mirror of
https://github.com/cwinfo/yggdrasil-go.git
synced 2024-11-22 04:50:29 +00:00
Neil Alexander
GitHub
commit
c11f08f2a3
@ -1,11 +1,11 @@
|
||||
# Golang CircleCI 2.0 configuration file
|
||||
#
|
||||
# Check https://circleci.com/docs/2.0/language-go/ for more details
|
||||
version: 2
|
||||
version: 2.1
|
||||
jobs:
|
||||
build-linux:
|
||||
docker:
|
||||
- image: circleci/golang:1.11
|
||||
- image: circleci/golang:1.12
|
||||
|
||||
steps:
|
||||
- checkout
|
||||
@ -79,17 +79,17 @@ jobs:
|
||||
echo -e "Host *\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
|
||||
|
||||
- run:
|
||||
name: Install Go 1.11
|
||||
name: Install Go 1.12
|
||||
command: |
|
||||
cd /tmp
|
||||
curl -LO https://dl.google.com/go/go1.11.5.darwin-amd64.pkg
|
||||
sudo installer -pkg /tmp/go1.11.5.darwin-amd64.pkg -target /
|
||||
curl -LO https://dl.google.com/go/go1.12.darwin-amd64.pkg
|
||||
sudo installer -pkg /tmp/go1.12.darwin-amd64.pkg -target /
|
||||
|
||||
- run:
|
||||
name: Install Gomobile
|
||||
command: |
|
||||
GO111MODULE=off go get golang.org/x/mobile/cmd/gomobile
|
||||
gomobile init
|
||||
#- run:
|
||||
# name: Install Gomobile
|
||||
# command: |
|
||||
# GO111MODULE=off go get golang.org/x/mobile/cmd/gomobile
|
||||
# gomobile init
|
||||
|
||||
- run:
|
||||
name: Build for macOS
|
||||
@ -119,7 +119,7 @@ jobs:
|
||||
|
||||
build-other:
|
||||
docker:
|
||||
- image: circleci/golang:1.11
|
||||
- image: circleci/golang:1.12
|
||||
|
||||
steps:
|
||||
- checkout
|
||||
@ -178,8 +178,8 @@ jobs:
|
||||
destination: /
|
||||
|
||||
workflows:
|
||||
version: 2
|
||||
build-all:
|
||||
version: 2.1
|
||||
build:
|
||||
jobs:
|
||||
- build-linux
|
||||
- build-macos
|
||||
|
||||
3
.gitmodules
vendored
Normal file
3
.gitmodules
vendored
Normal file
@ -0,0 +1,3 @@
|
||||
[submodule "doc/yggdrasil-network.github.io"]
|
||||
path = doc/yggdrasil-network.github.io
|
||||
url = https://github.com/yggdrasil-network/yggdrasil-network.github.io/
|
||||
@ -25,6 +25,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
||||
- in case of vulnerabilities.
|
||||
-->
|
||||
|
||||
## [0.3.5] - 2019-03-13
|
||||
### Fixed
|
||||
- The `AllowedEncryptionPublicKeys` option has now been fixed to handle incoming connections properly and no longer blocks outgoing connections (this was broken in v0.3.4)
|
||||
- Multicast TCP listeners will now be stopped correctly when the link-local address on the interface changes or disappears altogether
|
||||
|
||||
## [0.3.4] - 2019-03-12
|
||||
### Added
|
||||
- Support for multiple listeners (although currently only TCP listeners are supported)
|
||||
|
||||
200
README.md
200
README.md
@ -3,149 +3,121 @@
|
||||
[](https://circleci.com/gh/yggdrasil-network/yggdrasil-go)
|
||||
|
||||
## What is it?
|
||||
## Introduction
|
||||
|
||||
This is a toy implementation of an encrypted IPv6 network, with many good ideas stolen from [cjdns](https://github.com/cjdelisle/cjdns), which was written to test a particular routing scheme that was cobbled together one random afternoon.
|
||||
It's notably not a shortest path routing scheme, with the goal of scalable name-independent routing on dynamic networks with an internet-like topology.
|
||||
It's named Yggdrasil after the world tree from Norse mythology, because that seemed like the obvious name given how it works.
|
||||
More information is available at <https://yggdrasil-network.github.io/>.
|
||||
Yggdrasil is an early-stage implementation of a fully end-to-end encrypted IPv6
|
||||
network. It is lightweight, self-arranging, supported on multiple platforms and
|
||||
allows pretty much any IPv6-capable application to communicate securely with
|
||||
other Yggdrasil nodes. Yggdrasil does not require you to have IPv6 Internet
|
||||
connectivity - it also works over IPv4.
|
||||
|
||||
This is a toy / proof-of-principle, and considered alpha quality by the developers. It's not expected to be feature complete, and future updates may not be backwards compatible, though it should warn you if it sees a connection attempt with a node running a newer version.
|
||||
You're encouraged to play with it, but it is strongly advised not to use it for anything mission critical.
|
||||
Although Yggdrasil shares many similarities with
|
||||
[cjdns](https://github.com/cjdelisle/cjdns), it employs a different routing
|
||||
algorithm based on a globally-agreed spanning tree and greedy routing in a
|
||||
metric space, and aims to implement some novel local backpressure routing
|
||||
techniques. In theory, Yggdrasil should scale well on networks with
|
||||
internet-like topologies.
|
||||
|
||||
## Supported Platforms
|
||||
|
||||
We actively support the following platforms, and packages are available for
|
||||
some of the below:
|
||||
|
||||
- Linux
|
||||
- `.deb` and `.rpm` packages are built by CI for Debian and Red Hat-based
|
||||
distributions
|
||||
- Void and Arch packages also available within their respective repositories
|
||||
- macOS
|
||||
- `.pkg` packages are built by CI
|
||||
- Ubiquiti EdgeOS
|
||||
- `.deb` Vyatta packages are built by CI
|
||||
- Windows
|
||||
- FreeBSD
|
||||
- OpenBSD
|
||||
- NetBSD
|
||||
|
||||
Please see our [Platforms](https://yggdrasil-network.github.io/) pages for more
|
||||
specific information about each of our supported platforms, including
|
||||
installation steps and caveats.
|
||||
|
||||
You may also find other platform-specific wrappers, scripts or tools in the
|
||||
`contrib` folder.
|
||||
|
||||
## Building
|
||||
|
||||
1. Install Go (requires 1.11 or later, [godeb](https://github.com/niemeyer/godeb) is recommended for Debian-based Linux distributions).
|
||||
2. Clone this repository.
|
||||
2. `./build`
|
||||
If you want to build from source, as opposed to installing one of the pre-built
|
||||
packages:
|
||||
|
||||
Note that you can cross-compile for other platforms and architectures by specifying the `$GOOS` and `$GOARCH` environment variables, for example, `GOOS=windows ./build` or `GOOS=linux GOARCH=mipsle ./build`.
|
||||
1. Install [Go](https://golang.org) (requires Go 1.11 or later)
|
||||
2. Clone this repository
|
||||
2. Run `./build`
|
||||
|
||||
The build script sets its own `$GOPATH`, so the build environment is self-contained.
|
||||
Note that you can cross-compile for other platforms and architectures by
|
||||
specifying the `GOOS` and `GOARCH` environment variables, e.g. `GOOS=windows
|
||||
./build` or `GOOS=linux GOARCH=mipsle ./build`.
|
||||
|
||||
## Running
|
||||
|
||||
To run the program, you'll need permission to create a `tun` device and configure it using `ip`.
|
||||
If you don't want to mess with capabilities for the `tun` device, then using `sudo` should work, with the usual security caveats about running a program as root.
|
||||
### Generate configuration
|
||||
|
||||
To run with default settings:
|
||||
To generate static configuration, either generate a HJSON file (human-friendly,
|
||||
complete with comments):
|
||||
|
||||
1. `./yggdrasil --autoconf`
|
||||
|
||||
That will generate a new set of keys (and an IP address) each time the program is run.
|
||||
The program will bind to all addresses on a random port and listen for incoming connections.
|
||||
It will send announcements over IPv6 link-local multicast, and it will attempt to start a connection if it hears an announcement from another device.
|
||||
|
||||
In practice, you probably want to run this instead:
|
||||
|
||||
1. `./yggdrasil --genconf > conf.json`
|
||||
2. `./yggdrasil --useconf < conf.json`
|
||||
|
||||
This keeps a persistent set of keys (and by extension, IP address) and gives you the option of editing the configuration file.
|
||||
If you want to use it as an overlay network on top of e.g. the internet, then you can do so by adding the remote devices domain/address and port (as a string, e.g. `"1.2.3.4:5678"`) to the list of `Peers` in the configuration file.
|
||||
By default, it peers over TCP (which can be forced with `"tcp://1.2.3.4:5678"` syntax), but it's also possible to connect over a socks proxy (`"socks://socksHost:socksPort/1.2.3.4:5678"`).
|
||||
The socks proxy approach is useful for e.g. [peering over tor hidden services](https://github.com/yggdrasil-network/public-peers/blob/master/other/tor.md).
|
||||
UDP support was removed as part of v0.2, and may be replaced by a better implementation at a later date.
|
||||
|
||||
### Platforms
|
||||
|
||||
#### Linux
|
||||
|
||||
- Should work out of the box on most Linux distributions with `iproute2` installed.
|
||||
- systemd service scripts are included in the `contrib/systemd/` folder so that it runs automatically in the background (using `/etc/yggdrasil.conf` for configuration), copy the service files into `/etc/systemd/system`, copy `yggdrasil` into your `$PATH`, i.e. `/usr/bin`, and then enable the service:
|
||||
```
|
||||
systemctl enable yggdrasil
|
||||
systemctl start yggdrasil
|
||||
```
|
||||
- Once installed as a systemd service, you can read the `yggdrasil` output:
|
||||
```
|
||||
systemctl status yggdrasil
|
||||
journalctl -u yggdrasil
|
||||
./yggdrasil -genconf > /path/to/yggdrasil.conf
|
||||
```
|
||||
|
||||
#### macOS
|
||||
... or generate a plain JSON file (which is easy to manipulate
|
||||
programmatically):
|
||||
|
||||
- Tested and working out of the box on macOS 10.13 High Sierra.
|
||||
- May work in theory on any macOS version with `utun` support (which was added in macOS 10.7 Lion), although this is untested at present.
|
||||
- TAP mode is not supported on macOS.
|
||||
|
||||
#### FreeBSD, NetBSD
|
||||
|
||||
- Works in TAP mode, but currently doesn't work in TUN mode.
|
||||
- You may need to create the TAP adapter first if it doesn't already exist, i.e. `ifconfig tap0 create`.
|
||||
|
||||
#### OpenBSD
|
||||
|
||||
- Works in TAP mode, but currently doesn't work in TUN mode.
|
||||
- You may need to create the TAP adapter first if it doesn't already exist, i.e. `ifconfig tap0 create`.
|
||||
- OpenBSD is not capable of listening on both IPv4 and IPv6 at the same time on the same socket (unlike FreeBSD and NetBSD). This affects the `Listen` and `AdminListen` configuration options. You will need to set `Listen` and `AdminListen` to use either an IPv4 or an IPv6 address.
|
||||
- You may consider using [relayd](https://man.openbsd.org/relayd.8) to allow incoming Yggdrasil connections on both IPv4 and IPv6 simultaneously.
|
||||
|
||||
#### Windows
|
||||
|
||||
- Tested and working on Windows 7 and Windows 10, and should work on any recent versions of Windows, but it depends on the [OpenVPN TAP driver](https://openvpn.net/index.php/open-source/downloads.html) being installed first.
|
||||
- Has been proven to work with both the [NDIS 5](https://swupdate.openvpn.org/community/releases/tap-windows-9.9.2_3.exe) (`tap-windows-9.9.2_3`) driver and the [NDIS 6](https://swupdate.openvpn.org/community/releases/tap-windows-9.21.2.exe) (`tap-windows-9.21.2`) driver, however there are substantial performance issues with the NDIS 6 driver therefore it is recommended to use the NDIS 5 driver instead.
|
||||
- Be aware that connectivity issues can occur on Windows if multiple IPv6 addresses from the `200::/7` prefix are assigned to the TAP interface. If this happens, then you may need to manually remove the old/unused addresses from the interface (though the code has a workaround in place to do this automatically in some cases).
|
||||
- TUN mode is not supported on Windows.
|
||||
- Yggdrasil can be installed as a Windows service so that it runs automatically in the background. From an Administrator Command Prompt:
|
||||
```
|
||||
sc create yggdrasil binpath= "\"C:\path\to\yggdrasil.exe\" -useconffile \"C:\path\to\yggdrasil.conf\""
|
||||
sc config yggdrasil displayname= "Yggdrasil Service"
|
||||
sc config yggdrasil start= "auto"
|
||||
sc start yggdrasil
|
||||
```
|
||||
- Alternatively, if you want the service to autoconfigure instead of using an `yggdrasil.conf`, replace the `sc create` line from above with:
|
||||
```
|
||||
sc create yggdrasil binpath= "\"C:\path\to\yggdrasil.exe\" -autoconf"
|
||||
./yggdrasil -genconf -json > /path/to/yggdrasil.conf
|
||||
```
|
||||
|
||||
#### EdgeRouter
|
||||
You will need to edit the `yggdrasil.conf` file to add or remove peers, modify
|
||||
other configuration such as listen addresses or multicast addresses, etc.
|
||||
|
||||
- Tested and working on the EdgeRouter X, using the [vyatta-yggdrasil](https://github.com/neilalexander/vyatta-yggdrasil) wrapper package.
|
||||
### Run Yggdrasil
|
||||
|
||||
## Optional: advertise a prefix locally
|
||||
|
||||
Suppose a node has generated the address: `200:1111:2222:3333:4444:5555:6666:7777`
|
||||
|
||||
Then the node may also use addresses from the prefix: `300:1111:2222:3333::/64` (note the `200` changed to `300`, a separate `/8` is used for prefixes, but the rest of the first 64 bits are the same).
|
||||
|
||||
To advertise this prefix and a route to `200::/7`, the following seems to work on the developers' networks:
|
||||
|
||||
1. Enable IPv6 forwarding (e.g. `sysctl -w net.ipv6.conf.all.forwarding=1` or add it to sysctl.conf).
|
||||
|
||||
2. `ip addr add 300:1111:2222:3333::1/64 dev eth0` or similar, to assign an address for the router to use in that prefix, where the LAN is reachable through `eth0`.
|
||||
|
||||
3. Install/run `radvd` with something like the following in `/etc/radvd.conf`:
|
||||
To run with the generated static configuration:
|
||||
```
|
||||
interface eth0
|
||||
{
|
||||
AdvSendAdvert on;
|
||||
prefix 300:1111:2222:3333::/64 {
|
||||
AdvOnLink on;
|
||||
AdvAutonomous on;
|
||||
};
|
||||
route 200::/7 {};
|
||||
};
|
||||
./yggdrasil -useconffile /path/to/yggdrasil.conf
|
||||
```
|
||||
|
||||
This is enough to give unsupported devices on the LAN access to the yggdrasil network. See the [configuration](https://yggdrasil-network.github.io/configuration.html) page for more info.
|
||||
To run in auto-configuration mode (which will use sane defaults and random keys
|
||||
at each startup, instead of using a static configuration file):
|
||||
|
||||
## How does it work?
|
||||
```
|
||||
./yggdrasil -autoconf
|
||||
```
|
||||
|
||||
I'd rather not try to explain in the readme, but it is described further on the [about](https://yggdrasil-network.github.io/about.html) page, so you can check there if you're interested.
|
||||
Be warned that it's still not a very good explanation, but it at least gives a high-level overview and links to some relevant work by other people.
|
||||
You will likely need to run Yggdrasil as a privileged user or under `sudo`,
|
||||
unless you have permission to create TUN/TAP adapters. On Linux this can be done
|
||||
by giving the Yggdrasil binary the `CAP_NET_ADMIN` capability.
|
||||
|
||||
## Obligatory performance propaganda
|
||||
## Documentation
|
||||
|
||||
A [simplified model](misc/sim/treesim-forward.py) of this routing scheme has been tested in simulation on the 9204-node [skitter](https://www.caida.org/tools/measurement/skitter/) network topology dataset from [caida](https://www.caida.org/), and compared with results in [arxiv:0708.2309](https://arxiv.org/abs/0708.2309).
|
||||
Using the routing scheme as implemented in this code, the average multiplicative stretch is observed to be about 1.08, with an average routing table size of 6 for a name-dependent scheme, and approximately 30 additional (but smaller) entries needed for the name-independent routing table.
|
||||
The number of name-dependent routing table entries needed is proportional to node degree, so that 6 is the mean of a distribution with a long tail, but this may be an acceptable tradeoff(it's at least worth trying, hence this code).
|
||||
The size of name-dependent routing table entries is relatively large, due to cryptographic signatures associated with routing table updates, but in the absence of cryptographic overhead, each entry should otherwise be comparable in size to the BC routing scheme described in the above paper.
|
||||
A modified version of this scheme, with the same resource requirements, achieves a multiplicative stretch of 1.02, which drops to 1.01 if source routing is used.
|
||||
Both of these optimizations are not present in the current implementation, as the former depends on network state information that appears difficult to cryptographically secure, and the latter optimization is both tedious to implement and would make debugging other aspects of the implementation more difficult.
|
||||
Documentation is available on our [GitHub
|
||||
Pages](https://yggdrasil-network.github.io) site, or in the base submodule
|
||||
repository within `doc/yggdrasil-network.github.io`.
|
||||
|
||||
- [Configuration file options](https://yggdrasil-network.github.io/configuration.html)
|
||||
- [Platform-specific documentation](https://yggdrasil-network.github.io/platforms.html)
|
||||
- [Frequently asked questions](https://yggdrasil-network.github.io/faq.html)
|
||||
- [Admin API documentation](https://yggdrasil-network.github.io/admin.html)
|
||||
- [Version changelog](CHANGELOG.md)
|
||||
|
||||
## Community
|
||||
|
||||
Feel free to join us on our [Matrix
|
||||
channel](https://matrix.to/#/#yggdrasil:matrix.org) at `#yggdrasil:matrix.org`
|
||||
or in the `#yggdrasil` IRC channel on Freenode.
|
||||
|
||||
## License
|
||||
|
||||
This code is released under the terms of the LGPLv3, but with an added exception that was shamelessly taken from [godeb](https://github.com/niemeyer/godeb).
|
||||
Under certain circumstances, this exception permits distribution of binaries that are (statically or dynamically) linked with this code, without requiring the distribution of Minimal Corresponding Source or Minimal Application Code.
|
||||
This code is released under the terms of the LGPLv3, but with an added exception
|
||||
that was shamelessly taken from [godeb](https://github.com/niemeyer/godeb).
|
||||
Under certain circumstances, this exception permits distribution of binaries
|
||||
that are (statically or dynamically) linked with this code, without requiring
|
||||
the distribution of Minimal Corresponding Source or Minimal Application Code.
|
||||
For more details, see: [LICENSE](LICENSE).
|
||||
|
||||
@ -62,7 +62,7 @@ func readConfig(useconf *bool, useconffile *string, normaliseconf *bool) *nodeCo
|
||||
// then parse the configuration we loaded above on top of it. The effect
|
||||
// of this is that any configuration item that is missing from the provided
|
||||
// configuration will use a sane default.
|
||||
cfg := config.GenerateConfig(false)
|
||||
cfg := config.GenerateConfig()
|
||||
var dat map[string]interface{}
|
||||
if err := hjson.Unmarshal(conf, &dat); err != nil {
|
||||
panic(err)
|
||||
@ -154,7 +154,7 @@ func readConfig(useconf *bool, useconffile *string, normaliseconf *bool) *nodeCo
|
||||
// Generates a new configuration and returns it in HJSON format. This is used
|
||||
// with -genconf.
|
||||
func doGenconf(isjson bool) string {
|
||||
cfg := config.GenerateConfig(false)
|
||||
cfg := config.GenerateConfig()
|
||||
var bs []byte
|
||||
var err error
|
||||
if isjson {
|
||||
@ -191,7 +191,7 @@ func main() {
|
||||
case *autoconf:
|
||||
// Use an autoconf-generated config, this will give us random keys and
|
||||
// port numbers, and will use an automatically selected TUN/TAP interface.
|
||||
cfg = config.GenerateConfig(true)
|
||||
cfg = config.GenerateConfig()
|
||||
case *useconffile != "" || *useconf:
|
||||
// Read the configuration from either stdin or from the filesystem
|
||||
cfg = readConfig(useconf, useconffile, normaliseconf)
|
||||
|
||||
1
doc/yggdrasil-network.github.io
Submodule
1
doc/yggdrasil-network.github.io
Submodule
@ -0,0 +1 @@
|
||||
Subproject commit 10672210f2fdce97dd5c301dfeed47284d4a28f2
|
||||
@ -2,9 +2,6 @@ package config
|
||||
|
||||
import (
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"math/rand"
|
||||
"time"
|
||||
|
||||
"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
|
||||
"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
|
||||
@ -12,16 +9,16 @@ import (
|
||||
|
||||
// NodeConfig defines all configuration values needed to run a signle yggdrasil node
|
||||
type NodeConfig struct {
|
||||
Listen []string `comment:"Listen addresses for peer connections. Default is to listen for all\nTCP connections over IPv4 and IPv6 with a random port."`
|
||||
Peers []string `comment:"List of connection strings for outbound peer connections in URI format,\ne.g. tcp://a.b.c.d:e or socks://a.b.c.d:e/f.g.h.i:j. These connections\nwill obey the operating system routing table, therefore you should\nuse this section when you may connect via different interfaces."`
|
||||
InterfacePeers map[string][]string `comment:"List of connection strings for outbound peer connections in URI format,\narranged by source interface, e.g. { \"eth0\": [ tcp://a.b.c.d:e ] }.\nNote that SOCKS peerings will NOT be affected by this option and should\ngo in the \"Peers\" section instead."`
|
||||
Listen []string `comment:"Listen addresses for incoming connections. You will need to add\nlisteners in order to accept incoming peerings from non-local nodes.\nMulticast peer discovery will work regardless of any listeners set\nhere. Each listener should be specified in URI format as above, e.g.\ntcp://0.0.0.0:0 or tcp://[::]:0 to listen on all interfaces."`
|
||||
AdminListen string `comment:"Listen address for admin connections. Default is to listen for local\nconnections either on TCP/9001 or a UNIX socket depending on your\nplatform. Use this value for yggdrasilctl -endpoint=X. To disable\nthe admin socket, use the value \"none\" instead."`
|
||||
Peers []string `comment:"List of connection strings for static peers in URI format, e.g.\ntcp://a.b.c.d:e or socks://a.b.c.d:e/f.g.h.i:j."`
|
||||
InterfacePeers map[string][]string `comment:"List of connection strings for static peers in URI format, arranged\nby source interface, e.g. { \"eth0\": [ tcp://a.b.c.d:e ] }. Note that\nSOCKS peerings will NOT be affected by this option and should go in\nthe \"Peers\" section instead."`
|
||||
AllowedEncryptionPublicKeys []string `comment:"List of peer encryption public keys to allow or incoming TCP\nconnections from. If left empty/undefined then all connections\nwill be allowed by default."`
|
||||
MulticastInterfaces []string `comment:"Regular expressions for which interfaces multicast peer discovery\nshould be enabled on. If none specified, multicast peer discovery is\ndisabled. The default value is .* which uses all interfaces."`
|
||||
AllowedEncryptionPublicKeys []string `comment:"List of peer encryption public keys to allow incoming TCP peering\nconnections from. If left empty/undefined then all connections will\nbe allowed by default. This does not affect outgoing peerings, nor\ndoes it affect link-local peers discovered via multicast."`
|
||||
EncryptionPublicKey string `comment:"Your public encryption key. Your peers may ask you for this to put\ninto their AllowedEncryptionPublicKeys configuration."`
|
||||
EncryptionPrivateKey string `comment:"Your private encryption key. DO NOT share this with anyone!"`
|
||||
SigningPublicKey string `comment:"Your public signing key. You should not ordinarily need to share\nthis with anyone."`
|
||||
SigningPrivateKey string `comment:"Your private signing key. DO NOT share this with anyone!"`
|
||||
MulticastInterfaces []string `comment:"Regular expressions for which interfaces multicast peer discovery\nshould be enabled on. If none specified, multicast peer discovery is\ndisabled. The default value is .* which uses all interfaces."`
|
||||
LinkLocalTCPPort uint16 `comment:"The port number to be used for the link-local TCP listeners for the\nconfigured MulticastInterfaces. This option does not affect listeners\nspecified in the Listen option. Unless you plan to firewall link-local\ntraffic, it is best to leave this as the default value of 0. This\noption cannot currently be changed by reloading config during runtime."`
|
||||
IfName string `comment:"Local network interface name for TUN/TAP adapter, or \"auto\" to select\nan interface automatically, or \"none\" to run without TUN/TAP."`
|
||||
IfTAPMode bool `comment:"Set local network interface to TAP mode rather than TUN mode if\nsupported by your platform - option will be ignored if not."`
|
||||
@ -64,18 +61,13 @@ type SwitchOptions struct {
|
||||
// or whether to generate a random port number. The only side effect of setting
|
||||
// isAutoconf is that the TCP and UDP ports will likely end up with different
|
||||
// port numbers.
|
||||
func GenerateConfig(isAutoconf bool) *NodeConfig {
|
||||
func GenerateConfig() *NodeConfig {
|
||||
// Generate encryption keys.
|
||||
bpub, bpriv := crypto.NewBoxKeys()
|
||||
spub, spriv := crypto.NewSigKeys()
|
||||
// Create a node configuration and populate it.
|
||||
cfg := NodeConfig{}
|
||||
if isAutoconf {
|
||||
cfg.Listen = []string{"tcp://[::]:0"}
|
||||
} else {
|
||||
r1 := rand.New(rand.NewSource(time.Now().UnixNano()))
|
||||
cfg.Listen = []string{fmt.Sprintf("tcp://[::]:%d", r1.Intn(65534-32768)+32768)}
|
||||
}
|
||||
cfg.Listen = []string{}
|
||||
cfg.AdminListen = defaults.GetDefaults().DefaultAdminListen
|
||||
cfg.EncryptionPublicKey = hex.EncodeToString(bpub[:])
|
||||
cfg.EncryptionPrivateKey = hex.EncodeToString(bpriv[:])
|
||||
@ -91,6 +83,7 @@ func GenerateConfig(isAutoconf bool) *NodeConfig {
|
||||
cfg.SessionFirewall.Enable = false
|
||||
cfg.SessionFirewall.AllowFromDirect = true
|
||||
cfg.SessionFirewall.AllowFromRemote = true
|
||||
cfg.SessionFirewall.AlwaysAllowOutbound = true
|
||||
cfg.SwitchOptions.MaxTotalQueueSize = 4 * 1024 * 1024
|
||||
cfg.NodeInfoPrivacy = false
|
||||
|
||||
|
||||
@ -175,8 +175,8 @@ func (intf *linkInterface) handler() error {
|
||||
return errors.New("failed to connect: wrong version")
|
||||
}
|
||||
// Check if we're authorized to connect to this key / IP
|
||||
if !intf.incoming && !intf.force && !intf.link.core.peers.isAllowedEncryptionPublicKey(&meta.box) {
|
||||
intf.link.core.log.Warnf("%s connection to %s forbidden: AllowedEncryptionPublicKeys does not contain key %s",
|
||||
if intf.incoming && !intf.force && !intf.link.core.peers.isAllowedEncryptionPublicKey(&meta.box) {
|
||||
intf.link.core.log.Warnf("%s connection from %s forbidden: AllowedEncryptionPublicKeys does not contain key %s",
|
||||
strings.ToUpper(intf.info.linkType), intf.info.remote, hex.EncodeToString(meta.box[:]))
|
||||
intf.msgIO.close()
|
||||
return nil
|
||||
|
||||
@ -45,7 +45,7 @@ func (c *Core) addStaticPeers(cfg *config.NodeConfig) {
|
||||
func (c *Core) StartAutoconfigure() error {
|
||||
mobilelog := MobileLogger{}
|
||||
logger := log.New(mobilelog, "", 0)
|
||||
nc := config.GenerateConfig(true)
|
||||
nc := config.GenerateConfig()
|
||||
nc.IfName = "dummy"
|
||||
nc.AdminListen = "tcp://localhost:9001"
|
||||
nc.Peers = []string{}
|
||||
@ -64,7 +64,7 @@ func (c *Core) StartAutoconfigure() error {
|
||||
func (c *Core) StartJSON(configjson []byte) error {
|
||||
mobilelog := MobileLogger{}
|
||||
logger := log.New(mobilelog, "", 0)
|
||||
nc := config.GenerateConfig(false)
|
||||
nc := config.GenerateConfig()
|
||||
var dat map[string]interface{}
|
||||
if err := hjson.Unmarshal(configjson, &dat); err != nil {
|
||||
return err
|
||||
@ -82,7 +82,7 @@ func (c *Core) StartJSON(configjson []byte) error {
|
||||
|
||||
// Generates mobile-friendly configuration in JSON format.
|
||||
func GenerateConfigJSON() []byte {
|
||||
nc := config.GenerateConfig(false)
|
||||
nc := config.GenerateConfig()
|
||||
nc.IfName = "dummy"
|
||||
if json, err := json.Marshal(nc); err == nil {
|
||||
return json
|
||||
|
||||
@ -122,11 +122,48 @@ func (m *multicast) announce() {
|
||||
// There might be interfaces that we configured listeners for but are no
|
||||
// longer up - if that's the case then we should stop the listeners
|
||||
for name, listener := range m.listeners {
|
||||
if _, ok := interfaces[name]; !ok {
|
||||
// Prepare our stop function!
|
||||
stop := func() {
|
||||
listener.stop <- true
|
||||
delete(m.listeners, name)
|
||||
m.core.log.Debugln("No longer multicasting on", name)
|
||||
}
|
||||
// If the interface is no longer visible on the system then stop the
|
||||
// listener, as another one will be started further down
|
||||
if _, ok := interfaces[name]; !ok {
|
||||
stop()
|
||||
continue
|
||||
}
|
||||
// It's possible that the link-local listener address has changed so if
|
||||
// that is the case then we should clean up the interface listener
|
||||
found := false
|
||||
listenaddr, err := net.ResolveTCPAddr("tcp6", listener.listener.Addr().String())
|
||||
if err != nil {
|
||||
stop()
|
||||
continue
|
||||
}
|
||||
// Find the interface that matches the listener
|
||||
if intf, err := net.InterfaceByName(name); err == nil {
|
||||
if addrs, err := intf.Addrs(); err == nil {
|
||||
// Loop through the addresses attached to that listener and see if any
|
||||
// of them match the current address of the listener
|
||||
for _, addr := range addrs {
|
||||
if ip, _, err := net.ParseCIDR(addr.String()); err == nil {
|
||||
// Does the interface address match our listener address?
|
||||
if ip.Equal(listenaddr.IP) {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// If the address has not been found on the adapter then we should stop
|
||||
// and clean up the TCP listener. A new one will be created below if a
|
||||
// suitable link-local address is found
|
||||
if !found {
|
||||
stop()
|
||||
}
|
||||
}
|
||||
// Now that we have a list of valid interfaces from the operating system,
|
||||
// we can start checking if we can send multicasts on them
|
||||
|
||||
@ -19,6 +19,7 @@ import (
|
||||
"fmt"
|
||||
"math/rand"
|
||||
"net"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
@ -332,7 +333,7 @@ func (t *tcp) handler(sock net.Conn, incoming bool, options interface{}) {
|
||||
stream.init(sock)
|
||||
local, _, _ := net.SplitHostPort(sock.LocalAddr().String())
|
||||
remote, _, _ := net.SplitHostPort(sock.RemoteAddr().String())
|
||||
remotelinklocal := net.ParseIP(remote).IsLinkLocalUnicast()
|
||||
force := net.ParseIP(strings.Split(remote, "%")[0]).IsLinkLocalUnicast()
|
||||
var name string
|
||||
var proto string
|
||||
if socksaddr, issocks := options.(string); issocks {
|
||||
@ -342,7 +343,7 @@ func (t *tcp) handler(sock net.Conn, incoming bool, options interface{}) {
|
||||
name = "tcp://" + sock.RemoteAddr().String()
|
||||
proto = "tcp"
|
||||
}
|
||||
link, err := t.link.core.link.create(&stream, name, proto, local, remote, incoming, remotelinklocal)
|
||||
link, err := t.link.core.link.create(&stream, name, proto, local, remote, incoming, force)
|
||||
if err != nil {
|
||||
t.link.core.log.Println(err)
|
||||
panic(err)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user