j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity
2268 commits 2 branches 0 tags 10 MiB
Commit graph

2268 commits

This branch
This branch
All branches
Author SHA1 Message Date
Guus Sliepen
fec279a9c5 Make use of the improved hex and base64 functions. 
Also, use base64 for all EC related data, it is shorter and easy to
distinguish from the legacy protocol.
 2011-07-12 23:43:12 +02:00
Guus Sliepen
06b8271ed5 Make hexadecimal and base64 routines behave the same. 
The length parameter for the encoding functions is the length of the
binary input, and for the decoding functions it is the maximum size of
the binary output.

The return value is always the length of the resulting output, excluding
the terminating NULL character for the encoding routines.

All functions can encode and decode in-place. The encoding functions
will always write a terminating NULL character, and the decoding
functions will stop at a NULL character.
 2011-07-12 23:23:26 +02:00
Guus Sliepen
c108c79a22 Don't use wildcards in filenames in configure.in. 2011-07-11 22:14:06 +02:00
Guus Sliepen
bbeab00f46 Require ExperimentalProtocol = yes for new features, update documentation. 2011-07-11 21:54:01 +02:00
Guus Sliepen
d1cd3c8145 Close meta connection socket after cleaning up event structures. 
Epoll doesn't like it when an already closed filedescriptor is being
removed, so we defer closing the socket until after all else is cleaned
up.
 2011-07-10 22:46:43 +02:00
Guus Sliepen
30ef2a981e Automatically exchange ECDSA keys and upgrade to new authentication protocol. 
If we don't have ECDSA keys for the node we connect to, set protocol_minor
to 1, to indicate this to the other end. This will first complete the
old way of authentication with RSA keys, and will then exchange ECDSA keys.
The connection will be terminated right afterwards, and the next attempt
will use ECDSA keys.
 2011-07-10 22:34:17 +02:00
Guus Sliepen
027228debe Free ECDSA and RSA structures when freeing a connection_t. 2011-07-10 21:04:31 +02:00
Guus Sliepen
73863fab8a Hash input before signing it with ECDSA. 2011-07-08 18:17:34 +02:00
Guus Sliepen
8132be8fbd Very primitive ECDSA signed ECDH key exchange for the meta protocol. 
Nonces and hash of the ID requests should be included in the seed for the PRF.
 2011-07-07 22:30:55 +02:00
Guus Sliepen
210b5ceeee Read ECDSA keys. 2011-07-07 22:28:25 +02:00
Guus Sliepen
03582eb669 Implement ECDSA sign and verify operations. 
Very basic at the moment, doesn't hash the input first,
and uses OpenSSL's DER encoded signature as output.
 2011-07-07 22:27:17 +02:00
Guus Sliepen
86d83bd9bd Bump minor protocol to indicate ECDH capability for UDP session keys. 2011-07-05 21:29:31 +02:00
Guus Sliepen
9708bbfa8e Add a minor number to the protocol version. 2011-07-05 21:19:48 +02:00
Guus Sliepen
b99656d84a Round up the size of the secret parts after splitting it in two. 2011-07-04 07:51:47 +02:00
Guus Sliepen
95e1cc36d3 Add ECDSA key import. 2011-07-03 23:44:43 +02:00
Guus Sliepen
1e2d9b0899 Finish base64 decoding routine. 2011-07-03 23:33:56 +02:00
Guus Sliepen
80b81c00b1 Have tincctl generate ECDSA keys. 
The generate-keys command now generates both an RSA and an ECDSA keypair,
but one can generate-rsa-keys or generate-ecdsa-keys to just generate one type.
 2011-07-03 22:25:29 +02:00
Guus Sliepen
8ace7f3e57 Add ECDSA key generation. 2011-07-03 22:15:00 +02:00
Guus Sliepen
1d92dd62a7 Base64 encoding and decoding functions. 2011-07-03 22:13:58 +02:00
Guus Sliepen
c385d11533 Cleanups in ECDH code. 2011-07-03 22:13:34 +02:00
Guus Sliepen
895f868714 No need to keep around pointers to EC_GROUP. 2011-07-03 21:21:37 +02:00
Guus Sliepen
ac163120d7 Proper use of PRF. 2011-07-03 16:30:49 +02:00
Guus Sliepen
82f00ea07b Use PRF. 2011-07-03 15:59:49 +02:00
Guus Sliepen
feb3f22fff Add PRF to derive key material from the ECDH shared secret. 
It is modelled after the pseudorandom function from RFC4346 (TLS 1.1), the only
significant change is the use of SHA512 and Whirlpool instead of MD5 and SHA1.
 2011-07-03 15:26:58 +02:00
Guus Sliepen
8dfa072733 Support ECDH key exchange. 
REQ_KEY requests have an extra field indicating key exchange version.
If it is present and > 0, the sender supports ECDH. If the receiver also
does, then it will generate a new keypair and sends the public key in a
ANS_KEY request with "ECDH:" prefixed. The ans_key_h() function will
compute the shared secret, which, at the moment,is used as is to set the
cipher and HMAC keys. However, this must be changed to use a proper KDF.
In the future, the ECDH key exchange must also be signed.
 2011-07-03 13:17:28 +02:00
Guus Sliepen
ee8a214318 Preliminary implementation of Elliptic Curve Diffie-Hellman Ephemeral key exchange. 2011-06-27 21:52:23 +02:00
Guus Sliepen
6c21b5716b Add manpage for tinc-gui. 2011-06-26 13:17:50 +02:00
Guus Sliepen
4c934d0903 Remove debug messages that were printed to stdout. 2011-06-26 13:14:48 +02:00
Guus Sliepen
e73052b054 Update documentation to mention pidfiles instead of controlcookies. 2011-06-26 12:59:11 +02:00
Guus Sliepen
8c953b1bfe Don't react to escape character in tincctl top. 
Not only the ESC key generates an escape character, but many other keys
do as well, such as arrow keys.
 2011-06-26 12:58:50 +02:00
Guus Sliepen
27e6a89b15 Use pidfile in tinc-gui as well. 2011-06-26 12:53:41 +02:00
Guus Sliepen
660f530a6f Really stable sorting of tincctl top output. 2011-06-25 22:20:39 +02:00
Guus Sliepen
810766e139 Add +git to the version string. 2011-06-25 21:38:59 +02:00
Guus Sliepen
ab4d289faf Make pid files backwards compatible and add address of listening socket. 
The pid is now written first, so that a version 1.0.x tincd can be used to stop
a running version 1.1 tincd.  Getsockname() is used to determine the address of
the first listening socket, so that tincctl can connect to the local tincd even
if AddressFamily = ipv6, or if BindToAddress or BindToInterface is used.
 2011-06-25 21:35:27 +02:00
Guus Sliepen
a05fa7f882 Rename controlcookie file to pidfile. 2011-06-25 21:21:36 +02:00
Guus Sliepen
c64f64b875 Don't call exit_control() if we didn't do init_control(). 2011-06-25 21:16:13 +02:00
Guus Sliepen
3b237afbda Re-add support for SIGALRM. 2011-06-25 20:20:07 +02:00
Guus Sliepen
386c1aff08 Merge Tinc.py into tinc-gui to simplify make install. 
Autoconf/automake's Python support is strange.
 2011-06-25 17:39:02 +02:00
Guus Sliepen
c4c32f4059 Thank Scott Lamb, Sven-Haegar Koch and Loïc Grenié in the NEWS file. 2011-06-25 17:11:05 +02:00
Guus Sliepen
8733110dec Ensure the right files end up in the tarball after make dist. 2011-06-25 17:08:40 +02:00
Guus Sliepen
e4f65db897 Releasing 1.1pre1. 2011-06-25 15:28:54 +02:00
Guus Sliepen
2c5ded6520 Ensure that the texinfo manual can be converted to HTML. 
Somehow commit 2c30af6c90 was not properly
merged.
 2011-06-25 15:28:13 +02:00
Guus Sliepen
e8deda0b23 Update manpages and info manual. 2011-06-25 14:52:47 +02:00
Guus Sliepen
47393b5de4 Add Makefile.am in gui/. 
This ensures the gui source will be included in the tarball with make dist,
and will be installed with make install.
 2011-06-25 00:35:58 +02:00
Guus Sliepen
7944cce19e Don't use AM_CONDITIONAL for CURSES. 
For some reason, this doesn't work when cross-compiling for Windows.
 2011-06-25 00:06:06 +02:00
Guus Sliepen
365f60f3f8 Don't call event_del() from the mtuevent handler, always send_mtu_probe() in ans_key_h(). 2011-06-24 22:49:18 +02:00
Guus Sliepen
1fe8ba2f06 Delete mtuevent if it is not used. 
Keeping it around prevents ans_key_h() from restarting PMTU discovery.
 2011-06-24 22:10:03 +02:00
Guus Sliepen
79e9a4f743 Merge branch 'master' of git://tinc-vpn.org/tinc into 1.1 
Conflicts:
	NEWS
	README
	configure.in
	src/Makefile.am
 2011-06-24 21:40:55 +02:00
Guus Sliepen
05260f941c Releasing 1.0.15. 2011-06-24 14:50:20 +02:00
Guus Sliepen
3c0511984f Remove redundant @CFLAGS@ from AM_CFLAGS. 2011-06-24 12:27:04 +02:00