Encode and decode of tags and capabilities in NetworkConfig.

node/Capability.hpp

@@ -264,40 +264,6 @@ public:
 		}
 	}
 
-	template<unsigned int C>
-	inline void serialize(Buffer<C> &b,const bool forSign = false) const
-	{
-		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
-
-		b.append(_nwid);
-		b.append(_ts);
-		b.append(_expiration);
-		b.append(_id);
-		serializeRules(b,_rules,_ruleCount);
-		b.append((uint8_t)_maxCustodyChainLength);
-
-		if (!forSign) {
-			for(unsigned int i=0;;++i) {
-				if ((i < _maxCustodyChainLength)&&(i < ZT_MAX_CAPABILITY_CUSTODY_CHAIN_LENGTH)&&(_custody[i].to)) {
-					_custody[i].to.appendTo(b);
-					_custody[i].from.appendTo(b);
-					b.append((uint8_t)1); // 1 == Ed25519 signature
-					b.append((uint16_t)ZT_C25519_SIGNATURE_LEN); // length of signature
-					b.append(_custody[i].signature.data,ZT_C25519_SIGNATURE_LEN);
-				} else {
-					b.append((unsigned char)0,ZT_ADDRESS_LENGTH); // zero 'to' terminates chain
-					break;
-				}
-			}
-		}
-
-		// This is the size of any additional fields. If it is nonzero,
-		// the last 2 bytes of the next field will be another size field.
-		b.append((uint16_t)0);
-
-		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
-	}
-
 	template<unsigned int C>
 	static inline void deserializeRules(const Buffer<C> &b,unsigned int &p,ZT_VirtualNetworkRule *rules,unsigned int &ruleCount,const unsigned int maxRuleCount)
 	{
@@ -373,6 +339,41 @@ public:
 		}
 	}
 
+	template<unsigned int C>
+	inline void serialize(Buffer<C> &b,const bool forSign = false) const
+	{
+		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
+
+		// These are the same between Tag and Capability
+		b.append(_nwid);
+		b.append(_ts);
+		b.append(_expiration);
+		b.append(_id);
+
+		serializeRules(b,_rules,_ruleCount);
+		b.append((uint8_t)_maxCustodyChainLength);
+
+		if (!forSign) {
+			for(unsigned int i=0;;++i) {
+				if ((i < _maxCustodyChainLength)&&(i < ZT_MAX_CAPABILITY_CUSTODY_CHAIN_LENGTH)&&(_custody[i].to)) {
+					_custody[i].to.appendTo(b);
+					_custody[i].from.appendTo(b);
+					b.append((uint8_t)1); // 1 == Ed25519 signature
+					b.append((uint16_t)ZT_C25519_SIGNATURE_LEN); // length of signature
+					b.append(_custody[i].signature.data,ZT_C25519_SIGNATURE_LEN);
+				} else {
+					b.append((unsigned char)0,ZT_ADDRESS_LENGTH); // zero 'to' terminates chain
+					break;
+				}
+			}
+		}
+
+		// This is the size of any additional fields, currently 0.
+		b.append((uint16_t)0);
+
+		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
+	}
+
 	template<unsigned int C>
 	inline unsigned int deserialize(const Buffer<C> &b,unsigned int startAt = 0)
 	{
@@ -380,15 +381,18 @@ public:
 
 		unsigned int p = startAt;
 
+		// These are the same between Tag and Capability
 		_nwid = b.template at<uint64_t>(p); p += 8;
 		_ts = b.template at<uint64_t>(p); p += 8;
 		_expiration = b.template at<uint64_t>(p); p += 8;
 		_id = b.template at<uint32_t>(p); p += 4;
-		deserializeRules(b,p,_rules,_ruleCount,ZT_MAX_CAPABILITY_RULES);
-		_maxCustodyChainLength = (unsigned int)b[p++];
 
+		deserializeRules(b,p,_rules,_ruleCount,ZT_MAX_CAPABILITY_RULES);
+
+		_maxCustodyChainLength = (unsigned int)b[p++];
 		if ((_maxCustodyChainLength < 1)||(_maxCustodyChainLength > ZT_MAX_CAPABILITY_CUSTODY_CHAIN_LENGTH))
 			throw std::runtime_error("invalid max custody chain length");
+
 		for(unsigned int i=0;;++i) {
 			const Address to(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
 			if (!to)

node/IncomingPacket.cpp

@@ -717,7 +717,7 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 
 		const unsigned int metaDataLength = at<uint16_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT_LEN);
 		const char *metaDataBytes = (const char *)field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT,metaDataLength);
-		const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> metaData(metaDataBytes,metaDataLength);
+		const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> metaData(metaDataBytes,metaDataLength);
 
 		//const uint64_t haveRevision = ((ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT + metaDataLength + 8) <= size()) ? at<uint64_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT + metaDataLength) : 0ULL;
 

node/Network.cpp

@@ -358,18 +358,21 @@ Network::Network(const RuntimeEnvironment *renv,uint64_t nwid,void *uptr) :
 		RR->node->dataStorePut(confn,"\n",1,false);
 	} else {
 		bool gotConf = false;
+		Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> *dconf = new Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY>();
+		NetworkConfig *nconf = new NetworkConfig();
 		try {
 			std::string conf(RR->node->dataStoreGet(confn));
 			if (conf.length()) {
-				Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> dconf(conf.c_str());
+				dconf->load(conf.c_str());
-				NetworkConfig nconf;
+				if (nconf->fromDictionary(*dconf)) {
-				if (nconf.fromDictionary(dconf)) {
+					this->setConfiguration(*nconf,false);
-					this->setConfiguration(nconf,false);
 					_lastConfigUpdate = 0; // we still want to re-request a new config from the network
 					gotConf = true;
 				}
 			}
 		} catch ( ... ) {} // ignore invalids, we'll re-request
+		delete nconf;
+		delete dconf;
 
 		if (!gotConf) {
 			// Save a one-byte CR to persist membership while we request a real netconf
@@ -591,14 +594,16 @@ void Network::requestConfiguration()
 	if (_id == ZT_TEST_NETWORK_ID) // pseudo-network-ID, uses locally generated static config
 		return;
 
-	Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> rmd;
+	Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> rmd;
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,(uint64_t)ZT_NETWORKCONFIG_VERSION);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION,(uint64_t)ZT_PROTO_VERSION);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION,(uint64_t)ZEROTIER_ONE_VERSION_MAJOR);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION,(uint64_t)ZEROTIER_ONE_VERSION_MINOR);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION,(uint64_t)ZEROTIER_ONE_VERSION_REVISION);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_RULES,(uint64_t)ZT_MAX_NETWORK_RULES);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_CAPABILITIES,(uint64_t)ZT_MAX_NETWORK_CAPABILITIES);
 	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_CAPABILITY_RULES,(uint64_t)ZT_MAX_CAPABILITY_RULES);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_TAGS,(uint64_t)ZT_MAX_NETWORK_TAGS);
 
 	if (controller() == RR->identity.address()) {
 		if (RR->localNetworkController) {

node/NetworkConfig.cpp

@@ -18,6 +18,8 @@
 
 #include <stdint.h>
 
+#include <algorithm>
+
 #include "NetworkConfig.hpp"
 #include "Utils.hpp"
 
@@ -25,204 +27,152 @@ namespace ZeroTier {
 
 bool NetworkConfig::toDictionary(Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d,bool includeLegacy) const
 {
-	Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY> tmp;
+	Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY> *tmp = new Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY>();
 
-	d.clear();
+	try {
+		d.clear();
 
-	// Try to put the more human-readable fields first
+		// Try to put the more human-readable fields first
 
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_VERSION,(uint64_t)ZT_NETWORKCONFIG_VERSION)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_VERSION,(uint64_t)ZT_NETWORKCONFIG_VERSION)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,this->networkId)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,this->networkId)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,this->timestamp)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,this->timestamp)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_REVISION,this->revision)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_REVISION,this->revision)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,this->issuedTo)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,this->issuedTo)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_FLAGS,this->flags)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_FLAGS,this->flags)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,(uint64_t)this->multicastLimit)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,(uint64_t)this->multicastLimit)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TYPE,(uint64_t)this->type)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TYPE,(uint64_t)this->type)) return false;
-	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NAME,this->name)) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NAME,this->name)) return false;
 
 #ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
-	if (includeLegacy) {
+		if (includeLegacy) {
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD,this->allowPassiveBridging())) return false;
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD,this->allowPassiveBridging())) return false;
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD,this->enableBroadcast())) return false;
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD,this->enableBroadcast())) return false;
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD,this->isPrivate())) return false;
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD,this->isPrivate())) return false;
 
-		std::string v4s;
+			std::string v4s;
-		for(unsigned int i=0;i<staticIpCount;++i) {
+			for(unsigned int i=0;i<staticIpCount;++i) {
-			if (this->staticIps[i].ss_family == AF_INET) {
+				if (this->staticIps[i].ss_family == AF_INET) {
-				if (v4s.length() > 0)
+					if (v4s.length() > 0)
-					v4s.push_back(',');
+						v4s.push_back(',');
-				v4s.append(this->staticIps[i].toString());
+					v4s.append(this->staticIps[i].toString());
-			}
-		}
-		if (v4s.length() > 0) {
-			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD,v4s.c_str())) return false;
-		}
-		std::string v6s;
-		for(unsigned int i=0;i<staticIpCount;++i) {
-			if (this->staticIps[i].ss_family == AF_INET6) {
-				if (v6s.length() > 0)
-					v6s.push_back(',');
-				v6s.append(this->staticIps[i].toString());
-			}
-		}
-		if (v6s.length() > 0) {
-			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD,v6s.c_str())) return false;
-		}
-
-		std::string ets;
-		unsigned int et = 0;
-		ZT_VirtualNetworkRuleType lastrt = ZT_NETWORK_RULE_ACTION_ACCEPT;
-		for(unsigned int i=0;i<ruleCount;++i) {
-			ZT_VirtualNetworkRuleType rt = (ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f);
-			if (rt == ZT_NETWORK_RULE_MATCH_ETHERTYPE) {
-				et = rules[i].v.etherType;
-			} else if (rt == ZT_NETWORK_RULE_ACTION_ACCEPT) {
-				if (((int)lastrt < 32)||(lastrt == ZT_NETWORK_RULE_MATCH_ETHERTYPE)) {
-					if (ets.length() > 0)
-						ets.push_back(',');
-					char tmp[16];
-					Utils::snprintf(tmp,sizeof(tmp),"%x",et);
-					ets.append(tmp);
 				}
-				et = 0;
 			}
-			lastrt = rt;
+			if (v4s.length() > 0) {
-		}
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD,v4s.c_str())) return false;
-		if (ets.length() > 0) {
+			}
-			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD,ets.c_str())) return false;
+			std::string v6s;
-		}
+			for(unsigned int i=0;i<staticIpCount;++i) {
+				if (this->staticIps[i].ss_family == AF_INET6) {
+					if (v6s.length() > 0)
+						v6s.push_back(',');
+					v6s.append(this->staticIps[i].toString());
+				}
+			}
+			if (v6s.length() > 0) {
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD,v6s.c_str())) return false;
+			}
 
-		if (this->com) {
+			std::string ets;
-			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD,this->com.toString().c_str())) return false;
+			unsigned int et = 0;
-		}
+			ZT_VirtualNetworkRuleType lastrt = ZT_NETWORK_RULE_ACTION_ACCEPT;
+			for(unsigned int i=0;i<ruleCount;++i) {
+				ZT_VirtualNetworkRuleType rt = (ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f);
+				if (rt == ZT_NETWORK_RULE_MATCH_ETHERTYPE) {
+					et = rules[i].v.etherType;
+				} else if (rt == ZT_NETWORK_RULE_ACTION_ACCEPT) {
+					if (((int)lastrt < 32)||(lastrt == ZT_NETWORK_RULE_MATCH_ETHERTYPE)) {
+						if (ets.length() > 0)
+							ets.push_back(',');
+						char tmp2[16];
+						Utils::snprintf(tmp2,sizeof(tmp2),"%x",et);
+						ets.append(tmp2);
+					}
+					et = 0;
+				}
+				lastrt = rt;
+			}
+			if (ets.length() > 0) {
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD,ets.c_str())) return false;
+			}
 
-		std::string ab;
+			if (this->com) {
-		for(unsigned int i=0;i<this->specialistCount;++i) {
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD,this->com.toString().c_str())) return false;
-			if ((this->specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE) != 0) {
+			}
-				if (ab.length() > 0)
+
-					ab.push_back(',');
+			std::string ab;
-				ab.append(Address(this->specialists[i]).toString().c_str());
+			for(unsigned int i=0;i<this->specialistCount;++i) {
+				if ((this->specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE) != 0) {
+					if (ab.length() > 0)
+						ab.push_back(',');
+					ab.append(Address(this->specialists[i]).toString().c_str());
+				}
+			}
+			if (ab.length() > 0) {
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD,ab.c_str())) return false;
 			}
 		}
-		if (ab.length() > 0) {
-			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD,ab.c_str())) return false;
-		}
-	}
 #endif // ZT_SUPPORT_OLD_STYLE_NETCONF
 
-	// Then add binary blobs
+		// Then add binary blobs
 
-	if (this->com) {
+		if (this->com) {
-		tmp.clear();
+			tmp->clear();
-		this->com.serialize(tmp);
+			this->com.serialize(*tmp);
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_COM,tmp)) return false;
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_COM,*tmp)) return false;
-	}
-
-	tmp.clear();
-	for(unsigned int i=0;i<this->specialistCount;++i) {
-		tmp.append((uint64_t)this->specialists[i]);
-	}
-	if (tmp.size()) {
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,tmp)) return false;
-	}
-
-	tmp.clear();
-	for(unsigned int i=0;i<this->routeCount;++i) {
-		reinterpret_cast<const InetAddress *>(&(this->routes[i].target))->serialize(tmp);
-		reinterpret_cast<const InetAddress *>(&(this->routes[i].via))->serialize(tmp);
-		tmp.append((uint16_t)this->routes[i].flags);
-		tmp.append((uint16_t)this->routes[i].metric);
-	}
-	if (tmp.size()) {
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,tmp)) return false;
-	}
-
-	tmp.clear();
-	for(unsigned int i=0;i<this->staticIpCount;++i) {
-		this->staticIps[i].serialize(tmp);
-	}
-	if (tmp.size()) {
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,tmp)) return false;
-	}
-
-	tmp.clear();
-	for(unsigned int i=0;i<this->ruleCount;++i) {
-		tmp.append((uint8_t)rules[i].t);
-		switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) {
-			//case ZT_NETWORK_RULE_ACTION_DROP:
-			//case ZT_NETWORK_RULE_ACTION_ACCEPT:
-			default:
-				tmp.append((uint8_t)0);
-				break;
-			case ZT_NETWORK_RULE_ACTION_TEE:
-			case ZT_NETWORK_RULE_ACTION_REDIRECT:
-			case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
-			case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
-				tmp.append((uint8_t)5);
-				Address(rules[i].v.zt).appendTo(tmp);
-				break;
-			case ZT_NETWORK_RULE_MATCH_VLAN_ID:
-				tmp.append((uint8_t)2);
-				tmp.append((uint16_t)rules[i].v.vlanId);
-				break;
-			case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
-				tmp.append((uint8_t)1);
-				tmp.append((uint8_t)rules[i].v.vlanPcp);
-				break;
-			case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
-				tmp.append((uint8_t)1);
-				tmp.append((uint8_t)rules[i].v.vlanDei);
-				break;
-			case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
-				tmp.append((uint8_t)2);
-				tmp.append((uint16_t)rules[i].v.etherType);
-				break;
-			case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
-			case ZT_NETWORK_RULE_MATCH_MAC_DEST:
-				tmp.append((uint8_t)6);
-				tmp.append(rules[i].v.mac,6);
-				break;
-			case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
-			case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
-				tmp.append((uint8_t)5);
-				tmp.append(&(rules[i].v.ipv4.ip),4);
-				tmp.append((uint8_t)rules[i].v.ipv4.mask);
-				break;
-			case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
-			case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
-				tmp.append((uint8_t)17);
-				tmp.append(rules[i].v.ipv6.ip,16);
-				tmp.append((uint8_t)rules[i].v.ipv6.mask);
-				break;
-			case ZT_NETWORK_RULE_MATCH_IP_TOS:
-				tmp.append((uint8_t)1);
-				tmp.append((uint8_t)rules[i].v.ipTos);
-				break;
-			case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
-				tmp.append((uint8_t)1);
-				tmp.append((uint8_t)rules[i].v.ipProtocol);
-				break;
-			case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
-			case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
-				tmp.append((uint8_t)4);
-				tmp.append((uint16_t)rules[i].v.port[0]);
-				tmp.append((uint16_t)rules[i].v.port[1]);
-				break;
-			case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-				tmp.append((uint8_t)16);
-				tmp.append((uint64_t)rules[i].v.characteristics[0]);
-				tmp.append((uint64_t)rules[i].v.characteristics[1]);
-				break;
-			case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
-				tmp.append((uint8_t)4);
-				tmp.append((uint16_t)rules[i].v.frameSize[0]);
-				tmp.append((uint16_t)rules[i].v.frameSize[1]);
-				break;
 		}
-	}
+
-	if (tmp.size()) {
+		tmp->clear();
-		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_RULES,tmp)) return false;
+		for(unsigned int i=0;i<this->capabilityCount;++i)
+			this->capabilities[i].serialize(*tmp);
+		if (tmp->size()) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_CAPABILITIES,*tmp)) return false;
+		}
+
+		tmp->clear();
+		for(unsigned int i=0;i<this->tagCount;++i)
+			this->tags[i].serialize(*tmp);
+		if (tmp->size()) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TAGS,*tmp)) return false;
+		}
+
+		tmp->clear();
+		for(unsigned int i=0;i<this->specialistCount;++i)
+			tmp->append((uint64_t)this->specialists[i]);
+		if (tmp->size()) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,*tmp)) return false;
+		}
+
+		tmp->clear();
+		for(unsigned int i=0;i<this->routeCount;++i) {
+			reinterpret_cast<const InetAddress *>(&(this->routes[i].target))->serialize(*tmp);
+			reinterpret_cast<const InetAddress *>(&(this->routes[i].via))->serialize(*tmp);
+			tmp->append((uint16_t)this->routes[i].flags);
+			tmp->append((uint16_t)this->routes[i].metric);
+		}
+		if (tmp->size()) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,*tmp)) return false;
+		}
+
+		tmp->clear();
+		for(unsigned int i=0;i<this->staticIpCount;++i)
+			this->staticIps[i].serialize(*tmp);
+		if (tmp->size()) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,*tmp)) return false;
+		}
+
+		if (this->ruleCount) {
+			tmp->clear();
+			Capability::serializeRules(*tmp,rules,ruleCount);
+			if (tmp->size()) {
+				if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_RULES,*tmp)) return false;
+			}
+		}
+
+		delete tmp;
+	} catch ( ... ) {
+		delete tmp;
+		throw;
 	}
 
 	return true;
@@ -230,26 +180,31 @@ bool NetworkConfig::toDictionary(Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d,b
 
 bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d)
 {
-	try {
+	Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY> *tmp = new Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY>();
-		Buffer<ZT_NETWORKCONFIG_DICT_CAPACITY> tmp;
-		char tmp2[ZT_NETWORKCONFIG_DICT_CAPACITY];
 
+	try {
 		memset(this,0,sizeof(NetworkConfig));
 
 		// Fields that are always present, new or old
 		this->networkId = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,0);
-		if (!this->networkId)
+		if (!this->networkId) {
+			delete tmp;
 			return false;
+		}
 		this->timestamp = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,0);
 		this->revision = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_REVISION,0);
 		this->issuedTo = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,0);
-		if (!this->issuedTo)
+		if (!this->issuedTo) {
+			delete tmp;
 			return false;
+		}
 		this->multicastLimit = (unsigned int)d.getUI(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,0);
 		d.get(ZT_NETWORKCONFIG_DICT_KEY_NAME,this->name,sizeof(this->name));
 
 		if (d.getUI(ZT_NETWORKCONFIG_DICT_KEY_VERSION,0) < 6) {
 	#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
+			char tmp2[1024];
+
 			// Decode legacy fields if version is old
 			if (d.getB(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD))
 				this->flags |= ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING;
@@ -305,6 +260,7 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
 				}
 			}
 	#else
+			delete tmp;
 			return false;
 	#endif // ZT_SUPPORT_OLD_STYLE_NETCONF
 		} else {
@@ -312,99 +268,63 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
 			this->flags = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_FLAGS,0);
 			this->type = (ZT_VirtualNetworkType)d.getUI(ZT_NETWORKCONFIG_DICT_KEY_TYPE,(uint64_t)ZT_NETWORK_TYPE_PRIVATE);
 
-			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_COM,tmp)) {
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_COM,*tmp))
-				this->com.deserialize(tmp,0);
+				this->com.deserialize(*tmp,0);
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_CAPABILITIES,*tmp)) {
+				try {
+					unsigned int p = 0;
+					while (p < tmp->size()) {
+						Capability cap;
+						p += cap.deserialize(*tmp,p);
+						this->capabilities[this->capabilityCount++] = cap;
+					}
+				} catch ( ... ) {}
+				std::sort(&(this->capabilities[0]),&(this->capabilities[this->capabilityCount]));
 			}
 
-			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,tmp)) {
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_TAGS,*tmp)) {
+				try {
+					unsigned int p = 0;
+					while (p < tmp->size()) {
+						Tag tag;
+						p += tag.deserialize(*tmp,p);
+						this->tags[this->tagCount++] = tag;
+					}
+				} catch ( ... ) {}
+				std::sort(&(this->tags[0]),&(this->tags[this->tagCount]));
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,*tmp)) {
 				unsigned int p = 0;
-				while (((p + 8) <= tmp.size())&&(specialistCount < ZT_MAX_NETWORK_SPECIALISTS)) {
+				while (((p + 8) <= tmp->size())&&(specialistCount < ZT_MAX_NETWORK_SPECIALISTS)) {
-					this->specialists[this->specialistCount++] = tmp.at<uint64_t>(p);
+					this->specialists[this->specialistCount++] = tmp->at<uint64_t>(p);
 					p += 8;
 				}
 			}
 
-			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,tmp)) {
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,*tmp)) {
 				unsigned int p = 0;
-				while ((p < tmp.size())&&(routeCount < ZT_MAX_NETWORK_ROUTES)) {
+				while ((p < tmp->size())&&(routeCount < ZT_MAX_NETWORK_ROUTES)) {
-					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].target))->deserialize(tmp,p);
+					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].target))->deserialize(*tmp,p);
-					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].via))->deserialize(tmp,p);
+					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].via))->deserialize(*tmp,p);
-					this->routes[this->routeCount].flags = tmp.at<uint16_t>(p); p += 2;
+					this->routes[this->routeCount].flags = tmp->at<uint16_t>(p); p += 2;
-					this->routes[this->routeCount].metric = tmp.at<uint16_t>(p); p += 2;
+					this->routes[this->routeCount].metric = tmp->at<uint16_t>(p); p += 2;
 					++this->routeCount;
 				}
 			}
 
-			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,tmp)) {
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,*tmp)) {
 				unsigned int p = 0;
-				while ((p < tmp.size())&&(staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
+				while ((p < tmp->size())&&(staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
-					p += this->staticIps[this->staticIpCount++].deserialize(tmp,p);
+					p += this->staticIps[this->staticIpCount++].deserialize(*tmp,p);
 				}
 			}
 
-			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_RULES,tmp)) {
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_RULES,*tmp)) {
+				this->ruleCount = 0;
 				unsigned int p = 0;
-				while ((p < tmp.size())&&(ruleCount < ZT_MAX_NETWORK_RULES)) {
+				Capability::deserializeRules(*tmp,p,this->rules,this->ruleCount,ZT_MAX_NETWORK_RULES);
-					rules[ruleCount].t = (uint8_t)tmp[p++];
-					unsigned int fieldLen = (unsigned int)tmp[p++];
-					switch((ZT_VirtualNetworkRuleType)(rules[ruleCount].t & 0x7f)) {
-						default:
-							break;
-						case ZT_NETWORK_RULE_ACTION_TEE:
-						case ZT_NETWORK_RULE_ACTION_REDIRECT:
-						case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
-						case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
-							rules[ruleCount].v.zt = Address(tmp.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH).toInt();
-							break;
-						case ZT_NETWORK_RULE_MATCH_VLAN_ID:
-							rules[ruleCount].v.vlanId = tmp.at<uint16_t>(p);
-							break;
-						case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
-							rules[ruleCount].v.vlanPcp = (uint8_t)tmp[p];
-							break;
-						case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
-							rules[ruleCount].v.vlanDei = (uint8_t)tmp[p];
-							break;
-						case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
-							rules[ruleCount].v.etherType = tmp.at<uint16_t>(p);
-							break;
-						case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
-						case ZT_NETWORK_RULE_MATCH_MAC_DEST:
-							memcpy(rules[ruleCount].v.mac,tmp.field(p,6),6);
-							break;
-						case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
-						case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
-							memcpy(&(rules[ruleCount].v.ipv4.ip),tmp.field(p,4),4);
-							rules[ruleCount].v.ipv4.mask = (uint8_t)tmp[p + 4];
-							break;
-						case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
-						case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
-							memcpy(rules[ruleCount].v.ipv6.ip,tmp.field(p,16),16);
-							rules[ruleCount].v.ipv6.mask = (uint8_t)tmp[p + 16];
-							break;
-						case ZT_NETWORK_RULE_MATCH_IP_TOS:
-							rules[ruleCount].v.ipTos = (uint8_t)tmp[p];
-							break;
-						case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
-							rules[ruleCount].v.ipProtocol = (uint8_t)tmp[p];
-							break;
-						case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
-						case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
-							rules[ruleCount].v.port[0] = tmp.at<uint16_t>(p);
-							rules[ruleCount].v.port[1] = tmp.at<uint16_t>(p + 2);
-							break;
-						case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-							rules[ruleCount].v.characteristics[0] = tmp.at<uint64_t>(p);
-							rules[ruleCount].v.characteristics[1] = tmp.at<uint64_t>(p + 8);
-							break;
-						case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
-							rules[ruleCount].v.frameSize[0] = tmp.at<uint16_t>(p);
-							rules[ruleCount].v.frameSize[0] = tmp.at<uint16_t>(p + 2);
-							break;
-					}
-					p += fieldLen;
-					++ruleCount;
-				}
 			}
 		}
 
@@ -412,8 +332,10 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
 		//dump();
 		//printf("~~~\n");
 
+		delete tmp;
 		return true;
 	} catch ( ... ) {
+		delete tmp;
 		return false;
 	}
 }

node/NetworkConfig.hpp

@@ -66,22 +66,42 @@
 
 namespace ZeroTier {
 
-// Maximum size of a network config dictionary (can be increased)
+// Dictionary capacity needed for max size network config
-#define ZT_NETWORKCONFIG_DICT_CAPACITY 8194
+#define ZT_NETWORKCONFIG_DICT_CAPACITY (4096 + (sizeof(ZT_VirtualNetworkRule) * ZT_MAX_NETWORK_RULES) + (sizeof(Capability) * ZT_MAX_NETWORK_CAPABILITIES) + (sizeof(Tag) * ZT_MAX_NETWORK_TAGS))
+
+// Dictionary capacity needed for max size network meta-data
+#define ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY 1024
 
 // Network config version
 #define ZT_NETWORKCONFIG_VERSION 6
 
 // Fields for meta-data sent with network config requests
+
+// Network config version
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION "v"
+
+// Protocol version (see Packet.hpp)
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION "pv"
+
+// Software major, minor, revision
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION "majv"
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION "minv"
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION "revv"
-#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_RULES "Mr"
+
-#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_CAPABILITY_RULES "Mcr"
+// Maximum number of rules per network this node can accept
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_RULES "mr"
+
+// Maximum number of capabilities this node can accept
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_CAPABILITIES "mc"
+
+// Maximum number of rules per capability this node can accept
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_CAPABILITY_RULES "mcr"
+
+// Maximum number of tags this node can accept
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_MAX_NETWORK_TAGS "mt"
 
 // These dictionary keys are short so they don't take up much room.
+// By convention we use upper case for binary blobs, but it doesn't really matter.
 
 // network config version
 #define ZT_NETWORKCONFIG_DICT_KEY_VERSION "v"
@@ -111,6 +131,10 @@ namespace ZeroTier {
 #define ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS "I"
 // rules (binary blob)
 #define ZT_NETWORKCONFIG_DICT_KEY_RULES "R"
+// capabilities (binary blobs)
+#define ZT_NETWORKCONFIG_DICT_KEY_CAPABILITIES "CAP"
+// tags (binary blobs)
+#define ZT_NETWORKCONFIG_DICT_KEY_TAGS "TAG"
 
 // Legacy fields -- these are obsoleted but are included when older clients query
 
@@ -453,12 +477,12 @@ public:
 	ZT_VirtualNetworkRule rules[ZT_MAX_NETWORK_RULES];
 
 	/**
-	 * Capabilities for this node on this network
+	 * Capabilities for this node on this network, in ascending order of capability ID
 	 */
 	Capability capabilities[ZT_MAX_NETWORK_CAPABILITIES];
 
 	/**
-	 * Tags for this node on this network
+	 * Tags for this node on this network, in ascending order of tag ID
 	 */
 	Tag tags[ZT_MAX_NETWORK_TAGS];
 

node/NetworkController.hpp

@@ -75,7 +75,7 @@ public:
 		const Identity &signingId,
 		const Identity &identity,
 		uint64_t nwid,
-		const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &metaData,
+		const Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> &metaData,
 		NetworkConfig &nc) = 0;
 };
 

node/Tag.hpp

@@ -117,11 +117,14 @@ public:
 	{
 		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
 
+		// These are the same between Tag and Capability
 		b.append(_nwid);
 		b.append(_ts);
 		b.append(_expiration);
 		b.append(_id);
+
 		b.append(_value);
+
 		_issuedTo.appendTo(b);
 		_signedBy.appendTo(b);
 		if (!forSign) {
@@ -129,6 +132,7 @@ public:
 			b.append((uint16_t)ZT_C25519_SIGNATURE_LEN); // length of signature
 			b.append(_signature.data,ZT_C25519_SIGNATURE_LEN);
 		}
+
 		b.append((uint16_t)0); // length of additional fields, currently 0
 
 		if (forSign) b.append((uint64_t)0x7f7f7f7f7f7f7f7fULL);
@@ -139,11 +143,14 @@ public:
 	{
 		unsigned int p = startAt;
 
+		// These are the same between Tag and Capability
 		_nwid = b.template at<uint64_t>(p); p += 8;
 		_ts = b.template at<uint64_t>(p); p += 8;
 		_expiration = b.template at<uint64_t>(p); p += 8;
 		_id = b.template at<uint32_t>(p); p += 4;
+
 		_value = b.template at<uint32_t>(p); p += 4;
+
 		_issuedTo.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
 		_signedBy.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
 		if (b[p++] != 1)