diff --git a/domain-server/resources/describe-settings.json b/domain-server/resources/describe-settings.json index 5b1c3482c12..9ecfed178ac 100644 --- a/domain-server/resources/describe-settings.json +++ b/domain-server/resources/describe-settings.json @@ -975,105 +975,6 @@ } ] }, - { - "name": "mac_permissions", - "type": "table", - "caption": "Permissions for Users with MAC Addresses", - "can_add_new_rows": true, - "groups": [ - { - "label": "MAC Address", - "span": 1 - }, - { - "label": "Permissions ?", - "span": 12 - } - ], - "columns": [ - { - "name": "permissions_id", - "label": "" - }, - { - "name": "id_can_connect", - "label": "Connect", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_rez_avatar_entities", - "label": "Avatar Entities", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_adjust_locks", - "label": "Lock / Unlock", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_rez", - "label": "Rez", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_rez_tmp", - "label": "Rez Temporary", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_write_to_asset_server", - "label": "Write Assets", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_connect_past_max_capacity", - "label": "Ignore Max Capacity", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_kick", - "label": "Kick Users", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_replace_content", - "label": "Replace Content", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_get_and_set_private_user_data", - "label": "Get and Set Private User Data", - "type": "checkbox", - "editable": true, - "default": false - }, - { - "name": "id_can_view_asset_urls", - "label": "View Asset URLs", - "type": "checkbox", - "editable": true, - "default": false - } - ] - }, { "name": "machine_fingerprint_permissions", "type": "table", diff --git a/domain-server/src/DomainGatekeeper.cpp b/domain-server/src/DomainGatekeeper.cpp index 3844db12f57..9e3d4c1c0f4 100644 --- a/domain-server/src/DomainGatekeeper.cpp +++ b/domain-server/src/DomainGatekeeper.cpp @@ -145,27 +145,23 @@ void DomainGatekeeper::processConnectRequestPacket(QSharedPointer(); qDebug() << "Allowed connection from node" << uuidStringWithoutCurlyBraces(node->getUUID()) << "on" << message->getSenderSockAddr() - << "with MAC" << nodeConnection.hardwareAddress << "and machine fingerprint" << nodeConnection.machineFingerprint << "user" << username << "reason" << QString(metaEnum.valueToKey(nodeConnection.connectReason)) - << "previous connection uptime" << nodeConnection.previousConnectionUpTime/USECS_PER_MSEC << "msec" - << "sysinfo" << nodeConnection.SystemInfo; + << "previous connection uptime" << nodeConnection.previousConnectionUpTime/USECS_PER_MSEC << "msec"; // signal that we just connected a node so the DomainServer can get it a list // and broadcast its presence right away emit connectedNode(node, message->getFirstPacketReceiveTime()); } else { qDebug() << "Refusing connection from node at" << message->getSenderSockAddr() - << "with hardware address" << nodeConnection.hardwareAddress - << "and machine fingerprint" << nodeConnection.machineFingerprint - << "sysinfo" << nodeConnection.SystemInfo; + << "and machine fingerprint" << nodeConnection.machineFingerprint; } } NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QString verifiedUsername, QString verifiedDomainUserName, const QHostAddress& senderAddress, - const QString& hardwareAddress, const QUuid& machineFingerprint) { + const QUuid& machineFingerprint) { NodePermissions userPerms; userPerms.setAll(false); @@ -203,14 +199,7 @@ NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QStrin #ifdef WANT_DEBUG qDebug() << "| user-permissions: unverified or no username for" << userPerms.getID() << ", so:" << userPerms; #endif - if (!hardwareAddress.isEmpty() && _server->_settingsManager.hasPermissionsForMAC(hardwareAddress)) { - // this user comes from a MAC we have in our permissions table, apply those permissions - userPerms = _server->_settingsManager.getPermissionsForMAC(hardwareAddress); - -#ifdef WANT_DEBUG - qDebug() << "| user-permissions: specific MAC matches, so:" << userPerms; -#endif - } else if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) { + if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) { userPerms = _server->_settingsManager.getPermissionsForMachineFingerprint(machineFingerprint); #ifdef WANT_DEBUG qDebug() << "| user-permissions: specific Machine Fingerprint matches, so: " << userPerms; @@ -228,13 +217,6 @@ NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QStrin userPerms = _server->_settingsManager.getPermissionsForName(verifiedUsername); #ifdef WANT_DEBUG qDebug() << "| user-permissions: specific user matches, so:" << userPerms; -#endif - } else if (!hardwareAddress.isEmpty() && _server->_settingsManager.hasPermissionsForMAC(hardwareAddress)) { - // this user comes from a MAC we have in our permissions table, apply those permissions - userPerms = _server->_settingsManager.getPermissionsForMAC(hardwareAddress); - -#ifdef WANT_DEBUG - qDebug() << "| user-permissions: specific MAC matches, so:" << userPerms; #endif } else if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) { userPerms = _server->_settingsManager.getPermissionsForMachineFingerprint(machineFingerprint); @@ -359,13 +341,11 @@ void DomainGatekeeper::updateNodePermissions() { // or the public socket if we haven't activated a socket for the node yet SockAddr connectingAddr = node->getActiveSocket() ? *node->getActiveSocket() : node->getPublicSocket(); - QString hardwareAddress; QUuid machineFingerprint; bool isLocalUser { false }; DomainServerNodeData* nodeData = static_cast(node->getLinkedData()); if (nodeData) { - hardwareAddress = nodeData->getHardwareAddress(); machineFingerprint = nodeData->getMachineFingerprint(); auto sendingAddress = nodeData->getSendingSockAddr().getAddress(); @@ -375,7 +355,7 @@ void DomainGatekeeper::updateNodePermissions() { } userPerms = setPermissionsForUser(isLocalUser, verifiedUsername, verifiedDomainUserName, - connectingAddr.getAddress(), hardwareAddress, machineFingerprint); + connectingAddr.getAddress(), machineFingerprint); } node->setPermissions(userPerms); @@ -427,7 +407,6 @@ SharedNodePointer DomainGatekeeper::processAssignmentConnectRequest(const NodeCo // set assignment related data on the linked data for this node nodeData->setAssignmentUUID(matchingQueuedAssignment->getUUID()); nodeData->setNodeVersion(it->second.getNodeVersion()); - nodeData->setHardwareAddress(nodeConnection.hardwareAddress); nodeData->setMachineFingerprint(nodeConnection.machineFingerprint); // client-side send time of last connect/domain list request nodeData->setLastDomainCheckinTimestamp(nodeConnection.lastPingTimestamp); @@ -545,7 +524,7 @@ SharedNodePointer DomainGatekeeper::processAgentConnectRequest(const NodeConnect } userPerms = setPermissionsForUser(isLocalUser, verifiedUsername, verifiedDomainUsername, - nodeConnection.senderSockAddr.getAddress(), nodeConnection.hardwareAddress, + nodeConnection.senderSockAddr.getAddress(), nodeConnection.machineFingerprint); if (!userPerms.can(NodePermissions::Permission::canConnectToDomain)) { @@ -628,9 +607,6 @@ SharedNodePointer DomainGatekeeper::processAgentConnectRequest(const NodeConnect // if we have a username from the connect request, set it on the DomainServerNodeData nodeData->setUsername(username); - // set the hardware address passed in the connect request - nodeData->setHardwareAddress(nodeConnection.hardwareAddress); - // set the machine fingerprint passed in the connect request nodeData->setMachineFingerprint(nodeConnection.machineFingerprint); diff --git a/domain-server/src/DomainGatekeeper.h b/domain-server/src/DomainGatekeeper.h index fccb8e30d5f..3143eb27fb6 100644 --- a/domain-server/src/DomainGatekeeper.h +++ b/domain-server/src/DomainGatekeeper.h @@ -136,7 +136,7 @@ private slots: QSet _inFlightGroupMembershipsRequests; // keep track of which we've already asked for NodePermissions setPermissionsForUser(bool isLocalUser, QString verifiedUsername, QString verifiedDomainUsername, - const QHostAddress& senderAddress, const QString& hardwareAddress, + const QHostAddress& senderAddress, const QUuid& machineFingerprint); void getGroupMemberships(const QString& username); diff --git a/domain-server/src/DomainServerNodeData.h b/domain-server/src/DomainServerNodeData.h index a2794f5847a..fd51a969ece 100644 --- a/domain-server/src/DomainServerNodeData.h +++ b/domain-server/src/DomainServerNodeData.h @@ -52,9 +52,6 @@ class DomainServerNodeData : public NodeData { void setNodeVersion(const QString& nodeVersion) { _nodeVersion = nodeVersion; } const QString& getNodeVersion() { return _nodeVersion; } - - void setHardwareAddress(const QString& hardwareAddress) { _hardwareAddress = hardwareAddress; } - const QString& getHardwareAddress() { return _hardwareAddress; } void setMachineFingerprint(const QUuid& machineFingerprint) { _machineFingerprint = machineFingerprint; } const QUuid& getMachineFingerprint() { return _machineFingerprint; } @@ -91,7 +88,6 @@ class DomainServerNodeData : public NodeData { bool _isAuthenticated = true; NodeSet _nodeInterestSet; QString _nodeVersion; - QString _hardwareAddress; QUuid _machineFingerprint; quint64 _lastDomainCheckinTimestamp; QString _placeName; diff --git a/domain-server/src/DomainServerSettingsManager.cpp b/domain-server/src/DomainServerSettingsManager.cpp index 37d43246c42..cb3a29e96ec 100644 --- a/domain-server/src/DomainServerSettingsManager.cpp +++ b/domain-server/src/DomainServerSettingsManager.cpp @@ -525,7 +525,7 @@ void DomainServerSettingsManager::setupConfigMap(const QString& userConfigFilena // Default values for new canRezAvatarEntities permission. unpackPermissions(); std::list> permissionsSets{ - _standardAgentPermissions.get(), _agentPermissions.get(), _ipPermissions.get(), _macPermissions.get(), + _standardAgentPermissions.get(), _agentPermissions.get(), _ipPermissions.get(), _machineFingerprintPermissions.get(), _groupPermissions.get(), _groupForbiddens.get() }; foreach (auto permissionsSet, permissionsSets) { @@ -545,7 +545,7 @@ void DomainServerSettingsManager::setupConfigMap(const QString& userConfigFilena // Default values for new canViewAssetURLs permission. unpackPermissions(); std::list> permissionsSets{ - _standardAgentPermissions.get(), _agentPermissions.get(), _ipPermissions.get(), _macPermissions.get(), + _standardAgentPermissions.get(), _agentPermissions.get(), _ipPermissions.get(), _machineFingerprintPermissions.get(), _groupPermissions.get(), _groupForbiddens.get() }; foreach (auto permissionsSet, permissionsSets) { @@ -668,9 +668,6 @@ void DomainServerSettingsManager::packPermissions() { // save settings for IP addresses packPermissionsForMap("permissions", _ipPermissions, IP_PERMISSIONS_KEYPATH); - // save settings for MAC addresses - packPermissionsForMap("permissions", _macPermissions, MAC_PERMISSIONS_KEYPATH); - // save settings for Machine Fingerprint packPermissionsForMap("permissions", _machineFingerprintPermissions, MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH); @@ -749,17 +746,6 @@ void DomainServerSettingsManager::unpackPermissions() { } }); - needPack |= unpackPermissionsForKeypath(MAC_PERMISSIONS_KEYPATH, &_macPermissions, - [&](NodePermissionsPointer perms){ - // make sure that this permission row is for a non-empty hardware - if (perms->getKey().first.isEmpty()) { - _macPermissions.remove(perms->getKey()); - - // we removed a row from the MAC permissions, we'll need a re-pack - needPack = true; - } - }); - needPack |= unpackPermissionsForKeypath(MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH, &_machineFingerprintPermissions, [&](NodePermissionsPointer perms){ // make sure that this permission row has valid machine fingerprint @@ -802,8 +788,7 @@ void DomainServerSettingsManager::unpackPermissions() { std::array permissionsSets {{ &_standardAgentPermissions, &_agentPermissions, &_groupPermissions, &_groupForbiddens, - &_ipPermissions, &_macPermissions, - &_machineFingerprintPermissions + &_ipPermissions, &_machineFingerprintPermissions }}; foreach (auto permissionSet, permissionsSets) { @@ -1120,16 +1105,6 @@ NodePermissions DomainServerSettingsManager::getPermissionsForIP(const QHostAddr return nullPermissions; } -NodePermissions DomainServerSettingsManager::getPermissionsForMAC(const QString& macAddress) const { - NodePermissionsKey macKey = NodePermissionsKey(macAddress, 0); - if (_macPermissions.contains(macKey)) { - return *(_macPermissions[macKey].get()); - } - NodePermissions nullPermissions; - nullPermissions.setAll(false); - return nullPermissions; -} - NodePermissions DomainServerSettingsManager::getPermissionsForMachineFingerprint(const QUuid& machineFingerprint) const { NodePermissionsKey fingerprintKey = NodePermissionsKey(machineFingerprint.toString(), 0); if (_machineFingerprintPermissions.contains(fingerprintKey)) { diff --git a/domain-server/src/DomainServerSettingsManager.h b/domain-server/src/DomainServerSettingsManager.h index 3c7959291cb..b4b690f9602 100644 --- a/domain-server/src/DomainServerSettingsManager.h +++ b/domain-server/src/DomainServerSettingsManager.h @@ -32,7 +32,6 @@ const QString SETTINGS_PATHS_KEY = "paths"; const QString AGENT_STANDARD_PERMISSIONS_KEYPATH = "security.standard_permissions"; const QString AGENT_PERMISSIONS_KEYPATH = "security.permissions"; const QString IP_PERMISSIONS_KEYPATH = "security.ip_permissions"; -const QString MAC_PERMISSIONS_KEYPATH = "security.mac_permissions"; const QString MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH = "security.machine_fingerprint_permissions"; const QString GROUP_PERMISSIONS_KEYPATH = "security.group_permissions"; const QString GROUP_FORBIDDENS_KEYPATH = "security.group_forbiddens"; @@ -108,10 +107,6 @@ class DomainServerSettingsManager : public QObject { bool hasPermissionsForIP(const QHostAddress& address) const { return _ipPermissions.contains(address.toString(), 0); } NodePermissions getPermissionsForIP(const QHostAddress& address) const; - // these give access to permissions for specific MACs from the domain-server settings page - bool hasPermissionsForMAC(const QString& macAddress) const { return _macPermissions.contains(macAddress, 0); } - NodePermissions getPermissionsForMAC(const QString& macAddress) const; - // these give access to permissions for specific machine fingerprints from the domain-server settings page bool hasPermissionsForMachineFingerprint(const QUuid& machineFingerprint) { return _machineFingerprintPermissions.contains(machineFingerprint.toString(), 0); } NodePermissions getPermissionsForMachineFingerprint(const QUuid& machineFingerprint) const; @@ -237,7 +232,6 @@ private slots: NodePermissionsMap _agentPermissions; // specific account-names NodePermissionsMap _ipPermissions; // permissions granted by node IP address - NodePermissionsMap _macPermissions; // permissions granted by node MAC address NodePermissionsMap _machineFingerprintPermissions; // permissions granted by Machine Fingerprint NodePermissionsMap _groupPermissions; // permissions granted by membership to specific groups diff --git a/domain-server/src/NodeConnectionData.cpp b/domain-server/src/NodeConnectionData.cpp index d7d813e3df3..2d4d6d67da1 100644 --- a/domain-server/src/NodeConnectionData.cpp +++ b/domain-server/src/NodeConnectionData.cpp @@ -31,6 +31,7 @@ NodeConnectionData NodeConnectionData::fromDataStream(QDataStream& dataStream, c // NOTE: QDataStream::readBytes() - The buffer is allocated using new []. Destroy it with the delete [] operator. delete[] rawBytes; + // PROTOCOL TODO: remove the mac address and system info fields entirely // read the hardware address sent by the client dataStream >> newHeader.hardwareAddress; @@ -40,9 +41,6 @@ NodeConnectionData NodeConnectionData::fromDataStream(QDataStream& dataStream, c // and the operating system type QByteArray compressedSystemInfo; dataStream >> compressedSystemInfo; - if (!compressedSystemInfo.isEmpty()) { - newHeader.SystemInfo = qUncompress(compressedSystemInfo); - } dataStream >> newHeader.connectReason; diff --git a/domain-server/src/NodeConnectionData.h b/domain-server/src/NodeConnectionData.h index 5976f07787c..a76ab42b66a 100644 --- a/domain-server/src/NodeConnectionData.h +++ b/domain-server/src/NodeConnectionData.h @@ -32,7 +32,6 @@ class NodeConnectionData { QString placeName; QString hardwareAddress; QUuid machineFingerprint; - QString SystemInfo; quint32 connectReason; quint64 previousConnectionUpTime; QByteArray protocolVersion; diff --git a/libraries/networking/src/NodeList.cpp b/libraries/networking/src/NodeList.cpp index e2f4d0f2e18..b7c058c9c84 100644 --- a/libraries/networking/src/NodeList.cpp +++ b/libraries/networking/src/NodeList.cpp @@ -433,42 +433,14 @@ void NodeList::sendDomainServerCheckIn() { QByteArray protocolVersionSig = protocolVersionsSignature(); packetStream.writeBytes(protocolVersionSig.constData(), protocolVersionSig.size()); - // if possible, include the MAC address for the current interface in our connect request - QString hardwareAddress; - for (auto networkInterface : QNetworkInterface::allInterfaces()) { - for (auto interfaceAddress : networkInterface.addressEntries()) { - if (interfaceAddress.ip() == localSockAddr.getAddress()) { - // this is the interface whose local IP matches what we've detected the current IP to be - hardwareAddress = networkInterface.hardwareAddress(); - - // stop checking interfaces and addresses - break; - } - } - - // stop looping if this was the current interface - if (!hardwareAddress.isEmpty()) { - break; - } - } - - packetStream << hardwareAddress; + // PROTOCOL TODO: remove the system info and mac address fields entirely + packetStream << QString(); // now add the machine fingerprint packetStream << FingerprintUtils::getMachineFingerprint(); - platform::json all = platform::getAll(); - platform::json desc; - // only pull out those items that will fit within a packet - desc[platform::keys::COMPUTER] = all[platform::keys::COMPUTER]; - desc[platform::keys::MEMORY] = all[platform::keys::MEMORY]; - desc[platform::keys::CPUS] = all[platform::keys::CPUS]; - desc[platform::keys::GPUS] = all[platform::keys::GPUS]; - desc[platform::keys::DISPLAYS] = all[platform::keys::DISPLAYS]; - desc[platform::keys::NICS] = all[platform::keys::NICS]; - - QByteArray systemInfo(desc.dump().c_str()); - QByteArray compressedSystemInfo = qCompress(systemInfo); + // PROTOCOL TODO: remove the system info and mac address fields entirely + QByteArray compressedSystemInfo = qCompress(QByteArray()); if (compressedSystemInfo.size() > MAX_SYSTEM_INFO_SIZE) { // FIXME