Русская версия Readme: README_RU.md
Cjdns implements an encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing. This provides near-zero-configuration networking, and prevents many of the security and scalability issues that plague existing networks.
Versions from prior to Dec 26 2013 have a serious security issue allowing an
attacker inside of the network to impersonate somebody else. If you are using
an old version, please update. If the new version does not build or work for you
please use stable-0.5 and report the issue on github or in IRC. Note that
stable-0.5 will receive only critical security patches and not be updated as
the protocol changes so using it is not a long term solution.
The PPA at https://code.launchpad.net/~calebdelisle/cjdns-apt is no-longer
maintained, because of limitations in the launchpad system, it can neither be
updated to stable-0.5 nor to the master branch and
THE LAST SUCCESSFUL BUILD WAS BEFORE THE SECURITY PATCH.
Please remove the PPA installation.
The Internet gives everyone incredible power of expression once reserved for those wealthy enough to own a radio station or newspaper. Still, the Internet's aging protocols have inherent limitations which make them unfavorable toward a network owned by the people.
Recent revelations have triggered public outcry over governments reading of our email but few stop to imagine the implications of an unsecured mesh network, in such a network everybody could read your email.
All over the world we see Internet access markets dominated by a few businesses who charge outrageous rates and have not materially increased Internet speed since crushing the dial-up providers at the beginning of the 21st century. Most agree that we need more competition but few recognize that if we cannot trust the handful of ISPs we have now, how have no hope of trusting the next 10,000 ISP which we will need to bring about meaningful competition.
Indeed the problem of trust extends beyond our private correspondence. The very fabric of the Internet can be torn apart at any moment by a malicious ISP or even an honest mistake as was seen in April 8, 2010 when somebody at China Telecom misconfigured a router causing widespread Internet outages which lasted fifteen minutes.
As governments continue pushing to filter websites, there is an ever increasing risk of back-and-forth retaliatory filtration eventually leaving entire nations isolated and breeding the hate and intolerance which the Internet promised to end.
Cjdns was designed with the understanding that we must securely remove central authority for The Internet to continue spanning the globe without borders and boundaries. It is not just a nice idea, the very future of The Open Web is at stake.
When you receive a packet of information from the Internet, it seems logical to assume that it was meant for you, that it came from the computer which it says it came from and that nobody else has been reading or modifying it on the way. While many popular software applications are designed around these assumptions, the existing Internet does not guarantee any of them and a number of network security exploits come from the cases where these assumptions break down.
Cjdns guarantees confidentiality, authenticity and integrity of data by using modern cryptography in a non-intrusive way. Information transmitted over a cjdns network can't be altered or read en-route. While you can create multiple identities, it's practically impossible to impersonate other nodes on the network and since a node's IPv6 address is the fingerprint of its key, man-in-the-middle attacks are not possible.
Traditional networks require manual configuration of IP addresses. To get these addresses one must join an Internet Registry and file a lengthy application. Cjdns nodes generate their own addresses along with their keys, when two nodes find each other, they connect. When many nodes find one another, they form a network. General network architecture is of course needed to avoid bottlenecks but once the nodes are put in the right places, they will discover their roles in the network.
Cjdns is built around the bold and unproven assumption that a non-hierarchical network can scale. Cjdns uses a distributed hash table to spread the load of routing among a number of nodes, rather than requiring every node know the exact location of every other node. At the bottom layer, packets are tagged with the exact route they should take, think of it like driving directions. At the upper layer the nodes maintain and test routes to other nodes who have numerically similar IPv6 addresses to their own. Forwarding is achieved by sending a packet to physically nearby nodes who have destinations numerically close to the target address.
23:26 <@jercos> well, cjdns is now officially more reliable than the open
internet for getting to my cheaper VPSes :|
12:52 < mariner> so i don't know if it's been done before, and i assume it's
obvious, but I think it's neat. Currently on hype from an
airplane
00:36 < tester> man sites take so long to load on i2p
00:36 < tester> i value speed over anonymity any day
<DuoNoxSol> it's notably more reliable than the normal internet
<DuoNoxSol> even though it really really shouldn't be
<DuoNoxSol> seeing as the connections are largely over the normal internet
Hyperboria is the largest cjdns network, with hundreds of active nodes around the world.
Cjdns has been tested on x86, amd64, ARMv5, ARMv7, MIPS, and PowerPC. It's continually tested on Linux, FreeBSD, OS X, and Illumos systems.
The protocols and algorithms are experimental and subject to change. To minimize the harm to the network, please update your cjdns nodes often.
We are in need of some buildbots on more obscure systems and architectures.
If you would like to donate one, you could mail it, or you could administer
it and provide remote shell access. Please email [email protected]
if you'd like to help out.
In a cjdns network, a packet goes to a router and the router labels the packet with directions to the router best able to handle it. That is, a router which is physically nearby and has an address numerically close to the destination address of the packet. The directions are added to the packet to allow it to go through a number of routers with minimal handling, a verifiable form of source routing. They just read the label and bounce the packet wherever the next bits in the label tell them to. Routers have a responsibility to "keep in touch" with other routers that are physically close by and numerically near to their address.
The router engine is a modified implementation of the Kademlia distributed hash table.
- irc://irc.efnet.org/#cjdns (web client)
- Hyperboria
- Project Meshnet
- /r/darknetplan
- #cjdns on Twitter
Advanced configuration:
Thank you for your time and interest,
The cjdns developers.
These instructions are for Debian-based Linux distributions. They should be informative enough for user on other distributions - just don't expect them to work verbatim.
sudo apt-get install nodejs git build-essential
Installing Node.js, although preferable, is not strictly necessary. If Node.js is unavailable or an unacceptable version, it will be downloaded and built in the source tree.
Clone the repository from GitHub and change to the source directory:
git clone https://github.com/cjdelisle/cjdns.git cjdns
cd cjdns
./do
Look for Build completed successfully, type ./cjdroute to begin setup., then
proceed below:
Run cjdroute without options for HELP:
./cjdroute
cat /dev/net/tun
If it says: cat: /dev/net/tun: File descriptor in bad state Good!
If it says: cat: /dev/net/tun: No such file or directory, create it using:
sudo mkdir /dev/net &&
sudo mknod /dev/net/tun c 10 200 &&
sudo chmod 0666 /dev/net/tun
Then cat /dev/net/tun again.
If it says: cat: /dev/net/tun: Permission denied You're probably using a VPS
based on the OpenVZ virtualization platform. Ask your provider to enable the
TUN/TAP device - this is standard protocol so they should know exactly what you
need. If you're on OS X, don't worry about this step.
./cjdroute --genconf >> cjdroute.conf
Protect your conf file! A lost conf file means you lost your password and connections and anyone who connected to you will no longer be able to connect. A compromised conf file means that other people can impersonate you on the network.
To set generate a conf file with permissions set so that only your user can read it and write to it:
(umask 077 && ./cjdroute --genconf > cjdroute.conf)
To get into an existing network (e.g. Hyperboria), you need to connect to someone who is already in the network. This is required for a number of reasons:
- It helps prevent abuse because bad people will be less likely to abuse a system after they were, in an act of human kindness, given access to that system.
- This is not intended to overlay The Old Internet, it is intended to replace it. Each connection will in due time be replaced by a wire, a fiber optic cable, or a wireless network connection.
- In any case of a disagreement, there will be a "chain of friends" linking the people involved so there will already be a basis for coming to a resolution.
To find a friend, get out there and join our community. Also, have a look at the Project Meshnet Map to find peers near you (note: scroll the map right, not left; the markers don't repeat).
To initiate the connection OUTbound
In your conf file, you will see:
// Nodes to connect to.
"connectTo":
{
// Add connection credentials here to join the network
// Ask somebody who is already connected.
}A conf file with multiple friend-nodes, setup OUTbound, should look like:
// Nodes to connect to.
"connectTo":
{
//friend_1 (IPv4: 0.1.2.3; IPv6 fcaa:5bac:66e4:713:cb00:e446:c317:fc39)
"0.1.2.3:45678":
{
"password": "thisIsNotARealConnection_1",
"publicKey": "thisIsJustForAnExampleDoNotUseThisInYourConfFile_1.k"
}
//friend_2 (IPv4: 5.1.2.3; IPv6 fcbb:5bac:66e4:713:cb00:e446:c317:fc39)
"5.1.2.3:5678":
{
"password": "thisIsNotARealConnection_2",
"publicKey": "thisIsJustForAnExampleDoNotUseThisInYourConfFile_2.k"
}
}You can add as many connections as you want to the connectTo attribute,
following JSON syntax.
To allow your friend to initiate the connection INbound
In your conf file, you will see:
"authorizedPasswords":
[
// A unique string which is known to the client and server.
{"password": "thisisauniquestring_001"}
// More passwords should look like this.
// {"password": "thisisauniquestring_002"}
// {"password": "thisisauniquestring_003"}
// {"password": "thisisauniquestring_004"}
...
// "your.external.ip.goes.here:45678":{"password": "thisisauniquestring_001","publicKey":thisisauniqueKEY_001.k"}
],A conf file with multiple friend-nodes, setup INbound, should look like:
"authorizedPasswords":
[
// A unique string which is known to the client and server.
{"password": "thisisauniquestring_001"}
// More passwords should look like this.
//friend_3 (IPv4: 0.1.2.3; IPv6 fcaa:5bac:66e4:713:cb00:e446:c317:fc39)
{"password": "thisisauniquestring_002"}
//friend_4 (IPv4: 5.1.2.3; IPv6 fcbb:5bac:66e4:713:cb00:e446:c317:fc39)
{"password": "thisisauniquestring_003"}
// {"password": "thisisauniquestring_004"}
...
// "your.external.ip.goes.here:45678":{"password": "thisisauniquestring_001","publicKey":thisisauniqueKEY_001.k"}
],You need to give friend_3 (who is making the INbound connection) the following 4 items:
-
Your external IPv4
-
The port found in your conf file here:
`// Bind to this port. "bind": "0.0.0.0:yourportnumberishere",` -
Their unique password that you uncommented or created: "password": "thisisauniquestring_002"
-
Your public key: "publicKey":thisisauniqueKEY_001.k"
Please note that you and your friend can initiate a connection either outbound (from YOU --> FRIEND) or inbound (from FRIEND --> YOU) but traffic flows both ways once the connection is established.
See doc/configure.md for more details on configuration, including how to peer with other cjdns nodes over ethernet and wifi.
Once your node is running, you're now a newly minted IPv6 host. Your operating system may automatically reconfigure network services to use this new address. If this is not what you intend, you should check to see that you are not offering more services then you intended to. ;)
See doc/network-services.md for instructions.
sudo ./cjdroute < cjdroute.conf
If you want to have your logs written to a file:
sudo ./cjdroute < cjdroute.conf > cjdroute.log
To stop cjdns:
sudo killall cjdroute
If you are having problems use killall cjdroute to return to sanity. Use
pgrep cjdroute or top to see if it running.
Note: this starts cjdns as the root user so it can configure your system without concern for permissions. To start cjdns as a non-root user, see doc/non-root-user.md.
Welcome to the network! You're now a network administrator. There are responsibilities which come with being a network administrator which include being available in case there is something wrong with your equipment. You should stay on IRC so that people can reach you.
When cjdnroute is up and running, the admin interface will be available at
localhost:11234 (this can be changed in the cjdroute.conf
configuration file). See admin/README.md for more
information about the admin interface.
You can access the admin API with:
- the Python library; see contrib/python/README.md.
- the Perl library, maintained by Mikey; see contrib/perl/CJDNS/README.