mirror of
https://github.com/yggdrasil-network/yggdrasil-go.git
synced 2025-06-16 14:15:07 +03:00
Link refactoring
This commit is contained in:
Neil Alexander
parent
88a393a7b3
commit
496eed7974
12 changed files with 441 additions and 601 deletions
|
|
@ -321,6 +321,8 @@ type DataUnit uint64
|
|||
|
||||
func (d DataUnit) String() string {
|
||||
switch {
|
||||
case d > 1024*1024*1024*1024:
|
||||
return fmt.Sprintf("%2.ftb", float64(d)/1024/1024/1024/1024)
|
||||
case d > 1024*1024*1024:
|
||||
return fmt.Sprintf("%2.fgb", float64(d)/1024/1024/1024)
|
||||
case d > 1024*1024:
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ package core
|
|||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"fmt"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
|
|
@ -136,8 +137,15 @@ func (c *Core) GetSessions() []SessionInfo {
|
|||
// Listen starts a new listener (either TCP or TLS). The input should be a url.URL
|
||||
// parsed from a string of the form e.g. "tcp://a.b.c.d:e". In the case of a
|
||||
// link-local address, the interface should be provided as the second argument.
|
||||
func (c *Core) Listen(u *url.URL, sintf string) (*TcpListener, error) {
|
||||
return c.links.tcp.listenURL(u, sintf)
|
||||
func (c *Core) Listen(u *url.URL, sintf string) (*Listener, error) {
|
||||
switch u.Scheme {
|
||||
case "tcp":
|
||||
return c.links.tcp.listen(u, sintf)
|
||||
case "tls":
|
||||
return c.links.tls.listen(u, sintf)
|
||||
default:
|
||||
return nil, fmt.Errorf("unrecognised scheme %q", u.Scheme)
|
||||
}
|
||||
}
|
||||
|
||||
// Address gets the IPv6 address of the Yggdrasil node. This is always a /128
|
||||
|
|
|
|||
|
|
@ -133,7 +133,6 @@ func (c *Core) _close() error {
|
|||
c.addPeerTimer.Stop()
|
||||
c.addPeerTimer = nil
|
||||
}
|
||||
_ = c.links.stop()
|
||||
return err
|
||||
}
|
||||
|
||||
|
|
|
|||
120
src/core/link.go
120
src/core/link.go
|
|
@ -2,6 +2,7 @@ package core
|
|||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
|
|
@ -20,15 +21,15 @@ import (
|
|||
"github.com/Arceliar/phony"
|
||||
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||
"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||
"golang.org/x/net/proxy"
|
||||
//"github.com/Arceliar/phony" // TODO? use instead of mutexes
|
||||
)
|
||||
|
||||
type links struct {
|
||||
core *Core
|
||||
tcp *linkTCP // TCP interface support
|
||||
tls *linkTLS // TLS interface support
|
||||
mutex sync.RWMutex // protects links below
|
||||
links map[linkInfo]*link
|
||||
tcp tcp // TCP interface support
|
||||
stopped chan struct{}
|
||||
// TODO timeout (to remove from switch), read from config.ReadTimeout
|
||||
}
|
||||
|
|
@ -56,8 +57,16 @@ type linkOptions struct {
|
|||
pinnedEd25519Keys map[keyArray]struct{}
|
||||
}
|
||||
|
||||
type Listener struct {
|
||||
net.Listener
|
||||
Close context.CancelFunc // deliberately replaces net.Listener.Close()
|
||||
}
|
||||
|
||||
func (l *links) init(c *Core) error {
|
||||
l.core = c
|
||||
l.tcp = l.newLinkTCP()
|
||||
l.tls = l.newLinkTLS(l.tcp)
|
||||
|
||||
l.mutex.Lock()
|
||||
l.links = make(map[linkInfo]*link)
|
||||
l.mutex.Unlock()
|
||||
|
|
@ -70,41 +79,46 @@ func (l *links) init(c *Core) error {
|
|||
listeners = append(listeners, listener)
|
||||
}
|
||||
})
|
||||
if err := l.tcp.init(l, listeners); err != nil {
|
||||
c.log.Errorln("Failed to start TCP interface")
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *links) call(u *url.URL, sintf string) error {
|
||||
tcpOpts := tcpOptions{}
|
||||
if pubkeys, ok := u.Query()["key"]; ok && len(pubkeys) > 0 {
|
||||
tcpOpts.pinnedEd25519Keys = make(map[keyArray]struct{})
|
||||
for _, pubkey := range pubkeys {
|
||||
if sigPub, err := hex.DecodeString(pubkey); err == nil {
|
||||
var sigPubKey keyArray
|
||||
copy(sigPubKey[:], sigPub)
|
||||
tcpOpts.pinnedEd25519Keys[sigPubKey] = struct{}{}
|
||||
}
|
||||
// TODO: don't dial duplicates here
|
||||
tcpOpts := tcpOptions{
|
||||
linkOptions: linkOptions{
|
||||
pinnedEd25519Keys: map[keyArray]struct{}{},
|
||||
},
|
||||
}
|
||||
for _, pubkey := range u.Query()["key"] {
|
||||
if sigPub, err := hex.DecodeString(pubkey); err == nil {
|
||||
var sigPubKey keyArray
|
||||
copy(sigPubKey[:], sigPub)
|
||||
tcpOpts.pinnedEd25519Keys[sigPubKey] = struct{}{}
|
||||
}
|
||||
}
|
||||
switch u.Scheme {
|
||||
case "tcp":
|
||||
l.tcp.call(u.Host, tcpOpts, sintf)
|
||||
case "socks":
|
||||
tcpOpts.socksProxyAddr = u.Host
|
||||
if u.User != nil {
|
||||
tcpOpts.socksProxyAuth = &proxy.Auth{}
|
||||
tcpOpts.socksProxyAuth.User = u.User.Username()
|
||||
tcpOpts.socksProxyAuth.Password, _ = u.User.Password()
|
||||
}
|
||||
tcpOpts.upgrade = l.tcp.tls.forDialer // TODO make this configurable
|
||||
pathtokens := strings.Split(strings.Trim(u.Path, "/"), "/")
|
||||
l.tcp.call(pathtokens[0], tcpOpts, sintf)
|
||||
go func() {
|
||||
if _, err := l.tcp.dial(u, tcpOpts, sintf); err != nil {
|
||||
l.core.log.Warnf("Failed to dial TCP %s: %s\n", u.Host, err)
|
||||
}
|
||||
}()
|
||||
|
||||
/*
|
||||
case "socks":
|
||||
tcpOpts.socksProxyAddr = u.Host
|
||||
if u.User != nil {
|
||||
tcpOpts.socksProxyAuth = &proxy.Auth{}
|
||||
tcpOpts.socksProxyAuth.User = u.User.Username()
|
||||
tcpOpts.socksProxyAuth.Password, _ = u.User.Password()
|
||||
}
|
||||
tcpOpts.upgrade = l.tcp.tls.forDialer // TODO make this configurable
|
||||
pathtokens := strings.Split(strings.Trim(u.Path, "/"), "/")
|
||||
go l.tcp.call(pathtokens[0], tcpOpts, sintf)
|
||||
*/
|
||||
|
||||
case "tls":
|
||||
tcpOpts.upgrade = l.tcp.tls.forDialer
|
||||
// SNI headers must contain hostnames and not IP addresses, so we must make sure
|
||||
// that we do not populate the SNI with an IP literal. We do this by splitting
|
||||
// the host-port combo from the query option and then seeing if it parses to an
|
||||
|
|
@ -121,7 +135,12 @@ func (l *links) call(u *url.URL, sintf string) error {
|
|||
tcpOpts.tlsSNI = host
|
||||
}
|
||||
}
|
||||
l.tcp.call(u.Host, tcpOpts, sintf)
|
||||
go func() {
|
||||
if _, err := l.tls.dial(u, tcpOpts, sintf); err != nil {
|
||||
l.core.log.Warnf("Failed to dial TLS %s: %s\n", u.Host, err)
|
||||
}
|
||||
}()
|
||||
|
||||
default:
|
||||
return errors.New("unknown call scheme: " + u.Scheme)
|
||||
}
|
||||
|
|
@ -130,33 +149,37 @@ func (l *links) call(u *url.URL, sintf string) error {
|
|||
|
||||
func (l *links) create(conn net.Conn, name, linkType, local, remote string, incoming, force bool, options linkOptions) (*link, error) {
|
||||
// Technically anything unique would work for names, but let's pick something human readable, just for debugging
|
||||
info := linkInfo{
|
||||
linkType: linkType,
|
||||
local: local,
|
||||
remote: remote,
|
||||
}
|
||||
l.mutex.RLock()
|
||||
_, isIn := l.links[info]
|
||||
l.mutex.RUnlock()
|
||||
if isIn {
|
||||
return nil, fmt.Errorf("duplicate")
|
||||
}
|
||||
intf := link{
|
||||
conn: &linkConn{
|
||||
Conn: conn,
|
||||
up: time.Now(),
|
||||
},
|
||||
lname: name,
|
||||
links: l,
|
||||
options: options,
|
||||
info: linkInfo{
|
||||
linkType: linkType,
|
||||
local: local,
|
||||
remote: remote,
|
||||
},
|
||||
lname: name,
|
||||
links: l,
|
||||
options: options,
|
||||
info: info,
|
||||
incoming: incoming,
|
||||
force: force,
|
||||
}
|
||||
go func() {
|
||||
if _, err := intf.handler(); err != nil {
|
||||
l.core.log.Warnf("Handler error (incoming %v): %s\n", incoming, err)
|
||||
}
|
||||
}()
|
||||
return &intf, nil
|
||||
}
|
||||
|
||||
func (l *links) stop() error {
|
||||
close(l.stopped)
|
||||
if err := l.tcp.stop(); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (intf *link) handler() (chan struct{}, error) {
|
||||
// TODO split some of this into shorter functions, so it's easier to read, and for the FIXME duplicate peer issue mentioned later
|
||||
defer intf.conn.Close()
|
||||
|
|
@ -175,7 +198,7 @@ func (intf *link) handler() (chan struct{}, error) {
|
|||
return nil, errors.New("timeout on metadata send")
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return nil, fmt.Errorf("write handshake: %w", err)
|
||||
}
|
||||
if !util.FuncTimeout(30*time.Second, func() {
|
||||
var n int
|
||||
|
|
@ -187,7 +210,7 @@ func (intf *link) handler() (chan struct{}, error) {
|
|||
return nil, errors.New("timeout on metadata recv")
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return nil, fmt.Errorf("read handshake: %w", err)
|
||||
}
|
||||
meta = version_metadata{}
|
||||
base := version_getBaseMetadata()
|
||||
|
|
@ -211,7 +234,7 @@ func (intf *link) handler() (chan struct{}, error) {
|
|||
}
|
||||
// Check if the remote side matches the keys we expected. This is a bit of a weak
|
||||
// check - in future versions we really should check a signature or something like that.
|
||||
if pinned := intf.options.pinnedEd25519Keys; pinned != nil {
|
||||
if pinned := intf.options.pinnedEd25519Keys; len(pinned) > 0 {
|
||||
var key keyArray
|
||||
copy(key[:], meta.key)
|
||||
if _, allowed := pinned[key]; !allowed {
|
||||
|
|
@ -262,6 +285,9 @@ func (intf *link) handler() (chan struct{}, error) {
|
|||
strings.ToUpper(intf.info.linkType), themString, intf.info.local)
|
||||
// Run the handler
|
||||
err = intf.links.core.HandleConn(ed25519.PublicKey(intf.info.key[:]), intf.conn)
|
||||
if err != nil {
|
||||
err = fmt.Errorf("connection: %w", err)
|
||||
}
|
||||
// TODO don't report an error if it's just a 'use of closed network connection'
|
||||
if err != nil {
|
||||
intf.links.core.log.Infof("Disconnected %s: %s, source %s; error: %s",
|
||||
|
|
|
|||
188
src/core/link_tcp.go
Normal file
188
src/core/link_tcp.go
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
package core
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/Arceliar/phony"
|
||||
"golang.org/x/net/proxy"
|
||||
)
|
||||
|
||||
type linkTCP struct {
|
||||
phony.Inbox
|
||||
*links
|
||||
listener *net.ListenConfig
|
||||
_listeners map[net.Listener]context.CancelFunc
|
||||
}
|
||||
|
||||
type tcpOptions struct {
|
||||
linkOptions
|
||||
socksProxyAddr string // nolint:unused
|
||||
socksProxyAuth *proxy.Auth // nolint:unused
|
||||
socksPeerAddr string // nolint:unused
|
||||
tlsSNI string
|
||||
}
|
||||
|
||||
func (l *links) newLinkTCP() *linkTCP {
|
||||
lt := &linkTCP{
|
||||
links: l,
|
||||
listener: &net.ListenConfig{
|
||||
KeepAlive: -1,
|
||||
},
|
||||
_listeners: map[net.Listener]context.CancelFunc{},
|
||||
}
|
||||
lt.listener.Control = lt.tcpContext
|
||||
return lt
|
||||
}
|
||||
|
||||
func (l *linkTCP) dial(url *url.URL, options tcpOptions, sintf string) (*link, error) {
|
||||
addr, err := net.ResolveTCPAddr("tcp", url.Host)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
addr.Zone = sintf
|
||||
dialer, err := l.dialerFor(addr.String(), sintf)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
conn, err := dialer.DialContext(l.core.ctx, "tcp", addr.String())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if _, err = l.handler("TCP", conn, options, false); err != nil {
|
||||
l.core.log.Errorln("Failed to create outbound link:", err)
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (l *linkTCP) listen(url *url.URL, sintf string) (*Listener, error) {
|
||||
ctx, cancel := context.WithCancel(l.core.ctx)
|
||||
hostport := url.Host
|
||||
if sintf != "" {
|
||||
host, port, err := net.SplitHostPort(hostport)
|
||||
if err == nil {
|
||||
hostport = fmt.Sprintf("[%s%%%s]:%s", host, sintf, port)
|
||||
}
|
||||
}
|
||||
listener, err := l.listener.Listen(ctx, "tcp", hostport)
|
||||
if err != nil {
|
||||
cancel()
|
||||
return nil, err
|
||||
}
|
||||
phony.Block(l, func() {
|
||||
l._listeners[listener] = cancel
|
||||
})
|
||||
go func() {
|
||||
defer phony.Block(l, func() {
|
||||
delete(l._listeners, listener)
|
||||
})
|
||||
for {
|
||||
conn, err := listener.Accept()
|
||||
if err != nil {
|
||||
cancel()
|
||||
return
|
||||
}
|
||||
if _, err := l.handler("TCP", conn, tcpOptions{}, true); err != nil {
|
||||
l.core.log.Errorln("Failed to create link:", err)
|
||||
}
|
||||
}
|
||||
}()
|
||||
return &Listener{
|
||||
Listener: listener,
|
||||
Close: cancel,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (l *linkTCP) handler(proto string, conn net.Conn, options tcpOptions, incoming bool) (*link, error) {
|
||||
return l.links.create(
|
||||
conn, // connection
|
||||
conn.RemoteAddr().String(), // connection name
|
||||
proto, // connection protocol
|
||||
conn.LocalAddr().String(), // local address
|
||||
conn.RemoteAddr().String(), // remote address
|
||||
incoming, // not incoming
|
||||
false, // not forced
|
||||
options.linkOptions, // connection options
|
||||
)
|
||||
}
|
||||
|
||||
// Returns the address of the listener.
|
||||
func (l *linkTCP) getAddr() *net.TCPAddr {
|
||||
// TODO: Fix this, because this will currently only give a single address
|
||||
// to multicast.go, which obviously is not great, but right now multicast.go
|
||||
// doesn't have the ability to send more than one address in a packet either
|
||||
var addr *net.TCPAddr
|
||||
phony.Block(l, func() {
|
||||
for listener := range l._listeners {
|
||||
addr = listener.Addr().(*net.TCPAddr)
|
||||
}
|
||||
})
|
||||
return addr
|
||||
}
|
||||
|
||||
func (l *linkTCP) dialerFor(saddr, sintf string) (*net.Dialer, error) {
|
||||
dst, err := net.ResolveTCPAddr("tcp", saddr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if dst.IP.IsLinkLocalUnicast() {
|
||||
dst.Zone = sintf
|
||||
if dst.Zone == "" {
|
||||
return nil, fmt.Errorf("link-local address requires a zone")
|
||||
}
|
||||
}
|
||||
dialer := &net.Dialer{
|
||||
Timeout: time.Second * 5,
|
||||
KeepAlive: -1,
|
||||
Control: l.tcpContext,
|
||||
}
|
||||
if sintf != "" {
|
||||
dialer.Control = l.getControl(sintf)
|
||||
ief, err := net.InterfaceByName(sintf)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("interface %q not found", sintf)
|
||||
}
|
||||
if ief.Flags&net.FlagUp == 0 {
|
||||
return nil, fmt.Errorf("interface %q is not up", sintf)
|
||||
}
|
||||
addrs, err := ief.Addrs()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("interface %q addresses not available: %w", sintf, err)
|
||||
}
|
||||
for addrindex, addr := range addrs {
|
||||
src, _, err := net.ParseCIDR(addr.String())
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if src.Equal(dst.IP) {
|
||||
continue
|
||||
}
|
||||
if !src.IsGlobalUnicast() && !src.IsLinkLocalUnicast() {
|
||||
continue
|
||||
}
|
||||
bothglobal := src.IsGlobalUnicast() == dst.IP.IsGlobalUnicast()
|
||||
bothlinklocal := src.IsLinkLocalUnicast() == dst.IP.IsLinkLocalUnicast()
|
||||
if !bothglobal && !bothlinklocal {
|
||||
continue
|
||||
}
|
||||
if (src.To4() != nil) != (dst.IP.To4() != nil) {
|
||||
continue
|
||||
}
|
||||
if bothglobal || bothlinklocal || addrindex == len(addrs)-1 {
|
||||
dialer.LocalAddr = &net.TCPAddr{
|
||||
IP: src,
|
||||
Port: 0,
|
||||
Zone: sintf,
|
||||
}
|
||||
break
|
||||
}
|
||||
}
|
||||
if dialer.LocalAddr == nil {
|
||||
return nil, fmt.Errorf("no suitable source address found on interface %q", sintf)
|
||||
}
|
||||
}
|
||||
return dialer, nil
|
||||
}
|
||||
|
|
@ -11,7 +11,7 @@ import (
|
|||
|
||||
// WARNING: This context is used both by net.Dialer and net.Listen in tcp.go
|
||||
|
||||
func (t *tcp) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
func (t *linkTCP) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
var control error
|
||||
var recvanyif error
|
||||
|
||||
|
|
@ -28,6 +28,6 @@ func (t *tcp) tcpContext(network, address string, c syscall.RawConn) error {
|
|||
}
|
||||
}
|
||||
|
||||
func (t *tcp) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
func (t *linkTCP) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
return t.tcpContext
|
||||
}
|
||||
|
|
@ -11,7 +11,7 @@ import (
|
|||
|
||||
// WARNING: This context is used both by net.Dialer and net.Listen in tcp.go
|
||||
|
||||
func (t *tcp) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
func (t *linkTCP) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
var control error
|
||||
var bbr error
|
||||
|
||||
|
|
@ -31,7 +31,7 @@ func (t *tcp) tcpContext(network, address string, c syscall.RawConn) error {
|
|||
return nil
|
||||
}
|
||||
|
||||
func (t *tcp) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
func (t *linkTCP) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
return func(network, address string, c syscall.RawConn) error {
|
||||
var err error
|
||||
btd := func(fd uintptr) {
|
||||
|
|
@ -9,10 +9,10 @@ import (
|
|||
|
||||
// WARNING: This context is used both by net.Dialer and net.Listen in tcp.go
|
||||
|
||||
func (t *tcp) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
func (t *linkTCP) tcpContext(network, address string, c syscall.RawConn) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *tcp) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
func (t *linkTCP) getControl(sintf string) func(string, string, syscall.RawConn) error {
|
||||
return t.tcpContext
|
||||
}
|
||||
160
src/core/link_tls.go
Normal file
160
src/core/link_tls.go
Normal file
|
|
@ -0,0 +1,160 @@
|
|||
package core
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/hex"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"math/big"
|
||||
"net"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/Arceliar/phony"
|
||||
)
|
||||
|
||||
type linkTLS struct {
|
||||
phony.Inbox
|
||||
*links
|
||||
tcp *linkTCP
|
||||
listener *net.ListenConfig
|
||||
config *tls.Config
|
||||
_listeners map[net.Listener]context.CancelFunc
|
||||
}
|
||||
|
||||
func (l *links) newLinkTLS(tcp *linkTCP) *linkTLS {
|
||||
lt := &linkTLS{
|
||||
links: l,
|
||||
tcp: tcp,
|
||||
listener: &net.ListenConfig{
|
||||
Control: tcp.tcpContext,
|
||||
KeepAlive: -1,
|
||||
},
|
||||
_listeners: map[net.Listener]context.CancelFunc{},
|
||||
}
|
||||
var err error
|
||||
lt.config, err = lt.generateConfig()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return lt
|
||||
}
|
||||
|
||||
func (l *linkTLS) dial(url *url.URL, options tcpOptions, sintf string) (*link, error) {
|
||||
addr, err := net.ResolveTCPAddr("tcp", url.Host)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
addr.Zone = sintf
|
||||
dialer, err := l.tcp.dialerFor(addr.String(), sintf)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
tlsdialer := &tls.Dialer{
|
||||
NetDialer: dialer,
|
||||
Config: l.config,
|
||||
}
|
||||
conn, err := tlsdialer.DialContext(l.core.ctx, "tcp", addr.String())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if _, err = l.handler(conn, options, false); err != nil {
|
||||
l.core.log.Errorln("Failed to create outbound link:", err)
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (l *linkTLS) listen(url *url.URL, sintf string) (*Listener, error) {
|
||||
ctx, cancel := context.WithCancel(l.core.ctx)
|
||||
hostport := url.Host
|
||||
if sintf != "" {
|
||||
host, port, err := net.SplitHostPort(hostport)
|
||||
if err == nil {
|
||||
hostport = fmt.Sprintf("[%s%%%s]:%s", host, sintf, port)
|
||||
}
|
||||
}
|
||||
listener, err := l.listener.Listen(ctx, "tcp", hostport)
|
||||
if err != nil {
|
||||
cancel()
|
||||
return nil, err
|
||||
}
|
||||
tlslistener := tls.NewListener(listener, l.config)
|
||||
phony.Block(l, func() {
|
||||
l._listeners[tlslistener] = cancel
|
||||
})
|
||||
go func() {
|
||||
defer phony.Block(l, func() {
|
||||
delete(l._listeners, tlslistener)
|
||||
})
|
||||
for {
|
||||
conn, err := tlslistener.Accept()
|
||||
if err != nil {
|
||||
cancel()
|
||||
return
|
||||
}
|
||||
if _, err := l.handler(conn, tcpOptions{}, true); err != nil {
|
||||
l.core.log.Errorln("Failed to create inbound link:", err)
|
||||
}
|
||||
}
|
||||
}()
|
||||
return &Listener{
|
||||
Listener: tlslistener,
|
||||
Close: cancel,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (l *linkTLS) generateConfig() (*tls.Config, error) {
|
||||
certBuf := &bytes.Buffer{}
|
||||
|
||||
// TODO: because NotAfter is finite, we should add some mechanism to
|
||||
// regenerate the certificate and restart the listeners periodically
|
||||
// for nodes with very high uptimes. Perhaps regenerate certs and restart
|
||||
// listeners every few months or so.
|
||||
cert := x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{
|
||||
CommonName: hex.EncodeToString(l.links.core.public[:]),
|
||||
},
|
||||
NotBefore: time.Now(),
|
||||
NotAfter: time.Now().Add(time.Hour * 24 * 365),
|
||||
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
|
||||
certbytes, err := x509.CreateCertificate(rand.Reader, &cert, &cert, l.links.core.public, l.links.core.secret)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if err := pem.Encode(certBuf, &pem.Block{
|
||||
Type: "CERTIFICATE",
|
||||
Bytes: certbytes,
|
||||
}); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
rootCAs := x509.NewCertPool()
|
||||
rootCAs.AppendCertsFromPEM(certbytes)
|
||||
|
||||
return &tls.Config{
|
||||
RootCAs: rootCAs,
|
||||
Certificates: []tls.Certificate{
|
||||
{
|
||||
Certificate: [][]byte{certbytes},
|
||||
PrivateKey: l.links.core.secret,
|
||||
},
|
||||
},
|
||||
InsecureSkipVerify: true,
|
||||
MinVersion: tls.VersionTLS13,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (l *linkTLS) handler(conn net.Conn, options tcpOptions, incoming bool) (*link, error) {
|
||||
return l.tcp.handler("TLS", conn, options, incoming)
|
||||
}
|
||||
417
src/core/tcp.go
417
src/core/tcp.go
|
|
@ -1,417 +0,0 @@
|
|||
package core
|
||||
|
||||
// This sends packets to peers using TCP as a transport
|
||||
// It's generally better tested than the UDP implementation
|
||||
// Using it regularly is insane, but I find TCP easier to test/debug with it
|
||||
// Updating and optimizing the UDP version is a higher priority
|
||||
|
||||
// TODO:
|
||||
// Something needs to make sure we're getting *valid* packets
|
||||
// Could be used to DoS (connect, give someone else's keys, spew garbage)
|
||||
// I guess the "peer" part should watch for link packets, disconnect?
|
||||
|
||||
// TCP connections start with a metadata exchange.
|
||||
// It involves exchanging version numbers and crypto keys
|
||||
// See version.go for version metadata format
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"math/rand"
|
||||
"net"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"golang.org/x/net/proxy"
|
||||
|
||||
"github.com/yggdrasil-network/yggdrasil-go/src/address"
|
||||
//"github.com/yggdrasil-network/yggdrasil-go/src/util"
|
||||
)
|
||||
|
||||
const default_timeout = 6 * time.Second
|
||||
|
||||
// The TCP listener and information about active TCP connections, to avoid duplication.
|
||||
type tcp struct {
|
||||
links *links
|
||||
waitgroup sync.WaitGroup
|
||||
mutex sync.Mutex // Protecting the below
|
||||
listeners map[string]*TcpListener
|
||||
calls map[string]struct{}
|
||||
conns map[linkInfo](chan struct{})
|
||||
tls tcptls
|
||||
}
|
||||
|
||||
// TcpListener is a stoppable TCP listener interface. These are typically
|
||||
// returned from calls to the ListenTCP() function and are also used internally
|
||||
// to represent listeners created by the "Listen" configuration option and for
|
||||
// multicast interfaces.
|
||||
type TcpListener struct {
|
||||
Listener net.Listener
|
||||
opts tcpOptions
|
||||
stop chan struct{}
|
||||
}
|
||||
|
||||
type TcpUpgrade struct {
|
||||
upgrade func(c net.Conn, o *tcpOptions) (net.Conn, error)
|
||||
name string
|
||||
}
|
||||
|
||||
type tcpOptions struct {
|
||||
linkOptions
|
||||
upgrade *TcpUpgrade
|
||||
socksProxyAddr string
|
||||
socksProxyAuth *proxy.Auth
|
||||
socksPeerAddr string
|
||||
tlsSNI string
|
||||
}
|
||||
|
||||
func (l *TcpListener) Stop() {
|
||||
defer func() { _ = recover() }()
|
||||
close(l.stop)
|
||||
}
|
||||
|
||||
// Wrapper function to set additional options for specific connection types.
|
||||
func (t *tcp) setExtraOptions(c net.Conn) {
|
||||
switch sock := c.(type) {
|
||||
case *net.TCPConn:
|
||||
_ = sock.SetNoDelay(true)
|
||||
// TODO something for socks5
|
||||
default:
|
||||
}
|
||||
}
|
||||
|
||||
// Returns the address of the listener.
|
||||
func (t *tcp) getAddr() *net.TCPAddr {
|
||||
// TODO: Fix this, because this will currently only give a single address
|
||||
// to multicast.go, which obviously is not great, but right now multicast.go
|
||||
// doesn't have the ability to send more than one address in a packet either
|
||||
t.mutex.Lock()
|
||||
defer t.mutex.Unlock()
|
||||
for _, l := range t.listeners {
|
||||
return l.Listener.Addr().(*net.TCPAddr)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Initializes the struct.
|
||||
func (t *tcp) init(l *links, listeners []ListenAddress) error {
|
||||
t.links = l
|
||||
t.tls.init(t)
|
||||
t.mutex.Lock()
|
||||
t.calls = make(map[string]struct{})
|
||||
t.conns = make(map[linkInfo](chan struct{}))
|
||||
t.listeners = make(map[string]*TcpListener)
|
||||
t.mutex.Unlock()
|
||||
|
||||
for _, listenaddr := range listeners {
|
||||
u, err := url.Parse(string(listenaddr))
|
||||
if err != nil {
|
||||
t.links.core.log.Errorln("Failed to parse listener: listener", listenaddr, "is not correctly formatted, ignoring")
|
||||
continue
|
||||
}
|
||||
if _, err := t.listenURL(u, ""); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *tcp) stop() error {
|
||||
t.mutex.Lock()
|
||||
for _, listener := range t.listeners {
|
||||
listener.Stop()
|
||||
}
|
||||
t.mutex.Unlock()
|
||||
t.waitgroup.Wait()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *tcp) listenURL(u *url.URL, sintf string) (*TcpListener, error) {
|
||||
var listener *TcpListener
|
||||
var err error
|
||||
hostport := u.Host // Used for tcp and tls
|
||||
if len(sintf) != 0 {
|
||||
host, port, err := net.SplitHostPort(hostport)
|
||||
if err == nil {
|
||||
hostport = fmt.Sprintf("[%s%%%s]:%s", host, sintf, port)
|
||||
}
|
||||
}
|
||||
switch u.Scheme {
|
||||
case "tcp":
|
||||
listener, err = t.listen(hostport, nil)
|
||||
case "tls":
|
||||
listener, err = t.listen(hostport, t.tls.forListener)
|
||||
default:
|
||||
t.links.core.log.Errorln("Failed to add listener: listener", u.String(), "is not correctly formatted, ignoring")
|
||||
}
|
||||
return listener, err
|
||||
}
|
||||
|
||||
func (t *tcp) listen(listenaddr string, upgrade *TcpUpgrade) (*TcpListener, error) {
|
||||
var err error
|
||||
|
||||
ctx := t.links.core.ctx
|
||||
lc := net.ListenConfig{
|
||||
Control: t.tcpContext,
|
||||
}
|
||||
listener, err := lc.Listen(ctx, "tcp", listenaddr)
|
||||
if err == nil {
|
||||
l := TcpListener{
|
||||
Listener: listener,
|
||||
opts: tcpOptions{upgrade: upgrade},
|
||||
stop: make(chan struct{}),
|
||||
}
|
||||
t.waitgroup.Add(1)
|
||||
go t.listener(&l, listenaddr)
|
||||
return &l, nil
|
||||
}
|
||||
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Runs the listener, which spawns off goroutines for incoming connections.
|
||||
func (t *tcp) listener(l *TcpListener, listenaddr string) {
|
||||
defer t.waitgroup.Done()
|
||||
if l == nil {
|
||||
return
|
||||
}
|
||||
// Track the listener so that we can find it again in future
|
||||
t.mutex.Lock()
|
||||
if _, isIn := t.listeners[listenaddr]; isIn {
|
||||
t.mutex.Unlock()
|
||||
l.Listener.Close()
|
||||
return
|
||||
}
|
||||
callproto := "TCP"
|
||||
if l.opts.upgrade != nil {
|
||||
callproto = strings.ToUpper(l.opts.upgrade.name)
|
||||
}
|
||||
t.listeners[listenaddr] = l
|
||||
t.mutex.Unlock()
|
||||
// And here we go!
|
||||
defer func() {
|
||||
t.links.core.log.Infoln("Stopping", callproto, "listener on:", l.Listener.Addr().String())
|
||||
l.Listener.Close()
|
||||
t.mutex.Lock()
|
||||
delete(t.listeners, listenaddr)
|
||||
t.mutex.Unlock()
|
||||
}()
|
||||
t.links.core.log.Infoln("Listening for", callproto, "on:", l.Listener.Addr().String())
|
||||
go func() {
|
||||
<-l.stop
|
||||
l.Listener.Close()
|
||||
}()
|
||||
defer l.Stop()
|
||||
for {
|
||||
sock, err := l.Listener.Accept()
|
||||
if err != nil {
|
||||
t.links.core.log.Errorln("Failed to accept connection:", err)
|
||||
select {
|
||||
case <-l.stop:
|
||||
return
|
||||
default:
|
||||
}
|
||||
time.Sleep(time.Second) // So we don't busy loop
|
||||
continue
|
||||
}
|
||||
t.waitgroup.Add(1)
|
||||
options := l.opts
|
||||
go t.handler(sock, true, options)
|
||||
}
|
||||
}
|
||||
|
||||
// Checks if we already are calling this address
|
||||
func (t *tcp) startCalling(saddr string) bool {
|
||||
t.mutex.Lock()
|
||||
defer t.mutex.Unlock()
|
||||
_, isIn := t.calls[saddr]
|
||||
t.calls[saddr] = struct{}{}
|
||||
return !isIn
|
||||
}
|
||||
|
||||
// Checks if a connection already exists.
|
||||
// If not, it adds it to the list of active outgoing calls (to block future attempts) and dials the address.
|
||||
// If the dial is successful, it launches the handler.
|
||||
// When finished, it removes the outgoing call, so reconnection attempts can be made later.
|
||||
// This all happens in a separate goroutine that it spawns.
|
||||
func (t *tcp) call(saddr string, options tcpOptions, sintf string) {
|
||||
go func() {
|
||||
callname := saddr
|
||||
callproto := "TCP"
|
||||
if options.upgrade != nil {
|
||||
callproto = strings.ToUpper(options.upgrade.name)
|
||||
}
|
||||
if sintf != "" {
|
||||
callname = fmt.Sprintf("%s/%s/%s", callproto, saddr, sintf)
|
||||
}
|
||||
if !t.startCalling(callname) {
|
||||
return
|
||||
}
|
||||
defer func() {
|
||||
// Block new calls for a little while, to mitigate livelock scenarios
|
||||
rand.Seed(time.Now().UnixNano())
|
||||
delay := default_timeout + time.Duration(rand.Intn(10000))*time.Millisecond
|
||||
time.Sleep(delay)
|
||||
t.mutex.Lock()
|
||||
delete(t.calls, callname)
|
||||
t.mutex.Unlock()
|
||||
}()
|
||||
var conn net.Conn
|
||||
var err error
|
||||
if options.socksProxyAddr != "" {
|
||||
if sintf != "" {
|
||||
return
|
||||
}
|
||||
dialerdst, er := net.ResolveTCPAddr("tcp", options.socksProxyAddr)
|
||||
if er != nil {
|
||||
return
|
||||
}
|
||||
var dialer proxy.Dialer
|
||||
dialer, err = proxy.SOCKS5("tcp", dialerdst.String(), options.socksProxyAuth, proxy.Direct)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
ctx, done := context.WithTimeout(t.links.core.ctx, default_timeout)
|
||||
conn, err = dialer.(proxy.ContextDialer).DialContext(ctx, "tcp", saddr)
|
||||
done()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
t.waitgroup.Add(1)
|
||||
options.socksPeerAddr = saddr
|
||||
if ch := t.handler(conn, false, options); ch != nil {
|
||||
<-ch
|
||||
}
|
||||
} else {
|
||||
dst, err := net.ResolveTCPAddr("tcp", saddr)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
if dst.IP.IsLinkLocalUnicast() {
|
||||
dst.Zone = sintf
|
||||
if dst.Zone == "" {
|
||||
return
|
||||
}
|
||||
}
|
||||
dialer := net.Dialer{
|
||||
Control: t.tcpContext,
|
||||
}
|
||||
if sintf != "" {
|
||||
dialer.Control = t.getControl(sintf)
|
||||
ief, err := net.InterfaceByName(sintf)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
if ief.Flags&net.FlagUp == 0 {
|
||||
return
|
||||
}
|
||||
addrs, err := ief.Addrs()
|
||||
if err == nil {
|
||||
for addrindex, addr := range addrs {
|
||||
src, _, err := net.ParseCIDR(addr.String())
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if src.Equal(dst.IP) {
|
||||
continue
|
||||
}
|
||||
if !src.IsGlobalUnicast() && !src.IsLinkLocalUnicast() {
|
||||
continue
|
||||
}
|
||||
bothglobal := src.IsGlobalUnicast() == dst.IP.IsGlobalUnicast()
|
||||
bothlinklocal := src.IsLinkLocalUnicast() == dst.IP.IsLinkLocalUnicast()
|
||||
if !bothglobal && !bothlinklocal {
|
||||
continue
|
||||
}
|
||||
if (src.To4() != nil) != (dst.IP.To4() != nil) {
|
||||
continue
|
||||
}
|
||||
if bothglobal || bothlinklocal || addrindex == len(addrs)-1 {
|
||||
dialer.LocalAddr = &net.TCPAddr{
|
||||
IP: src,
|
||||
Port: 0,
|
||||
Zone: sintf,
|
||||
}
|
||||
break
|
||||
}
|
||||
}
|
||||
if dialer.LocalAddr == nil {
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
ctx, done := context.WithTimeout(t.links.core.ctx, default_timeout)
|
||||
conn, err = dialer.DialContext(ctx, "tcp", dst.String())
|
||||
done()
|
||||
if err != nil {
|
||||
t.links.core.log.Debugf("Failed to dial %s: %s", callproto, err)
|
||||
return
|
||||
}
|
||||
t.waitgroup.Add(1)
|
||||
if ch := t.handler(conn, false, options); ch != nil {
|
||||
<-ch
|
||||
}
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (t *tcp) handler(sock net.Conn, incoming bool, options tcpOptions) chan struct{} {
|
||||
defer t.waitgroup.Done() // Happens after sock.close
|
||||
defer sock.Close()
|
||||
t.setExtraOptions(sock)
|
||||
var upgraded bool
|
||||
if options.upgrade != nil {
|
||||
var err error
|
||||
if sock, err = options.upgrade.upgrade(sock, &options); err != nil {
|
||||
t.links.core.log.Errorln("TCP handler upgrade failed:", err)
|
||||
return nil
|
||||
}
|
||||
upgraded = true
|
||||
}
|
||||
var name, proto, local, remote string
|
||||
if options.socksProxyAddr != "" {
|
||||
name = "socks://" + sock.RemoteAddr().String() + "/" + options.socksPeerAddr
|
||||
proto = "socks"
|
||||
local, _, _ = net.SplitHostPort(sock.LocalAddr().String())
|
||||
remote, _, _ = net.SplitHostPort(options.socksPeerAddr)
|
||||
} else {
|
||||
if upgraded {
|
||||
proto = options.upgrade.name
|
||||
name = proto + "://" + sock.RemoteAddr().String()
|
||||
} else {
|
||||
proto = "tcp"
|
||||
name = proto + "://" + sock.RemoteAddr().String()
|
||||
}
|
||||
local, _, _ = net.SplitHostPort(sock.LocalAddr().String())
|
||||
remote, _, _ = net.SplitHostPort(sock.RemoteAddr().String())
|
||||
}
|
||||
localIP := net.ParseIP(local)
|
||||
if localIP = localIP.To16(); localIP != nil {
|
||||
var laddr address.Address
|
||||
var lsubnet address.Subnet
|
||||
copy(laddr[:], localIP)
|
||||
copy(lsubnet[:], localIP)
|
||||
if laddr.IsValid() || lsubnet.IsValid() {
|
||||
// The local address is with the network address/prefix range
|
||||
// This would route ygg over ygg, which we don't want
|
||||
// FIXME ideally this check should happen outside of the core library
|
||||
// Maybe dial/listen at the application level
|
||||
// Then pass a net.Conn to the core library (after these kinds of checks are done)
|
||||
t.links.core.log.Debugln("Dropping ygg-tunneled connection", local, remote)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
force := net.ParseIP(strings.Split(remote, "%")[0]).IsLinkLocalUnicast()
|
||||
link, err := t.links.create(sock, name, proto, local, remote, incoming, force, options.linkOptions)
|
||||
if err != nil {
|
||||
t.links.core.log.Println(err)
|
||||
panic(err)
|
||||
}
|
||||
t.links.core.log.Debugln("DEBUG: starting handler for", name)
|
||||
ch, err := link.handler()
|
||||
t.links.core.log.Debugln("DEBUG: stopped handler for", name, err)
|
||||
return ch
|
||||
}
|
||||
126
src/core/tls.go
126
src/core/tls.go
|
|
@ -1,126 +0,0 @@
|
|||
package core
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/hex"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"log"
|
||||
"math/big"
|
||||
"net"
|
||||
"time"
|
||||
)
|
||||
|
||||
type tcptls struct {
|
||||
tcp *tcp
|
||||
config *tls.Config
|
||||
forDialer *TcpUpgrade
|
||||
forListener *TcpUpgrade
|
||||
}
|
||||
|
||||
func (t *tcptls) init(tcp *tcp) {
|
||||
t.tcp = tcp
|
||||
t.forDialer = &TcpUpgrade{
|
||||
upgrade: t.upgradeDialer,
|
||||
name: "tls",
|
||||
}
|
||||
t.forListener = &TcpUpgrade{
|
||||
upgrade: t.upgradeListener,
|
||||
name: "tls",
|
||||
}
|
||||
|
||||
edpriv := make(ed25519.PrivateKey, ed25519.PrivateKeySize)
|
||||
copy(edpriv[:], tcp.links.core.secret[:])
|
||||
|
||||
certBuf := &bytes.Buffer{}
|
||||
|
||||
// TODO: because NotAfter is finite, we should add some mechanism to regenerate the certificate and restart the listeners periodically for nodes with very high uptimes. Perhaps regenerate certs and restart listeners every few months or so.
|
||||
pubtemp := x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{
|
||||
CommonName: hex.EncodeToString(tcp.links.core.public[:]),
|
||||
},
|
||||
NotBefore: time.Now(),
|
||||
NotAfter: time.Now().Add(time.Hour * 24 * 365),
|
||||
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
|
||||
derbytes, err := x509.CreateCertificate(rand.Reader, &pubtemp, &pubtemp, edpriv.Public(), edpriv)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to create certificate: %s", err)
|
||||
}
|
||||
|
||||
if err := pem.Encode(certBuf, &pem.Block{Type: "CERTIFICATE", Bytes: derbytes}); err != nil {
|
||||
panic("failed to encode certificate into PEM")
|
||||
}
|
||||
|
||||
cpool := x509.NewCertPool()
|
||||
cpool.AppendCertsFromPEM(derbytes)
|
||||
|
||||
t.config = &tls.Config{
|
||||
RootCAs: cpool,
|
||||
Certificates: []tls.Certificate{
|
||||
{
|
||||
Certificate: [][]byte{derbytes},
|
||||
PrivateKey: edpriv,
|
||||
},
|
||||
},
|
||||
InsecureSkipVerify: true,
|
||||
MinVersion: tls.VersionTLS13,
|
||||
}
|
||||
}
|
||||
|
||||
func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
|
||||
config := t.config.Clone()
|
||||
config.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
|
||||
if len(rawCerts) != 1 {
|
||||
return errors.New("tls not exactly 1 cert")
|
||||
}
|
||||
cert, err := x509.ParseCertificate(rawCerts[0])
|
||||
if err != nil {
|
||||
return errors.New("tls failed to parse cert")
|
||||
}
|
||||
if cert.PublicKeyAlgorithm != x509.Ed25519 {
|
||||
return errors.New("tls wrong cert algorithm")
|
||||
}
|
||||
pk := cert.PublicKey.(ed25519.PublicKey)
|
||||
var key keyArray
|
||||
copy(key[:], pk)
|
||||
// If options does not have a pinned key, then pin one now
|
||||
if options.pinnedEd25519Keys == nil {
|
||||
options.pinnedEd25519Keys = make(map[keyArray]struct{})
|
||||
options.pinnedEd25519Keys[key] = struct{}{}
|
||||
}
|
||||
if _, isIn := options.pinnedEd25519Keys[key]; !isIn {
|
||||
return errors.New("tls key does not match pinned key")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return config
|
||||
}
|
||||
|
||||
func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, error) {
|
||||
config := t.configForOptions(options)
|
||||
conn := tls.Server(c, config)
|
||||
if err := conn.Handshake(); err != nil {
|
||||
return c, err
|
||||
}
|
||||
return conn, nil
|
||||
}
|
||||
|
||||
func (t *tcptls) upgradeDialer(c net.Conn, options *tcpOptions) (net.Conn, error) {
|
||||
config := t.configForOptions(options)
|
||||
config.ServerName = options.tlsSNI
|
||||
conn := tls.Client(c, config)
|
||||
if err := conn.Handshake(); err != nil {
|
||||
return c, err
|
||||
}
|
||||
return conn, nil
|
||||
}
|
||||
|
|
@ -45,7 +45,7 @@ type interfaceInfo struct {
|
|||
}
|
||||
|
||||
type listenerInfo struct {
|
||||
listener *core.TcpListener
|
||||
listener *core.Listener
|
||||
time time.Time
|
||||
interval time.Duration
|
||||
port uint16
|
||||
|
|
@ -219,7 +219,7 @@ func (m *Multicast) _announce() {
|
|||
for name, info := range m._listeners {
|
||||
// Prepare our stop function!
|
||||
stop := func() {
|
||||
info.listener.Stop()
|
||||
info.listener.Close()
|
||||
delete(m._listeners, name)
|
||||
m.log.Debugln("No longer multicasting on", name)
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue