an Yggdrasil destination?
|
// Is the route an Yggdrasil destination?
|
||||||
var addr address
|
var addr address.Address
|
||||||
var snet subnet
|
var snet address.Subnet
|
||||||
copy(addr[:], ipaddr)
|
copy(addr[:], ipaddr)
|
||||||
copy(snet[:], ipnet.IP)
|
copy(snet[:], ipnet.IP)
|
||||||
if addr.isValid() || snet.isValid() {
|
if addr.IsValid() || snet.IsValid() {
|
||||||
return errors.New("Can't specify Yggdrasil destination as crypto-key route")
|
return errors.New("Can't specify Yggdrasil destination as crypto-key route")
|
||||||
}
|
}
|
||||||
// Do we already have a route for this subnet?
|
// Do we already have a route for this subnet?
|
||||||
@ -173,11 +176,11 @@ func (c *cryptokey) addRoute(cidr string, dest string) error {
|
|||||||
// Decode the public key
|
// Decode the public key
|
||||||
if bpk, err := hex.DecodeString(dest); err != nil {
|
if bpk, err := hex.DecodeString(dest); err != nil {
|
||||||
return err
|
return err
|
||||||
} else if len(bpk) != boxPubKeyLen {
|
} else if len(bpk) != crypto.BoxPubKeyLen {
|
||||||
return errors.New(fmt.Sprintf("Incorrect key length for %s", dest))
|
return errors.New(fmt.Sprintf("Incorrect key length for %s", dest))
|
||||||
} else {
|
} else {
|
||||||
// Add the new crypto-key route
|
// Add the new crypto-key route
|
||||||
var key boxPubKey
|
var key crypto.BoxPubKey
|
||||||
copy(key[:], bpk)
|
copy(key[:], bpk)
|
||||||
*routingtable = append(*routingtable, cryptokey_route{
|
*routingtable = append(*routingtable, cryptokey_route{
|
||||||
subnet: *ipnet,
|
subnet: *ipnet,
|
||||||
@ -205,16 +208,16 @@ func (c *cryptokey) addRoute(cidr string, dest string) error {
|
|||||||
// Looks up the most specific route for the given address (with the address
|
// Looks up the most specific route for the given address (with the address
|
||||||
// length specified in bytes) from the crypto-key routing table. An error is
|
// length specified in bytes) from the crypto-key routing table. An error is
|
||||||
// returned if the address is not suitable or no route was found.
|
// returned if the address is not suitable or no route was found.
|
||||||
func (c *cryptokey) getPublicKeyForAddress(addr address, addrlen int) (boxPubKey, error) {
|
func (c *cryptokey) getPublicKeyForAddress(addr address.Address, addrlen int) (crypto.BoxPubKey, error) {
|
||||||
// Check if the address is a valid Yggdrasil address - if so it
|
// Check if the address is a valid Yggdrasil address - if so it
|
||||||
// is exempt from all CKR checking
|
// is exempt from all CKR checking
|
||||||
if addr.isValid() {
|
if addr.IsValid() {
|
||||||
return boxPubKey{}, errors.New("Cannot look up CKR for Yggdrasil addresses")
|
return crypto.BoxPubKey{}, errors.New("Cannot look up CKR for Yggdrasil addresses")
|
||||||
}
|
}
|
||||||
|
|
||||||
// Build our references to the routing table and cache
|
// Build our references to the routing table and cache
|
||||||
var routingtable *[]cryptokey_route
|
var routingtable *[]cryptokey_route
|
||||||
var routingcache *map[address]cryptokey_route
|
var routingcache *map[address.Address]cryptokey_route
|
||||||
|
|
||||||
// Check if the prefix is IPv4 or IPv6
|
// Check if the prefix is IPv4 or IPv6
|
||||||
if addrlen == net.IPv6len {
|
if addrlen == net.IPv6len {
|
||||||
@ -224,7 +227,7 @@ func (c *cryptokey) getPublicKeyForAddress(addr address, addrlen int) (boxPubKey
|
|||||||
routingtable = &c.ipv4routes
|
routingtable = &c.ipv4routes
|
||||||
routingcache = &c.ipv4cache
|
routingcache = &c.ipv4cache
|
||||||
} else {
|
} else {
|
||||||
return boxPubKey{}, errors.New("Unexpected prefix size")
|
return crypto.BoxPubKey{}, errors.New("Unexpected prefix size")
|
||||||
}
|
}
|
||||||
|
|
||||||
// Check if there's a cache entry for this addr
|
// Check if there's a cache entry for this addr
|
||||||
@ -260,7 +263,7 @@ func (c *cryptokey) getPublicKeyForAddress(addr address, addrlen int) (boxPubKey
|
|||||||
}
|
}
|
||||||
|
|
||||||
// No route was found if we got to this point
|
// No route was found if we got to this point
|
||||||
return boxPubKey{}, errors.New(fmt.Sprintf("No route to %s", ip.String()))
|
return crypto.BoxPubKey{}, errors.New(fmt.Sprintf("No route to %s", ip.String()))
|
||||||
}
|
}
|
||||||
|
|
||||||
// Removes a source subnet, which allows traffic with these source addresses to
|
// Removes a source subnet, which allows traffic with these source addresses to
|
||||||
@ -312,7 +315,7 @@ func (c *cryptokey) removeRoute(cidr string, dest string) error {
|
|||||||
|
|
||||||
// Build our references to the routing table and cache
|
// Build our references to the routing table and cache
|
||||||
var routingtable *[]cryptokey_route
|
var routingtable *[]cryptokey_route
|
||||||
var routingcache *map[address]cryptokey_route
|
var routingcache *map[address.Address]cryptokey_route
|
||||||
|
|
||||||
// Check if the prefix is IPv4 or IPv6
|
// Check if the prefix is IPv4 or IPv6
|
||||||
if prefixsize == net.IPv6len*8 {
|
if prefixsize == net.IPv6len*8 {
|
||||||
@ -329,7 +332,7 @@ func (c *cryptokey) removeRoute(cidr string, dest string) error {
|
|||||||
bpk, err := hex.DecodeString(dest)
|
bpk, err := hex.DecodeString(dest)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
} else if len(bpk) != boxPubKeyLen {
|
} else if len(bpk) != crypto.BoxPubKeyLen {
|
||||||
return errors.New(fmt.Sprintf("Incorrect key length for %s", dest))
|
return errors.New(fmt.Sprintf("Incorrect key length for %s", dest))
|
||||||
}
|
}
|
||||||
netStr := ipnet.String()
|
netStr := ipnet.String()
|
||||||
|
@ -8,7 +8,9 @@ import (
|
|||||||
"net"
|
"net"
|
||||||
"regexp"
|
"regexp"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
"github.com/yggdrasil-network/yggdrasil-go/src/config"
|
"github.com/yggdrasil-network/yggdrasil-go/src/config"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
||||||
)
|
)
|
||||||
|
|
||||||
@ -19,10 +21,10 @@ var buildVersion string
|
|||||||
// object for each Yggdrasil node you plan to run.
|
// object for each Yggdrasil node you plan to run.
|
||||||
type Core struct {
|
type Core struct {
|
||||||
// This is the main data structure that holds everything else for a node
|
// This is the main data structure that holds everything else for a node
|
||||||
boxPub boxPubKey
|
boxPub crypto.BoxPubKey
|
||||||
boxPriv boxPrivKey
|
boxPriv crypto.BoxPrivKey
|
||||||
sigPub sigPubKey
|
sigPub crypto.SigPubKey
|
||||||
sigPriv sigPrivKey
|
sigPriv crypto.SigPrivKey
|
||||||
switchTable switchTable
|
switchTable switchTable
|
||||||
peers peers
|
peers peers
|
||||||
sessions sessions
|
sessions sessions
|
||||||
@ -37,15 +39,14 @@ type Core struct {
|
|||||||
ifceExpr []*regexp.Regexp // the zone of link-local IPv6 peers must match this
|
ifceExpr []*regexp.Regexp // the zone of link-local IPv6 peers must match this
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) init(bpub *boxPubKey,
|
func (c *Core) init(bpub *crypto.BoxPubKey,
|
||||||
bpriv *boxPrivKey,
|
bpriv *crypto.BoxPrivKey,
|
||||||
spub *sigPubKey,
|
spub *crypto.SigPubKey,
|
||||||
spriv *sigPrivKey) {
|
spriv *crypto.SigPrivKey) {
|
||||||
// TODO separate init and start functions
|
// TODO separate init and start functions
|
||||||
// Init sets up structs
|
// Init sets up structs
|
||||||
// Start launches goroutines that depend on structs being set up
|
// Start launches goroutines that depend on structs being set up
|
||||||
// This is pretty much required to completely avoid race conditions
|
// This is pretty much required to completely avoid race conditions
|
||||||
util_initByteStore()
|
|
||||||
if c.log == nil {
|
if c.log == nil {
|
||||||
c.log = log.New(ioutil.Discard, "", 0)
|
c.log = log.New(ioutil.Discard, "", 0)
|
||||||
}
|
}
|
||||||
@ -95,10 +96,10 @@ func (c *Core) Start(nc *config.NodeConfig, log *log.Logger) error {
|
|||||||
|
|
||||||
c.log.Println("Starting up...")
|
c.log.Println("Starting up...")
|
||||||
|
|
||||||
var boxPub boxPubKey
|
var boxPub crypto.BoxPubKey
|
||||||
var boxPriv boxPrivKey
|
var boxPriv crypto.BoxPrivKey
|
||||||
var sigPub sigPubKey
|
var sigPub crypto.SigPubKey
|
||||||
var sigPriv sigPrivKey
|
var sigPriv crypto.SigPrivKey
|
||||||
boxPubHex, err := hex.DecodeString(nc.EncryptionPublicKey)
|
boxPubHex, err := hex.DecodeString(nc.EncryptionPublicKey)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
@ -190,7 +191,7 @@ func (c *Core) Start(nc *config.NodeConfig, log *log.Logger) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
ip := net.IP(c.router.addr[:]).String()
|
ip := net.IP(c.router.addr[:]).String()
|
||||||
if err := c.router.tun.start(nc.IfName, nc.IfTAPMode, fmt.Sprintf("%s/%d", ip, 8*len(address_prefix)-1), nc.IfMTU); err != nil {
|
if err := c.router.tun.start(nc.IfName, nc.IfTAPMode, fmt.Sprintf("%s/%d", ip, 8*len(address.GetPrefix())-1), nc.IfMTU); err != nil {
|
||||||
c.log.Println("Failed to start TUN/TAP")
|
c.log.Println("Failed to start TUN/TAP")
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
@ -208,35 +209,35 @@ func (c *Core) Stop() {
|
|||||||
|
|
||||||
// Generates a new encryption keypair. The encryption keys are used to
|
// Generates a new encryption keypair. The encryption keys are used to
|
||||||
// encrypt traffic and to derive the IPv6 address/subnet of the node.
|
// encrypt traffic and to derive the IPv6 address/subnet of the node.
|
||||||
func (c *Core) NewEncryptionKeys() (*boxPubKey, *boxPrivKey) {
|
func (c *Core) NewEncryptionKeys() (*crypto.BoxPubKey, *crypto.BoxPrivKey) {
|
||||||
return newBoxKeys()
|
return crypto.NewBoxKeys()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Generates a new signing keypair. The signing keys are used to derive the
|
// Generates a new signing keypair. The signing keys are used to derive the
|
||||||
// structure of the spanning tree.
|
// structure of the spanning tree.
|
||||||
func (c *Core) NewSigningKeys() (*sigPubKey, *sigPrivKey) {
|
func (c *Core) NewSigningKeys() (*crypto.SigPubKey, *crypto.SigPrivKey) {
|
||||||
return newSigKeys()
|
return crypto.NewSigKeys()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the node ID.
|
// Gets the node ID.
|
||||||
func (c *Core) GetNodeID() *NodeID {
|
func (c *Core) GetNodeID() *crypto.NodeID {
|
||||||
return getNodeID(&c.boxPub)
|
return crypto.GetNodeID(&c.boxPub)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the tree ID.
|
// Gets the tree ID.
|
||||||
func (c *Core) GetTreeID() *TreeID {
|
func (c *Core) GetTreeID() *crypto.TreeID {
|
||||||
return getTreeID(&c.sigPub)
|
return crypto.GetTreeID(&c.sigPub)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the IPv6 address of the Yggdrasil node. This is always a /128.
|
// Gets the IPv6 address of the Yggdrasil node. This is always a /128.
|
||||||
func (c *Core) GetAddress() *net.IP {
|
func (c *Core) GetAddress() *net.IP {
|
||||||
address := net.IP(address_addrForNodeID(c.GetNodeID())[:])
|
address := net.IP(address.AddrForNodeID(c.GetNodeID())[:])
|
||||||
return &address
|
return &address
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the routed IPv6 subnet of the Yggdrasil node. This is always a /64.
|
// Gets the routed IPv6 subnet of the Yggdrasil node. This is always a /64.
|
||||||
func (c *Core) GetSubnet() *net.IPNet {
|
func (c *Core) GetSubnet() *net.IPNet {
|
||||||
subnet := address_subnetForNodeID(c.GetNodeID())[:]
|
subnet := address.SubnetForNodeID(c.GetNodeID())[:]
|
||||||
subnet = append(subnet, 0, 0, 0, 0, 0, 0, 0, 0)
|
subnet = append(subnet, 0, 0, 0, 0, 0, 0, 0, 0)
|
||||||
return &net.IPNet{IP: subnet, Mask: net.CIDRMask(64, 128)}
|
return &net.IPNet{IP: subnet, Mask: net.CIDRMask(64, 128)}
|
||||||
}
|
}
|
||||||
|
@ -1,167 +0,0 @@
|
|||||||
package yggdrasil
|
|
||||||
|
|
||||||
/*
|
|
||||||
|
|
||||||
This part of the package wraps crypto operations needed elsewhere
|
|
||||||
|
|
||||||
In particular, it exposes key generation for ed25519 and nacl box
|
|
||||||
|
|
||||||
It also defines NodeID and TreeID as hashes of keys, and wraps hash functions
|
|
||||||
|
|
||||||
*/
|
|
||||||
|
|
||||||
import (
|
|
||||||
"crypto/rand"
|
|
||||||
"crypto/sha512"
|
|
||||||
|
|
||||||
"golang.org/x/crypto/ed25519"
|
|
||||||
"golang.org/x/crypto/nacl/box"
|
|
||||||
)
|
|
||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
|
||||||
|
|
||||||
// NodeID and TreeID
|
|
||||||
|
|
||||||
const NodeIDLen = sha512.Size
|
|
||||||
const TreeIDLen = sha512.Size
|
|
||||||
const handleLen = 8
|
|
||||||
|
|
||||||
type NodeID [NodeIDLen]byte
|
|
||||||
type TreeID [TreeIDLen]byte
|
|
||||||
type handle [handleLen]byte
|
|
||||||
|
|
||||||
func getNodeID(pub *boxPubKey) *NodeID {
|
|
||||||
h := sha512.Sum512(pub[:])
|
|
||||||
return (*NodeID)(&h)
|
|
||||||
}
|
|
||||||
|
|
||||||
func getTreeID(pub *sigPubKey) *TreeID {
|
|
||||||
h := sha512.Sum512(pub[:])
|
|
||||||
return (*TreeID)(&h)
|
|
||||||
}
|
|
||||||
|
|
||||||
func newHandle() *handle {
|
|
||||||
var h handle
|
|
||||||
_, err := rand.Read(h[:])
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
return &h
|
|
||||||
}
|
|
||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
|
||||||
|
|
||||||
// Signatures
|
|
||||||
|
|
||||||
const sigPubKeyLen = ed25519.PublicKeySize
|
|
||||||
const sigPrivKeyLen = ed25519.PrivateKeySize
|
|
||||||
const sigLen = ed25519.SignatureSize
|
|
||||||
|
|
||||||
type sigPubKey [sigPubKeyLen]byte
|
|
||||||
type sigPrivKey [sigPrivKeyLen]byte
|
|
||||||
type sigBytes [sigLen]byte
|
|
||||||
|
|
||||||
func newSigKeys() (*sigPubKey, *sigPrivKey) {
|
|
||||||
var pub sigPubKey
|
|
||||||
var priv sigPrivKey
|
|
||||||
pubSlice, privSlice, err := ed25519.GenerateKey(rand.Reader)
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
copy(pub[:], pubSlice)
|
|
||||||
copy(priv[:], privSlice)
|
|
||||||
return &pub, &priv
|
|
||||||
}
|
|
||||||
|
|
||||||
func sign(priv *sigPrivKey, msg []byte) *sigBytes {
|
|
||||||
var sig sigBytes
|
|
||||||
sigSlice := ed25519.Sign(priv[:], msg)
|
|
||||||
copy(sig[:], sigSlice)
|
|
||||||
return &sig
|
|
||||||
}
|
|
||||||
|
|
||||||
func verify(pub *sigPubKey, msg []byte, sig *sigBytes) bool {
|
|
||||||
// Should sig be an array instead of a slice?...
|
|
||||||
// It's fixed size, but
|
|
||||||
return ed25519.Verify(pub[:], msg, sig[:])
|
|
||||||
}
|
|
||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
|
||||||
|
|
||||||
// NaCl-like crypto "box" (curve25519+xsalsa20+poly1305)
|
|
||||||
|
|
||||||
const boxPubKeyLen = 32
|
|
||||||
const boxPrivKeyLen = 32
|
|
||||||
const boxSharedKeyLen = 32
|
|
||||||
const boxNonceLen = 24
|
|
||||||
const boxOverhead = box.Overhead
|
|
||||||
|
|
||||||
type boxPubKey [boxPubKeyLen]byte
|
|
||||||
type boxPrivKey [boxPrivKeyLen]byte
|
|
||||||
type boxSharedKey [boxSharedKeyLen]byte
|
|
||||||
type boxNonce [boxNonceLen]byte
|
|
||||||
|
|
||||||
func newBoxKeys() (*boxPubKey, *boxPrivKey) {
|
|
||||||
pubBytes, privBytes, err := box.GenerateKey(rand.Reader)
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
pub := (*boxPubKey)(pubBytes)
|
|
||||||
priv := (*boxPrivKey)(privBytes)
|
|
||||||
return pub, priv
|
|
||||||
}
|
|
||||||
|
|
||||||
func getSharedKey(myPrivKey *boxPrivKey,
|
|
||||||
othersPubKey *boxPubKey) *boxSharedKey {
|
|
||||||
var shared [boxSharedKeyLen]byte
|
|
||||||
priv := (*[boxPrivKeyLen]byte)(myPrivKey)
|
|
||||||
pub := (*[boxPubKeyLen]byte)(othersPubKey)
|
|
||||||
box.Precompute(&shared, pub, priv)
|
|
||||||
return (*boxSharedKey)(&shared)
|
|
||||||
}
|
|
||||||
|
|
||||||
func boxOpen(shared *boxSharedKey,
|
|
||||||
boxed []byte,
|
|
||||||
nonce *boxNonce) ([]byte, bool) {
|
|
||||||
out := util_getBytes()
|
|
||||||
s := (*[boxSharedKeyLen]byte)(shared)
|
|
||||||
n := (*[boxNonceLen]byte)(nonce)
|
|
||||||
unboxed, success := box.OpenAfterPrecomputation(out, boxed, n, s)
|
|
||||||
return unboxed, success
|
|
||||||
}
|
|
||||||
|
|
||||||
func boxSeal(shared *boxSharedKey, unboxed []byte, nonce *boxNonce) ([]byte, *boxNonce) {
|
|
||||||
if nonce == nil {
|
|
||||||
nonce = newBoxNonce()
|
|
||||||
}
|
|
||||||
nonce.update()
|
|
||||||
out := util_getBytes()
|
|
||||||
s := (*[boxSharedKeyLen]byte)(shared)
|
|
||||||
n := (*[boxNonceLen]byte)(nonce)
|
|
||||||
boxed := box.SealAfterPrecomputation(out, unboxed, n, s)
|
|
||||||
return boxed, nonce
|
|
||||||
}
|
|
||||||
|
|
||||||
func newBoxNonce() *boxNonce {
|
|
||||||
var nonce boxNonce
|
|
||||||
_, err := rand.Read(nonce[:])
|
|
||||||
for ; err == nil && nonce[0] == 0xff; _, err = rand.Read(nonce[:]) {
|
|
||||||
// Make sure nonce isn't too high
|
|
||||||
// This is just to make rollover unlikely to happen
|
|
||||||
// Rollover is fine, but it may kill the session and force it to reopen
|
|
||||||
}
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
return &nonce
|
|
||||||
}
|
|
||||||
|
|
||||||
func (n *boxNonce) update() {
|
|
||||||
oldNonce := *n
|
|
||||||
n[len(n)-1] += 2
|
|
||||||
for i := len(n) - 2; i >= 0; i-- {
|
|
||||||
if n[i+1] < oldNonce[i+1] {
|
|
||||||
n[i] += 1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
@ -22,6 +22,8 @@ import "net/http"
|
|||||||
import "runtime"
|
import "runtime"
|
||||||
import "os"
|
import "os"
|
||||||
|
|
||||||
|
import "github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
import "github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
import "github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
import "github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
||||||
|
|
||||||
// Start the profiler in debug builds, if the required environment variable is set.
|
// Start the profiler in debug builds, if the required environment variable is set.
|
||||||
@ -48,8 +50,8 @@ func StartProfiler(log *log.Logger) error {
|
|||||||
// This function is only called by the simulator to set up a node with random
|
// This function is only called by the simulator to set up a node with random
|
||||||
// keys. It should not be used and may be removed in the future.
|
// keys. It should not be used and may be removed in the future.
|
||||||
func (c *Core) Init() {
|
func (c *Core) Init() {
|
||||||
bpub, bpriv := newBoxKeys()
|
bpub, bpriv := crypto.NewBoxKeys()
|
||||||
spub, spriv := newSigKeys()
|
spub, spriv := crypto.NewSigKeys()
|
||||||
c.init(bpub, bpriv, spub, spriv)
|
c.init(bpub, bpriv, spub, spriv)
|
||||||
c.switchTable.start()
|
c.switchTable.start()
|
||||||
c.router.start()
|
c.router.start()
|
||||||
@ -59,12 +61,12 @@ func (c *Core) Init() {
|
|||||||
|
|
||||||
// Core
|
// Core
|
||||||
|
|
||||||
func (c *Core) DEBUG_getSigningPublicKey() sigPubKey {
|
func (c *Core) DEBUG_getSigningPublicKey() crypto.SigPubKey {
|
||||||
return (sigPubKey)(c.sigPub)
|
return (crypto.SigPubKey)(c.sigPub)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_getEncryptionPublicKey() boxPubKey {
|
func (c *Core) DEBUG_getEncryptionPublicKey() crypto.BoxPubKey {
|
||||||
return (boxPubKey)(c.boxPub)
|
return (crypto.BoxPubKey)(c.boxPub)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_getSend() chan<- []byte {
|
func (c *Core) DEBUG_getSend() chan<- []byte {
|
||||||
@ -81,7 +83,7 @@ func (c *Core) DEBUG_getPeers() *peers {
|
|||||||
return &c.peers
|
return &c.peers
|
||||||
}
|
}
|
||||||
|
|
||||||
func (ps *peers) DEBUG_newPeer(box boxPubKey, sig sigPubKey, link boxSharedKey) *peer {
|
func (ps *peers) DEBUG_newPeer(box crypto.BoxPubKey, sig crypto.SigPubKey, link crypto.BoxSharedKey) *peer {
|
||||||
//in <-chan []byte,
|
//in <-chan []byte,
|
||||||
//out chan<- []byte) *peer {
|
//out chan<- []byte) *peer {
|
||||||
return ps.newPeer(&box, &sig, &link, "(simulator)") //, in, out)
|
return ps.newPeer(&box, &sig, &link, "(simulator)") //, in, out)
|
||||||
@ -98,7 +100,7 @@ func (ps *peers) DEBUG_startPeers() {
|
|||||||
}
|
}
|
||||||
*/
|
*/
|
||||||
|
|
||||||
func (ps *peers) DEBUG_hasPeer(key sigPubKey) bool {
|
func (ps *peers) DEBUG_hasPeer(key crypto.SigPubKey) bool {
|
||||||
ports := ps.ports.Load().(map[switchPort]*peer)
|
ports := ps.ports.Load().(map[switchPort]*peer)
|
||||||
for _, p := range ports {
|
for _, p := range ports {
|
||||||
if p == nil {
|
if p == nil {
|
||||||
@ -120,7 +122,7 @@ func (ps *peers) DEBUG_getPorts() map[switchPort]*peer {
|
|||||||
return newPeers
|
return newPeers
|
||||||
}
|
}
|
||||||
|
|
||||||
func (p *peer) DEBUG_getSigKey() sigPubKey {
|
func (p *peer) DEBUG_getSigKey() crypto.SigPubKey {
|
||||||
return p.sig
|
return p.sig
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -292,8 +294,8 @@ func (c *Core) DEBUG_startLoopbackUDPInterface() {
|
|||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
func (c *Core) DEBUG_getAddr() *address {
|
func (c *Core) DEBUG_getAddr() *address.Address {
|
||||||
return address_addrForNodeID(&c.dht.nodeID)
|
return address.AddrForNodeID(&c.dht.nodeID)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_startTun(ifname string, iftapmode bool) {
|
func (c *Core) DEBUG_startTun(ifname string, iftapmode bool) {
|
||||||
@ -302,7 +304,7 @@ func (c *Core) DEBUG_startTun(ifname string, iftapmode bool) {
|
|||||||
|
|
||||||
func (c *Core) DEBUG_startTunWithMTU(ifname string, iftapmode bool, mtu int) {
|
func (c *Core) DEBUG_startTunWithMTU(ifname string, iftapmode bool, mtu int) {
|
||||||
addr := c.DEBUG_getAddr()
|
addr := c.DEBUG_getAddr()
|
||||||
straddr := fmt.Sprintf("%s/%v", net.IP(addr[:]).String(), 8*len(address_prefix))
|
straddr := fmt.Sprintf("%s/%v", net.IP(addr[:]).String(), 8*len(address.GetPrefix()))
|
||||||
if ifname != "none" {
|
if ifname != "none" {
|
||||||
err := c.router.tun.setup(ifname, iftapmode, straddr, mtu)
|
err := c.router.tun.setup(ifname, iftapmode, straddr, mtu)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -320,38 +322,38 @@ func (c *Core) DEBUG_stopTun() {
|
|||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
func (c *Core) DEBUG_newBoxKeys() (*boxPubKey, *boxPrivKey) {
|
func (c *Core) DEBUG_newBoxKeys() (*crypto.BoxPubKey, *crypto.BoxPrivKey) {
|
||||||
return newBoxKeys()
|
return crypto.NewBoxKeys()
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_getSharedKey(myPrivKey *boxPrivKey, othersPubKey *boxPubKey) *boxSharedKey {
|
func (c *Core) DEBUG_getSharedKey(myPrivKey *crypto.BoxPrivKey, othersPubKey *crypto.BoxPubKey) *crypto.BoxSharedKey {
|
||||||
return getSharedKey(myPrivKey, othersPubKey)
|
return crypto.GetSharedKey(myPrivKey, othersPubKey)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_newSigKeys() (*sigPubKey, *sigPrivKey) {
|
func (c *Core) DEBUG_newSigKeys() (*crypto.SigPubKey, *crypto.SigPrivKey) {
|
||||||
return newSigKeys()
|
return crypto.NewSigKeys()
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_getNodeID(pub *boxPubKey) *NodeID {
|
func (c *Core) DEBUG_getNodeID(pub *crypto.BoxPubKey) *crypto.NodeID {
|
||||||
return getNodeID(pub)
|
return crypto.GetNodeID(pub)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_getTreeID(pub *sigPubKey) *TreeID {
|
func (c *Core) DEBUG_getTreeID(pub *crypto.SigPubKey) *crypto.TreeID {
|
||||||
return getTreeID(pub)
|
return crypto.GetTreeID(pub)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_addrForNodeID(nodeID *NodeID) string {
|
func (c *Core) DEBUG_addrForNodeID(nodeID *crypto.NodeID) string {
|
||||||
return net.IP(address_addrForNodeID(nodeID)[:]).String()
|
return net.IP(address.AddrForNodeID(nodeID)[:]).String()
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *Core) DEBUG_init(bpub []byte,
|
func (c *Core) DEBUG_init(bpub []byte,
|
||||||
bpriv []byte,
|
bpriv []byte,
|
||||||
spub []byte,
|
spub []byte,
|
||||||
spriv []byte) {
|
spriv []byte) {
|
||||||
var boxPub boxPubKey
|
var boxPub crypto.BoxPubKey
|
||||||
var boxPriv boxPrivKey
|
var boxPriv crypto.BoxPrivKey
|
||||||
var sigPub sigPubKey
|
var sigPub crypto.SigPubKey
|
||||||
var sigPriv sigPrivKey
|
var sigPriv crypto.SigPrivKey
|
||||||
copy(boxPub[:], bpub)
|
copy(boxPub[:], bpub)
|
||||||
copy(boxPriv[:], bpriv)
|
copy(boxPriv[:], bpriv)
|
||||||
copy(sigPub[:], spub)
|
copy(sigPub[:], spub)
|
||||||
@ -553,13 +555,13 @@ func (c *Core) DEBUG_simFixMTU() {
|
|||||||
|
|
||||||
func Util_testAddrIDMask() {
|
func Util_testAddrIDMask() {
|
||||||
for idx := 0; idx < 16; idx++ {
|
for idx := 0; idx < 16; idx++ {
|
||||||
var orig NodeID
|
var orig crypto.NodeID
|
||||||
orig[8] = 42
|
orig[8] = 42
|
||||||
for bidx := 0; bidx < idx; bidx++ {
|
for bidx := 0; bidx < idx; bidx++ {
|
||||||
orig[bidx/8] |= (0x80 >> uint8(bidx%8))
|
orig[bidx/8] |= (0x80 >> uint8(bidx%8))
|
||||||
}
|
}
|
||||||
addr := address_addrForNodeID(&orig)
|
addr := address.AddrForNodeID(&orig)
|
||||||
nid, mask := addr.getNodeIDandMask()
|
nid, mask := addr.GetNodeIDandMask()
|
||||||
for b := 0; b < len(mask); b++ {
|
for b := 0; b < len(mask); b++ {
|
||||||
nid[b] &= mask[b]
|
nid[b] &= mask[b]
|
||||||
orig[b] &= mask[b]
|
orig[b] &= mask[b]
|
||||||
|
@ -8,6 +8,8 @@ package yggdrasil
|
|||||||
import (
|
import (
|
||||||
"sort"
|
"sort"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
)
|
)
|
||||||
|
|
||||||
const dht_lookup_size = 16
|
const dht_lookup_size = 16
|
||||||
@ -15,8 +17,8 @@ const dht_lookup_size = 16
|
|||||||
// dhtInfo represents everything we know about a node in the DHT.
|
// dhtInfo represents everything we know about a node in the DHT.
|
||||||
// This includes its key, a cache of it's NodeID, coords, and timing/ping related info for deciding who/when to ping nodes for maintenance.
|
// This includes its key, a cache of it's NodeID, coords, and timing/ping related info for deciding who/when to ping nodes for maintenance.
|
||||||
type dhtInfo struct {
|
type dhtInfo struct {
|
||||||
nodeID_hidden *NodeID
|
nodeID_hidden *crypto.NodeID
|
||||||
key boxPubKey
|
key crypto.BoxPubKey
|
||||||
coords []byte
|
coords []byte
|
||||||
recv time.Time // When we last received a message
|
recv time.Time // When we last received a message
|
||||||
pings int // Time out if at least 3 consecutive maintenance pings drop
|
pings int // Time out if at least 3 consecutive maintenance pings drop
|
||||||
@ -24,9 +26,9 @@ type dhtInfo struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Returns the *NodeID associated with dhtInfo.key, calculating it on the fly the first time or from a cache all subsequent times.
|
// Returns the *NodeID associated with dhtInfo.key, calculating it on the fly the first time or from a cache all subsequent times.
|
||||||
func (info *dhtInfo) getNodeID() *NodeID {
|
func (info *dhtInfo) getNodeID() *crypto.NodeID {
|
||||||
if info.nodeID_hidden == nil {
|
if info.nodeID_hidden == nil {
|
||||||
info.nodeID_hidden = getNodeID(&info.key)
|
info.nodeID_hidden = crypto.GetNodeID(&info.key)
|
||||||
}
|
}
|
||||||
return info.nodeID_hidden
|
return info.nodeID_hidden
|
||||||
}
|
}
|
||||||
@ -34,36 +36,36 @@ func (info *dhtInfo) getNodeID() *NodeID {
|
|||||||
// Request for a node to do a lookup.
|
// Request for a node to do a lookup.
|
||||||
// Includes our key and coords so they can send a response back, and the destination NodeID we want to ask about.
|
// Includes our key and coords so they can send a response back, and the destination NodeID we want to ask about.
|
||||||
type dhtReq struct {
|
type dhtReq struct {
|
||||||
Key boxPubKey // Key of whoever asked
|
Key crypto.BoxPubKey // Key of whoever asked
|
||||||
Coords []byte // Coords of whoever asked
|
Coords []byte // Coords of whoever asked
|
||||||
Dest NodeID // NodeID they're asking about
|
Dest crypto.NodeID // NodeID they're asking about
|
||||||
}
|
}
|
||||||
|
|
||||||
// Response to a DHT lookup.
|
// Response to a DHT lookup.
|
||||||
// Includes the key and coords of the node that's responding, and the destination they were asked about.
|
// Includes the key and coords of the node that's responding, and the destination they were asked about.
|
||||||
// The main part is Infos []*dhtInfo, the lookup response.
|
// The main part is Infos []*dhtInfo, the lookup response.
|
||||||
type dhtRes struct {
|
type dhtRes struct {
|
||||||
Key boxPubKey // key of the sender
|
Key crypto.BoxPubKey // key of the sender
|
||||||
Coords []byte // coords of the sender
|
Coords []byte // coords of the sender
|
||||||
Dest NodeID
|
Dest crypto.NodeID
|
||||||
Infos []*dhtInfo // response
|
Infos []*dhtInfo // response
|
||||||
}
|
}
|
||||||
|
|
||||||
// Parts of a DHT req usable as a key in a map.
|
// Parts of a DHT req usable as a key in a map.
|
||||||
type dhtReqKey struct {
|
type dhtReqKey struct {
|
||||||
key boxPubKey
|
key crypto.BoxPubKey
|
||||||
dest NodeID
|
dest crypto.NodeID
|
||||||
}
|
}
|
||||||
|
|
||||||
// The main DHT struct.
|
// The main DHT struct.
|
||||||
type dht struct {
|
type dht struct {
|
||||||
core *Core
|
core *Core
|
||||||
nodeID NodeID
|
nodeID crypto.NodeID
|
||||||
peers chan *dhtInfo // other goroutines put incoming dht updates here
|
peers chan *dhtInfo // other goroutines put incoming dht updates here
|
||||||
reqs map[dhtReqKey]time.Time // Keeps track of recent outstanding requests
|
reqs map[dhtReqKey]time.Time // Keeps track of recent outstanding requests
|
||||||
callbacks map[dhtReqKey]dht_callbackInfo // Search and admin lookup callbacks
|
callbacks map[dhtReqKey]dht_callbackInfo // Search and admin lookup callbacks
|
||||||
// These next two could be replaced by a single linked list or similar...
|
// These next two could be replaced by a single linked list or similar...
|
||||||
table map[NodeID]*dhtInfo
|
table map[crypto.NodeID]*dhtInfo
|
||||||
imp []*dhtInfo
|
imp []*dhtInfo
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -80,12 +82,12 @@ func (t *dht) init(c *Core) {
|
|||||||
// This empties all info from the DHT and drops outstanding requests.
|
// This empties all info from the DHT and drops outstanding requests.
|
||||||
func (t *dht) reset() {
|
func (t *dht) reset() {
|
||||||
t.reqs = make(map[dhtReqKey]time.Time)
|
t.reqs = make(map[dhtReqKey]time.Time)
|
||||||
t.table = make(map[NodeID]*dhtInfo)
|
t.table = make(map[crypto.NodeID]*dhtInfo)
|
||||||
t.imp = nil
|
t.imp = nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// Does a DHT lookup and returns up to dht_lookup_size results.
|
// Does a DHT lookup and returns up to dht_lookup_size results.
|
||||||
func (t *dht) lookup(nodeID *NodeID, everything bool) []*dhtInfo {
|
func (t *dht) lookup(nodeID *crypto.NodeID, everything bool) []*dhtInfo {
|
||||||
results := make([]*dhtInfo, 0, len(t.table))
|
results := make([]*dhtInfo, 0, len(t.table))
|
||||||
for _, info := range t.table {
|
for _, info := range t.table {
|
||||||
results = append(results, info)
|
results = append(results, info)
|
||||||
@ -133,9 +135,9 @@ func (t *dht) insert(info *dhtInfo) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Return true if first/second/third are (partially) ordered correctly.
|
// Return true if first/second/third are (partially) ordered correctly.
|
||||||
func dht_ordered(first, second, third *NodeID) bool {
|
func dht_ordered(first, second, third *crypto.NodeID) bool {
|
||||||
lessOrEqual := func(first, second *NodeID) bool {
|
lessOrEqual := func(first, second *crypto.NodeID) bool {
|
||||||
for idx := 0; idx < NodeIDLen; idx++ {
|
for idx := 0; idx < crypto.NodeIDLen; idx++ {
|
||||||
if first[idx] > second[idx] {
|
if first[idx] > second[idx] {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
@ -190,7 +192,7 @@ func (t *dht) sendRes(res *dhtRes, req *dhtReq) {
|
|||||||
// Send a reply for a dhtReq
|
// Send a reply for a dhtReq
|
||||||
bs := res.encode()
|
bs := res.encode()
|
||||||
shared := t.core.sessions.getSharedKey(&t.core.boxPriv, &req.Key)
|
shared := t.core.sessions.getSharedKey(&t.core.boxPriv, &req.Key)
|
||||||
payload, nonce := boxSeal(shared, bs, nil)
|
payload, nonce := crypto.BoxSeal(shared, bs, nil)
|
||||||
p := wire_protoTrafficPacket{
|
p := wire_protoTrafficPacket{
|
||||||
Coords: req.Coords,
|
Coords: req.Coords,
|
||||||
ToKey: req.Key,
|
ToKey: req.Key,
|
||||||
@ -252,7 +254,7 @@ func (t *dht) sendReq(req *dhtReq, dest *dhtInfo) {
|
|||||||
// Send a dhtReq to the node in dhtInfo
|
// Send a dhtReq to the node in dhtInfo
|
||||||
bs := req.encode()
|
bs := req.encode()
|
||||||
shared := t.core.sessions.getSharedKey(&t.core.boxPriv, &dest.key)
|
shared := t.core.sessions.getSharedKey(&t.core.boxPriv, &dest.key)
|
||||||
payload, nonce := boxSeal(shared, bs, nil)
|
payload, nonce := crypto.BoxSeal(shared, bs, nil)
|
||||||
p := wire_protoTrafficPacket{
|
p := wire_protoTrafficPacket{
|
||||||
Coords: dest.coords,
|
Coords: dest.coords,
|
||||||
ToKey: dest.key,
|
ToKey: dest.key,
|
||||||
@ -267,7 +269,7 @@ func (t *dht) sendReq(req *dhtReq, dest *dhtInfo) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Sends a lookup to this info, looking for the target.
|
// Sends a lookup to this info, looking for the target.
|
||||||
func (t *dht) ping(info *dhtInfo, target *NodeID) {
|
func (t *dht) ping(info *dhtInfo, target *crypto.NodeID) {
|
||||||
// Creates a req for the node at dhtInfo, asking them about the target (if one is given) or themself (if no target is given)
|
// Creates a req for the node at dhtInfo, asking them about the target (if one is given) or themself (if no target is given)
|
||||||
if target == nil {
|
if target == nil {
|
||||||
target = &t.nodeID
|
target = &t.nodeID
|
||||||
|
@ -17,6 +17,8 @@ import (
|
|||||||
|
|
||||||
"golang.org/x/net/icmp"
|
"golang.org/x/net/icmp"
|
||||||
"golang.org/x/net/ipv6"
|
"golang.org/x/net/ipv6"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
)
|
)
|
||||||
|
|
||||||
type macAddress [6]byte
|
type macAddress [6]byte
|
||||||
@ -27,7 +29,7 @@ type icmpv6 struct {
|
|||||||
tun *tunAdapter
|
tun *tunAdapter
|
||||||
mylladdr net.IP
|
mylladdr net.IP
|
||||||
mymac macAddress
|
mymac macAddress
|
||||||
peermacs map[address]neighbor
|
peermacs map[address.Address]neighbor
|
||||||
}
|
}
|
||||||
|
|
||||||
type neighbor struct {
|
type neighbor struct {
|
||||||
@ -59,7 +61,7 @@ func ipv6Header_Marshal(h *ipv6.Header) ([]byte, error) {
|
|||||||
// addresses.
|
// addresses.
|
||||||
func (i *icmpv6) init(t *tunAdapter) {
|
func (i *icmpv6) init(t *tunAdapter) {
|
||||||
i.tun = t
|
i.tun = t
|
||||||
i.peermacs = make(map[address]neighbor)
|
i.peermacs = make(map[address.Address]neighbor)
|
||||||
|
|
||||||
// Our MAC address and link-local address
|
// Our MAC address and link-local address
|
||||||
i.mymac = macAddress{
|
i.mymac = macAddress{
|
||||||
@ -172,7 +174,7 @@ func (i *icmpv6) parse_packet_tun(datain []byte, datamac *[]byte) ([]byte, error
|
|||||||
}
|
}
|
||||||
case ipv6.ICMPTypeNeighborAdvertisement:
|
case ipv6.ICMPTypeNeighborAdvertisement:
|
||||||
if datamac != nil {
|
if datamac != nil {
|
||||||
var addr address
|
var addr address.Address
|
||||||
var mac macAddress
|
var mac macAddress
|
||||||
copy(addr[:], ipv6Header.Src[:])
|
copy(addr[:], ipv6Header.Src[:])
|
||||||
copy(mac[:], (*datamac)[:])
|
copy(mac[:], (*datamac)[:])
|
||||||
@ -254,7 +256,7 @@ func (i *icmpv6) create_icmpv6_tun(dst net.IP, src net.IP, mtype ipv6.ICMPType,
|
|||||||
return responsePacket, nil
|
return responsePacket, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (i *icmpv6) create_ndp_tap(dst address) ([]byte, error) {
|
func (i *icmpv6) create_ndp_tap(dst address.Address) ([]byte, error) {
|
||||||
// Create the ND payload
|
// Create the ND payload
|
||||||
var payload [28]byte
|
var payload [28]byte
|
||||||
copy(payload[:4], []byte{0x00, 0x00, 0x00, 0x00})
|
copy(payload[:4], []byte{0x00, 0x00, 0x00, 0x00})
|
||||||
@ -263,7 +265,7 @@ func (i *icmpv6) create_ndp_tap(dst address) ([]byte, error) {
|
|||||||
copy(payload[22:28], i.mymac[:6])
|
copy(payload[22:28], i.mymac[:6])
|
||||||
|
|
||||||
// Create the ICMPv6 solicited-node address
|
// Create the ICMPv6 solicited-node address
|
||||||
var dstaddr address
|
var dstaddr address.Address
|
||||||
copy(dstaddr[:13], []byte{
|
copy(dstaddr[:13], []byte{
|
||||||
0xFF, 0x02, 0x00, 0x00,
|
0xFF, 0x02, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x00, 0x00,
|
||||||
@ -296,13 +298,13 @@ func (i *icmpv6) create_ndp_tap(dst address) ([]byte, error) {
|
|||||||
// to the Yggdrasil TAP adapter.
|
// to the Yggdrasil TAP adapter.
|
||||||
func (i *icmpv6) handle_ndp(in []byte) ([]byte, error) {
|
func (i *icmpv6) handle_ndp(in []byte) ([]byte, error) {
|
||||||
// Ignore NDP requests for anything outside of fd00::/8
|
// Ignore NDP requests for anything outside of fd00::/8
|
||||||
var source address
|
var source address.Address
|
||||||
copy(source[:], in[8:])
|
copy(source[:], in[8:])
|
||||||
var snet subnet
|
var snet address.Subnet
|
||||||
copy(snet[:], in[8:])
|
copy(snet[:], in[8:])
|
||||||
switch {
|
switch {
|
||||||
case source.isValid():
|
case source.IsValid():
|
||||||
case snet.isValid():
|
case snet.IsValid():
|
||||||
default:
|
default:
|
||||||
return nil, errors.New("Not an NDP for 0200::/7")
|
return nil, errors.New("Not an NDP for 0200::/7")
|
||||||
}
|
}
|
||||||
|
@ -6,15 +6,17 @@ import (
|
|||||||
"runtime"
|
"runtime"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
)
|
)
|
||||||
|
|
||||||
type nodeinfo struct {
|
type nodeinfo struct {
|
||||||
core *Core
|
core *Core
|
||||||
myNodeInfo nodeinfoPayload
|
myNodeInfo nodeinfoPayload
|
||||||
myNodeInfoMutex sync.RWMutex
|
myNodeInfoMutex sync.RWMutex
|
||||||
callbacks map[boxPubKey]nodeinfoCallback
|
callbacks map[crypto.BoxPubKey]nodeinfoCallback
|
||||||
callbacksMutex sync.Mutex
|
callbacksMutex sync.Mutex
|
||||||
cache map[boxPubKey]nodeinfoCached
|
cache map[crypto.BoxPubKey]nodeinfoCached
|
||||||
cacheMutex sync.RWMutex
|
cacheMutex sync.RWMutex
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -32,8 +34,8 @@ type nodeinfoCallback struct {
|
|||||||
|
|
||||||
// Represents a session nodeinfo packet.
|
// Represents a session nodeinfo packet.
|
||||||
type nodeinfoReqRes struct {
|
type nodeinfoReqRes struct {
|
||||||
SendPermPub boxPubKey // Sender's permanent key
|
SendPermPub crypto.BoxPubKey // Sender's permanent key
|
||||||
SendCoords []byte // Sender's coords
|
SendCoords []byte // Sender's coords
|
||||||
IsResponse bool
|
IsResponse bool
|
||||||
NodeInfo nodeinfoPayload
|
NodeInfo nodeinfoPayload
|
||||||
}
|
}
|
||||||
@ -42,8 +44,8 @@ type nodeinfoReqRes struct {
|
|||||||
// the cache/callback maps clean of stale entries
|
// the cache/callback maps clean of stale entries
|
||||||
func (m *nodeinfo) init(core *Core) {
|
func (m *nodeinfo) init(core *Core) {
|
||||||
m.core = core
|
m.core = core
|
||||||
m.callbacks = make(map[boxPubKey]nodeinfoCallback)
|
m.callbacks = make(map[crypto.BoxPubKey]nodeinfoCallback)
|
||||||
m.cache = make(map[boxPubKey]nodeinfoCached)
|
m.cache = make(map[crypto.BoxPubKey]nodeinfoCached)
|
||||||
|
|
||||||
go func() {
|
go func() {
|
||||||
for {
|
for {
|
||||||
@ -67,7 +69,7 @@ func (m *nodeinfo) init(core *Core) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Add a callback for a nodeinfo lookup
|
// Add a callback for a nodeinfo lookup
|
||||||
func (m *nodeinfo) addCallback(sender boxPubKey, call func(nodeinfo *nodeinfoPayload)) {
|
func (m *nodeinfo) addCallback(sender crypto.BoxPubKey, call func(nodeinfo *nodeinfoPayload)) {
|
||||||
m.callbacksMutex.Lock()
|
m.callbacksMutex.Lock()
|
||||||
defer m.callbacksMutex.Unlock()
|
defer m.callbacksMutex.Unlock()
|
||||||
m.callbacks[sender] = nodeinfoCallback{
|
m.callbacks[sender] = nodeinfoCallback{
|
||||||
@ -77,7 +79,7 @@ func (m *nodeinfo) addCallback(sender boxPubKey, call func(nodeinfo *nodeinfoPay
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Handles the callback, if there is one
|
// Handles the callback, if there is one
|
||||||
func (m *nodeinfo) callback(sender boxPubKey, nodeinfo nodeinfoPayload) {
|
func (m *nodeinfo) callback(sender crypto.BoxPubKey, nodeinfo nodeinfoPayload) {
|
||||||
m.callbacksMutex.Lock()
|
m.callbacksMutex.Lock()
|
||||||
defer m.callbacksMutex.Unlock()
|
defer m.callbacksMutex.Unlock()
|
||||||
if callback, ok := m.callbacks[sender]; ok {
|
if callback, ok := m.callbacks[sender]; ok {
|
||||||
@ -123,7 +125,7 @@ func (m *nodeinfo) setNodeInfo(given interface{}) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Add nodeinfo into the cache for a node
|
// Add nodeinfo into the cache for a node
|
||||||
func (m *nodeinfo) addCachedNodeInfo(key boxPubKey, payload nodeinfoPayload) {
|
func (m *nodeinfo) addCachedNodeInfo(key crypto.BoxPubKey, payload nodeinfoPayload) {
|
||||||
m.cacheMutex.Lock()
|
m.cacheMutex.Lock()
|
||||||
defer m.cacheMutex.Unlock()
|
defer m.cacheMutex.Unlock()
|
||||||
m.cache[key] = nodeinfoCached{
|
m.cache[key] = nodeinfoCached{
|
||||||
@ -133,7 +135,7 @@ func (m *nodeinfo) addCachedNodeInfo(key boxPubKey, payload nodeinfoPayload) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Get a nodeinfo entry from the cache
|
// Get a nodeinfo entry from the cache
|
||||||
func (m *nodeinfo) getCachedNodeInfo(key boxPubKey) (nodeinfoPayload, error) {
|
func (m *nodeinfo) getCachedNodeInfo(key crypto.BoxPubKey) (nodeinfoPayload, error) {
|
||||||
m.cacheMutex.RLock()
|
m.cacheMutex.RLock()
|
||||||
defer m.cacheMutex.RUnlock()
|
defer m.cacheMutex.RUnlock()
|
||||||
if nodeinfo, ok := m.cache[key]; ok {
|
if nodeinfo, ok := m.cache[key]; ok {
|
||||||
@ -153,7 +155,7 @@ func (m *nodeinfo) handleNodeInfo(nodeinfo *nodeinfoReqRes) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Send nodeinfo request or response - called from the router
|
// Send nodeinfo request or response - called from the router
|
||||||
func (m *nodeinfo) sendNodeInfo(key boxPubKey, coords []byte, isResponse bool) {
|
func (m *nodeinfo) sendNodeInfo(key crypto.BoxPubKey, coords []byte, isResponse bool) {
|
||||||
table := m.core.switchTable.table.Load().(lookupTable)
|
table := m.core.switchTable.table.Load().(lookupTable)
|
||||||
nodeinfo := nodeinfoReqRes{
|
nodeinfo := nodeinfoReqRes{
|
||||||
SendCoords: table.self.getCoords(),
|
SendCoords: table.self.getCoords(),
|
||||||
@ -162,7 +164,7 @@ func (m *nodeinfo) sendNodeInfo(key boxPubKey, coords []byte, isResponse bool) {
|
|||||||
}
|
}
|
||||||
bs := nodeinfo.encode()
|
bs := nodeinfo.encode()
|
||||||
shared := m.core.sessions.getSharedKey(&m.core.boxPriv, &key)
|
shared := m.core.sessions.getSharedKey(&m.core.boxPriv, &key)
|
||||||
payload, nonce := boxSeal(shared, bs, nil)
|
payload, nonce := crypto.BoxSeal(shared, bs, nil)
|
||||||
p := wire_protoTrafficPacket{
|
p := wire_protoTrafficPacket{
|
||||||
Coords: coords,
|
Coords: coords,
|
||||||
ToKey: key,
|
ToKey: key,
|
||||||
|
@ -8,6 +8,9 @@ import (
|
|||||||
"sync"
|
"sync"
|
||||||
"sync/atomic"
|
"sync/atomic"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
// The peers struct represents peers with an active connection.
|
// The peers struct represents peers with an active connection.
|
||||||
@ -19,7 +22,7 @@ type peers struct {
|
|||||||
mutex sync.Mutex // Synchronize writes to atomic
|
mutex sync.Mutex // Synchronize writes to atomic
|
||||||
ports atomic.Value //map[switchPort]*peer, use CoW semantics
|
ports atomic.Value //map[switchPort]*peer, use CoW semantics
|
||||||
authMutex sync.RWMutex
|
authMutex sync.RWMutex
|
||||||
allowedEncryptionPublicKeys map[boxPubKey]struct{}
|
allowedEncryptionPublicKeys map[crypto.BoxPubKey]struct{}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Initializes the peers struct.
|
// Initializes the peers struct.
|
||||||
@ -28,11 +31,11 @@ func (ps *peers) init(c *Core) {
|
|||||||
defer ps.mutex.Unlock()
|
defer ps.mutex.Unlock()
|
||||||
ps.putPorts(make(map[switchPort]*peer))
|
ps.putPorts(make(map[switchPort]*peer))
|
||||||
ps.core = c
|
ps.core = c
|
||||||
ps.allowedEncryptionPublicKeys = make(map[boxPubKey]struct{})
|
ps.allowedEncryptionPublicKeys = make(map[crypto.BoxPubKey]struct{})
|
||||||
}
|
}
|
||||||
|
|
||||||
// Returns true if an incoming peer connection to a key is allowed, either because the key is in the whitelist or because the whitelist is empty.
|
// Returns true if an incoming peer connection to a key is allowed, either because the key is in the whitelist or because the whitelist is empty.
|
||||||
func (ps *peers) isAllowedEncryptionPublicKey(box *boxPubKey) bool {
|
func (ps *peers) isAllowedEncryptionPublicKey(box *crypto.BoxPubKey) bool {
|
||||||
ps.authMutex.RLock()
|
ps.authMutex.RLock()
|
||||||
defer ps.authMutex.RUnlock()
|
defer ps.authMutex.RUnlock()
|
||||||
_, isIn := ps.allowedEncryptionPublicKeys[*box]
|
_, isIn := ps.allowedEncryptionPublicKeys[*box]
|
||||||
@ -40,24 +43,24 @@ func (ps *peers) isAllowedEncryptionPublicKey(box *boxPubKey) bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Adds a key to the whitelist.
|
// Adds a key to the whitelist.
|
||||||
func (ps *peers) addAllowedEncryptionPublicKey(box *boxPubKey) {
|
func (ps *peers) addAllowedEncryptionPublicKey(box *crypto.BoxPubKey) {
|
||||||
ps.authMutex.Lock()
|
ps.authMutex.Lock()
|
||||||
defer ps.authMutex.Unlock()
|
defer ps.authMutex.Unlock()
|
||||||
ps.allowedEncryptionPublicKeys[*box] = struct{}{}
|
ps.allowedEncryptionPublicKeys[*box] = struct{}{}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Removes a key from the whitelist.
|
// Removes a key from the whitelist.
|
||||||
func (ps *peers) removeAllowedEncryptionPublicKey(box *boxPubKey) {
|
func (ps *peers) removeAllowedEncryptionPublicKey(box *crypto.BoxPubKey) {
|
||||||
ps.authMutex.Lock()
|
ps.authMutex.Lock()
|
||||||
defer ps.authMutex.Unlock()
|
defer ps.authMutex.Unlock()
|
||||||
delete(ps.allowedEncryptionPublicKeys, *box)
|
delete(ps.allowedEncryptionPublicKeys, *box)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the whitelist of allowed keys for incoming connections.
|
// Gets the whitelist of allowed keys for incoming connections.
|
||||||
func (ps *peers) getAllowedEncryptionPublicKeys() []boxPubKey {
|
func (ps *peers) getAllowedEncryptionPublicKeys() []crypto.BoxPubKey {
|
||||||
ps.authMutex.RLock()
|
ps.authMutex.RLock()
|
||||||
defer ps.authMutex.RUnlock()
|
defer ps.authMutex.RUnlock()
|
||||||
keys := make([]boxPubKey, 0, len(ps.allowedEncryptionPublicKeys))
|
keys := make([]crypto.BoxPubKey, 0, len(ps.allowedEncryptionPublicKeys))
|
||||||
for key := range ps.allowedEncryptionPublicKeys {
|
for key := range ps.allowedEncryptionPublicKeys {
|
||||||
keys = append(keys, key)
|
keys = append(keys, key)
|
||||||
}
|
}
|
||||||
@ -81,10 +84,10 @@ type peer struct {
|
|||||||
// BUG: sync/atomic, 32 bit platforms need the above to be the first element
|
// BUG: sync/atomic, 32 bit platforms need the above to be the first element
|
||||||
core *Core
|
core *Core
|
||||||
port switchPort
|
port switchPort
|
||||||
box boxPubKey
|
box crypto.BoxPubKey
|
||||||
sig sigPubKey
|
sig crypto.SigPubKey
|
||||||
shared boxSharedKey
|
shared crypto.BoxSharedKey
|
||||||
linkShared boxSharedKey
|
linkShared crypto.BoxSharedKey
|
||||||
endpoint string
|
endpoint string
|
||||||
firstSeen time.Time // To track uptime for getPeers
|
firstSeen time.Time // To track uptime for getPeers
|
||||||
linkOut (chan []byte) // used for protocol traffic (to bypass queues)
|
linkOut (chan []byte) // used for protocol traffic (to bypass queues)
|
||||||
@ -95,11 +98,11 @@ type peer struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Creates a new peer with the specified box, sig, and linkShared keys, using the lowest unocupied port number.
|
// Creates a new peer with the specified box, sig, and linkShared keys, using the lowest unocupied port number.
|
||||||
func (ps *peers) newPeer(box *boxPubKey, sig *sigPubKey, linkShared *boxSharedKey, endpoint string) *peer {
|
func (ps *peers) newPeer(box *crypto.BoxPubKey, sig *crypto.SigPubKey, linkShared *crypto.BoxSharedKey, endpoint string) *peer {
|
||||||
now := time.Now()
|
now := time.Now()
|
||||||
p := peer{box: *box,
|
p := peer{box: *box,
|
||||||
sig: *sig,
|
sig: *sig,
|
||||||
shared: *getSharedKey(&ps.core.boxPriv, box),
|
shared: *crypto.GetSharedKey(&ps.core.boxPriv, box),
|
||||||
linkShared: *linkShared,
|
linkShared: *linkShared,
|
||||||
endpoint: endpoint,
|
endpoint: endpoint,
|
||||||
firstSeen: now,
|
firstSeen: now,
|
||||||
@ -212,7 +215,7 @@ func (p *peer) handlePacket(packet []byte) {
|
|||||||
case wire_LinkProtocolTraffic:
|
case wire_LinkProtocolTraffic:
|
||||||
p.handleLinkTraffic(packet)
|
p.handleLinkTraffic(packet)
|
||||||
default:
|
default:
|
||||||
util_putBytes(packet)
|
util.PutBytes(packet)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -237,13 +240,13 @@ func (p *peer) sendPacket(packet []byte) {
|
|||||||
// This wraps the packet in the inner (ephemeral) and outer (permanent) crypto layers.
|
// This wraps the packet in the inner (ephemeral) and outer (permanent) crypto layers.
|
||||||
// It sends it to p.linkOut, which bypasses the usual packet queues.
|
// It sends it to p.linkOut, which bypasses the usual packet queues.
|
||||||
func (p *peer) sendLinkPacket(packet []byte) {
|
func (p *peer) sendLinkPacket(packet []byte) {
|
||||||
innerPayload, innerNonce := boxSeal(&p.linkShared, packet, nil)
|
innerPayload, innerNonce := crypto.BoxSeal(&p.linkShared, packet, nil)
|
||||||
innerLinkPacket := wire_linkProtoTrafficPacket{
|
innerLinkPacket := wire_linkProtoTrafficPacket{
|
||||||
Nonce: *innerNonce,
|
Nonce: *innerNonce,
|
||||||
Payload: innerPayload,
|
Payload: innerPayload,
|
||||||
}
|
}
|
||||||
outerPayload := innerLinkPacket.encode()
|
outerPayload := innerLinkPacket.encode()
|
||||||
bs, nonce := boxSeal(&p.shared, outerPayload, nil)
|
bs, nonce := crypto.BoxSeal(&p.shared, outerPayload, nil)
|
||||||
linkPacket := wire_linkProtoTrafficPacket{
|
linkPacket := wire_linkProtoTrafficPacket{
|
||||||
Nonce: *nonce,
|
Nonce: *nonce,
|
||||||
Payload: bs,
|
Payload: bs,
|
||||||
@ -259,7 +262,7 @@ func (p *peer) handleLinkTraffic(bs []byte) {
|
|||||||
if !packet.decode(bs) {
|
if !packet.decode(bs) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
outerPayload, isOK := boxOpen(&p.shared, packet.Payload, &packet.Nonce)
|
outerPayload, isOK := crypto.BoxOpen(&p.shared, packet.Payload, &packet.Nonce)
|
||||||
if !isOK {
|
if !isOK {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
@ -267,7 +270,7 @@ func (p *peer) handleLinkTraffic(bs []byte) {
|
|||||||
if !innerPacket.decode(outerPayload) {
|
if !innerPacket.decode(outerPayload) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
payload, isOK := boxOpen(&p.linkShared, innerPacket.Payload, &innerPacket.Nonce)
|
payload, isOK := crypto.BoxOpen(&p.linkShared, innerPacket.Payload, &innerPacket.Nonce)
|
||||||
if !isOK {
|
if !isOK {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
@ -279,7 +282,7 @@ func (p *peer) handleLinkTraffic(bs []byte) {
|
|||||||
case wire_SwitchMsg:
|
case wire_SwitchMsg:
|
||||||
p.handleSwitchMsg(payload)
|
p.handleSwitchMsg(payload)
|
||||||
default:
|
default:
|
||||||
util_putBytes(bs)
|
util.PutBytes(bs)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -293,7 +296,7 @@ func (p *peer) sendSwitchMsg() {
|
|||||||
msg.Hops = append(msg.Hops, switchMsgHop{
|
msg.Hops = append(msg.Hops, switchMsgHop{
|
||||||
Port: p.port,
|
Port: p.port,
|
||||||
Next: p.sig,
|
Next: p.sig,
|
||||||
Sig: *sign(&p.core.sigPriv, bs),
|
Sig: *crypto.Sign(&p.core.sigPriv, bs),
|
||||||
})
|
})
|
||||||
packet := msg.encode()
|
packet := msg.encode()
|
||||||
p.sendLinkPacket(packet)
|
p.sendLinkPacket(packet)
|
||||||
@ -317,7 +320,7 @@ func (p *peer) handleSwitchMsg(packet []byte) {
|
|||||||
sigMsg.Hops = msg.Hops[:idx]
|
sigMsg.Hops = msg.Hops[:idx]
|
||||||
loc.coords = append(loc.coords, hop.Port)
|
loc.coords = append(loc.coords, hop.Port)
|
||||||
bs := getBytesForSig(&hop.Next, &sigMsg)
|
bs := getBytesForSig(&hop.Next, &sigMsg)
|
||||||
if !verify(&prevKey, bs, &hop.Sig) {
|
if !crypto.Verify(&prevKey, bs, &hop.Sig) {
|
||||||
p.core.peers.removePeer(p.port)
|
p.core.peers.removePeer(p.port)
|
||||||
}
|
}
|
||||||
prevKey = hop.Next
|
prevKey = hop.Next
|
||||||
@ -339,7 +342,7 @@ func (p *peer) handleSwitchMsg(packet []byte) {
|
|||||||
|
|
||||||
// This generates the bytes that we sign or check the signature of for a switchMsg.
|
// This generates the bytes that we sign or check the signature of for a switchMsg.
|
||||||
// It begins with the next node's key, followed by the root and the timetsamp, followed by coords being advertised to the next node.
|
// It begins with the next node's key, followed by the root and the timetsamp, followed by coords being advertised to the next node.
|
||||||
func getBytesForSig(next *sigPubKey, msg *switchMsg) []byte {
|
func getBytesForSig(next *crypto.SigPubKey, msg *switchMsg) []byte {
|
||||||
var loc switchLocator
|
var loc switchLocator
|
||||||
for _, hop := range msg.Hops {
|
for _, hop := range msg.Hops {
|
||||||
loc.coords = append(loc.coords, hop.Port)
|
loc.coords = append(loc.coords, hop.Port)
|
||||||
|
@ -28,14 +28,18 @@ import (
|
|||||||
|
|
||||||
"golang.org/x/net/icmp"
|
"golang.org/x/net/icmp"
|
||||||
"golang.org/x/net/ipv6"
|
"golang.org/x/net/ipv6"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
// The router struct has channels to/from the tun/tap device and a self peer (0), which is how messages are passed between this node and the peers/switch layer.
|
// The router struct has channels to/from the tun/tap device and a self peer (0), which is how messages are passed between this node and the peers/switch layer.
|
||||||
// The router's mainLoop goroutine is responsible for managing all information related to the dht, searches, and crypto sessions.
|
// The router's mainLoop goroutine is responsible for managing all information related to the dht, searches, and crypto sessions.
|
||||||
type router struct {
|
type router struct {
|
||||||
core *Core
|
core *Core
|
||||||
addr address
|
addr address.Address
|
||||||
subnet subnet
|
subnet address.Subnet
|
||||||
in <-chan []byte // packets we received from the network, link to peer's "out"
|
in <-chan []byte // packets we received from the network, link to peer's "out"
|
||||||
out func([]byte) // packets we're sending to the network, link to peer's "in"
|
out func([]byte) // packets we're sending to the network, link to peer's "in"
|
||||||
toRecv chan router_recvPacket // packets to handle via recvPacket()
|
toRecv chan router_recvPacket // packets to handle via recvPacket()
|
||||||
@ -57,17 +61,17 @@ type router_recvPacket struct {
|
|||||||
// Initializes the router struct, which includes setting up channels to/from the tun/tap.
|
// Initializes the router struct, which includes setting up channels to/from the tun/tap.
|
||||||
func (r *router) init(core *Core) {
|
func (r *router) init(core *Core) {
|
||||||
r.core = core
|
r.core = core
|
||||||
r.addr = *address_addrForNodeID(&r.core.dht.nodeID)
|
r.addr = *address.AddrForNodeID(&r.core.dht.nodeID)
|
||||||
r.subnet = *address_subnetForNodeID(&r.core.dht.nodeID)
|
r.subnet = *address.SubnetForNodeID(&r.core.dht.nodeID)
|
||||||
in := make(chan []byte, 32) // TODO something better than this...
|
in := make(chan []byte, 32) // TODO something better than this...
|
||||||
p := r.core.peers.newPeer(&r.core.boxPub, &r.core.sigPub, &boxSharedKey{}, "(self)")
|
p := r.core.peers.newPeer(&r.core.boxPub, &r.core.sigPub, &crypto.BoxSharedKey{}, "(self)")
|
||||||
p.out = func(packet []byte) {
|
p.out = func(packet []byte) {
|
||||||
// This is to make very sure it never blocks
|
// This is to make very sure it never blocks
|
||||||
select {
|
select {
|
||||||
case in <- packet:
|
case in <- packet:
|
||||||
return
|
return
|
||||||
default:
|
default:
|
||||||
util_putBytes(packet)
|
util.PutBytes(packet)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
r.in = in
|
r.in = in
|
||||||
@ -121,7 +125,7 @@ func (r *router) mainLoop() {
|
|||||||
r.core.switchTable.doMaintenance()
|
r.core.switchTable.doMaintenance()
|
||||||
r.core.dht.doMaintenance()
|
r.core.dht.doMaintenance()
|
||||||
r.core.sessions.cleanup()
|
r.core.sessions.cleanup()
|
||||||
util_getBytes() // To slowly drain things
|
util.GetBytes() // To slowly drain things
|
||||||
}
|
}
|
||||||
case f := <-r.admin:
|
case f := <-r.admin:
|
||||||
f()
|
f()
|
||||||
@ -135,11 +139,11 @@ func (r *router) mainLoop() {
|
|||||||
// If the session hasn't responded recently, it triggers a ping or search to keep things alive or deal with broken coords *relatively* quickly.
|
// If the session hasn't responded recently, it triggers a ping or search to keep things alive or deal with broken coords *relatively* quickly.
|
||||||
// It also deals with oversized packets if there are MTU issues by calling into icmpv6.go to spoof PacketTooBig traffic, or DestinationUnreachable if the other side has their tun/tap disabled.
|
// It also deals with oversized packets if there are MTU issues by calling into icmpv6.go to spoof PacketTooBig traffic, or DestinationUnreachable if the other side has their tun/tap disabled.
|
||||||
func (r *router) sendPacket(bs []byte) {
|
func (r *router) sendPacket(bs []byte) {
|
||||||
var sourceAddr address
|
var sourceAddr address.Address
|
||||||
var destAddr address
|
var destAddr address.Address
|
||||||
var destSnet subnet
|
var destSnet address.Subnet
|
||||||
var destPubKey *boxPubKey
|
var destPubKey *crypto.BoxPubKey
|
||||||
var destNodeID *NodeID
|
var destNodeID *crypto.NodeID
|
||||||
var addrlen int
|
var addrlen int
|
||||||
if bs[0]&0xf0 == 0x60 {
|
if bs[0]&0xf0 == 0x60 {
|
||||||
// Check if we have a fully-sized header
|
// Check if we have a fully-sized header
|
||||||
@ -169,19 +173,19 @@ func (r *router) sendPacket(bs []byte) {
|
|||||||
// configured crypto-key routing source subnets
|
// configured crypto-key routing source subnets
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
if !destAddr.isValid() && !destSnet.isValid() {
|
if !destAddr.IsValid() && !destSnet.IsValid() {
|
||||||
// The addresses didn't match valid Yggdrasil node addresses so let's see
|
// The addresses didn't match valid Yggdrasil node addresses so let's see
|
||||||
// whether it matches a crypto-key routing range instead
|
// whether it matches a crypto-key routing range instead
|
||||||
if key, err := r.cryptokey.getPublicKeyForAddress(destAddr, addrlen); err == nil {
|
if key, err := r.cryptokey.getPublicKeyForAddress(destAddr, addrlen); err == nil {
|
||||||
// A public key was found, get the node ID for the search
|
// A public key was found, get the node ID for the search
|
||||||
destPubKey = &key
|
destPubKey = &key
|
||||||
destNodeID = getNodeID(destPubKey)
|
destNodeID = crypto.GetNodeID(destPubKey)
|
||||||
// Do a quick check to ensure that the node ID refers to a vaild Yggdrasil
|
// Do a quick check to ensure that the node ID refers to a vaild Yggdrasil
|
||||||
// address or subnet - this might be superfluous
|
// address or subnet - this might be superfluous
|
||||||
addr := *address_addrForNodeID(destNodeID)
|
addr := *address.AddrForNodeID(destNodeID)
|
||||||
copy(destAddr[:], addr[:])
|
copy(destAddr[:], addr[:])
|
||||||
copy(destSnet[:], addr[:])
|
copy(destSnet[:], addr[:])
|
||||||
if !destAddr.isValid() && !destSnet.isValid() {
|
if !destAddr.IsValid() && !destSnet.IsValid() {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
@ -190,25 +194,25 @@ func (r *router) sendPacket(bs []byte) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
doSearch := func(packet []byte) {
|
doSearch := func(packet []byte) {
|
||||||
var nodeID, mask *NodeID
|
var nodeID, mask *crypto.NodeID
|
||||||
switch {
|
switch {
|
||||||
case destNodeID != nil:
|
case destNodeID != nil:
|
||||||
// We already know the full node ID, probably because it's from a CKR
|
// We already know the full node ID, probably because it's from a CKR
|
||||||
// route in which the public key is known ahead of time
|
// route in which the public key is known ahead of time
|
||||||
nodeID = destNodeID
|
nodeID = destNodeID
|
||||||
var m NodeID
|
var m crypto.NodeID
|
||||||
for i := range m {
|
for i := range m {
|
||||||
m[i] = 0xFF
|
m[i] = 0xFF
|
||||||
}
|
}
|
||||||
mask = &m
|
mask = &m
|
||||||
case destAddr.isValid():
|
case destAddr.IsValid():
|
||||||
// We don't know the full node ID - try and use the address to generate
|
// We don't know the full node ID - try and use the address to generate
|
||||||
// a truncated node ID
|
// a truncated node ID
|
||||||
nodeID, mask = destAddr.getNodeIDandMask()
|
nodeID, mask = destAddr.GetNodeIDandMask()
|
||||||
case destSnet.isValid():
|
case destSnet.IsValid():
|
||||||
// We don't know the full node ID - try and use the subnet to generate
|
// We don't know the full node ID - try and use the subnet to generate
|
||||||
// a truncated node ID
|
// a truncated node ID
|
||||||
nodeID, mask = destSnet.getNodeIDandMask()
|
nodeID, mask = destSnet.GetNodeIDandMask()
|
||||||
default:
|
default:
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
@ -223,10 +227,10 @@ func (r *router) sendPacket(bs []byte) {
|
|||||||
}
|
}
|
||||||
var sinfo *sessionInfo
|
var sinfo *sessionInfo
|
||||||
var isIn bool
|
var isIn bool
|
||||||
if destAddr.isValid() {
|
if destAddr.IsValid() {
|
||||||
sinfo, isIn = r.core.sessions.getByTheirAddr(&destAddr)
|
sinfo, isIn = r.core.sessions.getByTheirAddr(&destAddr)
|
||||||
}
|
}
|
||||||
if destSnet.isValid() {
|
if destSnet.IsValid() {
|
||||||
sinfo, isIn = r.core.sessions.getByTheirSubnet(&destSnet)
|
sinfo, isIn = r.core.sessions.getByTheirSubnet(&destSnet)
|
||||||
}
|
}
|
||||||
switch {
|
switch {
|
||||||
@ -305,12 +309,12 @@ func (r *router) sendPacket(bs []byte) {
|
|||||||
func (r *router) recvPacket(bs []byte, sinfo *sessionInfo) {
|
func (r *router) recvPacket(bs []byte, sinfo *sessionInfo) {
|
||||||
// Note: called directly by the session worker, not the router goroutine
|
// Note: called directly by the session worker, not the router goroutine
|
||||||
if len(bs) < 24 {
|
if len(bs) < 24 {
|
||||||
util_putBytes(bs)
|
util.PutBytes(bs)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
var sourceAddr address
|
var sourceAddr address.Address
|
||||||
var dest address
|
var dest address.Address
|
||||||
var snet subnet
|
var snet address.Subnet
|
||||||
var addrlen int
|
var addrlen int
|
||||||
if bs[0]&0xf0 == 0x60 {
|
if bs[0]&0xf0 == 0x60 {
|
||||||
// IPv6 address
|
// IPv6 address
|
||||||
@ -330,17 +334,17 @@ func (r *router) recvPacket(bs []byte, sinfo *sessionInfo) {
|
|||||||
// Check that the packet is destined for either our Yggdrasil address or
|
// Check that the packet is destined for either our Yggdrasil address or
|
||||||
// subnet, or that it matches one of the crypto-key routing source routes
|
// subnet, or that it matches one of the crypto-key routing source routes
|
||||||
if !r.cryptokey.isValidSource(dest, addrlen) {
|
if !r.cryptokey.isValidSource(dest, addrlen) {
|
||||||
util_putBytes(bs)
|
util.PutBytes(bs)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
// See whether the packet they sent should have originated from this session
|
// See whether the packet they sent should have originated from this session
|
||||||
switch {
|
switch {
|
||||||
case sourceAddr.isValid() && sourceAddr == sinfo.theirAddr:
|
case sourceAddr.IsValid() && sourceAddr == sinfo.theirAddr:
|
||||||
case snet.isValid() && snet == sinfo.theirSubnet:
|
case snet.IsValid() && snet == sinfo.theirSubnet:
|
||||||
default:
|
default:
|
||||||
key, err := r.cryptokey.getPublicKeyForAddress(sourceAddr, addrlen)
|
key, err := r.cryptokey.getPublicKeyForAddress(sourceAddr, addrlen)
|
||||||
if err != nil || key != sinfo.theirPermPub {
|
if err != nil || key != sinfo.theirPermPub {
|
||||||
util_putBytes(bs)
|
util.PutBytes(bs)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -366,7 +370,7 @@ func (r *router) handleIn(packet []byte) {
|
|||||||
// Handles incoming traffic, i.e. encapuslated ordinary IPv6 packets.
|
// Handles incoming traffic, i.e. encapuslated ordinary IPv6 packets.
|
||||||
// Passes them to the crypto session worker to be decrypted and sent to the tun/tap.
|
// Passes them to the crypto session worker to be decrypted and sent to the tun/tap.
|
||||||
func (r *router) handleTraffic(packet []byte) {
|
func (r *router) handleTraffic(packet []byte) {
|
||||||
defer util_putBytes(packet)
|
defer util.PutBytes(packet)
|
||||||
p := wire_trafficPacket{}
|
p := wire_trafficPacket{}
|
||||||
if !p.decode(packet) {
|
if !p.decode(packet) {
|
||||||
return
|
return
|
||||||
@ -386,14 +390,14 @@ func (r *router) handleProto(packet []byte) {
|
|||||||
return
|
return
|
||||||
}
|
}
|
||||||
// Now try to open the payload
|
// Now try to open the payload
|
||||||
var sharedKey *boxSharedKey
|
var sharedKey *crypto.BoxSharedKey
|
||||||
if p.ToKey == r.core.boxPub {
|
if p.ToKey == r.core.boxPub {
|
||||||
// Try to open using our permanent key
|
// Try to open using our permanent key
|
||||||
sharedKey = r.core.sessions.getSharedKey(&r.core.boxPriv, &p.FromKey)
|
sharedKey = r.core.sessions.getSharedKey(&r.core.boxPriv, &p.FromKey)
|
||||||
} else {
|
} else {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
bs, isOK := boxOpen(sharedKey, p.Payload, &p.Nonce)
|
bs, isOK := crypto.BoxOpen(sharedKey, p.Payload, &p.Nonce)
|
||||||
if !isOK {
|
if !isOK {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
@ -418,12 +422,12 @@ func (r *router) handleProto(packet []byte) {
|
|||||||
case wire_DHTLookupResponse:
|
case wire_DHTLookupResponse:
|
||||||
r.handleDHTRes(bs, &p.FromKey)
|
r.handleDHTRes(bs, &p.FromKey)
|
||||||
default:
|
default:
|
||||||
util_putBytes(packet)
|
util.PutBytes(packet)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Decodes session pings from wire format and passes them to sessions.handlePing where they either create or update a session.
|
// Decodes session pings from wire format and passes them to sessions.handlePing where they either create or update a session.
|
||||||
func (r *router) handlePing(bs []byte, fromKey *boxPubKey) {
|
func (r *router) handlePing(bs []byte, fromKey *crypto.BoxPubKey) {
|
||||||
ping := sessionPing{}
|
ping := sessionPing{}
|
||||||
if !ping.decode(bs) {
|
if !ping.decode(bs) {
|
||||||
return
|
return
|
||||||
@ -433,12 +437,12 @@ func (r *router) handlePing(bs []byte, fromKey *boxPubKey) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Handles session pongs (which are really pings with an extra flag to prevent acknowledgement).
|
// Handles session pongs (which are really pings with an extra flag to prevent acknowledgement).
|
||||||
func (r *router) handlePong(bs []byte, fromKey *boxPubKey) {
|
func (r *router) handlePong(bs []byte, fromKey *crypto.BoxPubKey) {
|
||||||
r.handlePing(bs, fromKey)
|
r.handlePing(bs, fromKey)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Decodes dht requests and passes them to dht.handleReq to trigger a lookup/response.
|
// Decodes dht requests and passes them to dht.handleReq to trigger a lookup/response.
|
||||||
func (r *router) handleDHTReq(bs []byte, fromKey *boxPubKey) {
|
func (r *router) handleDHTReq(bs []byte, fromKey *crypto.BoxPubKey) {
|
||||||
req := dhtReq{}
|
req := dhtReq{}
|
||||||
if !req.decode(bs) {
|
if !req.decode(bs) {
|
||||||
return
|
return
|
||||||
@ -448,7 +452,7 @@ func (r *router) handleDHTReq(bs []byte, fromKey *boxPubKey) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Decodes dht responses and passes them to dht.handleRes to update the DHT table and further pass them to the search code (if applicable).
|
// Decodes dht responses and passes them to dht.handleRes to update the DHT table and further pass them to the search code (if applicable).
|
||||||
func (r *router) handleDHTRes(bs []byte, fromKey *boxPubKey) {
|
func (r *router) handleDHTRes(bs []byte, fromKey *crypto.BoxPubKey) {
|
||||||
res := dhtRes{}
|
res := dhtRes{}
|
||||||
if !res.decode(bs) {
|
if !res.decode(bs) {
|
||||||
return
|
return
|
||||||
@ -458,7 +462,7 @@ func (r *router) handleDHTRes(bs []byte, fromKey *boxPubKey) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Decodes nodeinfo request
|
// Decodes nodeinfo request
|
||||||
func (r *router) handleNodeInfo(bs []byte, fromKey *boxPubKey) {
|
func (r *router) handleNodeInfo(bs []byte, fromKey *crypto.BoxPubKey) {
|
||||||
req := nodeinfoReqRes{}
|
req := nodeinfoReqRes{}
|
||||||
if !req.decode(bs) {
|
if !req.decode(bs) {
|
||||||
return
|
return
|
||||||
|
@ -17,6 +17,8 @@ package yggdrasil
|
|||||||
import (
|
import (
|
||||||
"sort"
|
"sort"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
)
|
)
|
||||||
|
|
||||||
// This defines the maximum number of dhtInfo that we keep track of for nodes to query in an ongoing search.
|
// This defines the maximum number of dhtInfo that we keep track of for nodes to query in an ongoing search.
|
||||||
@ -30,28 +32,28 @@ const search_RETRY_TIME = time.Second
|
|||||||
// Information about an ongoing search.
|
// Information about an ongoing search.
|
||||||
// Includes the targed NodeID, the bitmask to match it to an IP, and the list of nodes to visit / already visited.
|
// Includes the targed NodeID, the bitmask to match it to an IP, and the list of nodes to visit / already visited.
|
||||||
type searchInfo struct {
|
type searchInfo struct {
|
||||||
dest NodeID
|
dest crypto.NodeID
|
||||||
mask NodeID
|
mask crypto.NodeID
|
||||||
time time.Time
|
time time.Time
|
||||||
packet []byte
|
packet []byte
|
||||||
toVisit []*dhtInfo
|
toVisit []*dhtInfo
|
||||||
visited map[NodeID]bool
|
visited map[crypto.NodeID]bool
|
||||||
}
|
}
|
||||||
|
|
||||||
// This stores a map of active searches.
|
// This stores a map of active searches.
|
||||||
type searches struct {
|
type searches struct {
|
||||||
core *Core
|
core *Core
|
||||||
searches map[NodeID]*searchInfo
|
searches map[crypto.NodeID]*searchInfo
|
||||||
}
|
}
|
||||||
|
|
||||||
// Intializes the searches struct.
|
// Intializes the searches struct.
|
||||||
func (s *searches) init(core *Core) {
|
func (s *searches) init(core *Core) {
|
||||||
s.core = core
|
s.core = core
|
||||||
s.searches = make(map[NodeID]*searchInfo)
|
s.searches = make(map[crypto.NodeID]*searchInfo)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Creates a new search info, adds it to the searches struct, and returns a pointer to the info.
|
// Creates a new search info, adds it to the searches struct, and returns a pointer to the info.
|
||||||
func (s *searches) createSearch(dest *NodeID, mask *NodeID) *searchInfo {
|
func (s *searches) createSearch(dest *crypto.NodeID, mask *crypto.NodeID) *searchInfo {
|
||||||
now := time.Now()
|
now := time.Now()
|
||||||
for dest, sinfo := range s.searches {
|
for dest, sinfo := range s.searches {
|
||||||
if now.Sub(sinfo.time) > time.Minute {
|
if now.Sub(sinfo.time) > time.Minute {
|
||||||
@ -102,7 +104,7 @@ func (s *searches) addToSearch(sinfo *searchInfo, res *dhtRes) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
// Deduplicate
|
// Deduplicate
|
||||||
vMap := make(map[NodeID]*dhtInfo)
|
vMap := make(map[crypto.NodeID]*dhtInfo)
|
||||||
for _, info := range sinfo.toVisit {
|
for _, info := range sinfo.toVisit {
|
||||||
vMap[*info.getNodeID()] = info
|
vMap[*info.getNodeID()] = info
|
||||||
}
|
}
|
||||||
@ -163,10 +165,10 @@ func (s *searches) continueSearch(sinfo *searchInfo) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Calls create search, and initializes the iterative search parts of the struct before returning it.
|
// Calls create search, and initializes the iterative search parts of the struct before returning it.
|
||||||
func (s *searches) newIterSearch(dest *NodeID, mask *NodeID) *searchInfo {
|
func (s *searches) newIterSearch(dest *crypto.NodeID, mask *crypto.NodeID) *searchInfo {
|
||||||
sinfo := s.createSearch(dest, mask)
|
sinfo := s.createSearch(dest, mask)
|
||||||
sinfo.toVisit = s.core.dht.lookup(dest, true)
|
sinfo.toVisit = s.core.dht.lookup(dest, true)
|
||||||
sinfo.visited = make(map[NodeID]bool)
|
sinfo.visited = make(map[crypto.NodeID]bool)
|
||||||
return sinfo
|
return sinfo
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -174,10 +176,10 @@ func (s *searches) newIterSearch(dest *NodeID, mask *NodeID) *searchInfo {
|
|||||||
// If the response is from the target, get/create a session, trigger a session ping, and return true.
|
// If the response is from the target, get/create a session, trigger a session ping, and return true.
|
||||||
// Otherwise return false.
|
// Otherwise return false.
|
||||||
func (s *searches) checkDHTRes(info *searchInfo, res *dhtRes) bool {
|
func (s *searches) checkDHTRes(info *searchInfo, res *dhtRes) bool {
|
||||||
them := getNodeID(&res.Key)
|
them := crypto.GetNodeID(&res.Key)
|
||||||
var destMasked NodeID
|
var destMasked crypto.NodeID
|
||||||
var themMasked NodeID
|
var themMasked crypto.NodeID
|
||||||
for idx := 0; idx < NodeIDLen; idx++ {
|
for idx := 0; idx < crypto.NodeIDLen; idx++ {
|
||||||
destMasked[idx] = info.dest[idx] & info.mask[idx]
|
destMasked[idx] = info.dest[idx] & info.mask[idx]
|
||||||
themMasked[idx] = them[idx] & info.mask[idx]
|
themMasked[idx] = them[idx] & info.mask[idx]
|
||||||
}
|
}
|
||||||
|
@ -8,23 +8,27 @@ import (
|
|||||||
"bytes"
|
"bytes"
|
||||||
"encoding/hex"
|
"encoding/hex"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
// All the information we know about an active session.
|
// All the information we know about an active session.
|
||||||
// This includes coords, permanent and ephemeral keys, handles and nonces, various sorts of timing information for timeout and maintenance, and some metadata for the admin API.
|
// This includes coords, permanent and ephemeral keys, handles and nonces, various sorts of timing information for timeout and maintenance, and some metadata for the admin API.
|
||||||
type sessionInfo struct {
|
type sessionInfo struct {
|
||||||
core *Core
|
core *Core
|
||||||
theirAddr address
|
theirAddr address.Address
|
||||||
theirSubnet subnet
|
theirSubnet address.Subnet
|
||||||
theirPermPub boxPubKey
|
theirPermPub crypto.BoxPubKey
|
||||||
theirSesPub boxPubKey
|
theirSesPub crypto.BoxPubKey
|
||||||
mySesPub boxPubKey
|
mySesPub crypto.BoxPubKey
|
||||||
mySesPriv boxPrivKey
|
mySesPriv crypto.BoxPrivKey
|
||||||
sharedSesKey boxSharedKey // derived from session keys
|
sharedSesKey crypto.BoxSharedKey // derived from session keys
|
||||||
theirHandle handle
|
theirHandle crypto.Handle
|
||||||
myHandle handle
|
myHandle crypto.Handle
|
||||||
theirNonce boxNonce
|
theirNonce crypto.BoxNonce
|
||||||
myNonce boxNonce
|
myNonce crypto.BoxNonce
|
||||||
theirMTU uint16
|
theirMTU uint16
|
||||||
myMTU uint16
|
myMTU uint16
|
||||||
wasMTUFixed bool // Was the MTU fixed by a receive error?
|
wasMTUFixed bool // Was the MTU fixed by a receive error?
|
||||||
@ -45,9 +49,9 @@ type sessionInfo struct {
|
|||||||
|
|
||||||
// Represents a session ping/pong packet, andincludes information like public keys, a session handle, coords, a timestamp to prevent replays, and the tun/tap MTU.
|
// Represents a session ping/pong packet, andincludes information like public keys, a session handle, coords, a timestamp to prevent replays, and the tun/tap MTU.
|
||||||
type sessionPing struct {
|
type sessionPing struct {
|
||||||
SendPermPub boxPubKey // Sender's permanent key
|
SendPermPub crypto.BoxPubKey // Sender's permanent key
|
||||||
Handle handle // Random number to ID session
|
Handle crypto.Handle // Random number to ID session
|
||||||
SendSesPub boxPubKey // Session key to use
|
SendSesPub crypto.BoxPubKey // Session key to use
|
||||||
Coords []byte
|
Coords []byte
|
||||||
Tstamp int64 // unix time, but the only real requirement is that it increases
|
Tstamp int64 // unix time, but the only real requirement is that it increases
|
||||||
IsPong bool
|
IsPong bool
|
||||||
@ -69,8 +73,8 @@ func (s *sessionInfo) update(p *sessionPing) bool {
|
|||||||
if p.SendSesPub != s.theirSesPub {
|
if p.SendSesPub != s.theirSesPub {
|
||||||
s.theirSesPub = p.SendSesPub
|
s.theirSesPub = p.SendSesPub
|
||||||
s.theirHandle = p.Handle
|
s.theirHandle = p.Handle
|
||||||
s.sharedSesKey = *getSharedKey(&s.mySesPriv, &s.theirSesPub)
|
s.sharedSesKey = *crypto.GetSharedKey(&s.mySesPriv, &s.theirSesPub)
|
||||||
s.theirNonce = boxNonce{}
|
s.theirNonce = crypto.BoxNonce{}
|
||||||
s.nonceMask = 0
|
s.nonceMask = 0
|
||||||
}
|
}
|
||||||
if p.MTU >= 1280 || p.MTU == 0 {
|
if p.MTU >= 1280 || p.MTU == 0 {
|
||||||
@ -99,15 +103,15 @@ type sessions struct {
|
|||||||
core *Core
|
core *Core
|
||||||
lastCleanup time.Time
|
lastCleanup time.Time
|
||||||
// Maps known permanent keys to their shared key, used by DHT a lot
|
// Maps known permanent keys to their shared key, used by DHT a lot
|
||||||
permShared map[boxPubKey]*boxSharedKey
|
permShared map[crypto.BoxPubKey]*crypto.BoxSharedKey
|
||||||
// Maps (secret) handle onto session info
|
// Maps (secret) handle onto session info
|
||||||
sinfos map[handle]*sessionInfo
|
sinfos map[crypto.Handle]*sessionInfo
|
||||||
// Maps mySesPub onto handle
|
// Maps mySesPub onto handle
|
||||||
byMySes map[boxPubKey]*handle
|
byMySes map[crypto.BoxPubKey]*crypto.Handle
|
||||||
// Maps theirPermPub onto handle
|
// Maps theirPermPub onto handle
|
||||||
byTheirPerm map[boxPubKey]*handle
|
byTheirPerm map[crypto.BoxPubKey]*crypto.Handle
|
||||||
addrToPerm map[address]*boxPubKey
|
addrToPerm map[address.Address]*crypto.BoxPubKey
|
||||||
subnetToPerm map[subnet]*boxPubKey
|
subnetToPerm map[address.Subnet]*crypto.BoxPubKey
|
||||||
// Options from the session firewall
|
// Options from the session firewall
|
||||||
sessionFirewallEnabled bool
|
sessionFirewallEnabled bool
|
||||||
sessionFirewallAllowsDirect bool
|
sessionFirewallAllowsDirect bool
|
||||||
@ -120,12 +124,12 @@ type sessions struct {
|
|||||||
// Initializes the session struct.
|
// Initializes the session struct.
|
||||||
func (ss *sessions) init(core *Core) {
|
func (ss *sessions) init(core *Core) {
|
||||||
ss.core = core
|
ss.core = core
|
||||||
ss.permShared = make(map[boxPubKey]*boxSharedKey)
|
ss.permShared = make(map[crypto.BoxPubKey]*crypto.BoxSharedKey)
|
||||||
ss.sinfos = make(map[handle]*sessionInfo)
|
ss.sinfos = make(map[crypto.Handle]*sessionInfo)
|
||||||
ss.byMySes = make(map[boxPubKey]*handle)
|
ss.byMySes = make(map[crypto.BoxPubKey]*crypto.Handle)
|
||||||
ss.byTheirPerm = make(map[boxPubKey]*handle)
|
ss.byTheirPerm = make(map[crypto.BoxPubKey]*crypto.Handle)
|
||||||
ss.addrToPerm = make(map[address]*boxPubKey)
|
ss.addrToPerm = make(map[address.Address]*crypto.BoxPubKey)
|
||||||
ss.subnetToPerm = make(map[subnet]*boxPubKey)
|
ss.subnetToPerm = make(map[address.Subnet]*crypto.BoxPubKey)
|
||||||
ss.lastCleanup = time.Now()
|
ss.lastCleanup = time.Now()
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -154,18 +158,18 @@ func (ss *sessions) setSessionFirewallBlacklist(blacklist []string) {
|
|||||||
|
|
||||||
// Determines whether the session with a given publickey is allowed based on
|
// Determines whether the session with a given publickey is allowed based on
|
||||||
// session firewall rules.
|
// session firewall rules.
|
||||||
func (ss *sessions) isSessionAllowed(pubkey *boxPubKey, initiator bool) bool {
|
func (ss *sessions) isSessionAllowed(pubkey *crypto.BoxPubKey, initiator bool) bool {
|
||||||
// Allow by default if the session firewall is disabled
|
// Allow by default if the session firewall is disabled
|
||||||
if !ss.sessionFirewallEnabled {
|
if !ss.sessionFirewallEnabled {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
// Prepare for checking whitelist/blacklist
|
// Prepare for checking whitelist/blacklist
|
||||||
var box boxPubKey
|
var box crypto.BoxPubKey
|
||||||
// Reject blacklisted nodes
|
// Reject blacklisted nodes
|
||||||
for _, b := range ss.sessionFirewallBlacklist {
|
for _, b := range ss.sessionFirewallBlacklist {
|
||||||
key, err := hex.DecodeString(b)
|
key, err := hex.DecodeString(b)
|
||||||
if err == nil {
|
if err == nil {
|
||||||
copy(box[:boxPubKeyLen], key)
|
copy(box[:crypto.BoxPubKeyLen], key)
|
||||||
if box == *pubkey {
|
if box == *pubkey {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
@ -175,7 +179,7 @@ func (ss *sessions) isSessionAllowed(pubkey *boxPubKey, initiator bool) bool {
|
|||||||
for _, b := range ss.sessionFirewallWhitelist {
|
for _, b := range ss.sessionFirewallWhitelist {
|
||||||
key, err := hex.DecodeString(b)
|
key, err := hex.DecodeString(b)
|
||||||
if err == nil {
|
if err == nil {
|
||||||
copy(box[:boxPubKeyLen], key)
|
copy(box[:crypto.BoxPubKeyLen], key)
|
||||||
if box == *pubkey {
|
if box == *pubkey {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
@ -208,7 +212,7 @@ func (ss *sessions) isSessionAllowed(pubkey *boxPubKey, initiator bool) bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Gets the session corresponding to a given handle.
|
// Gets the session corresponding to a given handle.
|
||||||
func (ss *sessions) getSessionForHandle(handle *handle) (*sessionInfo, bool) {
|
func (ss *sessions) getSessionForHandle(handle *crypto.Handle) (*sessionInfo, bool) {
|
||||||
sinfo, isIn := ss.sinfos[*handle]
|
sinfo, isIn := ss.sinfos[*handle]
|
||||||
if isIn && sinfo.timedout() {
|
if isIn && sinfo.timedout() {
|
||||||
// We have a session, but it has timed out
|
// We have a session, but it has timed out
|
||||||
@ -218,7 +222,7 @@ func (ss *sessions) getSessionForHandle(handle *handle) (*sessionInfo, bool) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Gets a session corresponding to an ephemeral session key used by this node.
|
// Gets a session corresponding to an ephemeral session key used by this node.
|
||||||
func (ss *sessions) getByMySes(key *boxPubKey) (*sessionInfo, bool) {
|
func (ss *sessions) getByMySes(key *crypto.BoxPubKey) (*sessionInfo, bool) {
|
||||||
h, isIn := ss.byMySes[*key]
|
h, isIn := ss.byMySes[*key]
|
||||||
if !isIn {
|
if !isIn {
|
||||||
return nil, false
|
return nil, false
|
||||||
@ -228,7 +232,7 @@ func (ss *sessions) getByMySes(key *boxPubKey) (*sessionInfo, bool) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Gets a session corresponding to a permanent key used by the remote node.
|
// Gets a session corresponding to a permanent key used by the remote node.
|
||||||
func (ss *sessions) getByTheirPerm(key *boxPubKey) (*sessionInfo, bool) {
|
func (ss *sessions) getByTheirPerm(key *crypto.BoxPubKey) (*sessionInfo, bool) {
|
||||||
h, isIn := ss.byTheirPerm[*key]
|
h, isIn := ss.byTheirPerm[*key]
|
||||||
if !isIn {
|
if !isIn {
|
||||||
return nil, false
|
return nil, false
|
||||||
@ -238,7 +242,7 @@ func (ss *sessions) getByTheirPerm(key *boxPubKey) (*sessionInfo, bool) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Gets a session corresponding to an IPv6 address used by the remote node.
|
// Gets a session corresponding to an IPv6 address used by the remote node.
|
||||||
func (ss *sessions) getByTheirAddr(addr *address) (*sessionInfo, bool) {
|
func (ss *sessions) getByTheirAddr(addr *address.Address) (*sessionInfo, bool) {
|
||||||
p, isIn := ss.addrToPerm[*addr]
|
p, isIn := ss.addrToPerm[*addr]
|
||||||
if !isIn {
|
if !isIn {
|
||||||
return nil, false
|
return nil, false
|
||||||
@ -248,7 +252,7 @@ func (ss *sessions) getByTheirAddr(addr *address) (*sessionInfo, bool) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Gets a session corresponding to an IPv6 /64 subnet used by the remote node/network.
|
// Gets a session corresponding to an IPv6 /64 subnet used by the remote node/network.
|
||||||
func (ss *sessions) getByTheirSubnet(snet *subnet) (*sessionInfo, bool) {
|
func (ss *sessions) getByTheirSubnet(snet *address.Subnet) (*sessionInfo, bool) {
|
||||||
p, isIn := ss.subnetToPerm[*snet]
|
p, isIn := ss.subnetToPerm[*snet]
|
||||||
if !isIn {
|
if !isIn {
|
||||||
return nil, false
|
return nil, false
|
||||||
@ -259,7 +263,7 @@ func (ss *sessions) getByTheirSubnet(snet *subnet) (*sessionInfo, bool) {
|
|||||||
|
|
||||||
// Creates a new session and lazily cleans up old/timedout existing sessions.
|
// Creates a new session and lazily cleans up old/timedout existing sessions.
|
||||||
// This includse initializing session info to sane defaults (e.g. lowest supported MTU).
|
// This includse initializing session info to sane defaults (e.g. lowest supported MTU).
|
||||||
func (ss *sessions) createSession(theirPermKey *boxPubKey) *sessionInfo {
|
func (ss *sessions) createSession(theirPermKey *crypto.BoxPubKey) *sessionInfo {
|
||||||
if ss.sessionFirewallEnabled {
|
if ss.sessionFirewallEnabled {
|
||||||
if !ss.isSessionAllowed(theirPermKey, true) {
|
if !ss.isSessionAllowed(theirPermKey, true) {
|
||||||
return nil
|
return nil
|
||||||
@ -268,10 +272,10 @@ func (ss *sessions) createSession(theirPermKey *boxPubKey) *sessionInfo {
|
|||||||
sinfo := sessionInfo{}
|
sinfo := sessionInfo{}
|
||||||
sinfo.core = ss.core
|
sinfo.core = ss.core
|
||||||
sinfo.theirPermPub = *theirPermKey
|
sinfo.theirPermPub = *theirPermKey
|
||||||
pub, priv := newBoxKeys()
|
pub, priv := crypto.NewBoxKeys()
|
||||||
sinfo.mySesPub = *pub
|
sinfo.mySesPub = *pub
|
||||||
sinfo.mySesPriv = *priv
|
sinfo.mySesPriv = *priv
|
||||||
sinfo.myNonce = *newBoxNonce()
|
sinfo.myNonce = *crypto.NewBoxNonce()
|
||||||
sinfo.theirMTU = 1280
|
sinfo.theirMTU = 1280
|
||||||
sinfo.myMTU = uint16(ss.core.router.tun.mtu)
|
sinfo.myMTU = uint16(ss.core.router.tun.mtu)
|
||||||
now := time.Now()
|
now := time.Now()
|
||||||
@ -295,9 +299,9 @@ func (ss *sessions) createSession(theirPermKey *boxPubKey) *sessionInfo {
|
|||||||
// lower => even nonce
|
// lower => even nonce
|
||||||
sinfo.myNonce[len(sinfo.myNonce)-1] &= 0xfe
|
sinfo.myNonce[len(sinfo.myNonce)-1] &= 0xfe
|
||||||
}
|
}
|
||||||
sinfo.myHandle = *newHandle()
|
sinfo.myHandle = *crypto.NewHandle()
|
||||||
sinfo.theirAddr = *address_addrForNodeID(getNodeID(&sinfo.theirPermPub))
|
sinfo.theirAddr = *address.AddrForNodeID(crypto.GetNodeID(&sinfo.theirPermPub))
|
||||||
sinfo.theirSubnet = *address_subnetForNodeID(getNodeID(&sinfo.theirPermPub))
|
sinfo.theirSubnet = *address.SubnetForNodeID(crypto.GetNodeID(&sinfo.theirPermPub))
|
||||||
sinfo.send = make(chan []byte, 32)
|
sinfo.send = make(chan []byte, 32)
|
||||||
sinfo.recv = make(chan *wire_trafficPacket, 32)
|
sinfo.recv = make(chan *wire_trafficPacket, 32)
|
||||||
go sinfo.doWorker()
|
go sinfo.doWorker()
|
||||||
@ -324,32 +328,32 @@ func (ss *sessions) cleanup() {
|
|||||||
s.close()
|
s.close()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
permShared := make(map[boxPubKey]*boxSharedKey, len(ss.permShared))
|
permShared := make(map[crypto.BoxPubKey]*crypto.BoxSharedKey, len(ss.permShared))
|
||||||
for k, v := range ss.permShared {
|
for k, v := range ss.permShared {
|
||||||
permShared[k] = v
|
permShared[k] = v
|
||||||
}
|
}
|
||||||
ss.permShared = permShared
|
ss.permShared = permShared
|
||||||
sinfos := make(map[handle]*sessionInfo, len(ss.sinfos))
|
sinfos := make(map[crypto.Handle]*sessionInfo, len(ss.sinfos))
|
||||||
for k, v := range ss.sinfos {
|
for k, v := range ss.sinfos {
|
||||||
sinfos[k] = v
|
sinfos[k] = v
|
||||||
}
|
}
|
||||||
ss.sinfos = sinfos
|
ss.sinfos = sinfos
|
||||||
byMySes := make(map[boxPubKey]*handle, len(ss.byMySes))
|
byMySes := make(map[crypto.BoxPubKey]*crypto.Handle, len(ss.byMySes))
|
||||||
for k, v := range ss.byMySes {
|
for k, v := range ss.byMySes {
|
||||||
byMySes[k] = v
|
byMySes[k] = v
|
||||||
}
|
}
|
||||||
ss.byMySes = byMySes
|
ss.byMySes = byMySes
|
||||||
byTheirPerm := make(map[boxPubKey]*handle, len(ss.byTheirPerm))
|
byTheirPerm := make(map[crypto.BoxPubKey]*crypto.Handle, len(ss.byTheirPerm))
|
||||||
for k, v := range ss.byTheirPerm {
|
for k, v := range ss.byTheirPerm {
|
||||||
byTheirPerm[k] = v
|
byTheirPerm[k] = v
|
||||||
}
|
}
|
||||||
ss.byTheirPerm = byTheirPerm
|
ss.byTheirPerm = byTheirPerm
|
||||||
addrToPerm := make(map[address]*boxPubKey, len(ss.addrToPerm))
|
addrToPerm := make(map[address.Address]*crypto.BoxPubKey, len(ss.addrToPerm))
|
||||||
for k, v := range ss.addrToPerm {
|
for k, v := range ss.addrToPerm {
|
||||||
addrToPerm[k] = v
|
addrToPerm[k] = v
|
||||||
}
|
}
|
||||||
ss.addrToPerm = addrToPerm
|
ss.addrToPerm = addrToPerm
|
||||||
subnetToPerm := make(map[subnet]*boxPubKey, len(ss.subnetToPerm))
|
subnetToPerm := make(map[address.Subnet]*crypto.BoxPubKey, len(ss.subnetToPerm))
|
||||||
for k, v := range ss.subnetToPerm {
|
for k, v := range ss.subnetToPerm {
|
||||||
subnetToPerm[k] = v
|
subnetToPerm[k] = v
|
||||||
}
|
}
|
||||||
@ -380,15 +384,15 @@ func (ss *sessions) getPing(sinfo *sessionInfo) sessionPing {
|
|||||||
Coords: coords,
|
Coords: coords,
|
||||||
MTU: sinfo.myMTU,
|
MTU: sinfo.myMTU,
|
||||||
}
|
}
|
||||||
sinfo.myNonce.update()
|
sinfo.myNonce.Increment()
|
||||||
return ref
|
return ref
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets the shared key for a pair of box keys.
|
// Gets the shared key for a pair of box keys.
|
||||||
// Used to cache recently used shared keys for protocol traffic.
|
// Used to cache recently used shared keys for protocol traffic.
|
||||||
// This comes up with dht req/res and session ping/pong traffic.
|
// This comes up with dht req/res and session ping/pong traffic.
|
||||||
func (ss *sessions) getSharedKey(myPriv *boxPrivKey,
|
func (ss *sessions) getSharedKey(myPriv *crypto.BoxPrivKey,
|
||||||
theirPub *boxPubKey) *boxSharedKey {
|
theirPub *crypto.BoxPubKey) *crypto.BoxSharedKey {
|
||||||
if skey, isIn := ss.permShared[*theirPub]; isIn {
|
if skey, isIn := ss.permShared[*theirPub]; isIn {
|
||||||
return skey
|
return skey
|
||||||
}
|
}
|
||||||
@ -401,7 +405,7 @@ func (ss *sessions) getSharedKey(myPriv *boxPrivKey,
|
|||||||
}
|
}
|
||||||
delete(ss.permShared, key)
|
delete(ss.permShared, key)
|
||||||
}
|
}
|
||||||
ss.permShared[*theirPub] = getSharedKey(myPriv, theirPub)
|
ss.permShared[*theirPub] = crypto.GetSharedKey(myPriv, theirPub)
|
||||||
return ss.permShared[*theirPub]
|
return ss.permShared[*theirPub]
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -417,7 +421,7 @@ func (ss *sessions) sendPingPong(sinfo *sessionInfo, isPong bool) {
|
|||||||
ping.IsPong = isPong
|
ping.IsPong = isPong
|
||||||
bs := ping.encode()
|
bs := ping.encode()
|
||||||
shared := ss.getSharedKey(&ss.core.boxPriv, &sinfo.theirPermPub)
|
shared := ss.getSharedKey(&ss.core.boxPriv, &sinfo.theirPermPub)
|
||||||
payload, nonce := boxSeal(shared, bs, nil)
|
payload, nonce := crypto.BoxSeal(shared, bs, nil)
|
||||||
p := wire_protoTrafficPacket{
|
p := wire_protoTrafficPacket{
|
||||||
Coords: sinfo.coords,
|
Coords: sinfo.coords,
|
||||||
ToKey: sinfo.theirPermPub,
|
ToKey: sinfo.theirPermPub,
|
||||||
@ -468,24 +472,6 @@ func (ss *sessions) handlePing(ping *sessionPing) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Used to subtract one nonce from another, staying in the range +- 64.
|
|
||||||
// This is used by the nonce progression machinery to advance the bitmask of recently received packets (indexed by nonce), or to check the appropriate bit of the bitmask.
|
|
||||||
// It's basically part of the machinery that prevents replays and duplicate packets.
|
|
||||||
func (n *boxNonce) minus(m *boxNonce) int64 {
|
|
||||||
diff := int64(0)
|
|
||||||
for idx := range n {
|
|
||||||
diff *= 256
|
|
||||||
diff += int64(n[idx]) - int64(m[idx])
|
|
||||||
if diff > 64 {
|
|
||||||
diff = 64
|
|
||||||
}
|
|
||||||
if diff < -64 {
|
|
||||||
diff = -64
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return diff
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the MTU of the session.
|
// Get the MTU of the session.
|
||||||
// Will be equal to the smaller of this node's MTU or the remote node's MTU.
|
// Will be equal to the smaller of this node's MTU or the remote node's MTU.
|
||||||
// If sending over links with a maximum message size (this was a thing with the old UDP code), it could be further lowered, to a minimum of 1280.
|
// If sending over links with a maximum message size (this was a thing with the old UDP code), it could be further lowered, to a minimum of 1280.
|
||||||
@ -500,9 +486,9 @@ func (sinfo *sessionInfo) getMTU() uint16 {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Checks if a packet's nonce is recent enough to fall within the window of allowed packets, and not already received.
|
// Checks if a packet's nonce is recent enough to fall within the window of allowed packets, and not already received.
|
||||||
func (sinfo *sessionInfo) nonceIsOK(theirNonce *boxNonce) bool {
|
func (sinfo *sessionInfo) nonceIsOK(theirNonce *crypto.BoxNonce) bool {
|
||||||
// The bitmask is to allow for some non-duplicate out-of-order packets
|
// The bitmask is to allow for some non-duplicate out-of-order packets
|
||||||
diff := theirNonce.minus(&sinfo.theirNonce)
|
diff := theirNonce.Minus(&sinfo.theirNonce)
|
||||||
if diff > 0 {
|
if diff > 0 {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
@ -510,10 +496,10 @@ func (sinfo *sessionInfo) nonceIsOK(theirNonce *boxNonce) bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Updates the nonce mask by (possibly) shifting the bitmask and setting the bit corresponding to this nonce to 1, and then updating the most recent nonce
|
// Updates the nonce mask by (possibly) shifting the bitmask and setting the bit corresponding to this nonce to 1, and then updating the most recent nonce
|
||||||
func (sinfo *sessionInfo) updateNonce(theirNonce *boxNonce) {
|
func (sinfo *sessionInfo) updateNonce(theirNonce *crypto.BoxNonce) {
|
||||||
// Shift nonce mask if needed
|
// Shift nonce mask if needed
|
||||||
// Set bit
|
// Set bit
|
||||||
diff := theirNonce.minus(&sinfo.theirNonce)
|
diff := theirNonce.Minus(&sinfo.theirNonce)
|
||||||
if diff > 0 {
|
if diff > 0 {
|
||||||
// This nonce is newer, so shift the window before setting the bit, and update theirNonce in the session info.
|
// This nonce is newer, so shift the window before setting the bit, and update theirNonce in the session info.
|
||||||
sinfo.nonceMask <<= uint64(diff)
|
sinfo.nonceMask <<= uint64(diff)
|
||||||
@ -559,7 +545,7 @@ func (sinfo *sessionInfo) doWorker() {
|
|||||||
|
|
||||||
// This encrypts a packet, creates a trafficPacket struct, encodes it, and sends it to router.out to pass it to the switch layer.
|
// This encrypts a packet, creates a trafficPacket struct, encodes it, and sends it to router.out to pass it to the switch layer.
|
||||||
func (sinfo *sessionInfo) doSend(bs []byte) {
|
func (sinfo *sessionInfo) doSend(bs []byte) {
|
||||||
defer util_putBytes(bs)
|
defer util.PutBytes(bs)
|
||||||
if !sinfo.init {
|
if !sinfo.init {
|
||||||
// To prevent using empty session keys
|
// To prevent using empty session keys
|
||||||
return
|
return
|
||||||
@ -593,8 +579,8 @@ func (sinfo *sessionInfo) doSend(bs []byte) {
|
|||||||
coords = wire_put_uint64(flowkey, coords) // Then variable-length encoded flowkey
|
coords = wire_put_uint64(flowkey, coords) // Then variable-length encoded flowkey
|
||||||
}
|
}
|
||||||
// Prepare the payload
|
// Prepare the payload
|
||||||
payload, nonce := boxSeal(&sinfo.sharedSesKey, bs, &sinfo.myNonce)
|
payload, nonce := crypto.BoxSeal(&sinfo.sharedSesKey, bs, &sinfo.myNonce)
|
||||||
defer util_putBytes(payload)
|
defer util.PutBytes(payload)
|
||||||
p := wire_trafficPacket{
|
p := wire_trafficPacket{
|
||||||
Coords: coords,
|
Coords: coords,
|
||||||
Handle: sinfo.theirHandle,
|
Handle: sinfo.theirHandle,
|
||||||
@ -612,13 +598,13 @@ func (sinfo *sessionInfo) doSend(bs []byte) {
|
|||||||
// If a packet does not decrypt successfully, it assumes the packet was truncated, and updates the MTU accordingly.
|
// If a packet does not decrypt successfully, it assumes the packet was truncated, and updates the MTU accordingly.
|
||||||
// TODO? remove the MTU updating part? That should never happen with TCP peers, and the old UDP code that caused it was removed (and if replaced, should be replaced with something that can reliably send messages with an arbitrary size).
|
// TODO? remove the MTU updating part? That should never happen with TCP peers, and the old UDP code that caused it was removed (and if replaced, should be replaced with something that can reliably send messages with an arbitrary size).
|
||||||
func (sinfo *sessionInfo) doRecv(p *wire_trafficPacket) {
|
func (sinfo *sessionInfo) doRecv(p *wire_trafficPacket) {
|
||||||
defer util_putBytes(p.Payload)
|
defer util.PutBytes(p.Payload)
|
||||||
if !sinfo.nonceIsOK(&p.Nonce) {
|
if !sinfo.nonceIsOK(&p.Nonce) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
bs, isOK := boxOpen(&sinfo.sharedSesKey, p.Payload, &p.Nonce)
|
bs, isOK := crypto.BoxOpen(&sinfo.sharedSesKey, p.Payload, &p.Nonce)
|
||||||
if !isOK {
|
if !isOK {
|
||||||
util_putBytes(bs)
|
util.PutBytes(bs)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
sinfo.updateNonce(&p.Nonce)
|
sinfo.updateNonce(&p.Nonce)
|
||||||
|
@ -16,6 +16,9 @@ import (
|
|||||||
"sync"
|
"sync"
|
||||||
"sync/atomic"
|
"sync/atomic"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
@ -30,16 +33,16 @@ const (
|
|||||||
// The coords represent a path from the root to a node.
|
// The coords represent a path from the root to a node.
|
||||||
// This path is generally part of a spanning tree, except possibly the last hop (it can loop when sending coords to your parent, but they see this and know not to use a looping path).
|
// This path is generally part of a spanning tree, except possibly the last hop (it can loop when sending coords to your parent, but they see this and know not to use a looping path).
|
||||||
type switchLocator struct {
|
type switchLocator struct {
|
||||||
root sigPubKey
|
root crypto.SigPubKey
|
||||||
tstamp int64
|
tstamp int64
|
||||||
coords []switchPort
|
coords []switchPort
|
||||||
}
|
}
|
||||||
|
|
||||||
// Returns true if the first sigPubKey has a higher TreeID.
|
// Returns true if the first sigPubKey has a higher TreeID.
|
||||||
func firstIsBetter(first, second *sigPubKey) bool {
|
func firstIsBetter(first, second *crypto.SigPubKey) bool {
|
||||||
// Higher TreeID is better
|
// Higher TreeID is better
|
||||||
ftid := getTreeID(first)
|
ftid := crypto.GetTreeID(first)
|
||||||
stid := getTreeID(second)
|
stid := crypto.GetTreeID(second)
|
||||||
for idx := 0; idx < len(ftid); idx++ {
|
for idx := 0; idx < len(ftid); idx++ {
|
||||||
if ftid[idx] == stid[idx] {
|
if ftid[idx] == stid[idx] {
|
||||||
continue
|
continue
|
||||||
@ -121,7 +124,7 @@ func (x *switchLocator) isAncestorOf(y *switchLocator) bool {
|
|||||||
|
|
||||||
// Information about a peer, used by the switch to build the tree and eventually make routing decisions.
|
// Information about a peer, used by the switch to build the tree and eventually make routing decisions.
|
||||||
type peerInfo struct {
|
type peerInfo struct {
|
||||||
key sigPubKey // ID of this peer
|
key crypto.SigPubKey // ID of this peer
|
||||||
locator switchLocator // Should be able to respond with signatures upon request
|
locator switchLocator // Should be able to respond with signatures upon request
|
||||||
degree uint64 // Self-reported degree
|
degree uint64 // Self-reported degree
|
||||||
time time.Time // Time this node was last seen
|
time time.Time // Time this node was last seen
|
||||||
@ -159,26 +162,26 @@ type switchData struct {
|
|||||||
// All the information stored by the switch.
|
// All the information stored by the switch.
|
||||||
type switchTable struct {
|
type switchTable struct {
|
||||||
core *Core
|
core *Core
|
||||||
key sigPubKey // Our own key
|
key crypto.SigPubKey // Our own key
|
||||||
time time.Time // Time when locator.tstamp was last updated
|
time time.Time // Time when locator.tstamp was last updated
|
||||||
drop map[sigPubKey]int64 // Tstamp associated with a dropped root
|
drop map[crypto.SigPubKey]int64 // Tstamp associated with a dropped root
|
||||||
mutex sync.RWMutex // Lock for reads/writes of switchData
|
mutex sync.RWMutex // Lock for reads/writes of switchData
|
||||||
parent switchPort // Port of whatever peer is our parent, or self if we're root
|
parent switchPort // Port of whatever peer is our parent, or self if we're root
|
||||||
data switchData //
|
data switchData //
|
||||||
updater atomic.Value // *sync.Once
|
updater atomic.Value // *sync.Once
|
||||||
table atomic.Value // lookupTable
|
table atomic.Value // lookupTable
|
||||||
packetIn chan []byte // Incoming packets for the worker to handle
|
packetIn chan []byte // Incoming packets for the worker to handle
|
||||||
idleIn chan switchPort // Incoming idle notifications from peer links
|
idleIn chan switchPort // Incoming idle notifications from peer links
|
||||||
admin chan func() // Pass a lambda for the admin socket to query stuff
|
admin chan func() // Pass a lambda for the admin socket to query stuff
|
||||||
queues switch_buffers // Queues - not atomic so ONLY use through admin chan
|
queues switch_buffers // Queues - not atomic so ONLY use through admin chan
|
||||||
queueTotalMaxSize uint64 // Maximum combined size of queues
|
queueTotalMaxSize uint64 // Maximum combined size of queues
|
||||||
}
|
}
|
||||||
|
|
||||||
// Minimum allowed total size of switch queues.
|
// Minimum allowed total size of switch queues.
|
||||||
const SwitchQueueTotalMinSize = 4 * 1024 * 1024
|
const SwitchQueueTotalMinSize = 4 * 1024 * 1024
|
||||||
|
|
||||||
// Initializes the switchTable struct.
|
// Initializes the switchTable struct.
|
||||||
func (t *switchTable) init(core *Core, key sigPubKey) {
|
func (t *switchTable) init(core *Core, key crypto.SigPubKey) {
|
||||||
now := time.Now()
|
now := time.Now()
|
||||||
t.core = core
|
t.core = core
|
||||||
t.key = key
|
t.key = key
|
||||||
@ -187,7 +190,7 @@ func (t *switchTable) init(core *Core, key sigPubKey) {
|
|||||||
t.data = switchData{locator: locator, peers: peers}
|
t.data = switchData{locator: locator, peers: peers}
|
||||||
t.updater.Store(&sync.Once{})
|
t.updater.Store(&sync.Once{})
|
||||||
t.table.Store(lookupTable{})
|
t.table.Store(lookupTable{})
|
||||||
t.drop = make(map[sigPubKey]int64)
|
t.drop = make(map[crypto.SigPubKey]int64)
|
||||||
t.packetIn = make(chan []byte, 1024)
|
t.packetIn = make(chan []byte, 1024)
|
||||||
t.idleIn = make(chan switchPort, 1024)
|
t.idleIn = make(chan switchPort, 1024)
|
||||||
t.admin = make(chan func())
|
t.admin = make(chan func())
|
||||||
@ -302,7 +305,7 @@ func (t *switchTable) cleanDropped() {
|
|||||||
// This is exchanged with peers to construct the spanning tree.
|
// This is exchanged with peers to construct the spanning tree.
|
||||||
// A subset of this information, excluding the signatures, is used to construct locators that are used elsewhere in the code.
|
// A subset of this information, excluding the signatures, is used to construct locators that are used elsewhere in the code.
|
||||||
type switchMsg struct {
|
type switchMsg struct {
|
||||||
Root sigPubKey
|
Root crypto.SigPubKey
|
||||||
TStamp int64
|
TStamp int64
|
||||||
Hops []switchMsgHop
|
Hops []switchMsgHop
|
||||||
}
|
}
|
||||||
@ -310,8 +313,8 @@ type switchMsg struct {
|
|||||||
// This represents the signed information about the path leading from the root the Next node, via the Port specified here.
|
// This represents the signed information about the path leading from the root the Next node, via the Port specified here.
|
||||||
type switchMsgHop struct {
|
type switchMsgHop struct {
|
||||||
Port switchPort
|
Port switchPort
|
||||||
Next sigPubKey
|
Next crypto.SigPubKey
|
||||||
Sig sigBytes
|
Sig crypto.SigBytes
|
||||||
}
|
}
|
||||||
|
|
||||||
// This returns a *switchMsg to a copy of this node's current switchMsg, which can safely have additional information appended to Hops and sent to a peer.
|
// This returns a *switchMsg to a copy of this node's current switchMsg, which can safely have additional information appended to Hops and sent to a peer.
|
||||||
@ -690,7 +693,7 @@ func (b *switch_buffers) cleanup(t *switchTable) {
|
|||||||
coords := switch_getPacketCoords(packet.bytes)
|
coords := switch_getPacketCoords(packet.bytes)
|
||||||
if t.selfIsClosest(coords) {
|
if t.selfIsClosest(coords) {
|
||||||
for _, packet := range buf.packets {
|
for _, packet := range buf.packets {
|
||||||
util_putBytes(packet.bytes)
|
util.PutBytes(packet.bytes)
|
||||||
}
|
}
|
||||||
b.size -= buf.size
|
b.size -= buf.size
|
||||||
delete(b.bufs, streamID)
|
delete(b.bufs, streamID)
|
||||||
@ -710,7 +713,7 @@ func (b *switch_buffers) cleanup(t *switchTable) {
|
|||||||
packet, buf.packets = buf.packets[0], buf.packets[1:]
|
packet, buf.packets = buf.packets[0], buf.packets[1:]
|
||||||
buf.size -= uint64(len(packet.bytes))
|
buf.size -= uint64(len(packet.bytes))
|
||||||
b.size -= uint64(len(packet.bytes))
|
b.size -= uint64(len(packet.bytes))
|
||||||
util_putBytes(packet.bytes)
|
util.PutBytes(packet.bytes)
|
||||||
if len(buf.packets) == 0 {
|
if len(buf.packets) == 0 {
|
||||||
delete(b.bufs, streamID)
|
delete(b.bufs, streamID)
|
||||||
} else {
|
} else {
|
||||||
|
@ -25,6 +25,10 @@ import (
|
|||||||
"time"
|
"time"
|
||||||
|
|
||||||
"golang.org/x/net/proxy"
|
"golang.org/x/net/proxy"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
const tcp_msgSize = 2048 + 65535 // TODO figure out what makes sense
|
const tcp_msgSize = 2048 + 65535 // TODO figure out what makes sense
|
||||||
@ -44,8 +48,8 @@ type tcpInterface struct {
|
|||||||
// This is used as the key to a map that tracks existing connections, to prevent multiple connections to the same keys and local/remote address pair from occuring.
|
// This is used as the key to a map that tracks existing connections, to prevent multiple connections to the same keys and local/remote address pair from occuring.
|
||||||
// Different address combinations are allowed, so multi-homing is still technically possible (but not necessarily advisable).
|
// Different address combinations are allowed, so multi-homing is still technically possible (but not necessarily advisable).
|
||||||
type tcpInfo struct {
|
type tcpInfo struct {
|
||||||
box boxPubKey
|
box crypto.BoxPubKey
|
||||||
sig sigPubKey
|
sig crypto.SigPubKey
|
||||||
localAddr string
|
localAddr string
|
||||||
remoteAddr string
|
remoteAddr string
|
||||||
}
|
}
|
||||||
@ -211,7 +215,7 @@ func (iface *tcpInterface) handler(sock net.Conn, incoming bool) {
|
|||||||
defer sock.Close()
|
defer sock.Close()
|
||||||
iface.setExtraOptions(sock)
|
iface.setExtraOptions(sock)
|
||||||
// Get our keys
|
// Get our keys
|
||||||
myLinkPub, myLinkPriv := newBoxKeys() // ephemeral link keys
|
myLinkPub, myLinkPriv := crypto.NewBoxKeys() // ephemeral link keys
|
||||||
meta := version_getBaseMetadata()
|
meta := version_getBaseMetadata()
|
||||||
meta.box = iface.core.boxPub
|
meta.box = iface.core.boxPub
|
||||||
meta.sig = iface.core.sigPub
|
meta.sig = iface.core.sigPub
|
||||||
@ -292,7 +296,7 @@ func (iface *tcpInterface) handler(sock net.Conn, incoming bool) {
|
|||||||
}()
|
}()
|
||||||
// Note that multiple connections to the same node are allowed
|
// Note that multiple connections to the same node are allowed
|
||||||
// E.g. over different interfaces
|
// E.g. over different interfaces
|
||||||
p := iface.core.peers.newPeer(&info.box, &info.sig, getSharedKey(myLinkPriv, &meta.link), sock.RemoteAddr().String())
|
p := iface.core.peers.newPeer(&info.box, &info.sig, crypto.GetSharedKey(myLinkPriv, &meta.link), sock.RemoteAddr().String())
|
||||||
p.linkOut = make(chan []byte, 1)
|
p.linkOut = make(chan []byte, 1)
|
||||||
in := func(bs []byte) {
|
in := func(bs []byte) {
|
||||||
p.handlePacket(bs)
|
p.handlePacket(bs)
|
||||||
@ -306,7 +310,7 @@ func (iface *tcpInterface) handler(sock net.Conn, incoming bool) {
|
|||||||
buf := net.Buffers{tcp_msg[:], msgLen, msg}
|
buf := net.Buffers{tcp_msg[:], msgLen, msg}
|
||||||
buf.WriteTo(sock)
|
buf.WriteTo(sock)
|
||||||
atomic.AddUint64(&p.bytesSent, uint64(len(tcp_msg)+len(msgLen)+len(msg)))
|
atomic.AddUint64(&p.bytesSent, uint64(len(tcp_msg)+len(msgLen)+len(msg)))
|
||||||
util_putBytes(msg)
|
util.PutBytes(msg)
|
||||||
}
|
}
|
||||||
timerInterval := tcp_ping_interval
|
timerInterval := tcp_ping_interval
|
||||||
timer := time.NewTimer(timerInterval)
|
timer := time.NewTimer(timerInterval)
|
||||||
@ -354,8 +358,8 @@ func (iface *tcpInterface) handler(sock net.Conn, incoming bool) {
|
|||||||
}()
|
}()
|
||||||
us, _, _ := net.SplitHostPort(sock.LocalAddr().String())
|
us, _, _ := net.SplitHostPort(sock.LocalAddr().String())
|
||||||
them, _, _ := net.SplitHostPort(sock.RemoteAddr().String())
|
them, _, _ := net.SplitHostPort(sock.RemoteAddr().String())
|
||||||
themNodeID := getNodeID(&info.box)
|
themNodeID := crypto.GetNodeID(&info.box)
|
||||||
themAddr := address_addrForNodeID(themNodeID)
|
themAddr := address.AddrForNodeID(themNodeID)
|
||||||
themAddrString := net.IP(themAddr[:]).String()
|
themAddrString := net.IP(themAddr[:]).String()
|
||||||
themString := fmt.Sprintf("%s@%s", themAddrString, them)
|
themString := fmt.Sprintf("%s@%s", themAddrString, them)
|
||||||
iface.core.log.Println("Connected:", themString, "source", us)
|
iface.core.log.Println("Connected:", themString, "source", us)
|
||||||
@ -390,9 +394,9 @@ func (iface *tcpInterface) reader(sock net.Conn, in func([]byte)) error {
|
|||||||
// We didn't get the whole message yet
|
// We didn't get the whole message yet
|
||||||
break
|
break
|
||||||
}
|
}
|
||||||
newMsg := append(util_getBytes(), msg...)
|
newMsg := append(util.GetBytes(), msg...)
|
||||||
in(newMsg)
|
in(newMsg)
|
||||||
util_yield()
|
util.Yield()
|
||||||
}
|
}
|
||||||
frag = append(bs[:0], frag...)
|
frag = append(bs[:0], frag...)
|
||||||
}
|
}
|
||||||
|
@ -10,7 +10,9 @@ import (
|
|||||||
"github.com/songgao/packets/ethernet"
|
"github.com/songgao/packets/ethernet"
|
||||||
"github.com/yggdrasil-network/water"
|
"github.com/yggdrasil-network/water"
|
||||||
|
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||||
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
const tun_IPv6_HEADER_LENGTH = 40
|
const tun_IPv6_HEADER_LENGTH = 40
|
||||||
@ -80,7 +82,7 @@ func (tun *tunAdapter) write() error {
|
|||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
if tun.iface.IsTAP() {
|
if tun.iface.IsTAP() {
|
||||||
var destAddr address
|
var destAddr address.Address
|
||||||
if data[0]&0xf0 == 0x60 {
|
if data[0]&0xf0 == 0x60 {
|
||||||
if len(data) < 40 {
|
if len(data) < 40 {
|
||||||
panic("Tried to send a packet shorter than an IPv6 header...")
|
panic("Tried to send a packet shorter than an IPv6 header...")
|
||||||
@ -94,7 +96,7 @@ func (tun *tunAdapter) write() error {
|
|||||||
} else {
|
} else {
|
||||||
return errors.New("Invalid address family")
|
return errors.New("Invalid address family")
|
||||||
}
|
}
|
||||||
sendndp := func(destAddr address) {
|
sendndp := func(destAddr address.Address) {
|
||||||
neigh, known := tun.icmpv6.peermacs[destAddr]
|
neigh, known := tun.icmpv6.peermacs[destAddr]
|
||||||
known = known && (time.Since(neigh.lastsolicitation).Seconds() < 30)
|
known = known && (time.Since(neigh.lastsolicitation).Seconds() < 30)
|
||||||
if !known {
|
if !known {
|
||||||
@ -154,7 +156,7 @@ func (tun *tunAdapter) write() error {
|
|||||||
panic(err)
|
panic(err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
util_putBytes(data)
|
util.PutBytes(data)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -191,7 +193,7 @@ func (tun *tunAdapter) read() error {
|
|||||||
// tun.icmpv6.recv <- b
|
// tun.icmpv6.recv <- b
|
||||||
go tun.icmpv6.parse_packet(b)
|
go tun.icmpv6.parse_packet(b)
|
||||||
}
|
}
|
||||||
packet := append(util_getBytes(), buf[o:n]...)
|
packet := append(util.GetBytes(), buf[o:n]...)
|
||||||
tun.send <- packet
|
tun.send <- packet
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -4,6 +4,8 @@ package yggdrasil
|
|||||||
// Used in the inital connection setup and key exchange
|
// Used in the inital connection setup and key exchange
|
||||||
// Some of this could arguably go in wire.go instead
|
// Some of this could arguably go in wire.go instead
|
||||||
|
|
||||||
|
import "github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
|
||||||
// This is the version-specific metadata exchanged at the start of a connection.
|
// This is the version-specific metadata exchanged at the start of a connection.
|
||||||
// It must always beign with the 4 bytes "meta" and a wire formatted uint64 major version number.
|
// It must always beign with the 4 bytes "meta" and a wire formatted uint64 major version number.
|
||||||
// The current version also includes a minor version number, and the box/sig/link keys that need to be exchanged to open an connection.
|
// The current version also includes a minor version number, and the box/sig/link keys that need to be exchanged to open an connection.
|
||||||
@ -12,9 +14,9 @@ type version_metadata struct {
|
|||||||
ver uint64 // 1 byte in this version
|
ver uint64 // 1 byte in this version
|
||||||
// Everything after this point potentially depends on the version number, and is subject to change in future versions
|
// Everything after this point potentially depends on the version number, and is subject to change in future versions
|
||||||
minorVer uint64 // 1 byte in this version
|
minorVer uint64 // 1 byte in this version
|
||||||
box boxPubKey
|
box crypto.BoxPubKey
|
||||||
sig sigPubKey
|
sig crypto.SigPubKey
|
||||||
link boxPubKey
|
link crypto.BoxPubKey
|
||||||
}
|
}
|
||||||
|
|
||||||
// Gets a base metadata with no keys set, but with the correct version numbers.
|
// Gets a base metadata with no keys set, but with the correct version numbers.
|
||||||
@ -28,12 +30,12 @@ func version_getBaseMetadata() version_metadata {
|
|||||||
|
|
||||||
// Gest the length of the metadata for this version, used to know how many bytes to read from the start of a connection.
|
// Gest the length of the metadata for this version, used to know how many bytes to read from the start of a connection.
|
||||||
func version_getMetaLength() (mlen int) {
|
func version_getMetaLength() (mlen int) {
|
||||||
mlen += 4 // meta
|
mlen += 4 // meta
|
||||||
mlen += 1 // ver, as long as it's < 127, which it is in this version
|
mlen += 1 // ver, as long as it's < 127, which it is in this version
|
||||||
mlen += 1 // minorVer, as long as it's < 127, which it is in this version
|
mlen += 1 // minorVer, as long as it's < 127, which it is in this version
|
||||||
mlen += boxPubKeyLen // box
|
mlen += crypto.BoxPubKeyLen // box
|
||||||
mlen += sigPubKeyLen // sig
|
mlen += crypto.SigPubKeyLen // sig
|
||||||
mlen += boxPubKeyLen // link
|
mlen += crypto.BoxPubKeyLen // link
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -7,6 +7,11 @@ package yggdrasil
|
|||||||
|
|
||||||
// Packet types, as wire_encode_uint64(type) at the start of each packet
|
// Packet types, as wire_encode_uint64(type) at the start of each packet
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||||
|
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||||
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
wire_Traffic = iota // data being routed somewhere, handle for crypto
|
wire_Traffic = iota // data being routed somewhere, handle for crypto
|
||||||
wire_ProtocolTraffic // protocol traffic, pub keys for crypto
|
wire_ProtocolTraffic // protocol traffic, pub keys for crypto
|
||||||
@ -193,14 +198,14 @@ func wire_chop_uint64(toUInt64 *uint64, fromSlice *[]byte) bool {
|
|||||||
// The wire format for ordinary IPv6 traffic encapsulated by the network.
|
// The wire format for ordinary IPv6 traffic encapsulated by the network.
|
||||||
type wire_trafficPacket struct {
|
type wire_trafficPacket struct {
|
||||||
Coords []byte
|
Coords []byte
|
||||||
Handle handle
|
Handle crypto.Handle
|
||||||
Nonce boxNonce
|
Nonce crypto.BoxNonce
|
||||||
Payload []byte
|
Payload []byte
|
||||||
}
|
}
|
||||||
|
|
||||||
// Encodes a wire_trafficPacket into its wire format.
|
// Encodes a wire_trafficPacket into its wire format.
|
||||||
func (p *wire_trafficPacket) encode() []byte {
|
func (p *wire_trafficPacket) encode() []byte {
|
||||||
bs := util_getBytes()
|
bs := util.GetBytes()
|
||||||
bs = wire_put_uint64(wire_Traffic, bs)
|
bs = wire_put_uint64(wire_Traffic, bs)
|
||||||
bs = wire_put_coords(p.Coords, bs)
|
bs = wire_put_coords(p.Coords, bs)
|
||||||
bs = append(bs, p.Handle[:]...)
|
bs = append(bs, p.Handle[:]...)
|
||||||
@ -224,16 +229,16 @@ func (p *wire_trafficPacket) decode(bs []byte) bool {
|
|||||||
case !wire_chop_slice(p.Nonce[:], &bs):
|
case !wire_chop_slice(p.Nonce[:], &bs):
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
p.Payload = append(util_getBytes(), bs...)
|
p.Payload = append(util.GetBytes(), bs...)
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
// The wire format for protocol traffic, such as dht req/res or session ping/pong packets.
|
// The wire format for protocol traffic, such as dht req/res or session ping/pong packets.
|
||||||
type wire_protoTrafficPacket struct {
|
type wire_protoTrafficPacket struct {
|
||||||
Coords []byte
|
Coords []byte
|
||||||
ToKey boxPubKey
|
ToKey crypto.BoxPubKey
|
||||||
FromKey boxPubKey
|
FromKey crypto.BoxPubKey
|
||||||
Nonce boxNonce
|
Nonce crypto.BoxNonce
|
||||||
Payload []byte
|
Payload []byte
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -275,7 +280,7 @@ func (p *wire_protoTrafficPacket) decode(bs []byte) bool {
|
|||||||
// The keys themselves are exchanged as part of the connection setup, and then omitted from the packets.
|
// The keys themselves are exchanged as part of the connection setup, and then omitted from the packets.
|
||||||
// The two layer logic is handled in peers.go, but it's kind of ugly.
|
// The two layer logic is handled in peers.go, but it's kind of ugly.
|
||||||
type wire_linkProtoTrafficPacket struct {
|
type wire_linkProtoTrafficPacket struct {
|
||||||
Nonce boxNonce
|
Nonce crypto.BoxNonce
|
||||||
Payload []byte
|
Payload []byte
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user