mirror of https://github.com/dswd/vpncloud.git
Compare commits
4 Commits
cac5af890b
...
a3a7e6c8a2
| Author | SHA1 | Date |
|---|---|---|
Dennis Schwerdel
|
a3a7e6c8a2 | |
|
Dennis Schwerdel
|
0af6c4fc39 | |
|
Dennis Schwerdel
|
4f8a4503b5 | |
|
Dennis Schwerdel
|
cbc135ce12 |
38
.travis.yml
38
.travis.yml
|
|
@ -1,38 +0,0 @@
|
|||
dist: xenial
|
||||
sudo: required
|
||||
language: rust
|
||||
cache: cargo
|
||||
rust:
|
||||
- nightly
|
||||
- beta
|
||||
- stable
|
||||
matrix:
|
||||
allow_failures:
|
||||
- rust: nightly
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- libcurl4-openssl-dev
|
||||
- libelf-dev
|
||||
- libdw-dev
|
||||
- binutils-dev
|
||||
- cmake
|
||||
- ruby-ronn
|
||||
before_script:
|
||||
- export PATH=$HOME/.cargo/bin:$PATH
|
||||
- cargo install cargo-update || echo "cargo-update already installed"
|
||||
- cargo install cargo-travis || echo "cargo-travis already installed"
|
||||
- cargo install-update -a # update outdated cached binaries
|
||||
script:
|
||||
- |
|
||||
cargo build && cargo test
|
||||
after_success:
|
||||
- |
|
||||
[ $TRAVIS_RUST_VERSION = stable ] && cargo coveralls
|
||||
env:
|
||||
global:
|
||||
- TRAVIS_CARGO_NIGHTLY_FEATURE=""
|
||||
notifications:
|
||||
email:
|
||||
on_success: never
|
||||
|
||||
|
|
@ -2,16 +2,19 @@
|
|||
|
||||
This project follows [semantic versioning](http://semver.org).
|
||||
|
||||
### UNRELEASED
|
||||
### v1.4.0 (2020-06-03)
|
||||
|
||||
- [added] Added option to listen on specified IP
|
||||
- [added] Added support for statsd monitoring
|
||||
- [changed] No longer using two sockets for ipv4 and ipv6
|
||||
- [changed] Warning for missing router is now info
|
||||
- [changed] New warning on claimed addresses in learning mode
|
||||
- [changed] Updated dependencies
|
||||
- [changed] Rewrote argument parsing
|
||||
- [changed] Changed stats file format to YAML
|
||||
- [changed] Using asciidoc for manpage
|
||||
- [changed] Updated dependencies
|
||||
- [fixed] Fixed problem that could lead to 100% cpu consumption
|
||||
|
||||
- [fixed] Fixed startup race condition
|
||||
|
||||
### v1.3.0 (2020-01-25)
|
||||
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
|
||||
[[package]]
|
||||
name = "bumpalo"
|
||||
version = "3.3.0"
|
||||
version = "3.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
|
||||
[[package]]
|
||||
|
|
@ -259,9 +259,9 @@ version = "1.0.2"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro-error-attr 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"version_check 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
|
|
@ -270,9 +270,9 @@ name = "proc-macro-error-attr"
|
|||
version = "1.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn-mid 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"version_check 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
|
@ -284,7 +284,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.17"
|
||||
version = "1.0.18"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"unicode-xid 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
|
|
@ -295,7 +295,7 @@ name = "quote"
|
|||
version = "1.0.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -350,7 +350,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "ring"
|
||||
version = "0.16.13"
|
||||
version = "0.16.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"cc 1.0.54 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
|
|
@ -372,7 +372,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "ryu"
|
||||
version = "1.0.4"
|
||||
version = "1.0.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
|
||||
[[package]]
|
||||
|
|
@ -390,17 +390,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
|
||||
[[package]]
|
||||
name = "serde"
|
||||
version = "1.0.110"
|
||||
version = "1.0.111"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
|
||||
[[package]]
|
||||
name = "serde_derive"
|
||||
version = "1.0.110"
|
||||
version = "1.0.111"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -409,8 +409,8 @@ version = "1.0.53"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"itoa 0.4.5 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"ryu 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"ryu 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -420,8 +420,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
dependencies = [
|
||||
"dtoa 0.4.5 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"linked-hash-map 0.5.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"yaml-rust 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"yaml-rust 0.4.4 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -476,11 +476,11 @@ name = "stdweb-derive"
|
|||
version = "0.5.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -489,13 +489,13 @@ version = "0.2.9"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"base-x 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_json 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"sha1 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -525,17 +525,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
dependencies = [
|
||||
"heck 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro-error 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "1.0.27"
|
||||
version = "1.0.30"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"unicode-xid 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
|
@ -545,9 +545,9 @@ name = "syn-mid"
|
|||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -600,10 +600,10 @@ version = "0.1.1"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro-hack 0.5.16 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"standback 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -669,7 +669,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
|
||||
[[package]]
|
||||
name = "vpncloud"
|
||||
version = "1.3.0"
|
||||
version = "1.4.0"
|
||||
dependencies = [
|
||||
"cc 1.0.54 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"daemonize 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
|
|
@ -680,16 +680,16 @@ dependencies = [
|
|||
"pkg-config 0.3.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"privdrop 0.3.4 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"rand 0.7.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"ring 0.16.13 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"ring 0.16.14 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_derive 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"serde_yaml 0.8.12 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"signal 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"siphasher 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"structopt 0.3.14 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"tempfile 3.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"time 0.2.16 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"yaml-rust 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"yaml-rust 0.4.4 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -711,12 +711,12 @@ name = "wasm-bindgen-backend"
|
|||
version = "0.2.63"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"bumpalo 3.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"bumpalo 3.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"wasm-bindgen-shared 0.2.63 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
||||
|
|
@ -734,9 +734,9 @@ name = "wasm-bindgen-macro-support"
|
|||
version = "0.2.63"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"wasm-bindgen-backend 0.2.63 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
"wasm-bindgen-shared 0.2.63 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
]
|
||||
|
|
@ -789,7 +789,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "yaml-rust"
|
||||
version = "0.4.3"
|
||||
version = "0.4.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
dependencies = [
|
||||
"linked-hash-map 0.5.3 (registry+https://github.com/rust-lang/crates.io-index)",
|
||||
|
|
@ -802,7 +802,7 @@ dependencies = [
|
|||
"checksum base-x 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)" = "1b20b618342cf9891c292c4f5ac2cde7287cc5c87e87e9c769d617793607dec1"
|
||||
"checksum bitflags 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
|
||||
"checksum boxfnonce 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "5988cb1d626264ac94100be357308f29ff7cbdd3b36bda27f450a4ee3f713426"
|
||||
"checksum bumpalo 3.3.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5356f1d23ee24a1f785a56d1d1a5f0fd5b0f6a0c0fb2412ce11da71649ab78f6"
|
||||
"checksum bumpalo 3.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "2e8c087f005730276d1096a652e92a8bacee2e2472bcc9715a74d2bec38b5820"
|
||||
"checksum bytes 0.5.4 (registry+https://github.com/rust-lang/crates.io-index)" = "130aac562c0dd69c56b3b1cc8ffd2e17be31d0b6c25b61c96b76231aa23e39e1"
|
||||
"checksum cc 1.0.54 (registry+https://github.com/rust-lang/crates.io-index)" = "7bbb73db36c1246e9034e307d0fba23f9a2e251faa47ade70c1bd252220c8311"
|
||||
"checksum cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)" = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
|
||||
|
|
@ -834,7 +834,7 @@ dependencies = [
|
|||
"checksum proc-macro-error 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "98e9e4b82e0ef281812565ea4751049f1bdcdfccda7d3f459f2e138a40c08678"
|
||||
"checksum proc-macro-error-attr 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "4f5444ead4e9935abd7f27dc51f7e852a0569ac888096d5ec2499470794e2e53"
|
||||
"checksum proc-macro-hack 0.5.16 (registry+https://github.com/rust-lang/crates.io-index)" = "7e0456befd48169b9f13ef0f0ad46d492cf9d2dbb918bcf38e01eed4ce3ec5e4"
|
||||
"checksum proc-macro2 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)" = "1502d12e458c49a4c9cbff560d0fe0060c252bc29799ed94ca2ed4bb665a0101"
|
||||
"checksum proc-macro2 1.0.18 (registry+https://github.com/rust-lang/crates.io-index)" = "beae6331a816b1f65d04c45b078fd8e6c93e8071771f41b8163255bbd8d7c8fa"
|
||||
"checksum quote 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)" = "54a21852a652ad6f610c9510194f398ff6f8692e334fd1145fed931f7fbe44ea"
|
||||
"checksum rand 0.7.3 (registry+https://github.com/rust-lang/crates.io-index)" = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
|
||||
"checksum rand_chacha 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
|
||||
|
|
@ -842,13 +842,13 @@ dependencies = [
|
|||
"checksum rand_hc 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
|
||||
"checksum redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)" = "2439c63f3f6139d1b57529d16bc3b8bb855230c8efcc5d3a896c8bea7c3b1e84"
|
||||
"checksum remove_dir_all 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)" = "4a83fa3702a688b9359eccba92d153ac33fd2e8462f9e0e3fdf155239ea7792e"
|
||||
"checksum ring 0.16.13 (registry+https://github.com/rust-lang/crates.io-index)" = "703516ae74571f24b465b4a1431e81e2ad51336cb0ded733a55a1aa3eccac196"
|
||||
"checksum ring 0.16.14 (registry+https://github.com/rust-lang/crates.io-index)" = "06b3fefa4f12272808f809a0af618501fdaba41a58963c5fb72238ab0be09603"
|
||||
"checksum rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
|
||||
"checksum ryu 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)" = "ed3d612bc64430efeb3f7ee6ef26d590dce0c43249217bddc62112540c7941e1"
|
||||
"checksum ryu 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)" = "71d301d4193d031abdd79ff7e3dd721168a9572ef3fe51a1517aba235bd8f86e"
|
||||
"checksum semver 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)" = "1d7eb9ef2c18661902cc47e535f9bc51b78acd254da71d375c2f6720d9a40403"
|
||||
"checksum semver-parser 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)" = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
|
||||
"checksum serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)" = "99e7b308464d16b56eba9964e4972a3eee817760ab60d88c3f86e1fecb08204c"
|
||||
"checksum serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)" = "818fbf6bfa9a42d3bfcaca148547aa00c7b915bec71d1757aa2d44ca68771984"
|
||||
"checksum serde 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)" = "c9124df5b40cbd380080b2cc6ab894c040a3070d995f5c9dc77e18c34a8ae37d"
|
||||
"checksum serde_derive 1.0.111 (registry+https://github.com/rust-lang/crates.io-index)" = "3f2c3ac8e6ca1e9c80b8be1023940162bf81ae3cffbb1809474152f2ce1eb250"
|
||||
"checksum serde_json 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)" = "993948e75b189211a9b31a7528f950c6adc21f9720b6438ff80a7fa2f864cea2"
|
||||
"checksum serde_yaml 0.8.12 (registry+https://github.com/rust-lang/crates.io-index)" = "16c7a592a1ec97c9c1c68d75b6e537dcbf60c7618e038e7841e00af1d9ccf0c4"
|
||||
"checksum sha1 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)" = "2579985fda508104f7587689507983eadd6a6e84dd35d6d115361f530916fa0d"
|
||||
|
|
@ -864,7 +864,7 @@ dependencies = [
|
|||
"checksum strsim 0.8.0 (registry+https://github.com/rust-lang/crates.io-index)" = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
|
||||
"checksum structopt 0.3.14 (registry+https://github.com/rust-lang/crates.io-index)" = "863246aaf5ddd0d6928dfeb1a9ca65f505599e4e1b399935ef7e75107516b4ef"
|
||||
"checksum structopt-derive 0.4.7 (registry+https://github.com/rust-lang/crates.io-index)" = "d239ca4b13aee7a2142e6795cbd69e457665ff8037aed33b3effdc430d2f927a"
|
||||
"checksum syn 1.0.27 (registry+https://github.com/rust-lang/crates.io-index)" = "ef781e621ee763a2a40721a8861ec519cb76966aee03bb5d00adb6a31dc1c1de"
|
||||
"checksum syn 1.0.30 (registry+https://github.com/rust-lang/crates.io-index)" = "93a56fabc59dce20fe48b6c832cc249c713e7ed88fa28b0ee0a3bfcaae5fe4e2"
|
||||
"checksum syn-mid 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)" = "7be3539f6c128a931cf19dcee741c1af532c7fd387baa739c03dd2e96479338a"
|
||||
"checksum tempfile 3.1.0 (registry+https://github.com/rust-lang/crates.io-index)" = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
|
||||
"checksum textwrap 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)" = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
|
||||
|
|
@ -893,4 +893,4 @@ dependencies = [
|
|||
"checksum winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
|
||||
"checksum xml-rs 0.8.3 (registry+https://github.com/rust-lang/crates.io-index)" = "b07db065a5cf61a7e4ba64f29e67db906fb1787316516c4e6e5ff0fea1efcd8a"
|
||||
"checksum xmltree 0.10.0 (registry+https://github.com/rust-lang/crates.io-index)" = "77a607efe600db25447a8d9bab1f39217a82c4ba160b51b027d7c4f6053004df"
|
||||
"checksum yaml-rust 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)" = "65923dd1784f44da1d2c3dbbc5e822045628c590ba72123e1c73d3c230c4434d"
|
||||
"checksum yaml-rust 0.4.4 (registry+https://github.com/rust-lang/crates.io-index)" = "39f0c922f1a334134dc2f7a8b67dc5d25f0735263feec974345ff706bcf20b0d"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
[package]
|
||||
name = "vpncloud"
|
||||
version = "1.3.0"
|
||||
version = "1.4.0"
|
||||
authors = ["Dennis Schwerdel <schwerdel@googlemail.com>"]
|
||||
build = "build.rs"
|
||||
license = "GPL-3.0"
|
||||
|
|
|
|||
53
README.md
53
README.md
|
|
@ -1,8 +1,7 @@
|
|||
VpnCloud - Peer-to-Peer VPN
|
||||
---------------------------
|
||||
|
||||
[](https://travis-ci.org/dswd/vpncloud)
|
||||
[](https://coveralls.io/github/dswd/vpncloud?branch=master)
|
||||
|
||||
|
||||
|
||||
**VpnCloud** is a simple VPN over UDP. It creates a virtual network interface on
|
||||
the host and forwards all received data via UDP to the destination. VpnCloud
|
||||
|
|
@ -32,61 +31,23 @@ somewhat stable state. VpnCloud features the following functionality:
|
|||
* Support for tunneled VLans (TAP device)
|
||||
* Option to hide protocol header
|
||||
* Automatic port forwarding via UPnP
|
||||
* Support for publishing [beacons](https://vpncloud.ddswd.de/docs/beacons) to help nodes find each others
|
||||
* Support for statsd monitoring
|
||||
|
||||
|
||||
### Installing
|
||||
|
||||
#### Compiling from source
|
||||
Prerequisites: Git, [Cargo](https://www.rust-lang.org/install.html), Ronn
|
||||
Prerequisites: Git, [Cargo](https://www.rust-lang.org/install.html), asciidoctor
|
||||
|
||||
The checked-out code can be compiled with ``cargo build`` or ``cargo build --release`` (release version). The binary could then be found in `target/release/vpncloud`.
|
||||
|
||||
The tests can be run via ``cargo test``.
|
||||
|
||||
|
||||
#### Cross-Compiling
|
||||
This software can be cross-compiled for a number of different architectures.
|
||||
Please also see the [extended rust cross compilation docs](https://github.com/japaric/rust-cross).
|
||||
#### Cross-Compiling & packaging
|
||||
Please see the [builder folder](builder).
|
||||
|
||||
##### ARMv7 (e.g. Raspberry Pi)
|
||||
1. Install the Cargo target
|
||||
|
||||
$> rustup target add armv7-unknown-linux-gnueabihf
|
||||
|
||||
2. Install the required build environment (on Ubuntu)
|
||||
|
||||
$> sudo apt-get install -qq gcc-arm-linux-gnueabihf
|
||||
|
||||
3. Build the software
|
||||
|
||||
$> cargo build --release --target=armv7-unknown-linux-gnueabihf
|
||||
|
||||
#### Debian / Ubuntu
|
||||
Deb packages for each release can be found in the
|
||||
[releases](https://github.com/dswd/vpncloud/releases) section. Currently only
|
||||
packages for amd64 are available (I am accepting help on building and packaging
|
||||
for other platforms).
|
||||
|
||||
Debian packages can be built using [cargo-deb](https://github.com/mmstick/cargo-deb): ``cargo deb``
|
||||
|
||||
|
||||
#### Arch Linux (AUR)
|
||||
There is a [VpnCloud package for Arch Linux](https://aur.archlinux.org/packages/vpncloud/)
|
||||
thanks to Oscar Rainford (fourbytes).
|
||||
|
||||
#### CentOS 7 (maybe other RPM based)
|
||||
CentOS 7 .rpm package can be built using [cargo-rpm](https://github.com/RustRPM/cargo-rpm): ``cargo rpm``
|
||||
On an CentOS 7:
|
||||
|
||||
1. Install the required build environment (on CentOS 7)
|
||||
|
||||
$> yum groupinstall -y 'Development Tools'
|
||||
|
||||
2. Build the software
|
||||
|
||||
$> cargo rpm build
|
||||
|
||||
rpm will be situated in `target/release/rpmbuild/RPMS/`
|
||||
|
||||
### Contributions welcome
|
||||
There are several areas in which still some work has to be done and where
|
||||
|
|
|
|||
|
|
@ -1,3 +1,19 @@
|
|||
vpncloud (1.4.0) stable; urgency=medium
|
||||
|
||||
* [added] Added option to listen on specified IP
|
||||
* [added] Added support for statsd monitoring
|
||||
* [changed] No longer using two sockets for ipv4 and ipv6
|
||||
* [changed] Warning for missing router is now info
|
||||
* [changed] New warning on claimed addresses in learning mode
|
||||
* [changed] Rewrote argument parsing
|
||||
* [changed] Changed stats file format to YAML
|
||||
* [changed] Using asciidoc for manpage
|
||||
* [changed] Updated dependencies
|
||||
* [fixed] Fixed problem that could lead to 100% cpu consumption
|
||||
* [fixed] Fixed startup race condition
|
||||
|
||||
-- Dennis Schwerdel <schwerdel@googlemail.com> Wed, 03 Jun 2020 17:46:00 +0200
|
||||
|
||||
vpncloud (1.3.0) stable; urgency=medium
|
||||
|
||||
* [added] Building for aarch64 aka arm64 (thanks to Ivan)
|
||||
|
|
|
|||
1226
assets/vpncloud.1
1226
assets/vpncloud.1
File diff suppressed because it is too large
Load Diff
|
|
@ -5,16 +5,18 @@ Wants=network-online.target
|
|||
Documentation=man:vpncloud(1)
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/bin/vpncloud --config /etc/vpncloud/%i.net --log-file /var/log/vpncloud-%i.log --stats-file /var/log/vpncloud-%i.stats
|
||||
Type=forking
|
||||
ExecStart=/usr/bin/vpncloud --config /etc/vpncloud/%i.net --log-file /var/log/vpncloud-%i.log --stats-file /var/log/vpncloud-%i.stats --daemon --pid-file /run/vpncloud-%i.pid
|
||||
PIDFile=/run/vpncloud-%i.pid
|
||||
WorkingDirectory=/etc/vpncloud
|
||||
RestartSec=5s
|
||||
Restart=on-failure
|
||||
LimitNPROC=10
|
||||
TasksMax=10
|
||||
MemoryMax=50M
|
||||
PrivateTmp=yes
|
||||
ProtectHome=yes
|
||||
ProtectSystem=strict
|
||||
ReadWritePaths=/var/log
|
||||
ReadWritePaths=/var/log /run
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
|
||||
DeviceAllow=/dev/null rw
|
||||
DeviceAllow=/dev/net/tun rw
|
||||
|
|
|
|||
14
build.rs
14
build.rs
|
|
@ -13,17 +13,21 @@ fn main() {
|
|||
println!("cargo:rerun-if-changed=src/c/tuntap.c");
|
||||
cc::Build::new().file("src/c/tuntap.c").include("src").compile("libtuntap.a");
|
||||
|
||||
// Process manpage using ronn command
|
||||
println!("cargo:rerun-if-changed=vpncloud.md");
|
||||
fs::copy("vpncloud.md", Path::new(&out_dir).join("vpncloud.1.ronn")).unwrap();
|
||||
match Command::new("ronn").args(&["-r", "vpncloud.1.ronn"]).current_dir(&Path::new(&out_dir)).status() {
|
||||
// Process manpage using asciidoctor command
|
||||
println!("cargo:rerun-if-changed=vpncloud.adoc");
|
||||
fs::copy("vpncloud.adoc", Path::new(&out_dir).join("vpncloud.adoc")).unwrap();
|
||||
match Command::new("asciidoctor")
|
||||
.args(&["-b", "manpage", "vpncloud.adoc"])
|
||||
.current_dir(&Path::new(&out_dir))
|
||||
.status()
|
||||
{
|
||||
Ok(_) => {
|
||||
Command::new("gzip").args(&["vpncloud.1"]).current_dir(&Path::new(&out_dir)).status().unwrap();
|
||||
fs::copy(Path::new(&out_dir).join("vpncloud.1.gz"), "target/vpncloud.1.gz").unwrap();
|
||||
}
|
||||
Err(err) => {
|
||||
println!("cargo:warning=Error building manpage: {}", err);
|
||||
println!("cargo:warning=The manpage will not be build. Do you have 'ronn'?");
|
||||
println!("cargo:warning=The manpage will not be build. Do you have 'asciidoctor'?");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ RUN apt-get update \
|
|||
libc6-dev-armhf-cross \
|
||||
libc6-dev-i386 \
|
||||
gcc-5-multilib \
|
||||
ruby-ronn \
|
||||
asciidoctor \
|
||||
&& rm -rf /var/cache/dpkg
|
||||
|
||||
RUN ln -s asm-generic/ /usr/include/asm
|
||||
|
|
|
|||
|
|
@ -1,9 +1,7 @@
|
|||
FROM centos:7
|
||||
|
||||
RUN yum groupinstall -y 'Development Tools'
|
||||
|
||||
RUN yum-config-manager --add-repo http://springdale.math.ias.edu/data/puias/computational/7/x86_64 \
|
||||
&& yum install --nogpgcheck -y rubygem-ronn
|
||||
RUN yum install -y ruby && gem install asciidoctor
|
||||
|
||||
RUN useradd -ms /bin/bash user
|
||||
USER user
|
||||
|
|
|
|||
|
|
@ -40,7 +40,8 @@ use std::{
|
|||
path::Path,
|
||||
process::Command,
|
||||
str::FromStr,
|
||||
sync::Mutex
|
||||
sync::Mutex,
|
||||
thread
|
||||
};
|
||||
|
||||
use crate::{
|
||||
|
|
@ -400,6 +401,8 @@ fn run<P: Protocol>(config: Config) {
|
|||
}
|
||||
if let Some(pid_file) = config.pid_file {
|
||||
daemonize = daemonize.pid_file(pid_file).chown_pid_file(true);
|
||||
// Give child process some time to write PID file
|
||||
daemonize = daemonize.exit_action(|| thread::sleep(std::time::Duration::from_millis(10)));
|
||||
}
|
||||
try_fail!(daemonize.start(), "Failed to daemonize: {}");
|
||||
} else if config.user.is_some() || config.group.is_some() {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,465 @@
|
|||
vpncloud(1)
|
||||
===========
|
||||
|
||||
== Name
|
||||
vpncloud - Peer-to-peer VPN
|
||||
|
||||
|
||||
== SYNOPSIS
|
||||
|
||||
*vpncloud [options] [--config <file>] [-t <type>] [-d <name>] [-l <addr>] [-c <addr>...]*
|
||||
|
||||
|
||||
== OPTIONS
|
||||
|
||||
*--config <file>*::
|
||||
Read configuration options from the specified file. Please see the section
|
||||
*CONFIG FILES* for documentation on the file format.
|
||||
If the same option is defined in the config file and as a parameter, the
|
||||
parameter overrides the config file.
|
||||
|
||||
*-t <type>*, *--type <type>*::
|
||||
Set the type of network. There are two options: *tap* devices process
|
||||
Ethernet frames *tun* devices process IP packets. [default: *tap*]
|
||||
|
||||
*-d <name>*, *--device <name>*::
|
||||
Name of the virtual device. Any *%d* will be filled with a free number.
|
||||
[default: *vpncloud%d*]
|
||||
|
||||
*--device-path <path>*::
|
||||
The path of the base device inode, e.g. /dev/net/run.
|
||||
|
||||
*-m <mode>*, *--mode <mode>*::
|
||||
The mode of the VPN. The VPN can like a router, a switch or a hub. A *hub*
|
||||
will send all data always to all peers. A *switch* will learn addresses
|
||||
from incoming data and only send data to all peers when the address is
|
||||
unknown. A *router* will send data according to known subnets of the
|
||||
peers and ignore them otherwise. The *normal* mode is switch for tap
|
||||
devices and router for tun devices. [default: *normal*]
|
||||
|
||||
*-l <addr>*, *--listen <addr>*::
|
||||
The address on which to listen for data. This can be simply a port number
|
||||
or a full address in form IP:PORT. If the IP is specified as \'\*' or only
|
||||
a port number is given, then the socket will listen on all IPs (v4 and v6),
|
||||
otherwise the socket will only listen on the given IP. [default: **3210**]
|
||||
|
||||
*-c <addr>*, *--connect <addr>*::
|
||||
Address of a peer to connect to. The address should be in the form
|
||||
*addr:port*. If the node is not started, the connection will be retried
|
||||
periodically. This parameter can be repeated to connect to multiple peers.
|
||||
|
||||
*-s <subnet>*, *--subnet <subnet>*:
|
||||
The local subnets to use. This parameter should be in the form
|
||||
*address/prefixlen* where address is an IPv4 address, an IPv6 address, or a
|
||||
MAC address. The prefix length is the number of significant front bits that
|
||||
distinguish the subnet from other subnets. Example: *10.1.1.0/24*.
|
||||
|
||||
*--shared-key <key>*::
|
||||
An optional shared key to encrypt the VPN data. If this option is not set,
|
||||
the traffic will be sent unencrypted.
|
||||
|
||||
*--crypto <method>*::
|
||||
The encryption method to use ("aes256", or "chacha20"). Most current CPUs
|
||||
have special support for AES256 so this should be faster. For older
|
||||
computers lacking this support, only CHACHA20 is supported.
|
||||
[default: *chacha20*]
|
||||
|
||||
*--magic <id>*::
|
||||
Override the 4-byte magic header of each packet. This header identifies the
|
||||
network and helps to distinguish it from other networks and other
|
||||
applications. The id can either be a 4 byte / 8 character hexadecimal
|
||||
string or an arbitrary string prefixed with "hash:" which will then be
|
||||
hashed into 4 bytes.
|
||||
|
||||
*--peer-timeout <secs>*::
|
||||
Peer timeout in seconds. The peers will exchange information periodically
|
||||
and drop peers that are silent for this period of time. [default: **600**]
|
||||
|
||||
*--keepalive <secs>*::
|
||||
Interval of peer exchange messages in seconds. The peers will exchange
|
||||
information periodically to keep connections alive. This setting overrides
|
||||
how often this will happen. [default: *peer-timeout/2-60*]
|
||||
|
||||
*--dst-timeout <secs>*::
|
||||
Switch table entry timeout in seconds. This parameter is only used in switch
|
||||
mode. Addresses that have not been seen for the given period of time will
|
||||
be forgotten. [default: **300**]
|
||||
|
||||
*--beacon-store <path|command>*::
|
||||
Periodically store beacons containing the address of this node in the given
|
||||
file or via the given command. If the parameter value starts with a pipe
|
||||
character (*|*), the rest of the value is interpreted as a shell command.
|
||||
Otherwise the value is interpreted as a file to write the beacon to.
|
||||
If this parameter is not given, beacon storage is disabled.
|
||||
Please see the section *BEACONS* for more information.
|
||||
|
||||
*--beacon-load <path|command>*::
|
||||
Periodically load beacons containing the addresses of other nodes from the
|
||||
given file or via the given command. If the parameter value starts with a
|
||||
pipe character (*|*), the rest of the value is interpreted as a shell
|
||||
command. Otherwise the value is interpreted as a file to read the beacon
|
||||
from.
|
||||
If this parameter is not given, beacon loading is disabled.
|
||||
Please see the section *BEACONS* for more information.
|
||||
|
||||
*--beacon-interval <secs>*::
|
||||
Beacon storage/loading interval in seconds. If configured to do so via
|
||||
*--beacon-store* and *--beacon-load*, the node will periodically store its
|
||||
beacon and load beacons of other nodes. This parameter defines the interval
|
||||
in seconds. [default: **3600**]
|
||||
|
||||
*--ifup <command>*::
|
||||
A command to setup the network interface. The command will be run (as
|
||||
parameter to *sh -c*) when the device has been created to configure it.
|
||||
The name of the allocated device will be available via the environment
|
||||
variable *IFNAME*.
|
||||
Please note that this command is executed with the full permissions of the
|
||||
caller.
|
||||
|
||||
*--ifdown <command>*::
|
||||
A command to bring down the network interface. The command will be run (as
|
||||
parameter to *sh -c*) to remove any configuration from the device.
|
||||
The name of the allocated device will be available via the environment
|
||||
variable *IFNAME*.
|
||||
Please note that this command is executed with the (limited) permissions of
|
||||
the user and group given as *--user* and *--group*.
|
||||
|
||||
*--pid-file <file>*::
|
||||
Store the process id in this file when running in the background. If set,
|
||||
the given file will be created containing the process id of the new
|
||||
background process. This option is only used when running in background.
|
||||
|
||||
*--user <user>*::
|
||||
*--group <group>*::
|
||||
Change the user and/or group of the process once all the setup has been
|
||||
done.
|
||||
|
||||
*--log-file <file>*::
|
||||
If set, print logs also to the given file. The file will be created and
|
||||
truncated if is exists.
|
||||
|
||||
*--stats-file <file>*::
|
||||
If set, periodically write statistics on peers and current traffic to the
|
||||
given file. The file will be periodically overwritten with new data.
|
||||
|
||||
*--daemon*::
|
||||
Spawn a background process instead of running the process in the foreground.
|
||||
If this flag is set, the process will first carry out all the
|
||||
initialization, then drop permissions if *--user* or *--group* is used and
|
||||
then spawn a background process and write its process id to a file if
|
||||
*--pid-file* is set. Then, the main process will exit and the background
|
||||
process continues to provide the VPN. At the time, when the main process
|
||||
exits, the interface exists and is properly configured to be used.
|
||||
|
||||
*--no-port-forwarding*::
|
||||
Disable automatic port forward. If this option is not set, VpnCloud tries to
|
||||
detect a NAT router and automatically add a port forwarding to it.
|
||||
|
||||
*-v*, *--verbose*::
|
||||
Print debug information, including information for data being received and
|
||||
sent.
|
||||
|
||||
*-q*, *--quiet*::
|
||||
Only print errors and warnings.
|
||||
|
||||
*-h*, *--help*::
|
||||
Display the help.
|
||||
|
||||
|
||||
== DESCRIPTION
|
||||
|
||||
*VpnCloud* is a simple VPN over UDP. It creates a virtual network interface on
|
||||
the host and forwards all received data via UDP to the destination. It can work
|
||||
in 3 different modes:
|
||||
|
||||
*Switch mode*:: In this mode, the VPN will dynamically learn addresses
|
||||
as they are used as source addresses and use them to forward data to its
|
||||
destination. Addresses that have not been seen for some time
|
||||
(option *dst_timeout*) will be forgotten. Data for unknown addresses will be
|
||||
broadcast to all peers. This mode is the default mode for TAP devices that
|
||||
process Ethernet frames but it can also be used with TUN devices and IP
|
||||
packets.
|
||||
*Hub mode*:: In this mode, all data will always be broadcast to all peers.
|
||||
This mode uses lots of bandwidth and should only be used in special cases.
|
||||
*Router mode*:: In this mode, data will be forwarded based on preconfigured
|
||||
address ranges ("subnets"). Data for unknown nodes will be silently ignored.
|
||||
This mode is the default mode for TUN devices that work with IP packets but
|
||||
it can also be used with TAP devices and Ethernet frames.
|
||||
|
||||
All connected VpnCloud nodes will form a peer-to-peer network and cross-connect
|
||||
automatically until the network is fully connected. The nodes will periodically
|
||||
exchange information with the other nodes to signal that they are still active
|
||||
and to allow the automatic cross-connect behavior. There are some important
|
||||
things to note:
|
||||
|
||||
. To avoid that different networks that reuse each others addresses merge due
|
||||
to the cross-connect behavior, the *magic* option can be used and set
|
||||
to any unique string to identify the network. The *magic* must be the
|
||||
same on all nodes of the same VPN network.
|
||||
. The cross-connect behavior can be able to connect nodes that are behind
|
||||
firewalls or NATs as it can function as hole-punching.
|
||||
. The management traffic will increase with the peer number quadratically.
|
||||
It should still be reasonably small for high node numbers (below 10 KiB/s
|
||||
for 10.000 nodes). A longer *peer_timeout* can be used to reduce the traffic
|
||||
further. For high node numbers, router mode should be used as it never
|
||||
broadcasts data.
|
||||
|
||||
VpnCloud does not implement any loop-avoidance. Since data received on the UDP
|
||||
socket will only be sent to the local network interface and vice versa, VpnCloud
|
||||
cannot produce loops on its own. On the TAP device, however STP data can be
|
||||
transported to avoid loops caused by other network components.
|
||||
|
||||
For TAP devices, IEEE 802.1q frames (VLAN tagged) are detected and forwarded
|
||||
based on separate MAC tables. Any nested tags (Q-in-Q) will be ignored.
|
||||
|
||||
== EXAMPLES
|
||||
|
||||
=== Switched TAP scenario
|
||||
|
||||
In the example scenario, a simple layer 2 network tunnel is established. Most
|
||||
likely those commands need to be run as *root* using *sudo*.
|
||||
|
||||
First, VpnCloud need to be started on both nodes (the address after *-c* is the
|
||||
address of the remote node and the the *X* in the interface address must be
|
||||
unique among all nodes, e.g. 0, 1, 2, ...):
|
||||
|
||||
----
|
||||
vpncloud -c REMOTE_HOST:PORT --ifup 'ifconfig $IFNAME 10.0.0.X/24 mtu 1400 up'
|
||||
----
|
||||
|
||||
Afterwards, the interface can be used to communicate.
|
||||
|
||||
=== Routed TUN example
|
||||
|
||||
In this example, 2 nodes and their subnets should communicate using IP.
|
||||
First, VpnCloud need to be started on both nodes:
|
||||
|
||||
----
|
||||
vpncloud -t tun -c REMOTE_HOST:PORT --subnet 10.0.X.0/24 --ifup 'ifconfig $IFNAME 10.0.X.1/16 mtu 1400 up'
|
||||
----
|
||||
|
||||
It is important to configure the interface in a way that all addresses on the
|
||||
VPN can be reached directly. E.g. if subnets 10.0.1.0/24, 10.0.2.0/24 and so on
|
||||
are used, the interface needs to be configured as 10.0.1.1/16.
|
||||
For TUN devices, this means that the prefix length of the subnets
|
||||
(/24 in this example) must be different than the prefix length that the
|
||||
interface is configured with (/16 in this example).
|
||||
|
||||
=== Important notes
|
||||
|
||||
. VpnCloud can be used to connect two separate networks. TAP networks can be
|
||||
bridged using *brctl* and TUN networks must be routed. It is very important
|
||||
to be careful when setting up such a scenario in order to avoid network loops,
|
||||
security issues, DHCP issues and many more problems.
|
||||
. TAP devices will forward DHCP data. If done intentionally, this can be used
|
||||
to assign unique addresses to all participants. If this happens accidentally,
|
||||
it can conflict with DHCP servers of the local network and can have severe
|
||||
side effects.
|
||||
. VpnCloud is not designed for high security use cases. Although the used crypto
|
||||
primitives are expected to be very secure, their application has not been
|
||||
reviewed.
|
||||
The shared key is hashed using _ScryptSalsa208Sha256_ to derive a key,
|
||||
which is used to encrypt the payload of messages using _ChaCha20Poly1305_ or
|
||||
_AES256-GCM_. The encryption includes an authentication that also protects the
|
||||
header.
|
||||
This method does only protect against attacks on single messages but not
|
||||
against attacks that manipulate the message series itself (i.e. suppress
|
||||
messages, reorder them, or duplicate them).
|
||||
|
||||
== CONFIG FILES
|
||||
|
||||
The config file is a YAML file that contains configuration values. All entries
|
||||
are optional and override the defaults. Please see the section *OPTIONS* for
|
||||
detailed descriptions of the options.
|
||||
|
||||
*device_type*:: Set the type of network. Same as *--type*
|
||||
*device_name*:: Name of the virtual device. Same as *--device*
|
||||
*device_path*:: Set the path of the base device. Same as *--device-path*
|
||||
*ifup*:: A command to setup the network interface. Same as *--ifup*
|
||||
*ifdown*:: A command to bring down the network interface. Same as *--ifdown*
|
||||
*crypto*:: The encryption method to use. Same as *--crypto*
|
||||
*shared_key*:: The shared key to encrypt all traffic. Same as *--shared-key*
|
||||
*magic*:: Override the 4-byte magic header of each packet. Same as *--magic*
|
||||
*port*:: A port number to listen on. This option is DEPRECATED.
|
||||
*listen*:: The address on which to listen for data. Same as *--listen*
|
||||
*peers*:: A list of addresses to connect to. See *--connect*
|
||||
*peer_timeout*:: Peer timeout in seconds. Same as**--peer-timeout**
|
||||
*beacon_store*:: Path or command to store beacons. Same as *--beacon-store*
|
||||
*beacon_load*:: Path or command to load beacons. Same as *--beacon-load*
|
||||
*beacon_interval*:: Interval for loading and storing beacons in seconds. Same as *--beacon-interval*
|
||||
*mode*:: The mode of the VPN. Same as *--mode*
|
||||
*dst_timeout*:: Switch table entry timeout in seconds. Same as *--dst-timeout*
|
||||
*subnets*:: A list of local subnets to use. See *--subnet*
|
||||
*port_forwarding*:: Whether to activate port forwardig. See *--no-port-forwarding*
|
||||
*user*:: The name of a user to run the background process under. See *--user*
|
||||
*group*:: The name of a group to run the background process under. See *--group*
|
||||
*pid_file*:: The path of the pid file to create. See *--pid-file*
|
||||
*stats_file*:: The path of the statistics file. See *--stats-file*
|
||||
|
||||
=== Example
|
||||
|
||||
device_type: tun
|
||||
device_name: vpncloud%d
|
||||
ifup: ifconfig $IFNAME 10.0.1.1/16 mtu 1400 up
|
||||
crypto: aes256
|
||||
shared_key: mysecret
|
||||
listen: 3210
|
||||
peers:
|
||||
- remote.machine.foo:3210
|
||||
- remote.machine.bar:3210
|
||||
peer_timeout: 600
|
||||
mode: normal
|
||||
subnets:
|
||||
- 10.0.1.0/24
|
||||
port_forwarding: true
|
||||
user: nobody
|
||||
group: nogroup
|
||||
pid_file: /run/vpncloud.pid
|
||||
|
||||
== BEACONS
|
||||
|
||||
Beacons are short character sequences that contain a timestamp and a list of
|
||||
addresses. They can be published and retrieved by other nodes to find peers
|
||||
without the need for static addresses.
|
||||
|
||||
The beacons are short (less than 100 characters), encrypted and encoded with
|
||||
printable characters to allow publishing them in various places on the
|
||||
internet, e.g.:
|
||||
|
||||
* On shared drives or synchronized folders (e.g. on Dropbox)
|
||||
* Via a dedicated database
|
||||
* Via a general purpose message board of message service (e.g. Twitter)
|
||||
|
||||
The beacons are very robust. They only consist of alphanumeric characters
|
||||
and can be interleaved with non-alphanumeric characters (e.g. whitespace).
|
||||
Also the beacons contain a prefix and suffix that depends on the configured
|
||||
network magic and secret key (if set) so that all nodes can find beacons in
|
||||
a long text.
|
||||
|
||||
When beacons are stored or loaded via a command (using the pipe character *|*),
|
||||
the command is interpreted using the configured shell *sh*. This command has
|
||||
access to the following environment variables:
|
||||
|
||||
*$begin*:: The prefix of the beacon.
|
||||
*$end*:: The suffix of the beacon.
|
||||
*$data* (only on store):: The middle part of the beacon. Do not use this
|
||||
without prefix and suffix!
|
||||
*$beacon* (only on store):: The full beacon consisting of prefix, data and
|
||||
suffix.
|
||||
The commands are called in separate threads, so even longer running commands
|
||||
will not block the node.
|
||||
|
||||
== NETWORK PROTOCOL
|
||||
|
||||
The protocol of VpnCloud is kept as simple as possible to allow other
|
||||
implementations and to maximize the performance.
|
||||
|
||||
Every packet sent over UDP contains the following header (in order):
|
||||
|
||||
4 bytes *magic*::
|
||||
This field is used to identify the packet and to sort out packets that do
|
||||
not belong. The default is *[0x76, 0x70, 0x6e, 0x01]* ("vpn\x01").
|
||||
This field can be used to identify VpnCloud packets and might be set to
|
||||
something different to hide the protocol.
|
||||
|
||||
1 byte *crypto method*::
|
||||
This field specifies the method that must be used to decrypt the rest of the
|
||||
data. The currently supported methods are:
|
||||
|
||||
** Method *0*, *No encryption*: Rest of the data can be read without
|
||||
decrypting it.
|
||||
** Method *1*, *ChaCha20*: The header is followed by a 12 byte
|
||||
_nonce_. The rest of the data is encrypted with the
|
||||
*libsodium::crypto_aead_chacha20poly1305_ietf* method, using the 8 byte
|
||||
header as additional data.
|
||||
** Method *2*, *AES256*: The header is followed by a 12 byte _nonce_.
|
||||
The rest of the data is encrypted with the
|
||||
*libsodium::crypto_aead_aes256gcm* method, using the 8 byte header
|
||||
as additional data.
|
||||
|
||||
2 *reserved bytes*::
|
||||
that are currently unused and set to 0
|
||||
|
||||
1 byte for the *message type*::
|
||||
This byte specifies the type of message that follows. Currently the
|
||||
following message types are supported:
|
||||
|
||||
** Type 0: Data packet
|
||||
** Type 1: Peer list
|
||||
** Type 2: Initial message
|
||||
** Type 3: Closing message
|
||||
|
||||
After this 8 byte header, the rest of the message follows. It is encrypted using
|
||||
the method specified in the header.
|
||||
|
||||
In the decrypted data, the message as specified in the *message type* field
|
||||
will follow:
|
||||
|
||||
*Data packet* (message type 0)::
|
||||
This packet contains payload. The format of the data depends on the device
|
||||
type. For TUN devices, this data contains an IP packet. For TAP devices it
|
||||
contains an Ethernet frame. The data starts right after the header and ends
|
||||
at the end of the packet.
|
||||
If it is an Ethernet frame, it will start with the destination MAC and end
|
||||
with the payload. It does not contain the preamble, SFD, padding, and CRC
|
||||
fields.
|
||||
*Peer list* (message type 1)::
|
||||
This packet contains the peer list of the sender. The first byte after the
|
||||
switch byte contains the number of IPv4 addresses that follow.
|
||||
After that, the specified number of addresses follow, where each address
|
||||
is encoded in 6 bytes. The first 4 bytes are the IPv4 address and the later
|
||||
2 bytes are port number (both in network byte order).
|
||||
After those addresses, the next byte contains the number of IPv6 addresses
|
||||
that follow. After that, the specified number of addresses follow, where
|
||||
each address is encoded in 18 bytes. The first 16 bytes are the IPv6 address
|
||||
and the later 2 bytes are port number (both in network byte order).
|
||||
*Initial message* (message type 2)::
|
||||
This packet contains the following information:
|
||||
** The stage of the initialization process
|
||||
** A random node id to distinguish different nodes
|
||||
** All the local subnets claimed by the nodes
|
||||
|
||||
+
|
||||
Its first byte marks the stage of the initial handshake process.
|
||||
The next 16 bytes contain the unique node id. After that,
|
||||
the list of local subnets follows.
|
||||
The subnet list is encoded in the following way: Its first byte of data
|
||||
contains the number of encoded subnets that follow. After that, the given
|
||||
number of encoded subnets follow.
|
||||
For each subnet, the first byte is the length of bytes in the base address
|
||||
and is followed by the given number of base address bytes and one additional
|
||||
byte that is the prefix length of the subnet.
|
||||
The addresses for the subnet will be encoded like they are encoded in their
|
||||
native protocol (4 bytes for IPv4, 16 bytes for IPv6, and 6 bytes for a MAC
|
||||
address) with the exception of MAC addresses in a VLan which will be encoded
|
||||
in 8 bytes where the first 2 bytes are the VLan number in network byte order
|
||||
and the later 6 bytes are the MAC address.
|
||||
*Closing message* (message type 3)::
|
||||
This packet does not contain any more data.
|
||||
|
||||
Nodes are expected to send an *initial message* with stage 0 whenever they
|
||||
connect to a node they were not connected to before. As a reply to this message,
|
||||
another initial should be sent with stage 1. Also a *peer list* message should
|
||||
be sent as a reply.
|
||||
|
||||
When connected, nodes should periodically send their *peer list* to all
|
||||
of their peers to spread this information and to avoid peer timeouts.
|
||||
To avoid the cubic growth of management traffic, nodes should at a certain
|
||||
network size start sending partial peer lists instead of the full list. A
|
||||
reasonable number would be about 20 peers. The subsets should be selected
|
||||
randomly.
|
||||
|
||||
Nodes should remove peers from their peer list after a certain period of
|
||||
inactivity or when receiving a *closing message*. Before shutting down, nodes
|
||||
should send the closing message to all of their peers in order to avoid
|
||||
receiving further data until the timeout is reached.
|
||||
|
||||
Nodes should only add nodes to their peer list after receiving an initial
|
||||
message from them instead of adding them right from the peer list of another
|
||||
peer. This is necessary to avoid the case of a large network keeping dead nodes
|
||||
alive.
|
||||
|
||||
== COPYRIGHT
|
||||
|
||||
Copyright (C) 2015-2020 Dennis Schwerdel
|
||||
This software is licensed under GPL-3 or newer (see LICENSE.md)
|
||||
507
vpncloud.md
507
vpncloud.md
|
|
@ -1,507 +0,0 @@
|
|||
vpncloud(1) -- Peer-to-peer VPN
|
||||
===============================
|
||||
|
||||
## SYNOPSIS
|
||||
|
||||
`vpncloud [options] [--config <file>] [-t <type>] [-d <name>] [-l <addr>] [-c <addr>...]`
|
||||
|
||||
|
||||
## OPTIONS
|
||||
|
||||
* `--config <file>`:
|
||||
|
||||
Read configuration options from the specified file. Please see the section
|
||||
**CONFIG FILES** for documentation on the file format.
|
||||
If the same option is defined in the config file and as a parameter, the
|
||||
parameter overrides the config file.
|
||||
|
||||
* `-t <type>`, `--type <type>`:
|
||||
|
||||
Set the type of network. There are two options: **tap** devices process
|
||||
Ethernet frames **tun** devices process IP packets. [default: `tap`]
|
||||
|
||||
* `-d <name>`, `--device <name>`:
|
||||
|
||||
Name of the virtual device. Any `%d` will be filled with a free number.
|
||||
[default: `vpncloud%d`]
|
||||
|
||||
* `--device-path <path>`:
|
||||
|
||||
The path of the base device inode, e.g. /dev/net/run.
|
||||
|
||||
* `-m <mode>`, `--mode <mode>`:
|
||||
|
||||
The mode of the VPN. The VPN can like a router, a switch or a hub. A **hub**
|
||||
will send all data always to all peers. A **switch** will learn addresses
|
||||
from incoming data and only send data to all peers when the address is
|
||||
unknown. A **router** will send data according to known subnets of the
|
||||
peers and ignore them otherwise. The **normal** mode is switch for tap
|
||||
devices and router for tun devices. [default: `normal`]
|
||||
|
||||
* `-l <addr>`, `--listen <addr>`:
|
||||
|
||||
The address on which to listen for data. This can be simply a port number
|
||||
or a full address in form IP:PORT. If the IP is specified as '*' or only
|
||||
a port number is given, then the socket will listen on all IPs (v4 and v6),
|
||||
otherwise the socket will only listen on the given IP. [default: `3210`]
|
||||
|
||||
* `-c <addr>`, `--connect <addr>`:
|
||||
|
||||
Address of a peer to connect to. The address should be in the form
|
||||
`addr:port`. If the node is not started, the connection will be retried
|
||||
periodically. This parameter can be repeated to connect to multiple peers.
|
||||
|
||||
* `-s <subnet>`, `--subnet <subnet>`:
|
||||
|
||||
The local subnets to use. This parameter should be in the form
|
||||
`address/prefixlen` where address is an IPv4 address, an IPv6 address, or a
|
||||
MAC address. The prefix length is the number of significant front bits that
|
||||
distinguish the subnet from other subnets. Example: `10.1.1.0/24`.
|
||||
|
||||
* `--shared-key <key>`:
|
||||
|
||||
An optional shared key to encrypt the VPN data. If this option is not set,
|
||||
the traffic will be sent unencrypted.
|
||||
|
||||
* `--crypto <method>`:
|
||||
|
||||
The encryption method to use ("aes256", or "chacha20"). Most current CPUs
|
||||
have special support for AES256 so this should be faster. For older
|
||||
computers lacking this support, only CHACHA20 is supported.
|
||||
[default: `chacha20`]
|
||||
|
||||
* `--magic <id>`:
|
||||
|
||||
Override the 4-byte magic header of each packet. This header identifies the
|
||||
network and helps to distinguish it from other networks and other
|
||||
applications. The id can either be a 4 byte / 8 character hexadecimal
|
||||
string or an arbitrary string prefixed with "hash:" which will then be
|
||||
hashed into 4 bytes.
|
||||
|
||||
* `--peer-timeout <secs>`:
|
||||
|
||||
Peer timeout in seconds. The peers will exchange information periodically
|
||||
and drop peers that are silent for this period of time. [default: `600`]
|
||||
|
||||
* `--keepalive <secs>`:
|
||||
|
||||
Interval of peer exchange messages in seconds. The peers will exchange
|
||||
information periodically to keep connections alive. This setting overrides
|
||||
how often this will happen. [default: `peer-timeout/2-60`]
|
||||
|
||||
* `--dst-timeout <secs>`:
|
||||
|
||||
Switch table entry timeout in seconds. This parameter is only used in switch
|
||||
mode. Addresses that have not been seen for the given period of time will
|
||||
be forgotten. [default: `300`]
|
||||
|
||||
* `--beacon-store <path|command>`:
|
||||
|
||||
Periodically store beacons containing the address of this node in the given
|
||||
file or via the given command. If the parameter value starts with a pipe
|
||||
character (`|`), the rest of the value is interpreted as a shell command.
|
||||
Otherwise the value is interpreted as a file to write the beacon to.
|
||||
If this parameter is not given, beacon storage is disabled.
|
||||
Please see the section **BEACONS** for more information.
|
||||
|
||||
* `--beacon-load <path|command>`:
|
||||
|
||||
Periodically load beacons containing the addresses of other nodes from the
|
||||
given file or via the given command. If the parameter value starts with a
|
||||
pipe character (`|`), the rest of the value is interpreted as a shell
|
||||
command. Otherwise the value is interpreted as a file to read the beacon
|
||||
from.
|
||||
If this parameter is not given, beacon loading is disabled.
|
||||
Please see the section **BEACONS** for more information.
|
||||
|
||||
* `--beacon-interval <secs>`:
|
||||
|
||||
Beacon storage/loading interval in seconds. If configured to do so via
|
||||
`--beacon-store` and `--beacon-load`, the node will periodically store its
|
||||
beacon and load beacons of other nodes. This parameter defines the interval
|
||||
in seconds. [default: `3600`]
|
||||
|
||||
* `--ifup <command>`:
|
||||
|
||||
A command to setup the network interface. The command will be run (as
|
||||
parameter to `sh -c`) when the device has been created to configure it.
|
||||
The name of the allocated device will be available via the environment
|
||||
variable `IFNAME`.
|
||||
Please note that this command is executed with the full permissions of the
|
||||
caller.
|
||||
|
||||
* `--ifdown <command>`:
|
||||
|
||||
A command to bring down the network interface. The command will be run (as
|
||||
parameter to `sh -c`) to remove any configuration from the device.
|
||||
The name of the allocated device will be available via the environment
|
||||
variable `IFNAME`.
|
||||
Please note that this command is executed with the (limited) permissions of
|
||||
the user and group given as `--user` and `--group`.
|
||||
|
||||
* `--pid-file <file>`:
|
||||
|
||||
Store the process id in this file when running in the background. If set,
|
||||
the given file will be created containing the process id of the new
|
||||
background process. This option is only used when running in background.
|
||||
|
||||
* `--user <user>`:
|
||||
* `--group <group>`:
|
||||
|
||||
Change the user and/or group of the process once all the setup has been
|
||||
done.
|
||||
|
||||
* `--log-file <file>`:
|
||||
|
||||
If set, print logs also to the given file. The file will be created and
|
||||
truncated if is exists.
|
||||
|
||||
* `--stats-file <file>`:
|
||||
|
||||
If set, periodically write statistics on peers and current traffic to the
|
||||
given file. The file will be periodically overwritten with new data.
|
||||
|
||||
* `--daemon`:
|
||||
|
||||
Spawn a background process instead of running the process in the foreground.
|
||||
If this flag is set, the process will first carry out all the
|
||||
initialization, then drop permissions if `--user` or `--group` is used and
|
||||
then spawn a background process and write its process id to a file if
|
||||
`--pid-file` is set. Then, the main process will exit and the background
|
||||
process continues to provide the VPN. At the time, when the main process
|
||||
exits, the interface exists and is properly configured to be used.
|
||||
|
||||
* `--no-port-forwarding`:
|
||||
|
||||
Disable automatic port forward. If this option is not set, VpnCloud tries to
|
||||
detect a NAT router and automatically add a port forwarding to it.
|
||||
|
||||
* `-v`, `--verbose`:
|
||||
|
||||
Print debug information, including information for data being received and
|
||||
sent.
|
||||
|
||||
* `-q`, `--quiet`:
|
||||
|
||||
Only print errors and warnings.
|
||||
|
||||
* `-h`, `--help`:
|
||||
|
||||
Display the help.
|
||||
|
||||
|
||||
## DESCRIPTION
|
||||
|
||||
**VpnCloud** is a simple VPN over UDP. It creates a virtual network interface on
|
||||
the host and forwards all received data via UDP to the destination. It can work
|
||||
in 3 different modes:
|
||||
|
||||
* **Switch mode**: In this mode, the VPN will dynamically learn addresses
|
||||
as they are used as source addresses and use them to forward data to its
|
||||
destination. Addresses that have not been seen for some time
|
||||
(option `dst_timeout`) will be forgotten. Data for unknown addresses will be
|
||||
broadcast to all peers. This mode is the default mode for TAP devices that
|
||||
process Ethernet frames but it can also be used with TUN devices and IP
|
||||
packets.
|
||||
|
||||
* **Hub mode**: In this mode, all data will always be broadcast to all peers.
|
||||
This mode uses lots of bandwidth and should only be used in special cases.
|
||||
|
||||
* **Router mode**: In this mode, data will be forwarded based on preconfigured
|
||||
address ranges ("subnets"). Data for unknown nodes will be silently ignored.
|
||||
This mode is the default mode for TUN devices that work with IP packets but
|
||||
it can also be used with TAP devices and Ethernet frames.
|
||||
|
||||
All connected VpnCloud nodes will form a peer-to-peer network and cross-connect
|
||||
automatically until the network is fully connected. The nodes will periodically
|
||||
exchange information with the other nodes to signal that they are still active
|
||||
and to allow the automatic cross-connect behavior. There are some important
|
||||
things to note:
|
||||
|
||||
- To avoid that different networks that reuse each others addresses merge due
|
||||
to the cross-connect behavior, the `magic` option can be used and set
|
||||
to any unique string to identify the network. The `magic` must be the
|
||||
same on all nodes of the same VPN network.
|
||||
|
||||
- The cross-connect behavior can be able to connect nodes that are behind
|
||||
firewalls or NATs as it can function as hole-punching.
|
||||
|
||||
- The management traffic will increase with the peer number quadratically.
|
||||
It should still be reasonably small for high node numbers (below 10 KiB/s
|
||||
for 10.000 nodes). A longer `peer_timeout` can be used to reduce the traffic
|
||||
further. For high node numbers, router mode should be used as it never
|
||||
broadcasts data.
|
||||
|
||||
VpnCloud does not implement any loop-avoidance. Since data received on the UDP
|
||||
socket will only be sent to the local network interface and vice versa, VpnCloud
|
||||
cannot produce loops on its own. On the TAP device, however STP data can be
|
||||
transported to avoid loops caused by other network components.
|
||||
|
||||
For TAP devices, IEEE 802.1q frames (VLAN tagged) are detected and forwarded
|
||||
based on separate MAC tables. Any nested tags (Q-in-Q) will be ignored.
|
||||
|
||||
|
||||
## EXAMPLES
|
||||
|
||||
### Switched TAP scenario
|
||||
|
||||
In the example scenario, a simple layer 2 network tunnel is established. Most
|
||||
likely those commands need to be run as **root** using `sudo`.
|
||||
|
||||
First, VpnCloud need to be started on both nodes (the address after `-c` is the
|
||||
address of the remote node and the the `X` in the interface address must be
|
||||
unique among all nodes, e.g. 0, 1, 2, ...):
|
||||
|
||||
```
|
||||
vpncloud -c REMOTE_HOST:PORT --ifup 'ifconfig $IFNAME 10.0.0.X/24 mtu 1400 up'
|
||||
```
|
||||
|
||||
Afterwards, the interface can be used to communicate.
|
||||
|
||||
|
||||
### Routed TUN example
|
||||
|
||||
In this example, 2 nodes and their subnets should communicate using IP.
|
||||
First, VpnCloud need to be started on both nodes:
|
||||
|
||||
```
|
||||
vpncloud -t tun -c REMOTE_HOST:PORT --subnet 10.0.X.0/24 --ifup 'ifconfig $IFNAME 10.0.X.1/16 mtu 1400 up'
|
||||
```
|
||||
|
||||
It is important to configure the interface in a way that all addresses on the
|
||||
VPN can be reached directly. E.g. if subnets 10.0.1.0/24, 10.0.2.0/24 and so on
|
||||
are used, the interface needs to be configured as 10.0.1.1/16.
|
||||
For TUN devices, this means that the prefix length of the subnets
|
||||
(/24 in this example) must be different than the prefix length that the
|
||||
interface is configured with (/16 in this example).
|
||||
|
||||
|
||||
### Important notes
|
||||
|
||||
- VpnCloud can be used to connect two separate networks. TAP networks can be
|
||||
bridged using `brctl` and TUN networks must be routed. It is very important
|
||||
to be careful when setting up such a scenario in order to avoid network loops,
|
||||
security issues, DHCP issues and many more problems.
|
||||
|
||||
- TAP devices will forward DHCP data. If done intentionally, this can be used
|
||||
to assign unique addresses to all participants. If this happens accidentally,
|
||||
it can conflict with DHCP servers of the local network and can have severe
|
||||
side effects.
|
||||
|
||||
- VpnCloud is not designed for high security use cases. Although the used crypto
|
||||
primitives are expected to be very secure, their application has not been
|
||||
reviewed.
|
||||
The shared key is hashed using *ScryptSalsa208Sha256* to derive a key,
|
||||
which is used to encrypt the payload of messages using *ChaCha20Poly1305* or
|
||||
*AES256-GCM*. The encryption includes an authentication that also protects the
|
||||
header.
|
||||
This method does only protect against attacks on single messages but not
|
||||
against attacks that manipulate the message series itself (i.e. suppress
|
||||
messages, reorder them, or duplicate them).
|
||||
|
||||
|
||||
## CONFIG FILES
|
||||
|
||||
The config file is a YAML file that contains configuration values. All entries
|
||||
are optional and override the defaults. Please see the section **OPTIONS** for
|
||||
detailed descriptions of the options.
|
||||
|
||||
* `device_type`: Set the type of network. Same as `--type`
|
||||
* `device_name`: Name of the virtual device. Same as `--device`
|
||||
* `device_path`: Set the path of the base device. Same as `--device-path`
|
||||
* `ifup`: A command to setup the network interface. Same as `--ifup`
|
||||
* `ifdown`: A command to bring down the network interface. Same as `--ifdown`
|
||||
* `crypto`: The encryption method to use. Same as `--crypto`
|
||||
* `shared_key`: The shared key to encrypt all traffic. Same as `--shared-key`
|
||||
* `magic`: Override the 4-byte magic header of each packet. Same as `--magic`
|
||||
* `port`: A port number to listen on. This option is DEPRECATED.
|
||||
* `listen`: The address on which to listen for data. Same as `--listen`
|
||||
* `peers`: A list of addresses to connect to. See `--connect`
|
||||
* `peer_timeout`: Peer timeout in seconds. Same as`--peer-timeout`
|
||||
* `beacon_store`: Path or command to store beacons. Same as `--beacon-store`
|
||||
* `beacon_load`: Path or command to load beacons. Same as `--beacon-load`
|
||||
* `beacon_interval`: Interval for loading and storing beacons in seconds. Same as `--beacon-interval`
|
||||
* `mode`: The mode of the VPN. Same as `--mode`
|
||||
* `dst_timeout`: Switch table entry timeout in seconds. Same as `--dst-timeout`
|
||||
* `subnets`: A list of local subnets to use. See `--subnet`
|
||||
* `port_forwarding`: Whether to activate port forwardig. See `--no-port-forwarding`
|
||||
* `user`: The name of a user to run the background process under. See `--user`
|
||||
* `group`: The name of a group to run the background process under. See `--group`
|
||||
* `pid_file`: The path of the pid file to create. See `--pid-file`
|
||||
* `stats_file`: The path of the statistics file. See `--stats-file`
|
||||
|
||||
|
||||
### Example
|
||||
|
||||
device_type: tun
|
||||
device_name: vpncloud%d
|
||||
ifup: ifconfig $IFNAME 10.0.1.1/16 mtu 1400 up
|
||||
crypto: aes256
|
||||
shared_key: mysecret
|
||||
listen: 3210
|
||||
peers:
|
||||
- remote.machine.foo:3210
|
||||
- remote.machine.bar:3210
|
||||
peer_timeout: 600
|
||||
mode: normal
|
||||
subnets:
|
||||
- 10.0.1.0/24
|
||||
port_forwarding: true
|
||||
user: nobody
|
||||
group: nogroup
|
||||
pid_file: /run/vpncloud.pid
|
||||
|
||||
|
||||
## BEACONS
|
||||
|
||||
Beacons are short character sequences that contain a timestamp and a list of
|
||||
addresses. They can be published and retrieved by other nodes to find peers
|
||||
without the need for static addresses.
|
||||
|
||||
The beacons are short (less than 100 characters), encrypted and encoded with
|
||||
printable characters to allow publishing them in various places on the
|
||||
internet, e.g.:
|
||||
- On shared drives or synchronized folders (e.g. on Dropbox)
|
||||
- Via a dedicated database
|
||||
- Via a general purpose message board of message service (e.g. Twitter)
|
||||
|
||||
The beacons are very robust. They only consist of alphanumeric characters
|
||||
and can be interleaved with non-alphanumeric characters (e.g. whitespace).
|
||||
Also the beacons contain a prefix and suffix that depends on the configured
|
||||
network magic and secret key (if set) so that all nodes can find beacons in
|
||||
a long text.
|
||||
|
||||
When beacons are stored or loaded via a command (using the pipe character `|`),
|
||||
the command is interpreted using the configured shell `sh`. This command has
|
||||
access to the following environment variables:
|
||||
* `$begin`: The prefix of the beacon.
|
||||
* `$end`: The suffix of the beacon.
|
||||
* `$data` (only on store): The middle part of the beacon. Do not use this
|
||||
without prefix and suffix!
|
||||
* `$beacon` (only on store): The full beacon consisting of prefix, data and
|
||||
suffix.
|
||||
The commands are called in separate threads, so even longer running commands
|
||||
will not block the node.
|
||||
|
||||
|
||||
## NETWORK PROTOCOL
|
||||
|
||||
The protocol of VpnCloud is kept as simple as possible to allow other
|
||||
implementations and to maximize the performance.
|
||||
|
||||
Every packet sent over UDP contains the following header (in order):
|
||||
|
||||
* 4 bytes `magic`
|
||||
|
||||
This field is used to identify the packet and to sort out packets that do
|
||||
not belong. The default is `[0x76, 0x70, 0x6e, 0x01]` ("vpn\x01").
|
||||
This field can be used to identify VpnCloud packets and might be set to
|
||||
something different to hide the protocol.
|
||||
|
||||
* 1 byte `crypto method`
|
||||
|
||||
This field specifies the method that must be used to decrypt the rest of the
|
||||
data. The currently supported methods are:
|
||||
|
||||
- Method `0`, **No encryption**: Rest of the data can be read without
|
||||
decrypting it.
|
||||
|
||||
- Method `1`, **ChaCha20**: The header is followed by a 12 byte
|
||||
*nonce*. The rest of the data is encrypted with the
|
||||
`libsodium::crypto_aead_chacha20poly1305_ietf` method, using the 8 byte
|
||||
header as additional data.
|
||||
|
||||
- Method `2`, **AES256**: The header is followed by a 12 byte *nonce*.
|
||||
The rest of the data is encrypted with the
|
||||
`libsodium::crypto_aead_aes256gcm` method, using the 8 byte header
|
||||
as additional data.
|
||||
|
||||
* 2 `reserved bytes` that are currently unused and set to 0
|
||||
|
||||
* 1 byte for the `message type`
|
||||
|
||||
This byte specifies the type of message that follows. Currently the
|
||||
following message types are supported:
|
||||
|
||||
- Type 0: Data packet
|
||||
- Type 1: Peer list
|
||||
- Type 2: Initial message
|
||||
- Type 3: Closing message
|
||||
|
||||
After this 8 byte header, the rest of the message follows. It is encrypted using
|
||||
the method specified in the header.
|
||||
|
||||
In the decrypted data, the message as specified in the `message type` field
|
||||
will follow:
|
||||
|
||||
* **Data packet** (message type 0):
|
||||
This packet contains payload. The format of the data depends on the device
|
||||
type. For TUN devices, this data contains an IP packet. For TAP devices it
|
||||
contains an Ethernet frame. The data starts right after the header and ends
|
||||
at the end of the packet.
|
||||
If it is an Ethernet frame, it will start with the destination MAC and end
|
||||
with the payload. It does not contain the preamble, SFD, padding, and CRC
|
||||
fields.
|
||||
|
||||
* **Peer list** (message type 1):
|
||||
This packet contains the peer list of the sender. The first byte after the
|
||||
switch byte contains the number of IPv4 addresses that follow.
|
||||
After that, the specified number of addresses follow, where each address
|
||||
is encoded in 6 bytes. The first 4 bytes are the IPv4 address and the later
|
||||
2 bytes are port number (both in network byte order).
|
||||
After those addresses, the next byte contains the number of IPv6 addresses
|
||||
that follow. After that, the specified number of addresses follow, where
|
||||
each address is encoded in 18 bytes. The first 16 bytes are the IPv6 address
|
||||
and the later 2 bytes are port number (both in network byte order).
|
||||
|
||||
* **Initial message** (message type 2):
|
||||
This packet contains the following information:
|
||||
- The stage of the initialization process
|
||||
- A random node id to distinguish different nodes
|
||||
- All the local subnets claimed by the nodes
|
||||
|
||||
Its first byte marks the stage of the initial handshake process.
|
||||
The next 16 bytes contain the unique node id. After that,
|
||||
the list of local subnets follows.
|
||||
The subnet list is encoded in the following way: Its first byte of data
|
||||
contains the number of encoded subnets that follow. After that, the given
|
||||
number of encoded subnets follow.
|
||||
For each subnet, the first byte is the length of bytes in the base address
|
||||
and is followed by the given number of base address bytes and one additional
|
||||
byte that is the prefix length of the subnet.
|
||||
The addresses for the subnet will be encoded like they are encoded in their
|
||||
native protocol (4 bytes for IPv4, 16 bytes for IPv6, and 6 bytes for a MAC
|
||||
address) with the exception of MAC addresses in a VLan which will be encoded
|
||||
in 8 bytes where the first 2 bytes are the VLan number in network byte order
|
||||
and the later 6 bytes are the MAC address.
|
||||
|
||||
* **Closing message** (message type 3):
|
||||
This packet does not contain any more data.
|
||||
|
||||
Nodes are expected to send an **initial message** with stage 0 whenever they
|
||||
connect to a node they were not connected to before. As a reply to this message,
|
||||
another initial should be sent with stage 1. Also a **peer list** message should
|
||||
be sent as a reply.
|
||||
|
||||
When connected, nodes should periodically send their **peer list** to all
|
||||
of their peers to spread this information and to avoid peer timeouts.
|
||||
To avoid the cubic growth of management traffic, nodes should at a certain
|
||||
network size start sending partial peer lists instead of the full list. A
|
||||
reasonable number would be about 20 peers. The subsets should be selected
|
||||
randomly.
|
||||
|
||||
Nodes should remove peers from their peer list after a certain period of
|
||||
inactivity or when receiving a **closing message**. Before shutting down, nodes
|
||||
should send the closing message to all of their peers in order to avoid
|
||||
receiving further data until the timeout is reached.
|
||||
|
||||
Nodes should only add nodes to their peer list after receiving an initial
|
||||
message from them instead of adding them right from the peer list of another
|
||||
peer. This is necessary to avoid the case of a large network keeping dead nodes
|
||||
alive.
|
||||
|
||||
|
||||
## COPYRIGHT
|
||||
|
||||
Copyright (C) 2015-2020 Dennis Schwerdel
|
||||
This software is licensed under GPL-3 or newer (see LICENSE.md)
|
||||
Loading…
Reference in New Issue