From ece844834d2cecc028ce81ca283f5d441088580e Mon Sep 17 00:00:00 2001 From: Michael Prokop Date: Wed, 17 Feb 2010 01:46:30 +0100 Subject: [PATCH] Imported Upstream version 0.3.3 --- ChangeLog | 11 + README | 8 +- doc/Makefile | 59 ++ doc/anyrtpproxy.8.txt | 150 +++++ doc/anytun-config.8 | 231 +++++++ doc/anytun-config.8.txt | 181 ++++++ doc/anytun-controld.8 | 139 ++++ doc/anytun-controld.8.txt | 118 ++++ doc/anytun-showtables.8 | 73 +++ doc/anytun-showtables.8.txt | 72 +++ doc/anytun.8 | 499 ++++++++++++++ doc/anytun.8.txt | 381 +++++++++++ etc/anytun/p2p-a/config | 2 +- etc/anytun/p2p-b/config | 2 +- etc/init.d/anytun | 21 +- src/Doxyfile | 1252 ------------------------------------ src/Makefile | 118 ++-- src/anytun-config.cpp | 23 +- src/anytun-controld.cpp | 65 +- src/anytun.cpp | 155 ++--- src/anytun.sln | 24 + src/anytun.suo | Bin 68608 -> 0 bytes src/anytun.vcproj | 809 +++++++++++++++++++++-- src/bsd/tunDevice.cpp | 14 +- src/configure | 65 +- src/cryptinit.hpp | 19 +- src/daemon.hpp | 165 ----- src/datatypes.h | 2 + src/keyDerivation.cpp | 4 +- src/linux/tunDevice.cpp | 10 +- src/man/Makefile | 57 -- src/man/anyrtpproxy.8.txt | 150 ----- src/man/anytun-config.8.txt | 173 ----- src/man/anytun-controld.8.txt | 110 ---- src/man/anytun-showtables.8.txt | 71 -- src/man/anytun.8.txt | 373 ----------- src/nullDaemon.cpp | 58 ++ src/nullDaemon.h | 48 ++ src/options.cpp | 75 ++- src/options.h | 4 + src/packetSource.cpp | 107 ++- src/packetSource.h | 27 +- src/posix/posixDaemon.cpp | 165 +++++ src/posix/posixDaemon.h | 55 ++ src/posix/signalHandler.hpp | 142 ++++ src/posix/sysExec.hpp | 186 ++++++ src/resolver.cpp | 12 +- src/resolver.h | 10 +- src/signalController.cpp | 188 +----- src/signalController.h | 132 +--- src/syncServer.cpp | 64 +- src/syncServer.h | 15 +- src/syncTcpConnection.cpp | 8 +- src/sysExec.cpp | 119 +--- src/sysExec.h | 36 +- src/tunDevice.h | 8 +- src/win32/make_version_h.bat | 22 + src/win32/signalHandler.hpp | 86 +++ src/win32/signalServiceHandler.hpp | 48 ++ src/win32/sysExec.hpp | 160 +++++ src/win32/tunDevice.cpp | 5 + src/win32/winService.cpp | 114 ++-- src/win32/winService.h | 35 +- version | 2 +- wireshark-lua/satp.lua | 83 --- 65 files changed, 4371 insertions(+), 3249 deletions(-) create mode 100644 doc/Makefile create mode 100644 doc/anyrtpproxy.8.txt create mode 100644 doc/anytun-config.8 create mode 100644 doc/anytun-config.8.txt create mode 100644 doc/anytun-controld.8 create mode 100644 doc/anytun-controld.8.txt create mode 100644 doc/anytun-showtables.8 create mode 100644 doc/anytun-showtables.8.txt create mode 100644 doc/anytun.8 create mode 100644 doc/anytun.8.txt delete mode 100644 src/Doxyfile delete mode 100644 src/anytun.suo delete mode 100644 src/daemon.hpp delete mode 100644 src/man/Makefile delete mode 100644 src/man/anyrtpproxy.8.txt delete mode 100644 src/man/anytun-config.8.txt delete mode 100644 src/man/anytun-controld.8.txt delete mode 100644 src/man/anytun-showtables.8.txt delete mode 100644 src/man/anytun.8.txt create mode 100644 src/nullDaemon.cpp create mode 100644 src/nullDaemon.h create mode 100644 src/posix/posixDaemon.cpp create mode 100644 src/posix/posixDaemon.h create mode 100644 src/posix/signalHandler.hpp create mode 100644 src/posix/sysExec.hpp create mode 100644 src/win32/make_version_h.bat create mode 100644 src/win32/signalHandler.hpp create mode 100644 src/win32/signalServiceHandler.hpp create mode 100644 src/win32/sysExec.hpp delete mode 100644 wireshark-lua/satp.lua diff --git a/ChangeLog b/ChangeLog index f53739c..88a0095 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,14 @@ +20**.**.** -- Version ? + +* Security fix: packet length check errors +* fixed droping of priveleges on FreeBSD +* added sysExec for Windows +* added multi socket support which allows simultanous usage + of IPv4 and IPv6 even on operating systems without V4_MAPPED + address support +* added -v|--version option +* added prebuilt manpage to release tarball (less build deps) + 2009.12.02 -- Version 0.3.2 * added 64bit build target to windows build system diff --git a/README b/README index ffceb10..60ef964 100644 --- a/README +++ b/README @@ -7,6 +7,7 @@ issues when using this library. Linux ----- +(this includes Debian with FreeBSD Kernel) using libgcrypt: libgcrypt11-dev @@ -21,7 +22,7 @@ common: libboost-system1.35-dev libboost-regex1.35-dev -only for manpage: +if you want to rebuild the manpage: asciidoc @@ -35,11 +36,10 @@ using ssl crypto lib: common: - devel/boost + devel/boost (boost-libs on newer versions of the ports tree) devel/gmake -only for manpage: - +if you want to rebuild the manpage: textproc/asciidoc textproc/libxslt textproc/docbook-xsl diff --git a/doc/Makefile b/doc/Makefile new file mode 100644 index 0000000..4f8d8e8 --- /dev/null +++ b/doc/Makefile @@ -0,0 +1,59 @@ +## +## anytun +## +## The secure anycast tunneling protocol (satp) defines a protocol used +## for communication between any combination of unicast and anycast +## tunnel endpoints. It has less protocol overhead than IPSec in Tunnel +## mode and allows tunneling of every ETHER TYPE protocol (e.g. +## ethernet, ip, arp ...). satp directly includes cryptography and +## message authentication based on the methodes used by SRTP. It is +## intended to deliver a generic, scaleable and secure solution for +## tunneling and relaying of packets of any protocol. +## +## +## Copyright (C) 2007-2009 Othmar Gsenger, Erwin Nindl, +## Christian Pointner +## +## This file is part of Anytun. +## +## Anytun is free software: you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published by +## the Free Software Foundation, either version 3 of the License, or +## any later version. +## +## Anytun is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## +## You should have received a copy of the GNU General Public License +## along with anytun. If not, see . +## + +VERSION=$(shell cat ../version) + +MANPAGES := anytun.8 anytun-controld.8 anytun-config.8 anytun-showtables.8 #anyrtpproxy.8 +XML := $(MANPAGES:%.8=%.8.xml) + +.PHONY: clean realclean + +all: manpage + +define create-manpage + a2x -f manpage $(1) + @ sed -i -e 's/\[FIXME: source\]/anytun ${VERSION}/' $(2) + @ sed -i -e 's/\[FIXME: manual\]/$(2:.8=) user manual/' $(2) + @ sed -i -e 's/^\($(subst -,\\-,$(2:.8=))\)$$/\\fB\1\\fR/' $(2) + @ sed -i -e 's/^ \[ \([^ ]*\)/ [ \\fB\1\\fR/' $(2) +endef + +%.8: %.8.txt + $(call create-manpage,$<,$@) + +manpage: $(MANPAGES) + +clean: + rm -f $(XML) + +realclean: + rm -f $(MANPAGES) diff --git a/doc/anyrtpproxy.8.txt b/doc/anyrtpproxy.8.txt new file mode 100644 index 0000000..a92d2e6 --- /dev/null +++ b/doc/anyrtpproxy.8.txt @@ -0,0 +1,150 @@ +anyrtpproxy(8) +============== + +NAME +---- +anyrtpproxy - anycast rtpproxy + +SYNOPSIS +-------- + +.... +anyrtpproxy + [ -h|--help ] + [ -D|--nodaemonize ] + [ -C|--chroot ] + [ -u|--username ] + [ -H|--chroot-dir ] + [ -P|--write-pid ] + [ -i|--interface ] + [ -s|--control [:] ] + [ -p|--port-range ] + [ -n|--nat ] + [ -o|--no-nat-once ] + [ -S|--sync-port port> ] + [ -M|--sync-hosts :[,:[...]] ] +.... + + +DESCRIPTION +----------- + +*anyrtpproxy* is a rtpproxy which can be used in combination with anycast. It uses +the same control protocol than rtpproxy though it can be controled through the nathelper +plugin of openser. *anyrtpproxy* uses the same synchronisation protocol than *Anytun* +to sync the session information among all anycast instances. + + +OPTIONS +------- + +*-D, --nodaemonize*:: + This option instructs *anyrtpproxy* to run in the foreground + instead of becoming a daemon. + +*-C, --chroot*:: + chroot and drop privileges + +*-u, --username *:: + if chroot change to this user + +*-H, --chroot-dir *:: + chroot to this directory + +*-P, --write-pid *:: + write pid to this file + +*-i, --interface *:: + The local interface to listen on for RTP packets + +*-s, --control [:]*:: + The local address and port to listen on for control messages from openser + +*-p, --port-range *:: + A pool of ports which should be used by *anyrtpproxy* to relay RTP packets. + The range may not overlap between the anycast instances + +*-n, --nat*:: + Allow to learn the remote address and port in order to handle clients behind nat. + This option should only be enabled if the source is authenticated (i.e. through + *anytun*) + +*-o, --no-nat-once*:: + Disable learning of remote address and port in case the first packet does not + come from the client which is specified by openser during configuration. Invoking + this parameter increases the security level of the system but in case of nat needs + a working nat transversal such as stun. + +*-S, --sync-port *:: + local unicast(sync) port to bind to + + This port is used by anycast hosts to synchronize information about tunnel + endpoints. No payload data is transmitted via this port. + + It is possible to obtain a list of active connections by telnetting into + this port. This port is read-only and unprotected by default. It is advised + to protect this port using firewall rules and, eventually, IPsec. + +*-M, --sync-hosts :,[:[...]]*:: + remote hosts to sync with + + Here, one has to specify all unicast IP addresses of all + other anycast hosts that comprise the anycast tunnel endpoint. + +EXAMPLES +-------- + +Anycast Setup with 3 instances: +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +On the host with unicast hostname unicast1.anycast.anytun.org and anycast +hostname anycast.anytun.org: +-------------------------------------------------------------------------------------- +# anyrtpproxy -i anycast.anytun.org -p 20000 25000 -S 2342 \ + -M unicast2.anycast.anytun.org:2342,unicast3.anycast.anytun.org:2342 +-------------------------------------------------------------------------------------- + +On the host with unicast hostname unicast2.anycast.anytun.org and anycast +hostname anycast.anytun.org: +-------------------------------------------------------------------------------------- +# anyrtpproxy -i anycast.anytun.org -p 25000 30000 -S 2342 \ + -M unicast1.anycast.anytun.org:2342,unicast3.anycast.anytun.org:2342 +-------------------------------------------------------------------------------------- + +On the host with unicast hostname unicast3.anycast.anytun.org and anycast +hostname anycast.anytun.org: +-------------------------------------------------------------------------------------- +# anyrtpproxy -i anycast.anytun.org -p 30000 35000 -S 2342 \ + -M unicast1.anycast.anytun.org:2342,unicast2.anycast.anytun.org:2342 +-------------------------------------------------------------------------------------- + + +BUGS +---- +Most likely there are some bugs in *anyrtpproxy*. If you find a bug, please let +the developers know at satp@anytun.org. Of course, patches are preferred. + +SEE ALSO +-------- +anytun(8) + +AUTHORS +------- + +Othmar Gsenger +Erwin Nindl +Christian Pointner + + +RESOURCES +--------- + +Main web site: http://www.anytun.org/ + + +COPYING +------- + +Copyright \(C) 2007-2009 Othmar Gsenger, Erwin Nindl and Christian +Pointner. This program is free software: you can redistribute it +and/or modify it under the terms of the GNU General Public License +as published by the Free Software Foundation, either version 3 of +the License, or any later version. + diff --git a/doc/anytun-config.8 b/doc/anytun-config.8 new file mode 100644 index 0000000..7947a65 --- /dev/null +++ b/doc/anytun-config.8 @@ -0,0 +1,231 @@ +'\" t +.\" Title: anytun-config +.\" Author: [see the "AUTHORS" section] +.\" Generator: DocBook XSL Stylesheets v1.75.1 +.\" Date: 02/16/2010 +.\" Manual: anytun-config user manual +.\" Source: anytun 0.3.3 +.\" Language: English +.\" +.TH "ANYTUN\-CONFIG" "8" "02/16/2010" "anytun 0.3.3" "anytun-config user manual" +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +anytun-config \- anycast tunneling configuration utility +.SH "SYNOPSIS" +.sp +.nf +\fBanytun\-config\fR + [ \fB\-h|\-\-help\fR ] + [ \fB\-L|\-\-log\fR :[,[,[\&.\&.]]] + [ \fB\-U|\-\-debug\fR ] + [ \fB\-r|\-\-remote\-host\fR ] + [ \fB\-o|\-\-remote\-port\fR ] + [ \fB\-4|\-\-ipv4\-only\fR ] + [ \fB\-6|\-\-ipv6\-only\fR ] + [ \fB\-R|\-\-route\fR / ] + [ \fB\-m|\-\-mux\fR ] + [ \fB\-w|\-\-window\-size\fR ] + [ \fB\-k|\-\-kd\-prf\fR ] + [ \fB\-e|\-\-role\fR ] + [ \fB\-E|\-\-passphrase\fR ] + [ \fB\-K|\-\-key\fR ] + [ \fB\-A|\-\-salt\fR ] +.fi +.SH "DESCRIPTION" +.sp +\fBanytun\-config\fR writes routing/connection table entries, that can be read by \fBanytun\-controld\fR\&. +.SH "OPTIONS" +.PP +\fB\-L, \-\-log \fR\fB\fI:[,[,[\&.\&.]]]\fR\fR +.RS 4 +add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&. + +The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config +\fIsyslog:3,anytun\-config,daemon\fR +is added\&. + +The following targets are supported: +.PP +\fIsyslog\fR +.RS 4 +log to syslog daemon, parameters [,[,]] +.RE +.PP +\fIfile\fR +.RS 4 +log to file, parameters [,] +.RE +.PP +\fIstdout\fR +.RS 4 +log to standard output, parameters +.RE +.PP +\fIstderr\fR +.RS 4 +log to standard error, parameters +.RE +.RE +.PP +\fB\-U, \-\-debug\fR +.RS 4 +This option instructs +\fBAnytun\fR +to run in debug mode\&. It implicits +\fB\-D\fR +(don\(cqt daemonize) and adds a log target with the configuration +\fIstdout:5\fR +(logging with maximum level)\&. In future releases there might be additional output when this option is supplied\&. +.RE +.PP +\fB\-r, \-\-remote\-host \fR\fB\fI\fR\fR +.RS 4 +This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&. +.RE +.PP +\fB\-o, \-\-remote\-port \fR\fB\fI\fR\fR +.RS 4 +The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&. +.RE +.PP +\fB\-4, \-\-ipv4\-only\fR +.RS 4 +Resolv to IPv4 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&. +.RE +.PP +\fB\-6, \-\-ipv6\-only\fR +.RS 4 +Resolv to IPv6 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&. +.RE +.PP +\fB\-R, \-\-route \fR\fB\fI/\fR\fR +.RS 4 +add a route to connection\&. This can be invoked several times\&. +.RE +.PP +\fB\-m, \-\-mux \fR\fB\fI\fR\fR +.RS 4 +the multiplex id to use\&. default: 0 +.RE +.PP +\fB\-w, \-\-window\-size \fR\fB\fI\fR\fR +.RS 4 +seqence window size + +Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&. +.RE +.PP +\fB\-k, \-\-kd\(emprf \fR\fB\fI\fR\fR +.RS 4 +key derivation pseudo random function + +The pseudo random function which is used for calculating the session keys and session salt\&. + +Possible values: +.PP +\fInull\fR +.RS 4 +no random function, keys and salt are set to 0\&.\&.00 +.RE +.PP +\fIaes\-ctr\fR +.RS 4 +AES in counter mode with 128 Bits, default value +.RE +.PP +\fIaes\-ctr\-128\fR +.RS 4 +AES in counter mode with 128 Bits +.RE +.PP +\fIaes\-ctr\-192\fR +.RS 4 +AES in counter mode with 192 Bits +.RE +.PP +\fIaes\-ctr\-256\fR +.RS 4 +AES in counter mode with 256 Bits +.RE +.RE +.PP +\fB\-e, \-\-role \fR\fB\fI\fR\fR +.RS 4 +SATP uses different session keys for inbound and outbound traffic\&. The role parameter is used to determine which keys to use for outbound or inbound packets\&. On both sides of a vpn connection different roles have to be used\&. Possible values are +\fBleft\fR +and +\fBright\fR\&. You may also use +\fBalice\fR +or +\fBserver\fR +as a replacement for +\fBleft\fR +and +\fBbob\fR +or +\fBclient\fR +as a replacement for +\fBright\fR\&. By default +\fBleft\fR +is used\&. +.RE +.PP +\fB\-E, \-\-passphrase \fR\fB\fI\fR\fR +.RS 4 +This passphrase is used to generate the master key and master salt\&. For the master key the last n bits of the SHA256 digest of the passphrase (where n is the length of the master key in bits) is used\&. The master salt gets generated with the SHA1 digest\&. You may force a specific key and or salt by using +\fB\-\-key\fR +and +\fB\-\-salt\fR\&. +.RE +.PP +\fB\-K, \-\-key \fR\fB\fI\fR\fR +.RS 4 +master key to use for key derivation + +Master key in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits)\&. +.RE +.PP +\fB\-A, \-\-salt \fR\fB\fI\fR\fR +.RS 4 +master salt to use for key derivation + +Master salt in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes)\&. +.RE +.SH "EXAMPLES" +.sp +Add a client with Connection ID (Mux) 12 and add 2 Routes to this client +.sp +.if n \{\ +.RS 4 +.\} +.nf +# anytun\-config \-w 0 \-m 12 \-K 0123456789ABCDEFFEDCBA9876543210 \-A 0123456789ABCDDCBA9876543210 \e + \-R 192\&.0\&.2\&.0/24 \-R 192\&.168\&.1\&.1/32 \-e server >> routingtable +.fi +.if n \{\ +.RE +.\} +.SH "BUGS" +.sp +Most likely there are some bugs in \fBAnytun\fR\&. If you find a bug, please let the developers know at satp@anytun\&.org\&. Of course, patches are preferred\&. +.SH "SEE ALSO" +.sp +anytun(8), anytun\-controld(8), anytun\-showtables(8) +.SH "AUTHORS" +.sp +Othmar Gsenger Erwin Nindl Christian Pointner +.SH "RESOURCES" +.sp +Main web site: http://www\&.anytun\&.org/ +.SH "COPYING" +.sp +Copyright (C) 2007\-2009 Othmar Gsenger, Erwin Nindl and Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&. diff --git a/doc/anytun-config.8.txt b/doc/anytun-config.8.txt new file mode 100644 index 0000000..1aebf9a --- /dev/null +++ b/doc/anytun-config.8.txt @@ -0,0 +1,181 @@ +anytun-config(8) +================ + +NAME +---- + +anytun-config - anycast tunneling configuration utility + +SYNOPSIS +-------- + +.... +anytun-config + [ -h|--help ] + [ -L|--log :[,[,[..]]] + [ -U|--debug ] + [ -r|--remote-host ] + [ -o|--remote-port ] + [ -4|--ipv4-only ] + [ -6|--ipv6-only ] + [ -R|--route / ] + [ -m|--mux ] + [ -w|--window-size ] + [ -k|--kd-prf ] + [ -e|--role ] + [ -E|--passphrase ] + [ -K|--key ] + [ -A|--salt ] +.... + +DESCRIPTION +----------- + +*anytun-config* writes routing/connection table entries, that can be read by *anytun-controld*. + +OPTIONS +------- + +*-L, --log ':[,[,[..]]]'*:: + add log target to logging system. This can be invoked several times + in order to log to different targets at the same time. Every target + hast its own log level which is a number between 0 and 5. Where 0 means + disabling log and 5 means debug messages are enabled. + + The file target can be used more the once with different levels. + If no target is provided at the command line a single target with the + config 'syslog:3,anytun-config,daemon' is added. + + The following targets are supported: + + 'syslog';; log to syslog daemon, parameters [,[,]] + 'file';; log to file, parameters [,] + 'stdout';; log to standard output, parameters + 'stderr';; log to standard error, parameters + +*-U, --debug*:: + This option instructs *Anytun* to run in debug mode. It implicits *-D* + (don't daemonize) and adds a log target with the configuration + 'stdout:5' (logging with maximum level). In future releases there might + be additional output when this option is supplied. + +*-r, --remote-host ''*:: + This option can be used to specify the remote tunnel + endpoint. In case of anycast tunnel endpoints, the + anycast IP address has to be used. If you do not specify + an address, it is automatically determined after receiving + the first data packet. + +*-o, --remote-port ''*:: + The UDP port used for payload data by the remote host + (specified with -p on the remote host). If you do not specify + a port, it is automatically determined after receiving + the first data packet. + +*-4, --ipv4-only*:: + Resolv to IPv4 addresses only. The default is to resolv both + IPv4 and IPv6 addresses. + +*-6, --ipv6-only*:: + Resolv to IPv6 addresses only. The default is to resolv both + IPv4 and IPv6 addresses. + +*-R, --route '/'*:: + add a route to connection. This can be invoked several times. + +*-m, --mux ''*:: + the multiplex id to use. default: 0 + +*-w, --window-size ''*:: + seqence window size + + Sometimes, packets arrive out of order on the receiver + side. This option defines the size of a list of received + packets' sequence numbers. If, according to this list, + a received packet has been previously received or has + been transmitted in the past, and is therefore not in + the list anymore, this is interpreted as a replay attack + and the packet is dropped. A value of 0 deactivates this + list and, as a consequence, the replay protection employed + by filtering packets according to their secuence number. + By default the sequence window is disabled and therefore a + window size of 0 is used. + +*-k, --kd--prf ''*:: + key derivation pseudo random function + + The pseudo random function which is used for calculating the + session keys and session salt. + + Possible values: + + 'null';; no random function, keys and salt are set to 0..00 + 'aes-ctr';; AES in counter mode with 128 Bits, default value + 'aes-ctr-128';; AES in counter mode with 128 Bits + 'aes-ctr-192';; AES in counter mode with 192 Bits + 'aes-ctr-256';; AES in counter mode with 256 Bits + +*-e, --role ''*:: + SATP uses different session keys for inbound and outbound traffic. The + role parameter is used to determine which keys to use for outbound or + inbound packets. On both sides of a vpn connection different roles have + to be used. Possible values are *left* and *right*. You may also use + *alice* or *server* as a replacement for *left* and *bob* or *client* as + a replacement for *right*. By default *left* is used. + +*-E, --passphrase ''*:: + This passphrase is used to generate the master key and master salt. + For the master key the last n bits of the SHA256 digest of the + passphrase (where n is the length of the master key in bits) is used. + The master salt gets generated with the SHA1 digest. + You may force a specific key and or salt by using *--key* and *--salt*. + +*-K, --key ''*:: + master key to use for key derivation + + Master key in hexadecimal notation, e.g. + 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length + of 32, 48 or 64 characters (128, 192 or 256 bits). + +*-A, --salt ''*:: + master salt to use for key derivation + + Master salt in hexadecimal notation, e.g. + 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length + of 28 characters (14 bytes). + + +EXAMPLES +-------- + +Add a client with Connection ID (Mux) 12 and add 2 Routes to this client + +------------------------------------------------------------------------------------------------ +# anytun-config -w 0 -m 12 -K 0123456789ABCDEFFEDCBA9876543210 -A 0123456789ABCDDCBA9876543210 \ + -R 192.0.2.0/24 -R 192.168.1.1/32 -e server >> routingtable +------------------------------------------------------------------------------------------------ + +BUGS +---- +Most likely there are some bugs in *Anytun*. If you find a bug, please let +the developers know at satp@anytun.org. Of course, patches are preferred. + +SEE ALSO +-------- +anytun(8), anytun-controld(8), anytun-showtables(8) + +AUTHORS +------- + +Othmar Gsenger +Erwin Nindl +Christian Pointner + + +RESOURCES +--------- + +Main web site: http://www.anytun.org/ + + +COPYING +------- + +Copyright \(C) 2007-2009 Othmar Gsenger, Erwin Nindl and Christian +Pointner. This program is free software: you can redistribute it +and/or modify it under the terms of the GNU General Public License +as published by the Free Software Foundation, either version 3 of +the License, or any later version. diff --git a/doc/anytun-controld.8 b/doc/anytun-controld.8 new file mode 100644 index 0000000..8273d3e --- /dev/null +++ b/doc/anytun-controld.8 @@ -0,0 +1,139 @@ +'\" t +.\" Title: anytun-controld +.\" Author: [see the "AUTHORS" section] +.\" Generator: DocBook XSL Stylesheets v1.75.1 +.\" Date: 02/16/2010 +.\" Manual: anytun-controld user manual +.\" Source: anytun 0.3.3 +.\" Language: English +.\" +.TH "ANYTUN\-CONTROLD" "8" "02/16/2010" "anytun 0.3.3" "anytun-controld user manual" +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +anytun-controld \- anycast tunneling control daemon +.SH "SYNOPSIS" +.sp +.nf +\fBanytun\-controld\fR + [ \fB\-h|\-\-help\fR ] + [ \fB\-D|\-\-nodaemonize\fR ] + [ \fB\-u|\-\-username\fR ] + [ \fB\-g|\-\-groupname\fR ] + [ \fB\-C|\-\-chroot\fR ] + [ \fB\-P|\-\-write\-pid\fR ] + [ \fB\-L|\-\-log\fR :[,[,[\&.\&.]]] ] + [ \fB\-U|\-\-debug\fR ] + [ \fB\-f|\-\-file\fR ] + [ \fB\-X|\-\-control\-host\fR < [:port>] | : > ] +.fi +.SH "DESCRIPTION" +.sp +\fBanytun\-controld\fR configures the multi\-connection support for \fBAnytun\fR\&. It reads a connection/routing table and outputs it via a tcp socket to all connected \fBAnytun\fR servers\&. When the control daemon is restarted with a new connection/routing table all \fBAnytun\fR servers automatically load the new configuration\&. Please make sure to protect that information as it contains the connection keys\&. +.SH "OPTIONS" +.PP +\fB\-D, \-\-nodaemonize\fR +.RS 4 +This option instructs +\fBanytun\-controld\fR +to run in foreground instead of becoming a daemon which is the default\&. +.RE +.PP +\fB\-u, \-\-username \fR\fB\fI\fR\fR +.RS 4 +run as this user\&. If no group is specified (\fB\-g\fR) the default group of the user is used\&. The default is to not drop privileges\&. +.RE +.PP +\fB\-g, \-\-groupname \fR\fB\fI\fR\fR +.RS 4 +run as this group\&. If no username is specified (\fB\-u\fR) this gets ignored\&. The default is to not drop privileges\&. +.RE +.PP +\fB\-C, \-\-chroot \fR\fB\fI\fR\fR +.RS 4 +Instruct +\fBanytun\-controld\fR +to run in a chroot jail\&. The default is to not run in chroot\&. +.RE +.PP +\fB\-P, \-\-write\-pid \fR\fB\fI\fR\fR +.RS 4 +Instruct +\fBanytun\-controld\fR +to write it\(cqs pid to this file\&. The default is to not create a pid file\&. +.RE +.PP +\fB\-L, \-\-log \fR\fB\fI:[,[,[\&.\&.]]]\fR\fR +.RS 4 +add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&. + +The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config +\fIsyslog:3,anytun\-controld,daemon\fR +is added\&. + +The following targets are supported: +.PP +\fIsyslog\fR +.RS 4 +log to syslog daemon, parameters [,[,]] +.RE +.PP +\fIfile\fR +.RS 4 +log to file, parameters [,] +.RE +.PP +\fIstdout\fR +.RS 4 +log to standard output, parameters +.RE +.PP +\fIstderr\fR +.RS 4 +log to standard error, parameters +.RE +.RE +.PP +\fB\-U, \-\-debug\fR +.RS 4 +This option instructs +\fBAnytun\fR +to run in debug mode\&. It implicits +\fB\-D\fR +(don\(cqt daemonize) and adds a log target with the configuration +\fIstdout:5\fR +(logging with maximum level)\&. In future releases there might be additional output when this option is supplied\&. +.RE +.PP +\fB\-f, \-\-file \fR\fB\fI\fR\fR +.RS 4 +The path to the file which holds the sync information\&. +.RE +.PP +\fB\-X, \-\-control\-host \fR\fB\fI[:]\fR\fR +.RS 4 +fetch the config from this host\&. The default is not to use a control host and therefore this is empty\&. Mind that the port can be omitted in which case port 2323 is used\&. If you want to specify an ipv6 address and a port you have to use [ and ] to separate the address from the port, eg\&.: [::1]:1234\&. If you want to use the default port [ and ] can be omitted\&. +.RE +.SH "BUGS" +.sp +Most likely there are some bugs in \fBAnytun\fR\&. If you find a bug, please let the developers know at satp@anytun\&.org\&. Of course, patches are preferred\&. +.SH "SEE ALSO" +.sp +anytun(8), anytun\-config(8), anytun\-showtables(8) +.SH "AUTHORS" +.sp +Othmar Gsenger Erwin Nindl Christian Pointner +.SH "RESOURCES" +.sp +Main web site: http://www\&.anytun\&.org/ +.SH "COPYING" +.sp +Copyright (C) 2007\-2009 Othmar Gsenger, Erwin Nindl and Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&. diff --git a/doc/anytun-controld.8.txt b/doc/anytun-controld.8.txt new file mode 100644 index 0000000..6c7a3d8 --- /dev/null +++ b/doc/anytun-controld.8.txt @@ -0,0 +1,118 @@ +anytun-controld(8) +================== + +NAME +---- + +anytun-controld - anycast tunneling control daemon + +SYNOPSIS +-------- + +.... +anytun-controld + [ -h|--help ] + [ -D|--nodaemonize ] + [ -u|--username ] + [ -g|--groupname ] + [ -C|--chroot ] + [ -P|--write-pid ] + [ -L|--log :[,[,[..]]] ] + [ -U|--debug ] + [ -f|--file ] + [ -X|--control-host < [:port>] | : > ] +.... + +DESCRIPTION +----------- + +*anytun-controld* configures the multi-connection support for *Anytun*. It reads a connection/routing table and outputs it via a tcp socket to all connected *Anytun* servers. When the control daemon is restarted with a new connection/routing table all *Anytun* servers automatically load the new configuration. Please make sure to protect that information as it contains the connection keys. + +OPTIONS +------- + +*-D, --nodaemonize*:: + This option instructs *anytun-controld* to run in foreground + instead of becoming a daemon which is the default. + +*-u, --username ''*:: + run as this user. If no group is specified (*-g*) the default group of + the user is used. The default is to not drop privileges. + +*-g, --groupname ''*:: + run as this group. If no username is specified (*-u*) this gets ignored. + The default is to not drop privileges. + +*-C, --chroot ''*:: + Instruct *anytun-controld* to run in a chroot jail. The default is + to not run in chroot. + +*-P, --write-pid ''*:: + Instruct *anytun-controld* to write it's pid to this file. The default is + to not create a pid file. + +*-L, --log ':[,[,[..]]]'*:: + add log target to logging system. This can be invoked several times + in order to log to different targets at the same time. Every target + hast its own log level which is a number between 0 and 5. Where 0 means + disabling log and 5 means debug messages are enabled. + + The file target can be used more the once with different levels. + If no target is provided at the command line a single target with the + config 'syslog:3,anytun-controld,daemon' is added. + + The following targets are supported: + + 'syslog';; log to syslog daemon, parameters [,[,]] + 'file';; log to file, parameters [,] + 'stdout';; log to standard output, parameters + 'stderr';; log to standard error, parameters + +*-U, --debug*:: + This option instructs *Anytun* to run in debug mode. It implicits *-D* + (don't daemonize) and adds a log target with the configuration + 'stdout:5' (logging with maximum level). In future releases there might + be additional output when this option is supplied. + +*-f, --file ''*:: + The path to the file which holds the sync information. + +*-X, --control-host '[:]'*:: + fetch the config from this host. The default is not to use a control + host and therefore this is empty. Mind that the port can be omitted + in which case port 2323 is used. If you want to specify an + ipv6 address and a port you have to use [ and ] to separate the address + from the port, eg.: [::1]:1234. If you want to use the default port + [ and ] can be omitted. + + +BUGS +---- +Most likely there are some bugs in *Anytun*. If you find a bug, please let +the developers know at satp@anytun.org. Of course, patches are preferred. + +SEE ALSO +-------- +anytun(8), anytun-config(8), anytun-showtables(8) + +AUTHORS +------- + +Othmar Gsenger +Erwin Nindl +Christian Pointner + + +RESOURCES +--------- + +Main web site: http://www.anytun.org/ + + +COPYING +------- + +Copyright \(C) 2007-2009 Othmar Gsenger, Erwin Nindl and Christian +Pointner. This program is free software: you can redistribute it +and/or modify it under the terms of the GNU General Public License +as published by the Free Software Foundation, either version 3 of +the License, or any later version. + diff --git a/doc/anytun-showtables.8 b/doc/anytun-showtables.8 new file mode 100644 index 0000000..0f0e598 --- /dev/null +++ b/doc/anytun-showtables.8 @@ -0,0 +1,73 @@ +'\" t +.\" Title: anytun-showtables +.\" Author: [see the "AUTHORS" section] +.\" Generator: DocBook XSL Stylesheets v1.75.1 +.\" Date: 02/16/2010 +.\" Manual: anytun-showtables user manual +.\" Source: anytun 0.3.3 +.\" Language: English +.\" +.TH "ANYTUN\-SHOWTABLES" "8" "02/16/2010" "anytun 0.3.3" "anytun-showtables user manual" +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +anytun-showtables \- anycast tunneling routing table visualization utility +.SH "SYNOPSIS" +.sp +.nf +\fBanytun\-showtables\fR +.fi +.SH "DESCRIPTION" +.sp +\fBanytun\-showtables\fR displays routing and connection tables used by \fBAnytun\fR\&. It can be used to display a saved routing/connection table used by \fBanytun\-controld\fR or to connect to a the sync port of \fBAnytun\fR\&. +.SH "OPTIONS" +.sp +This Tool does not take any options\&. It takes the sync information from the standard input and prints the routing table to the standard output\&. +.SH "EXAMPLES" +.sp +Print routing table stored in local file +.sp +.if n \{\ +.RS 4 +.\} +.nf +# perl \-ne \'chomp; print\' < routingtable | \&./anytun\-showtables +.fi +.if n \{\ +.RE +.\} +.sp +Print current routing table and watch changes +.sp +.if n \{\ +.RS 4 +.\} +.nf +# nc unicast1\&.anycast\&.anytun\&.org 23 | \&./anytun\-showtables +.fi +.if n \{\ +.RE +.\} +.SH "BUGS" +.sp +Most likely there are some bugs in \fBAnytun\fR\&. If you find a bug, please let the developers know at satp@anytun\&.org\&. Of course, patches are preferred\&. +.SH "SEE ALSO" +.sp +anytun(8), anytun\-controld(8), anytun\-config(8) +.SH "AUTHORS" +.sp +Othmar Gsenger Erwin Nindl Christian Pointner +.SH "RESOURCES" +.sp +Main web site: http://www\&.anytun\&.org/ +.SH "COPYING" +.sp +Copyright (C) 2007\-2009 Othmar Gsenger, Erwin Nindl and Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&. diff --git a/doc/anytun-showtables.8.txt b/doc/anytun-showtables.8.txt new file mode 100644 index 0000000..13070a4 --- /dev/null +++ b/doc/anytun-showtables.8.txt @@ -0,0 +1,72 @@ +anytun-showtables(8) +==================== + +NAME +---- + +anytun-showtables - anycast tunneling routing table visualization utility + +SYNOPSIS +-------- + +.... +anytun-showtables +.... + +DESCRIPTION +----------- + +*anytun-showtables* displays routing and connection tables used by *Anytun*. It can be used to display a saved routing/connection table used by *anytun-controld* or to connect to a the sync port of *Anytun*. + +OPTIONS +------- + +This Tool does not take any options. It takes the sync information from +the standard input and prints the routing table to the standard output. + +EXAMPLES +-------- + +Print routing table stored in local file + +----------------------------------------------------------------------------------- +# perl -ne 'chomp; print' < routingtable | ./anytun-showtables +----------------------------------------------------------------------------------- + +Print current routing table and watch changes + +----------------------------------------------------------------------------------- +# nc unicast1.anycast.anytun.org 23 | ./anytun-showtables +----------------------------------------------------------------------------------- + +BUGS +---- +Most likely there are some bugs in *Anytun*. If you find a bug, please let +the developers know at satp@anytun.org. Of course, patches are preferred. + +SEE ALSO +-------- +anytun(8), anytun-controld(8), anytun-config(8) + +AUTHORS +------- + +Othmar Gsenger +Erwin Nindl +Christian Pointner + + +RESOURCES +--------- + +Main web site: http://www.anytun.org/ + + +COPYING +------- + +Copyright \(C) 2007-2009 Othmar Gsenger, Erwin Nindl and Christian +Pointner. This program is free software: you can redistribute it +and/or modify it under the terms of the GNU General Public License +as published by the Free Software Foundation, either version 3 of +the License, or any later version. diff --git a/doc/anytun.8 b/doc/anytun.8 new file mode 100644 index 0000000..9a167c6 --- /dev/null +++ b/doc/anytun.8 @@ -0,0 +1,499 @@ +'\" t +.\" Title: anytun +.\" Author: [see the "AUTHORS" section] +.\" Generator: DocBook XSL Stylesheets v1.75.1 +.\" Date: 02/16/2010 +.\" Manual: anytun user manual +.\" Source: anytun 0.3.3 +.\" Language: English +.\" +.TH "ANYTUN" "8" "02/16/2010" "anytun 0.3.3" "anytun user manual" +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +anytun \- anycast tunneling daemon +.SH "SYNOPSIS" +.sp +.nf +\fBanytun\fR + [ \fB\-h|\-\-help\fR ] + [ \fB\-D|\-\-nodaemonize\fR ] + [ \fB\-u|\-\-username\fR ] + [ \fB\-g|\-\-groupname\fR ] + [ \fB\-C|\-\-chroot\fR ] + [ \fB\-P|\-\-write\-pid\fR ] + [ \fB\-L|\-\-log\fR :[,[,[\&.\&.]]] ] + [ \fB\-U|\-\-debug\fR ] + [ \fB\-i|\-\-interface\fR ] + [ \fB\-p|\-\-port\fR ] + [ \fB\-r|\-\-remote\-host\fR ] + [ \fB\-o|\-\-remote\-port\fR ] + [ \fB\-4|\-\-ipv4\-only\fR ] + [ \fB\-6|\-\-ipv6\-only\fR ] + [ \fB\-I|\-\-sync\-interface\fR ] + [ \fB\-S|\-\-sync\-port\fR port> ] + [ \fB\-M|\-\-sync\-hosts\fR [:][,[:][\&.\&.\&.]] ] + [ \fB\-X|\-\-control\-host\fR [:] + [ \fB\-d|\-\-dev\fR ] + [ \fB\-t|\-\-type\fR ] + [ \fB\-n|\-\-ifconfig\fR / ] + [ \fB\-x|\-\-post\-up\-script\fR