VERSION 1.1.12: yet another minor fix to managed routes

This version just contains another minor fix to managed routes for GitHub issue #352.
Version bump again. Slack has updated their client twice in one day so its okay.
2026-09-22 15:29:03 -07:00 · 2016-07-12 15:09:44 -07:00 · 2016-07-12 15:03:06 -07:00 · 2016-07-12 15:00:30 -07:00 · 2016-07-12 13:58:15 -07:00 · 2016-07-12 13:37:38 -07:00
32 changed files with 322 additions and 49 deletions
@@ -1,3 +1,22 @@
+zerotier-one (1.1.12) unstable; urgency=medium
+
+  * See https://github.com/zerotier/ZeroTierOne for release notes.
+
+ -- Adam Ierymenko <adam.ierymenko@zerotier.com>  Tue, 12 Jul 2016 03:02:22 -0700
+
+zerotier-one (1.1.10) unstable; urgency=medium
+
+  * See https://github.com/zerotier/ZeroTierOne for release notes.
+  * ZeroTier Debian packages no longer depend on http-parser since its ABI is too unstable.
+
+ -- Adam Ierymenko <adam.ierymenko@zerotier.com>  Tue, 12 Jul 2016 12:29:00 -0700
+
+zerotier-one (1.1.8) unstable; urgency=low
+
+  * See https://github.com/zerotier/ZeroTierOne for release notes.
+
+ -- Adam Ierymenko <adam.ierymenko@zerotier.com>  Fri, 08 Jul 2016 01:56:00 -0700
+
 zerotier-one (1.1.6) unstable; urgency=medium

  * First Debian release on ZeroTier, Inc. private apt repository.
@@ -3,14 +3,14 @@ Maintainer: Adam Ierymenko <adam.ierymenko@zerotier.com>
 Section: net
 Priority: optional
 Standards-Version: 3.9.6
-Build-Depends: debhelper (>= 9), libhttp-parser-dev (>= 2.1), liblz4-dev, libnatpmp-dev, dh-systemd, ruby-ronn
+Build-Depends: debhelper (>= 9), liblz4-dev, libnatpmp-dev, dh-systemd, ruby-ronn
 Vcs-Git: git://github.com/zerotier/ZeroTierOne
 Vcs-Browser: https://github.com/zerotier/ZeroTierOne
 Homepage: https://www.zerotier.com/

 Package: zerotier-one
 Architecture: any
-Depends:  ${shlibs:Depends}, ${misc:Depends}, libhttp-parser2.1, liblz4-1, libnatpmp1, iproute2
+Depends:  ${shlibs:Depends}, ${misc:Depends}, liblz4-1, libnatpmp1, iproute2
 Homepage: https://www.zerotier.com/
 Description: ZeroTier network virtualization service
 ZeroTier One lets you join ZeroTier virtual networks and
@@ -759,7 +759,7 @@
 			<key>OVERWRITE_PERMISSIONS</key>
 			<false/>
 			<key>VERSION</key>
-			<string>1.1.6</string>
+			<string>1.1.12</string>
 		</dict>
 		<key>PROJECT_COMMENTS</key>
 		<dict>
@@ -116,6 +116,11 @@ extern "C" {
 */
 #define ZT_MAX_PEER_NETWORK_PATHS 4

+/**
+ * Maximum number of trusted physical network paths
+ */
+#define ZT_MAX_TRUSTED_PATHS 16
+
 /**
 * Maximum number of hops in a ZeroTier circuit test
 *
@@ -887,6 +892,11 @@ typedef struct
 	 */
 	uint64_t lastReceive;

+	/**
+	 * Is this a trusted path? If so this will be its nonzero ID.
+	 */
+	uint64_t trustedPathId;
+
 	/**
 	 * Is path active?
 	 */
@@ -1837,6 +1847,29 @@ void ZT_Node_clusterHandleIncomingMessage(ZT_Node *node,const void *msg,unsigned
 */
 void ZT_Node_clusterStatus(ZT_Node *node,ZT_ClusterStatus *cs);

+/**
+ * Set trusted paths
+ *
+ * A trusted path is a physical network (network/bits) over which both
+ * encryption and authentication can be skipped to improve performance.
+ * Each trusted path must have a non-zero unique ID that is the same across
+ * all participating nodes.
+ *
+ * We don't recommend using trusted paths at all unless you really *need*
+ * near-bare-metal performance. Even on a LAN authentication and encryption
+ * are never a bad thing, and anything that introduces an "escape hatch"
+ * for encryption should be treated with the utmost care.
+ *
+ * Calling with NULL pointers for networks and ids and a count of zero clears
+ * all trusted paths.
+ *
+ * @param node Node instance
+ * @param networks Array of [count] networks
+ * @param ids Array of [count] corresponding non-zero path IDs (zero path IDs are ignored)
+ * @param count Number of trusted paths-- values greater than ZT_MAX_TRUSTED_PATHS are clipped
+ */
+void ZT_Node_setTrustedPaths(ZT_Node *node,const struct sockaddr_storage *networks,const uint64_t *ids,unsigned int count);
+
 /**
 * Do things in the background until Node dies
 *
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.5 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.5 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.5 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.5 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 #RUN ln -sf /usr/bin/clang++-3.5 /usr/bin/clang++
 #RUN ln -sf /usr/bin/clang-3.5 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 #RUN ln -sf /usr/bin/clang++-3.5 /usr/bin/clang++
 #RUN ln -sf /usr/bin/clang-3.5 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -4,6 +4,8 @@ MAINTAINER Adam Ierymenko <adam.ierymenko@zerotier.com>
 RUN apt-get update
 RUN apt-get install -y build-essential debhelper ruby-ronn g++ make devscripts

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /

 RUN mv -f /ZeroTierOne/debian/control.wheezy /ZeroTierOne/debian/control
@@ -7,6 +7,8 @@
 FROM zerotier/zt1-build-debian-wheezy-x86-base
 MAINTAINER Adam Ierymenko <adam.ierymenko@zerotier.com>

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /

 RUN mv -f /ZeroTierOne/debian/control.wheezy /ZeroTierOne/debian/control
@@ -5,5 +5,6 @@ RUN yum update -y
 RUN yum install -y make rpmdevtools gcc-c++ rubygem-ronn json-parser-devel lz4-devel http-parser-devel libnatpmp-devel

 RUN rpm --erase http-parser-devel
+RUN yum install -y rubygem-ronn ruby

 ADD zt1-src.tar.gz /
@@ -14,5 +14,6 @@ MAINTAINER Adam Ierymenko <adam.ierymenko@zerotier.com>
 RUN echo 'i686-redhat-linux' >/etc/rpm/platform

 RUN rpm --erase http-parser-devel
+RUN yum install -y rubygem-ronn ruby

 ADD zt1-src.tar.gz /
@@ -31,5 +31,34 @@ for db in `find /tmp/zt-rpm-repo -mindepth 2 -maxdepth 2 -type d`; do
 	createrepo --database $db
 done

+# Stupid RHEL stuff
+cd /tmp/zt-rpm-repo/el
+ln -sf 6 6Client
+ln -sf 6 6Workstation
+ln -sf 6 6Server
+ln -sf 6 6.0
+ln -sf 6 6.1
+ln -sf 6 6.2
+ln -sf 6 6.3
+ln -sf 6 6.4
+ln -sf 6 6.5
+ln -sf 6 6.6
+ln -sf 6 6.7
+ln -sf 6 6.8
+ln -sf 6 6.9
+ln -sf 7 7Client
+ln -sf 7 7Workstation
+ln -sf 7 7Server
+ln -sf 7 7.0
+ln -sf 7 7.1
+ln -sf 7 7.2
+ln -sf 7 7.3
+ln -sf 7 7.4
+ln -sf 7 7.5
+ln -sf 7 7.6
+ln -sf 7 7.7
+ln -sf 7 7.8
+ln -sf 7 7.9
+
 echo
 echo Repo created in /tmp/zt-rpm-repo
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.6 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.6 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.6 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.6 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.7 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.7 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -7,4 +7,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l
 RUN ln -sf /usr/bin/clang++-3.7 /usr/bin/clang++
 RUN ln -sf /usr/bin/clang-3.7 /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -9,4 +9,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l

 RUN rm -f /usr/bin/clang++ /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -9,4 +9,6 @@ RUN apt-get install -y build-essential debhelper libhttp-parser-dev liblz4-dev l

 RUN rm -f /usr/bin/clang++ /usr/bin/clang

+RUN dpkg --purge libhttp-parser-dev
+
 ADD zt1-src.tar.gz /
@@ -42,9 +42,24 @@ namespace ZeroTier {

 bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,bool deferred)
 {
-	const Address sourceAddress(source());
 	try {
-		if ((cipher() == ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_NONE)&&(verb() == Packet::VERB_HELLO)) {
+		const Address sourceAddress(source());
+
+		// Check for trusted paths or unencrypted HELLOs (HELLO is the only packet sent in the clear)
+		const unsigned int c = cipher();
+		bool trusted = false;
+		if (c == ZT_PROTO_CIPHER_SUITE__NO_CRYPTO_TRUSTED_PATH) {
+			// If this is marked as a packet via a trusted path, check source address and path ID.
+			// Obviously if no trusted paths are configured this always returns false and such
+			// packets are dropped on the floor.
+			if (RR->topology->shouldInboundPathBeTrusted(_remoteAddress,trustedPathId())) {
+				trusted = true;
+				TRACE("TRUSTED PATH packet approved from %s(%s), trusted path ID %llx",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),trustedPathId());
+			} else {
+				TRACE("dropped packet from %s(%s), cipher set to trusted path mode but path %llx@%s is not trusted!",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),trustedPathId(),_remoteAddress.toString().c_str());
+				return true;
+			}
+		} else if ((c == ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_NONE)&&(verb() == Packet::VERB_HELLO)) {
 			// Unencrypted HELLOs require some potentially expensive verification, so
 			// do this in the background if background processing is enabled.
 			if ((RR->dpEnabled > 0)&&(!deferred)) {
@@ -61,12 +76,15 @@ bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,bool deferred)

 		SharedPtr<Peer> peer(RR->topology->getPeer(sourceAddress));
 		if (peer) {
-			if (!dearmor(peer->key())) {
-				TRACE("dropped packet from %s(%s), MAC authentication failed (size: %u)",peer->address().toString().c_str(),_remoteAddress.toString().c_str(),size());
-				return true;
+			if (!trusted) {
+				if (!dearmor(peer->key())) {
+					TRACE("dropped packet from %s(%s), MAC authentication failed (size: %u)",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str(),size());
+					return true;
+				}
 			}
+
 			if (!uncompress()) {
-				TRACE("dropped packet from %s(%s), compressed data invalid",peer->address().toString().c_str(),_remoteAddress.toString().c_str());
+				TRACE("dropped packet from %s(%s), compressed data invalid",sourceAddress.toString().c_str(),_remoteAddress.toString().c_str());
 				return true;
 			}
Author	SHA1	Message	Date
Adam Ierymenko	bdc3b0834b	VERSION 1.1.12: yet another minor fix to managed routes This version just contains another minor fix to managed routes for GitHub issue #352.	2016-07-12 15:09:44 -07:00
Adam Ierymenko	1a285e5342	Version bump again. Slack has updated their client twice in one day so its okay.	2016-07-12 15:03:06 -07:00
Adam Ierymenko	8912515011	Fix to fix to GitHub issue #352	2016-07-12 15:00:30 -07:00
Adam Ierymenko	6ec3464ee9	JSON fix for trusted paths (does not affect normal op)	2016-07-12 13:58:15 -07:00
Adam Ierymenko	4b5e43ab0d	VERSION 1.1.10: minor managed route fixes Version 1.1.10 is a minor bug fix release. It fixes the following two issues: * Routes are no longer added 'via' IP addresses of the current node's ZT interface. * IPv6 default route is now fixed on Mac. * IP addresses are now deleted before new ones are added to allow changes to netmask on Mac and some other platforms. This version also quietly introduces a feature called trusted paths. We'll be documenting this in our community section soon. This is an experimental feature for in-LAN SDN use.	2016-07-12 13:37:38 -07:00
Adam Ierymenko	a6d9ae3a36	Man page fix on fedora-22	2016-07-12 13:30:15 -07:00
Adam Ierymenko	34e7c8652a	Version bumps.	2016-07-12 12:30:35 -07:00
Adam Ierymenko	1861f67fa7	Version bump to 1.1.10	2016-07-12 12:21:36 -07:00
Adam Ierymenko	b5e9d3f6f4	Rename file to be intuitive.	2016-07-12 11:41:19 -07:00
Adam Ierymenko	9785fde32a	Trusted paths work!	2016-07-12 11:40:45 -07:00
Adam Ierymenko	9657675755	Plumbing through trusted path stuff to OneService.	2016-07-12 11:30:22 -07:00
Adam Ierymenko	5d7174b162	Go back to bundling libhttp-parser on Debian, at least for our own internally-created packages, since this library has a massively unstable ABI and causes nothing but problems if referenced from the distro.	2016-07-12 10:11:00 -07:00
Adam Ierymenko	cdb5ceac7b	Should remove old IPs before trying to add new ones.	2016-07-12 09:43:12 -07:00
Adam Ierymenko	23391ff9da	More OSX IPv6 fixes.	2016-07-12 09:22:04 -07:00
Adam Ierymenko	3f2b21ce71	Do not shadow our own route twice on Mac if there is no default route. (Fix for issue found during IPv6 default route override testing.)	2016-07-12 08:55:57 -07:00
Adam Ierymenko	6535730255	GitHub issue #352	2016-07-12 08:42:36 -07:00
Adam Ierymenko	765082fdb6	Trusted path support, and version bump to 1.1.9	2016-07-12 08:29:50 -07:00
Adam Ierymenko	aff62e9e10	Version bump in Mac pkg.	2016-07-08 14:28:34 -07:00
Adam Ierymenko	2d598dd433	Automatically add symlinks to redhat distro.	2016-07-08 14:25:25 -07:00
Adam Ierymenko	f86e9b7df2	Bump version in RPM spec and DEB.	2016-07-08 13:57:16 -07:00