ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.protocol.7
(Generate patch)

Comparing gvpe/doc/gvpe.protocol.7 (file contents):
Revision 1.10 by pcg, Mon Sep 1 06:06:11 2008 UTC vs.
Revision 1.12 by root, Sat Jul 13 04:10:29 2013 UTC

1.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05) 1.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.20)
2.\" 2.\"
3.\" Standard preamble: 3.\" Standard preamble:
4.\" ======================================================================== 4.\" ========================================================================
5.de Sh \" Subsection heading
6.br
7.if t .Sp
8.ne 5
9.PP
10\fB\\$1\fR
11.PP
12..
13.de Sp \" Vertical space (when we can't use .PP) 5.de Sp \" Vertical space (when we can't use .PP)
14.if t .sp .5v 6.if t .sp .5v
15.if n .sp 7.if n .sp
16.. 8..
17.de Vb \" Begin verbatim text 9.de Vb \" Begin verbatim text
… …
51.\" Escape single quotes in literal strings from groff's Unicode transform. 43.\" Escape single quotes in literal strings from groff's Unicode transform.
52.ie \n(.g .ds Aq \(aq 44.ie \n(.g .ds Aq \(aq
53.el .ds Aq ' 45.el .ds Aq '
54.\" 46.\"
55.\" If the F register is turned on, we'll generate index entries on stderr for 47.\" If the F register is turned on, we'll generate index entries on stderr for
56.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index 48.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
57.\" entries marked with X<> in POD. Of course, you'll have to process the 49.\" entries marked with X<> in POD. Of course, you'll have to process the
58.\" output yourself in some meaningful fashion. 50.\" output yourself in some meaningful fashion.
59.ie \nF \{\ 51.ie \nF \{\
60. de IX 52. de IX
61. tm Index:\\$1\t\\n%\t"\\$2" 53. tm Index:\\$1\t\\n%\t"\\$2"
… …
130.\} 122.\}
131.rm #[ #] #H #V #F C 123.rm #[ #] #H #V #F C
132.\" ======================================================================== 124.\" ========================================================================
133.\" 125.\"
134.IX Title "GVPE.PROTOCOL 7" 126.IX Title "GVPE.PROTOCOL 7"
135.TH GVPE.PROTOCOL 7 "2008-09-01" "2.2" "GNU Virtual Private Ethernet" 127.TH GVPE.PROTOCOL 7 "2013-07-12" "2.24" "GNU Virtual Private Ethernet"
136.\" For nroff, turn off justification. Always turn off hyphenation; it makes 128.\" For nroff, turn off justification. Always turn off hyphenation; it makes
137.\" way too many mistakes in technical documents. 129.\" way too many mistakes in technical documents.
138.if n .ad l 130.if n .ad l
139.nh 131.nh
140.SH "The GNU-VPE Protocols" 132.SH "The GNU-VPE Protocols"
… …
155reliability, and robustness. 147reliability, and robustness.
156.PP 148.PP
157The following sections describe each transport protocol in more 149The following sections describe each transport protocol in more
158detail. They are sorted by overhead/efficiency, the most efficient 150detail. They are sorted by overhead/efficiency, the most efficient
159transport is listed first: 151transport is listed first:
160.Sh "\s-1RAW\s0 \s-1IP\s0" 152.SS "\s-1RAW\s0 \s-1IP\s0"
161.IX Subsection "RAW IP" 153.IX Subsection "RAW IP"
162This protocol is the best choice, performance-wise, as the minimum 154This protocol is the best choice, performance-wise, as the minimum
163overhead per packet is only 38 bytes. 155overhead per packet is only 38 bytes.
164.PP 156.PP
165It works by sending the \s-1VPN\s0 payload using raw \s-1IP\s0 frames (using the 157It works by sending the \s-1VPN\s0 payload using raw \s-1IP\s0 frames (using the
166protocol set by \f(CW\*(C`ip\-proto\*(C'\fR). 158protocol set by \f(CW\*(C`ip\-proto\*(C'\fR).
167.PP 159.PP
168Using raw \s-1IP\s0 frames has the drawback that many firewalls block \*(L"unknown\*(R" 160Using raw \s-1IP\s0 frames has the drawback that many firewalls block \*(L"unknown\*(R"
169protocols, so this transport only works if you have full \s-1IP\s0 connectivity 161protocols, so this transport only works if you have full \s-1IP\s0 connectivity
170between nodes. 162between nodes.
171.Sh "\s-1ICMP\s0" 163.SS "\s-1ICMP\s0"
172.IX Subsection "ICMP" 164.IX Subsection "ICMP"
173This protocol offers very low overhead (minimum 42 bytes), and can 165This protocol offers very low overhead (minimum 42 bytes), and can
174sometimes tunnel through firewalls when other protocols can not. 166sometimes tunnel through firewalls when other protocols can not.
175.PP 167.PP
176It works by prepending an \s-1ICMP\s0 header with type \f(CW\*(C`icmp\-type\*(C'\fR and a code 168It works by prepending an \s-1ICMP\s0 header with type \f(CW\*(C`icmp\-type\*(C'\fR and a code
… …
178packets look like echo replies, which looks rather strange to network 170packets look like echo replies, which looks rather strange to network
179administrators. 171administrators.
180.PP 172.PP
181This transport should only be used if other transports (i.e. raw \s-1IP\s0) are 173This transport should only be used if other transports (i.e. raw \s-1IP\s0) are
182not available or undesirable (due to their overhead). 174not available or undesirable (due to their overhead).
183.Sh "\s-1UDP\s0" 175.SS "\s-1UDP\s0"
184.IX Subsection "UDP" 176.IX Subsection "UDP"
185This is a good general choice for the transport protocol as \s-1UDP\s0 packets 177This is a good general choice for the transport protocol as \s-1UDP\s0 packets
186tunnel well through most firewalls and routers, and the overhead per 178tunnel well through most firewalls and routers, and the overhead per
187packet is moderate (minimum 58 bytes). 179packet is moderate (minimum 58 bytes).
188.PP 180.PP
189It should be used if \s-1RAW\s0 \s-1IP\s0 is not available. 181It should be used if \s-1RAW\s0 \s-1IP\s0 is not available.
190.Sh "\s-1TCP\s0" 182.SS "\s-1TCP\s0"
191.IX Subsection "TCP" 183.IX Subsection "TCP"
192This protocol is a very bad choice, as it not only has high overhead (more 184This protocol is a very bad choice, as it not only has high overhead (more
193than 60 bytes), but the transport also retries on it's own, which leads 185than 60 bytes), but the transport also retries on it's own, which leads
194to congestion when the link has moderate packet loss (as both the \s-1TCP\s0 186to congestion when the link has moderate packet loss (as both the \s-1TCP\s0
195transport and the tunneled traffic will retry, increasing congestion more 187transport and the tunneled traffic will retry, increasing congestion more
… …
206.PP 198.PP
207This protocol also has server and client sides. If the \f(CW\*(C`tcp\-port\*(C'\fR is 199This protocol also has server and client sides. If the \f(CW\*(C`tcp\-port\*(C'\fR is
208set to zero, other nodes cannot connect to this node directly. If the 200set to zero, other nodes cannot connect to this node directly. If the
209\&\f(CW\*(C`tcp\-port\*(C'\fR is non-zero, the node can act both as a client as well as a 201\&\f(CW\*(C`tcp\-port\*(C'\fR is non-zero, the node can act both as a client as well as a
210server. 202server.
211.Sh "\s-1DNS\s0" 203.SS "\s-1DNS\s0"
212.IX Subsection "DNS" 204.IX Subsection "DNS"
213\&\fB\s-1WARNING:\s0\fR Parsing and generating \s-1DNS\s0 packets is rather tricky. The code 205\&\fB\s-1WARNING:\s0\fR Parsing and generating \s-1DNS\s0 packets is rather tricky. The code
214almost certainly contains buffer overflows and other, likely exploitable, 206almost certainly contains buffer overflows and other, likely exploitable,
215bugs. You have been warned. 207bugs. You have been warned.
216.PP 208.PP
… …
222traffic even if it doesn't need to transport packets. 214traffic even if it doesn't need to transport packets.
223.PP 215.PP
224In addition, the same problems as the \s-1TCP\s0 transport also plague this 216In addition, the same problems as the \s-1TCP\s0 transport also plague this
225protocol. 217protocol.
226.PP 218.PP
227It's only use is to tunnel through firewalls that do not allow direct 219Its only use is to tunnel through firewalls that do not allow direct
228internet access. Similar to using a \s-1HTTP\s0 proxy (as the \s-1TCP\s0 transport 220internet access. Similar to using a \s-1HTTP\s0 proxy (as the \s-1TCP\s0 transport
229does), it uses a local \s-1DNS\s0 server/forwarder (given by the \f(CW\*(C`dns\-forw\-host\*(C'\fR 221does), it uses a local \s-1DNS\s0 server/forwarder (given by the \f(CW\*(C`dns\-forw\-host\*(C'\fR
230configuration value) as a proxy to send and receive data as a client, 222configuration value) as a proxy to send and receive data as a client,
231and an \f(CW\*(C`NS\*(C'\fR record pointing to the \s-1GVPE\s0 server (as given by the 223and an \f(CW\*(C`NS\*(C'\fR record pointing to the \s-1GVPE\s0 server (as given by the
232\&\f(CW\*(C`dns\-hostname\*(C'\fR directive). 224\&\f(CW\*(C`dns\-hostname\*(C'\fR directive).
… …
240.IX Header "PART 2: The GNU VPE protocol" 232.IX Header "PART 2: The GNU VPE protocol"
241This section, unfortunately, is not yet finished, although the protocol 233This section, unfortunately, is not yet finished, although the protocol
242is stable (until bugs in the cryptography are found, which will likely 234is stable (until bugs in the cryptography are found, which will likely
243completely change the following description). Nevertheless, it should give 235completely change the following description). Nevertheless, it should give
244you some overview over the protocol. 236you some overview over the protocol.
245.Sh "Anatomy of a \s-1VPN\s0 packet" 237.SS "Anatomy of a \s-1VPN\s0 packet"
246.IX Subsection "Anatomy of a VPN packet" 238.IX Subsection "Anatomy of a VPN packet"
247The exact layout and field lengths of a \s-1VPN\s0 packet is determined at 239The exact layout and field lengths of a \s-1VPN\s0 packet is determined at
248compile time and doesn't change. The same structure is used for all 240compile time and doesn't change. The same structure is used for all
249transport protocols, be it \s-1RAWIP\s0 or \s-1TCP\s0. 241transport protocols, be it \s-1RAWIP\s0 or \s-1TCP\s0.
250.PP 242.PP
… …
280.PP 272.PP
281\&\s-1SEQNO\s0 is a 32\-bit sequence number. It is negotiated at every connection 273\&\s-1SEQNO\s0 is a 32\-bit sequence number. It is negotiated at every connection
282initialization and starts at some random 31 bit value. \s-1VPE\s0 currently uses 274initialization and starts at some random 31 bit value. \s-1VPE\s0 currently uses
283a sliding window of 512 packets/sequence numbers to detect reordering, 275a sliding window of 512 packets/sequence numbers to detect reordering,
284duplication and replay attacks. 276duplication and replay attacks.
277.PP
278The encryption is done on \s-1RAND+SEQNO+DATA\s0 in \s-1CBC\s0 mode with zero \s-1IV\s0 (or,
279equivalently, the \s-1IV\s0 is \s-1RAND+SEQNO\s0, encrypted with the block cipher,
280unless \s-1RAND\s0 size is decreased or increased over the default value).
285.Sh "The authentication protocol" 281.SS "The authentication protocol"
286.IX Subsection "The authentication protocol" 282.IX Subsection "The authentication protocol"
287Before nodes can exchange packets, they need to establish authenticity of 283Before nodes can exchange packets, they need to establish authenticity of
288the other side and a key. Every node has a private \s-1RSA\s0 key and the public 284the other side and a key. Every node has a private \s-1RSA\s0 key and the public
289\&\s-1RSA\s0 keys of all other nodes. 285\&\s-1RSA\s0 keys of all other nodes.
290.PP 286.PP
291A host establishes a simplex connection by sending the other node an 287A host establishes a simplex connection by sending the other node an \s-1RSA\s0
292\&\s-1RSA\s0 encrypted challenge containing a random challenge (consisting of 288encrypted challenge containing a random challenge (consisting of the
293the encryption key to use when sending packets, more random data and 289encryption and authentication keys to use when sending packets, more
294\&\s-1PKCS1_OAEP\s0 padding) and a random 16 byte \*(L"challenge-id\*(R" (used to detect 290random data and \s-1PKCS1_OAEP\s0 padding) and a random 16 byte \*(L"challenge-id\*(R"
295duplicate auth packets). The destination node will respond by replying 291(used to detect duplicate auth packets). The destination node will respond
296with an (unencrypted) \s-1RIPEMD160\s0 hash of the decrypted challenge, which 292by replying with an (unencrypted) hash of the decrypted challenge, which
297will authenticate that node. The destination node will also set the 293will authenticate that node. The destination node will also set the
298outgoing encryption parameters as given in the packet. 294outgoing encryption parameters as given in the packet.
299.PP 295.PP
300When the source node receives a correct auth reply (by verifying the 296When the source node receives a correct auth reply (by verifying the
301hash and the id, which will expire after 120 seconds), it will start to 297hash and the id, which will expire after 120 seconds), it will start to
… …
308.PP 304.PP
309This protocol is completely symmetric, so to be able to send packets the 305This protocol is completely symmetric, so to be able to send packets the
310destination node must send a challenge in the exact same way as already 306destination node must send a challenge in the exact same way as already
311described (so, in essence, two simplex connections are created per node 307described (so, in essence, two simplex connections are created per node
312pair). 308pair).
313.Sh "Retrying" 309.SS "Retrying"
314.IX Subsection "Retrying" 310.IX Subsection "Retrying"
315When there is no response to an auth request, the node will send auth 311When there is no response to an auth request, the node will send auth
316requests in bursts with an exponential back-off. After some time it will 312requests in bursts with an exponential back-off. After some time it will
317resort to \s-1PING\s0 packets, which are very small (8 bytes + protocol header) 313resort to \s-1PING\s0 packets, which are very small (8 bytes + protocol header)
318and lightweight (no \s-1RSA\s0 operations required). A node that receives ping 314and lightweight (no \s-1RSA\s0 operations required). A node that receives ping
… …
332period to \f(CW\*(C`max\-ttl\*(C'\fR seconds. 328period to \f(CW\*(C`max\-ttl\*(C'\fR seconds.
333.PP 329.PP
334Sending packets over the \s-1VPN\s0 will reset the retry intervals as well, which 330Sending packets over the \s-1VPN\s0 will reset the retry intervals as well, which
335means as long as somebody is trying to send packets to a given node, \s-1GVPE\s0 331means as long as somebody is trying to send packets to a given node, \s-1GVPE\s0
336will try to connect every few seconds. 332will try to connect every few seconds.
337.Sh "Routing and Protocol translation" 333.SS "Routing and Protocol translation"
338.IX Subsection "Routing and Protocol translation" 334.IX Subsection "Routing and Protocol translation"
339The \s-1GVPE\s0 routing algorithm is easy: there isn't much routing to speak 335The \s-1GVPE\s0 routing algorithm is easy: there isn't much routing to speak
340of: When routing packets to another node, \s-1GVPE\s0 trues the following 336of: When routing packets to another node, \s-1GVPE\s0 tries the following
341options, in order: 337options, in order:
342.IP "If the two nodes should be able to reach each other directly (common protocol, port known), then \s-1GVPE\s0 will send the packet directly to the other node." 4 338.IP "If the two nodes should be able to reach each other directly (common protocol, port known), then \s-1GVPE\s0 will send the packet directly to the other node." 4
343.IX Item "If the two nodes should be able to reach each other directly (common protocol, port known), then GVPE will send the packet directly to the other node." 339.IX Item "If the two nodes should be able to reach each other directly (common protocol, port known), then GVPE will send the packet directly to the other node."
344.PD 0 340.PD 0
345.ie n .IP "If this isn't possible (e.g. because the node doesn't have a \*(C`hostname\*(C' or known port), but the nodes speak a common protocol and a router is available, then \s-1GVPE\s0 will ask a router to ""mediate"" between both nodes (see below)." 4 341.ie n .IP "If this isn't possible (e.g. because the node doesn't have a \*(C`hostname\*(C' or known port), but the nodes speak a common protocol and a router is available, then \s-1GVPE\s0 will ask a router to ""mediate"" between both nodes (see below)." 4
346.el .IP "If this isn't possible (e.g. because the node doesn't have a \f(CW\*(C`hostname\*(C'\fR or known port), but the nodes speak a common protocol and a router is available, then \s-1GVPE\s0 will ask a router to ``mediate'' between both nodes (see below)." 4 342.el .IP "If this isn't possible (e.g. because the node doesn't have a \f(CW\*(C`hostname\*(C'\fR or known port), but the nodes speak a common protocol and a router is available, then \s-1GVPE\s0 will ask a router to ``mediate'' between both nodes (see below)." 4
347.IX Item "If this isn't possible (e.g. because the node doesn't have a hostname or known port), but the nodes speak a common protocol and a router is available, then GVPE will ask a router to mediate between both nodes (see below)." 343.IX Item "If this isn't possible (e.g. because the node doesn't have a hostname or known port), but the nodes speak a common protocol and a router is available, then GVPE will ask a router to mediate between both nodes (see below)."
348.ie n .IP "If a direct connection isn't possible (no common protocols) or forbidden (\*(C`deny\-direct\*(C'\fR) and there are any routers, then \s-1GVPE\s0 will try to send packets to the router with the highest priority that is connected already \fIand is able (as specified by the config file) to connect directly to the target node." 4 344.ie n .IP "If a direct connection isn't possible (no common protocols) or forbidden (\*(C`deny\-direct\*(C') and there are any routers, then \s-1GVPE\s0 will try to send packets to the router with the highest priority that is connected already \fIand\fR is able (as specified by the config file) to connect directly to the target node." 4
349.el .IP "If a direct connection isn't possible (no common protocols) or forbidden (\f(CW\*(C`deny\-direct\*(C'\fR) and there are any routers, then \s-1GVPE\s0 will try to send packets to the router with the highest priority that is connected already \fIand\fR is able (as specified by the config file) to connect directly to the target node." 4 345.el .IP "If a direct connection isn't possible (no common protocols) or forbidden (\f(CW\*(C`deny\-direct\*(C'\fR) and there are any routers, then \s-1GVPE\s0 will try to send packets to the router with the highest priority that is connected already \fIand\fR is able (as specified by the config file) to connect directly to the target node." 4
350.IX Item "If a direct connection isn't possible (no common protocols) or forbidden (deny-direct) and there are any routers, then GVPE will try to send packets to the router with the highest priority that is connected already and is able (as specified by the config file) to connect directly to the target node." 346.IX Item "If a direct connection isn't possible (no common protocols) or forbidden (deny-direct) and there are any routers, then GVPE will try to send packets to the router with the highest priority that is connected already and is able (as specified by the config file) to connect directly to the target node."
351.IP "If no such router exists, then \s-1GVPE\s0 will simply send the packet to the node with the highest priority available." 4 347.IP "If no such router exists, then \s-1GVPE\s0 will simply send the packet to the node with the highest priority available." 4
352.IX Item "If no such router exists, then GVPE will simply send the packet to the node with the highest priority available." 348.IX Item "If no such router exists, then GVPE will simply send the packet to the node with the highest priority available."
353.IP "Failing all that, the packet will be dropped." 4 349.IP "Failing all that, the packet will be dropped." 4

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines