j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity
tinc/src/protocol.h

134 lines
4.7 KiB
C
Raw Normal View History

Initial revision
2000-03-26 00:33:07 +00:00
/*
protocol.h -- header for protocol.c
Update copyright notices, remove Ivo's email address.
2006-04-26 13:52:58 +00:00
Copyright (C) 1999-2005 Ivo Timmermans,
Update copyright notices.
2013-08-13 18:38:57 +00:00
2000-2013 Guus Sliepen <guus@tinc-vpn.org>
Initial revision
2000-03-26 00:33:07 +00:00
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
Update the address of the Free Software Foundation in all copyright headers.
2009-09-24 22:01:00 +00:00
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Initial revision
2000-03-26 00:33:07 +00:00
*/
#ifndef __TINC_PROTOCOL_H__
#define __TINC_PROTOCOL_H__
Add an invitation protocol. Using the tinc command, an administrator of an existing VPN can generate invitations for new nodes. The invitation is a small URL that can easily be copy&pasted into email or live chat. Another person can have tinc automatically setup the necessary configuration files and exchange keys with the server, by only using the invitation URL. The invitation protocol uses temporary ECDSA keys. The invitation URL consists of the hostname and port of the server, a hash of the server's temporary ECDSA key and a cookie. When the client wants to accept an invitation, it also creates a temporary ECDSA key, connects to the server and says it wants to accept an invitation. Both sides exchange their temporary keys. The client verifies that the server's key matches the hash in the invitation URL. After setting up an SPTPS connection using the temporary keys, the client gives the cookie to the server. If the cookie is valid, the server sends the client an invitation file containing the client's new name and a copy of the server's host config file. If everything is ok, the client will generate a long-term ECDSA key and send it to the server, which will add it to a new host config file for the client. The invitation protocol currently allows multiple host config files to be send from the server to the client. However, the client filters out most configuration variables for its own host configuration file. In particular, it only accepts Name, Mode, Broadcast, ConnectTo, Subnet and AutoConnect. Also, at the moment no tinc-up script is generated. When an invitation has succesfully been accepted, the client needs to start the tinc daemon manually.
2013-05-29 16:31:10 +00:00
#include "ecdsa.h"
Add a minor number to the protocol version.
2011-07-05 19:19:48 +00:00
/* Protocol version. Different major versions are incompatible. */
- Fixed modulo in keylength check - Updated header file to reflect new protocol code
2000-09-11 10:05:35 +00:00
Add a minor number to the protocol version.
2011-07-05 19:19:48 +00:00
#define PROT_MAJOR 17
Prepend source node ID information to UDP datagrams. This commit changes the layout of UDP datagrams to include the 6-byte ID (i.e. node name hash) of the node that crafted the packet at the very beginning of the datagram (i.e. before the seqno). Note that this only applies to SPTPS. This is implemented at the lowest layer, i.e. in handle_incoming_vpn_data() and send_sptps_data() functions. Source ID is added and removed there, in such a way that the upper layers are unaware of its presence. This is the first stepping stone towards supporting UDP relaying in SPTPS, by providing information about the original sender in the packet itself. Nevertheless, even without relaying this commit already provides a few benefits such as being able to reliably determine the source node of a packet in the presence of an unknown source IP address, without having to painfully go through all node keys. This makes tinc's behavior much more scalable in this regard. This change does not break anything with regard to the protocol: It preserves compatibility with 1.0 and even with older pre-1.1 releases thanks to a minor protocol version change (17.4). Source ID information won't be included in packets sent to nodes with minor version < 4. One drawback, however, is that this change increases SPTPS datagram overhead by 6 bytes (the size of the source ID itself).
2014-09-27 17:13:33 +00:00
#define PROT_MINOR 4 /* Should not exceed 255! */
- Added meta.c which contains functions to send, receive and broadcast metadata. It will also handle encryption and decryption, and possibly compression and checksumming. - Moved request dispatcher to protocol.c.
2000-09-26 14:06:11 +00:00
Native Windows support.
2003-07-29 22:59:01 +00:00
/* Silly Windows */
#ifdef ERROR
#undef ERROR
#endif
- Fixed modulo in keylength check - Updated header file to reflect new protocol code
2000-09-11 10:05:35 +00:00
/* Request numbers */
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
typedef enum request_t {
Fix whitespace.
2012-10-10 15:17:49 +00:00
ALL = -1, /* Guardian for allow_request */
Switch to K&R style indentation.
2002-09-09 21:25:28 +00:00
ID = 0, METAKEY, CHALLENGE, CHAL_REPLY, ACK,
STATUS, ERROR, TERMREQ,
PING, PONG,
ADD_SUBNET, DEL_SUBNET,
ADD_EDGE, DEL_EDGE,
KEY_CHANGED, REQ_KEY, ANS_KEY,
PACKET,
Use minor protocol version to determine whether to use ECDH key exchange between nodes.
2012-07-19 23:02:51 +00:00
/* Tinc 1.1 requests */
Use the TCP socket infrastructure for control sockets. The control socket code was completely different from how meta connections are handled, resulting in lots of extra code to handle requests. Also, not every operating system has UNIX sockets, so we have to resort to another type of sockets or pipes for those anyway. To reduce code duplication and make control sockets work the same on all platforms, we now just connect to the TCP port where tincd is already listening on. To authenticate, the program that wants to control a running tinc daemon must send the contents of a cookie file. The cookie is a random 256 bits number that is regenerated every time tincd starts. The cookie file should only be readable by the same user that can start a tincd. Instead of the binary-ish protocol previously used, we now use an ASCII protocol similar to that of the meta connections, but this can still change.
2009-11-07 22:43:25 +00:00
CONTROL,
Use minor protocol version to determine whether to use ECDH key exchange between nodes.
2012-07-19 23:02:51 +00:00
REQ_PUBKEY, ANS_PUBKEY,
Use datagram SPTPS for packet exchange between nodes. When two nodes which support SPTPS want to send packets to each other, they now always use SPTPS. The node initiating the SPTPS session send the first SPTPS packet via an extended REQ_KEY messages. All other handshake messages are sent using ANS_KEY messages. This ensures that intermediate nodes using an older version of tinc can still help with NAT traversal. After the authentication phase is over, SPTPS packets are sent via UDP, or are encapsulated in extended REQ_KEY messages instead of PACKET messages.
2012-07-30 16:36:59 +00:00
REQ_SPTPS,
Fix whitespace.
2012-10-10 15:17:49 +00:00
LAST /* Guardian for the highest request number */
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
} request_t;
Initial revision
2000-03-26 00:33:07 +00:00
Put a break on requests that run around in circles.
2002-03-21 23:11:53 +00:00
typedef struct past_request_t {
Always pass request strings to other functions as const char *.
2012-05-08 14:44:15 +00:00
const char *request;
Switch to K&R style indentation.
2002-09-09 21:25:28 +00:00
time_t firstseen;
Put a break on requests that run around in circles.
2002-03-21 23:11:53 +00:00
} past_request_t;
Replace Opaque and Strict options with a TunnelServer option.
2003-11-17 15:30:18 +00:00
extern bool tunnelserver;
Add the StrictSubnets option. When this option is enabled, tinc will not accept dynamic updates of Subnets from other nodes, but will only use Subnets read from local host config files to build its routing table.
2010-03-01 23:18:44 +00:00
extern bool strictsubnets;
Require ExperimentalProtocol = yes for new features, update documentation.
2011-07-11 19:54:01 +00:00
extern bool experimental;
Replace Opaque and Strict options with a TunnelServer option.
2003-11-17 15:30:18 +00:00
Add an invitation protocol. Using the tinc command, an administrator of an existing VPN can generate invitations for new nodes. The invitation is a small URL that can easily be copy&pasted into email or live chat. Another person can have tinc automatically setup the necessary configuration files and exchange keys with the server, by only using the invitation URL. The invitation protocol uses temporary ECDSA keys. The invitation URL consists of the hostname and port of the server, a hash of the server's temporary ECDSA key and a cookie. When the client wants to accept an invitation, it also creates a temporary ECDSA key, connects to the server and says it wants to accept an invitation. Both sides exchange their temporary keys. The client verifies that the server's key matches the hash in the invitation URL. After setting up an SPTPS connection using the temporary keys, the client gives the cookie to the server. If the cookie is valid, the server sends the client an invitation file containing the client's new name and a copy of the server's host config file. If everything is ok, the client will generate a long-term ECDSA key and send it to the server, which will add it to a new host config file for the client. The invitation protocol currently allows multiple host config files to be send from the server to the client. However, the client filters out most configuration variables for its own host configuration file. In particular, it only accepts Name, Mode, Broadcast, ConnectTo, Subnet and AutoConnect. Also, at the moment no tinc-up script is generated. When an invitation has succesfully been accepted, the client needs to start the tinc daemon manually.
2013-05-29 16:31:10 +00:00
extern ecdsa_t *invitation_key;
Prevent possible buffer overflows when using very large (>= 8192 bit) RSA keys. Thanks to Tonnerre Lombard for noticing!
2005-06-03 10:16:03 +00:00
/* Maximum size of strings in a request.
* scanf terminates %2048s with a NUL character,
* but the NUL character can be written after the 2048th non-NUL character.
*/
- No more %as.
2000-11-22 19:55:53 +00:00
Prevent possible buffer overflows when using very large (>= 8192 bit) RSA keys. Thanks to Tonnerre Lombard for noticing!
2005-06-03 10:16:03 +00:00
#define MAX_STRING_SIZE 2049
Allow multiple listening sockets.
2002-02-26 23:26:41 +00:00
#define MAX_STRING "%2048s"
- No more %as.
2000-11-22 19:55:53 +00:00
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
#include "edge.h"
#include "net.h"
#include "node.h"
#include "subnet.h"
Merging of the entire pre5 branch.
2002-02-10 21:57:54 +00:00
/* Basic functions */
- Fixed modulo in keylength check - Updated header file to reflect new protocol code
2000-09-11 10:05:35 +00:00
Prevent definitions from messing up attributes.
2003-07-30 21:52:41 +00:00
extern bool send_request(struct connection_t *, const char *, ...) __attribute__ ((__format__(printf, 2, 3)));
Always pass request strings to other functions as const char *.
2012-05-08 14:44:15 +00:00
extern void forward_request(struct connection_t *, const char *);
extern bool receive_request(struct connection_t *, const char *);
Initial revision
2000-03-26 00:33:07 +00:00
- Added support for jumbograms. - Remove tcpaddress from edges, it is not used at all. - Last bits of code to prevent looping requests.
2002-03-22 11:43:48 +00:00
extern void init_requests(void);
extern void exit_requests(void);
Always pass request strings to other functions as const char *.
2012-05-08 14:44:15 +00:00
extern bool seen_request(const char *);
- Added support for jumbograms. - Remove tcpaddress from edges, it is not used at all. - Last bits of code to prevent looping requests.
2002-03-22 11:43:48 +00:00
Merging of the entire pre5 branch.
2002-02-10 21:57:54 +00:00
/* Requests */
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
extern bool send_id(struct connection_t *);
extern bool send_metakey(struct connection_t *);
Very primitive ECDSA signed ECDH key exchange for the meta protocol. Nonces and hash of the ID requests should be included in the seed for the PRF.
2011-07-07 20:30:55 +00:00
extern bool send_metakey_ec(struct connection_t *);
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
extern bool send_challenge(struct connection_t *);
extern bool send_chal_reply(struct connection_t *);
extern bool send_ack(struct connection_t *);
Sprinkle around a lot of const and some C99 initialisers.
2003-07-24 12:08:16 +00:00
extern bool send_status(struct connection_t *, int, const char *);
Always pass request strings to other functions as const char *.
2012-05-08 14:44:15 +00:00
extern bool send_error(struct connection_t *, int, const char *);
Use bools and enums where appropriate.
2003-07-22 20:55:21 +00:00
extern bool send_termreq(struct connection_t *);
extern bool send_ping(struct connection_t *);
extern bool send_pong(struct connection_t *);
Sprinkle around a lot of const and some C99 initialisers.
2003-07-24 12:08:16 +00:00
extern bool send_add_subnet(struct connection_t *, const struct subnet_t *);
extern bool send_del_subnet(struct connection_t *, const struct subnet_t *);
extern bool send_add_edge(struct connection_t *, const struct edge_t *);
extern bool send_del_edge(struct connection_t *, const struct edge_t *);
Fix sparse warnings and add an extra sprinkling of const. This is more or less the equivalent of Sven-Haegar Koch's fixes in the 1.1 branch.
2011-05-28 21:36:52 +00:00
extern void send_key_changed(void);
Handle UDP packets from different and ports than advertised. Previously, tinc used a fixed address and port for each node for UDP packet exchange. The port was the one advertised by that node as its listening port. However, due to NAT the port might be different. Now, tinc sends a different session key to each node. This way, the sending node can be determined from incoming packets by checking the MAC against all session keys. If a match is found, the address and port for that node are updated.
2009-04-02 23:05:23 +00:00
extern bool send_req_key(struct node_t *);
extern bool send_ans_key(struct node_t *);
Fix sparse warnings and add an extra sprinkling of const. This is more or less the equivalent of Sven-Haegar Koch's fixes in the 1.1 branch.
2011-05-28 21:36:52 +00:00
extern bool send_tcppacket(struct connection_t *, const struct vpn_packet_t *);
Merging of the entire pre5 branch.
2002-02-10 21:57:54 +00:00
/* Request handlers */
Always pass request strings to other functions as const char *.
2012-05-08 14:44:15 +00:00
extern bool id_h(struct connection_t *, const char *);
extern bool metakey_h(struct connection_t *, const char *);
extern bool challenge_h(struct connection_t *, const char *);
extern bool chal_reply_h(struct connection_t *, const char *);
extern bool ack_h(struct connection_t *, const char *);
extern bool status_h(struct connection_t *, const char *);
extern bool error_h(struct connection_t *, const char *);
extern bool termreq_h(struct connection_t *, const char *);
extern bool ping_h(struct connection_t *, const char *);
extern bool pong_h(struct connection_t *, const char *);
extern bool add_subnet_h(struct connection_t *, const char *);
extern bool del_subnet_h(struct connection_t *, const char *);
extern bool add_edge_h(struct connection_t *, const char *);
extern bool del_edge_h(struct connection_t *, const char *);
extern bool key_changed_h(struct connection_t *, const char *);
extern bool req_key_h(struct connection_t *, const char *);
extern bool ans_key_h(struct connection_t *, const char *);
extern bool tcppacket_h(struct connection_t *, const char *);
extern bool control_h(struct connection_t *, const char *);
Merging of the entire pre5 branch.
2002-02-10 21:57:54 +00:00
Fix whitespace.
2012-10-10 15:17:49 +00:00
#endif /* __TINC_PROTOCOL_H__ */
Reference in a new issue Copy permalink