Introduce raw TCP SPTPS packet transport.
Currently, SPTPS packets are transported over TCP metaconnections using extended REQ_KEY requests, in order for the packets to pass through tinc-1.0 nodes unaltered. Unfortunately, this method presents two significant downsides: - An already encrypted SPTPS packet is decrypted and then encrypted again every time it passes through a node, since it is transported over the SPTPS channels of the metaconnections. This double-encryption is unnecessary and wastes CPU cycles. - More importantly, the only way to transport binary data over standard metaconnection messages such as REQ_KEY is to encode it in base64, which has a 33% encoding overhead. This wastes 25% of the network bandwidth. This commit introduces a new protocol message, SPTPS_PACKET, which can be used to transport SPTPS packets over a TCP metaconnection in an efficient way. The new message is appropriately protected through a minor protocol version increment, and extended REQ_KEY messages are still used with nodes that do not support the new message, as well as for the intial handshake packets, for which efficiency is not a concern. The way SPTPS_PACKET works is very similar to how the traditional PACKET message works: after the SPTPS_PACKET message, the raw binary packet is sent directly over the metaconnection. There is one important difference, however: in the case of SPTPS_PACKET, the packet is sent directly over the TCP stream completely bypassing the SPTPS channel of the metaconnection itself for maximum efficiency. This is secure because the SPTPS packet that is being sent is already encrypted with an end-to-end key.
This commit is contained in:
parent
d237efd325
commit
7e6b2dd1ea
8 changed files with 126 additions and 3 deletions
|
|
@ -153,6 +153,36 @@ bool tcppacket_h(connection_t *c, const char *request) {
|
|||
return true;
|
||||
}
|
||||
|
||||
bool send_sptps_tcppacket(connection_t *c, const char* packet, int len) {
|
||||
/* If there already is a lot of data in the outbuf buffer, discard this packet.
|
||||
We use a very simple Random Early Drop algorithm. */
|
||||
|
||||
if(2.0 * c->outbuf.len / (float)maxoutbufsize - 1 > (float)rand()/(float)RAND_MAX)
|
||||
return true;
|
||||
|
||||
if(!send_request(c, "%d %hd", SPTPS_PACKET, len))
|
||||
return false;
|
||||
|
||||
send_meta_raw(c, packet, len);
|
||||
return true;
|
||||
}
|
||||
|
||||
bool sptps_tcppacket_h(connection_t *c, const char* request) {
|
||||
short int len;
|
||||
|
||||
if(sscanf(request, "%*d %hd", &len) != 1) {
|
||||
logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "SPTPS_PACKET", c->name,
|
||||
c->hostname);
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Set sptpslen to len, this will tell receive_meta() that a SPTPS packet is coming. */
|
||||
|
||||
c->sptpslen = len;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Transmitting UDP information */
|
||||
|
||||
bool send_udp_info(node_t *from, node_t *to) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue