<div class="title">

= SAM V3 =

</div>
<div class="inner" role="main">

<div class="fluid">

<div class="meta">

This page was last updated in June 2019 and is accurate for router version 0.9.39.

</div>
Specified below is a simple client protocol for interacting with I2P.

SAM version 3 was introduced in I2P release 0.7.3. Alternatives: [[en/docs/api/bob|BOB(unsupported)]]. Older versions: [[en/docs/api/sam|SAM V1]], [[en/docs/api/samv2|SAM V2]],

== Known SAM libraries ==

{|
!width="8%"| Library Name
!width="8%"| Language
!width="5%"| Version
!width="4%"| STREAM
!width="3%"| DGRAM
!width="2%"| RAW
!width="65%"| Site
|-
| i2psam
| C++, C wrapper
| 3.1
| yes
| yes
| no
| [https://github.com/i2p/i2psam github.com/i2p/i2psam]
|-
| gosam
| Go
| 3.2
| yes
| no
| no
| [https://github.com/eyedeekay/goSam github.com/eyedeekay/goSam]
|-
| sam3
| Go
| 3.2
| yes
| yes
| yes
| [https://bitbucket.org/eyedeekay/sam3 bitbucket.org/eyedeekay/sam3]
|-
| txi2p
| Python
| 3.1
| yes
| no
| no
| [https://github.com/str4d/txi2p github.com/str4d/txi2p]
|-
| i2p.socket
| Python
| 3.2
| yes
| yes
| yes
| [https://github.com/majestrate/i2p.socket github.com/majestrate/i2p.socket]
|-
| i2plib
| Python
| 3.1
| yes
| yes
| yes
| [https://github.com/l-n-s/i2plib github.com/l-n-s/i2plib]
|-
| i2p-rs
| Rust
| 3.1
| yes
| yes
| yes
| [https://github.com/i2p/i2p-rs github.com/i2p/i2p-rs]
|-
| libsam3
| C
| 3.1
| yes
| yes
| yes
| [https://github.com/i2p/libsam3 github.com/i2p/libsam3]
|-
| mooni2p
| Lua
| 3.1
| yes
| yes
| yes
| [https://notabug.org/l-n-s/mooni2p notabug.org/l-n-s/mooni2p]
|-
| haskell-network-anonymous-i2p
| Haskell
| 3.1
| yes
| yes
| yes
| [https://github.com/solatis/haskell-network-anonymous-i2p github.com/solatis/haskell-network-anonymous-i2p]
|-
| node-i2p
| Javascript
| 3.0
| yes
| unk
| unk
| [https://github.com/redhog/node-i2p github.com/redhog/node-i2p]
|-
| Jsam
| Java
| 3.1
| yes
| no
| no
| [https://github.com/eyedeekay/Jsam github.com/eyedeekay/Jsam]
|-
| i2pdotnet
| .Net
| 3.0
| yes
| unk
| unk
| [https://github.com/SamuelFisher/i2pdotnet github.com/SamuelFisher/i2pdotnet]
|-
| i2p.rb
| Ruby
| 3.0
| yes
| no
| no
| [https://github.com/dryruby/i2p.rb github.com/dryruby/i2p.rb]
|}

== Version 3 Changes ==

=== Version 3.0 Changes ===

Version 3.0 was introduced in I2P release 0.7.3. SAM v2 provided a way to manage several sockets on the same I2P destination ''in parallel'', i.e. the client does not have to wait for data being successfully sent on one socket before sending data on another socket. But all data transited through the same client<-->SAM socket, which was quite complicated to manage for the client.

SAM v3 manages sockets in a different way: each ''I2P socket'' matches a unique client<-->SAM socket, which is much more simple to handle. This is similar to [[en/docs/api/bob|BOB]].<br />
SAM v3 also offers a UDP port for sending datagrams through I2P, and can forward back I2P datagrams to the client's datagram server.
=== Version 3.1 Changes ===

Version 3.1 was introduced in I2P release 0.9.14. SAM 3.1 is the recommended minimum SAM implementation because of its support for better signature types than SAM 3.0.

* DEST GENERATE and SESSION CREATE now support a SIGNATURE_TYPE parameter.
* The MIN and MAX parameters in HELLO VERSION are now optional.
* The MIN and MAX parameters in HELLO VERSION now support single-digit versions such as "3".
* RAW SEND is now supported on the bridge socket.

=== Version 3.2 Changes ===

Version 3.2 was introduced in I2P release 0.9.24.

==== I2CP Port and Protocol Support ====

* SESSION CREATE options FROM_PORT and TO_PORT
* SESSION CREATE STYLE=RAW option PROTOCOL
* STREAM CONNECT, DATAGRAM SEND, and RAW SEND options FROM_PORT and TO_PORT
* RAW SEND option PROTOCOL
* DATAGRAM RECEIVED, RAW RECEIVED, and forwarded or received streams and repliable datagrams, includes FROM_PORT and TO_PORT
* RAW session option HEADER=true will cause the forwarded raw datagrams to be prepended with a line containing PROTOCOL=nnn FROM_PORT=nnnn TO_PORT=nnnn
* The first line of datagrams sent through port 7655 may now start with any 3.x version
* The first line of datagrams sent through port 7655 may contain any of the options FROM_PORT, TO_PORT, PROTOCOL
* RAW RECEIVED includes PROTOCOL=nnn

==== SSL and Authentication ====

* USER/PASSWORD in the HELLO parameters for authorization. See [[#userpw|below]].
* Optional authorization configuration with the AUTH command. See [[#auth|below]].
* Optional SSL/TLS support on the control socket. See [[#ssl|below]].
* STREAM FORWARD option SSL=true

==== Multithreading ====

* Concurrent pending STREAM ACCEPTs are allowed on the same session ID.

==== Command Line Parsing and Keepalive ====

* Optional commands QUIT, STOP and EXIT to close the session and socket. See [[#quit|below]].
* Command parsing will properly handle UTF-8
* Command parsing reliably handles whitespace inside quotes
* A backslash '\' may escape quotes on the command line
* Recommended that the server map commands to upper case, for ease in testing via telnet.
* Empty option values such as PROTOCOL or PROTOCOL= may be allowed, implementation dependent.
* PING/PONG for keepalive. See below.
* Servers may implement timeouts for the HELLO or subsequent commands, implementation dependent.

=== Version 3.3 Changes ===

Version 3.3 was introduced in I2P release 0.9.25.

* The same session may be used for streams, datagrams, and raw simultaneously. Incoming packets and streams will be routed based on I2P protocol and to-port. See [[#master|the MASTER section below]].
* DATAGRAM SEND and RAW SEND now support options SEND_TAGS, TAG_THRESHOLD, EXPIRES, and SEND_LEASESET. See [[#v3dgsend|the datagram sending section below]].

== Version 3 Protocol ==

=== Simple Anonymous Messaging (SAM) Version 3.3 Specification Overview ===

The client application talks to the SAM bridge, which deals with all of the I2P functionality (using the [[en/docs/api/streaming|streaming library]] for virtual streams, or [[en/docs/protocol/i2cp|I2CP]] directly for datagrams).

By default, the client<-->SAM bridge communication is unencrypted and unauthenticated. The SAM bridge may support SSL/TLS connections; configuration and implementation details are outside the scope of this specification. As of SAM 3.2, optional authentication user/password parameters are supported in the initial handshake and may be required by the bridge.

I2P communications can take three distinct forms:

* [[en/docs/api/streaming|Virtual streams]]
* [[en/docs/spec/datagrams#repliable|Repliable datagrams]] (messages with a FROM field)
* [[en/docs/spec/datagrams#raw|Anonymous datagrams]] (raw anonymous messages)

I2P communications are supported by I2P sessions, and each I2P session is bound to an address (called destination). An I2P session is associated with one of the three types above, and cannot carry communications of another type, unless using [[#master|MASTER sessions]].

=== Encoding and Escaping ===

All of these SAM messages are sent on a single line, terminated by the newline character (\n). Prior to SAM 3.2, only 7-bit ASCII was supported. As of SAM 3.2, the encoding must be UTF-8. Any UTF8-encoded keys or values should work.

The formatting shown in this specification below is merely for readability, and while the first two words in each message must stay in their specific order, the ordering of the key=value pairs can change (e.g. "ONE TWO A=B C=D" or "ONE TWO C=D A=B" are both perfectly valid constructions). In addition, the protocol is case-sensitive. In the following, message examples are preceded by "-> " for messages sent by the client to the SAM bridge, and by "<- " for messages sent by the SAM bridge to the client.

The basic command or response line takes one of the following forms:

<pre> COMMAND SUBCOMMAND [key=value] [key=value] ...
COMMAND # As of SAM 3.2
PING[ arbitrary text] # As of SAM 3.2
PONG[ arbitrary text] # As of SAM 3.2</pre>
COMMAND without a SUBCOMMAND is supported for some new commands in SAM 3.2 only.
Key=value pairs must be separated by a single space. (As of SAM 3.2, multiple spaces are allowed) Values may be enclosed in double quotes if they contain spaces, e.g. key="long value text". (Prior to SAM 3.2, this did not work reliably in some implementations)

Prior to SAM 3.2, there was no escaping mechanism. As of SAM 3.2, double quotes may be escaped with a backslash '\' and a backslash may be represented as two backslashes '\\'.

=== Empty values ===

As of SAM 3.2, empty option values such as KEY, KEY=, or KEY="" may be allowed, implementation dependent.

=== Case Sensitivity ===

The protocol, as specified, is case-sensitive. It is recommended but not required that the server map commands to upper case, for ease in testing via telnet. This would allow, for example, "hello version" to work. This is implementation-dependent. Do not map keys or values to upper case, as this would corrupt [[en/docs/protocol/i2cp|I2CP]] options.

=== SAM Connection Handshake ===

No SAM communication can occur until after the client and bridge have agreed on a protocol version, which is done by the client sending a HELLO and the bridge sending a HELLO REPLY:

<pre>-> HELLO VERSION
[MIN=$min] # Optional as of SAM 3.1, required for 3.0 and earlier
[MAX=$max] # Optional as of SAM 3.1, required for 3.0 and earlier
[USER="xxx"] # As of SAM 3.2, required if authentication is enabled, see below
[PASSWORD="yyy"] # As of SAM 3.2, required if authentication is enabled, see below</pre>
and
<pre><- HELLO REPLY RESULT=OK VERSION=3.1</pre>
As of version 3.1 (I2P 0.9.14), the MIN and MAX parameters are optional. SAM will always return the highest version possible given the MIN and MAX constraints, or the current server version if no constraints are given. If the SAM bridge cannot find a suitable version, it replies with:

<pre><- HELLO REPLY RESULT=NOVERSION</pre>
If some error occurred, such as a bad request format, it replies with:
<pre><- HELLO REPLY RESULT=I2P_ERROR MESSAGE=$message</pre>
==== SSL ====

The server's control socket may optionally offer SSL/TLS support, as configured on the server and client. Implementations may offer other transport layers as well; this is outside the scope of the protocol definition.

==== Authorization ====

For authorization, client adds USER="xxx" PASSWORD="yyy" to the HELLO parameters. Double quotes for user and password are recommended but not required. A double quote inside a user or password must be escaped with a backslash. On failure the server will reply with an I2P_ERROR and a message. It is recommended that SSL be enabled on any SAM servers where authorization is required.

==== Timeouts ====

Servers may implement timeouts for the HELLO or subsequent commands, implementation dependent. Clients should promptly send the HELLO and the next command after connecting.

If a timeout occurs before the HELLO is received, the bridge replies with:

<pre><- HELLO REPLY RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnects.
If a timeout occurs after the HELLO is received but before the next command, the bridge replies with:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnects.
=== I2CP Ports and Protocol ===

As of SAM 3.2, the [[en/docs/protocol/i2cp|I2CP]] ports and protocol may be specified by the SAM client sender to be passed through to [[en/docs/protocol/i2cp|I2CP]], and the SAM bridge will pass the received [[en/docs/protocol/i2cp|I2CP]] port and protocol information to the SAM client.

For FROM_PORT and TO_PORT, the valid range is 0-65535, and the default is 0.

For PROTOCOL, which may be specified only for RAW, the valid range is 0-255, and the default is 18.

For SESSION commands, the specified ports and protocol are the defaults for that session. For individual streams or datagrams, the specified ports and protocol override the session defaults. For received streams or datagrams, the indicated ports and protocol are as received from [[en/docs/protocol/i2cp|I2CP]].

See the [[en/docs/protocol/i2cp|I2CP]] specification for more information.

=== SAM Sessions ===

A SAM session is created by a client opening a socket to the SAM bridge, operating a handshake, and sending a SESSION CREATE message, and the session terminates when the socket is disconnected.

Each registered I2P Destination is uniquely associated with a session ID (or nickname).

Each session is uniquely associated with:

* the socket from which the client creates the session
* its ID (or nickname)

==== Session Creation Request ====

The session creation message can only use one of these forms (messages received through other forms are answered with an error message) :

<pre>-> SESSION CREATE
STYLE={STREAM,DATAGRAM,RAW}
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
[SIGNATURE_TYPE=value] # SAM 3.1 or higher only, for DESTINATION=TRANSIENT only, default DSA_SHA1
[PORT=$port] # Required for DATAGRAM and RAW, invalid for STREAM
[HOST=$host] # Optional for DATAGRAM and RAW, invalid for STREAM
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, for STYLE=RAW only, default 18
[HEADER={true,false}] # SAM 3.2 or higher only, for STYLE=RAW only, default false
[option=value]* # I2CP and streaming options</pre>
DESTINATION specifies what destination should be used for sending and receiving messages/streams. The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 663 or more bytes in binary and 884 or more bytes in base 64, depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

If the signing private key is all zeros, the the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]] section follows. Offline signatures are only supported for STREAM and RAW sessions. Offline signatures may not be created with DESTINATION=TRANSIENT. The format of the offline signature section is:

# - Expires timestamp (4 bytes, big endian, seconds since epoch, rolls over in 2106)
# - Sig type of transient Signing Public Key (2 bytes, big endian)
# - Transient Signing Public key (length as specified by transient sig type)
# - Signature of above three fields by offline key (length as specified by destination sig type)
# - Transient Signing Private key (length as specified by transient sig type)

If the destination is specified as TRANSIENT, the SAM bridge creates a new destination. As of version 3.1 (I2P 0.9.14), if the destination is TRANSIENT, an optional parameter SIGNATURE_TYPE is supported. The SIGNATURE_TYPE value may be any name (e.g. ECDSA_SHA256_P256, case insensitive) or number (e.g. 1) supported by [[en/docs/spec/common-structures#type_Certificate|Key Certificates]]. The default is DSA_SHA1.

$nickname is the choice of the client. No whitespace is allowed.

Additional options given are passed to the I2P session configuration if not interpreted by the SAM bridge (e.g. outbound.length=0). These options [[#options|are documented below]].

The SAM bridge itself should already be configured with what router it should communicate over I2P through (though if need be there may be a way to provide an override, e.g. i2cp.tcp.host=localhost and i2cp.tcp.port=7654).

==== Session Creation Response ====

After receiving the session create message, the SAM bridge will reply with a session status message, as follows:

If the creation was successful:

<pre><- SESSION STATUS RESULT=OK DESTINATION=$privkey</pre>
The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 663 or more bytes in binary and 884 or more bytes in base 64, depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

If the SESSION CREATE contained a signing private key of all zeros and a [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]] section, the SESSION STATUS reply will include the same data in the same format. See the SESSION CREATE section above for details.

If the nickname is already associated with a session:

<pre><- SESSION STATUS RESULT=DUPLICATED_ID</pre>
If the destination is already in use:

<pre><- SESSION STATUS RESULT=DUPLICATED_DEST</pre>
If the destination is not a valid private destination key:

<pre><- SESSION STATUS RESULT=INVALID_KEY</pre>
If some other error has occurred:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
If it's not OK, the MESSAGE should contain human-readable information as to why the session could not be created.

SAM sessions live and die with the socket they are associated with. When the socket is closed, the session dies, and all communications using the session die at the same time. And the other way round, when the session dies for any reason, the SAM bridge closes the socket.

=== SAM Virtual Streams ===

Virtual streams are guaranteed to be sent reliably and in order, with failure and success notification as soon as it is available.

Streams are bidirectional communication sockets between two I2P destinations, but their opening has to be requested by one of them. Hereafter, CONNECT commands are used by the SAM client for such a request. FORWARD / ACCEPT commands are used by the SAM client when he wants to listen to requests coming from other I2P destinations.

=== SAM Virtual Streams : CONNECT ===

A client asks for a connection by:

* opening a new socket with the SAM bridge
* passing the same HELLO handshake as above
* sending the STREAM CONNECT command

==== Connect Request ====

<pre>-> STREAM CONNECT
ID=$nickname
DESTINATION=$destination
[SILENT={true,false}] # default false
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0</pre>
This establishes a new virtual connection from the local session whose ID is $nickname to the specified peer.

The target is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

==== Connect Response ====

If SILENT=true is passed, the SAM bridge won't issue any other message on the socket. If the connection fails, the socket will be closed. If the connection succeeds, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false, which is the default value, the SAM bridge sends a last message to its client before forwarding or shutting down the socket:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
CANT_REACH_PEER
I2P_ERROR
INVALID_KEY
INVALID_ID
TIMEOUT</pre>
If the RESULT is OK, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer. If the connection was not possible (timeout, etc), RESULT will contain the appropriate error value (accompanied by an optional human-readable MESSAGE), and the SAM bridge closes the socket.

=== SAM Virtual Streams : ACCEPT ===

A client waits for an incoming connection request by:

* opening a new socket with the SAM bridge
* passing the same HELLO handshake as above
* sending the STREAM ACCEPT command

==== Accept Request ====

<pre>-> STREAM ACCEPT
ID=$nickname
[SILENT={true,false}] # default false</pre>
This makes the session ${nickname} listen for one incoming connection request from the I2P network. ACCEPT is not allowed while there is an active FORWARD on the session.

As of SAM 3.2, multiple concurrent pending STREAM ACCEPTs are allowed on the same session ID (even with the same port). Prior to 3.2, concurrent accepts would fail with ALREADY_ACCEPTING.

==== Accept Response ====

If SILENT=true is passed, the SAM bridge won't issue any other message on the socket. If the accept fails, the socket will be closed. If the accept succeeds, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer. For reliability, and to receive the destination for incoming connections, SILENT=false is recommended.

If SILENT=false, which is the default value, the SAM bridge answers with:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
I2P_ERROR
INVALID_ID</pre>
If the result is not OK, the socket is closed immediately by the SAM bridge. If the result is OK, the SAM bridge starts waiting for an incoming connection request from another I2P peer. When a request arrives, the SAM bridge accepts it and:

If SILENT=true was passed, the SAM bridge won't issue any other message on the client socket. All remaining data passing through the current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false was passed, which is the default value, the SAM bridge sends the client a ASCII line containing the base64 public destination key of the requesting peer, and additional information for SAM 3.2 only:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n</pre>
After this '\n' terminated line, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer, until one of the peer closes the socket.
=== SAM Virtual Streams : FORWARD ===

A client can use a regular socket server and wait for connection requests coming from I2P. For that, the client must:

* open a new socket with the SAM bridge
* pass the same HELLO handshake as above
* send the forward command

==== Forward Request ====

<pre>-> STREAM FORWARD
ID=$nickname
PORT=$port
[HOST=$host]
[SILENT={true,false}] # default false
[SSL={true,false}] # SAM 3.2 or higher only, default false</pre>
This makes the session ${nickname} listen for incoming connection requests from the I2P network. FORWARD is not allowed while there is a pending ACCEPT on the session.

==== Forward Response ====

SILENT defaults to false. Whether SILENT is true or false, the SAM bridge always answers with a STREAM STATUS message. Note that this is a different behavior from STREAM ACCEPT and STREAM CONNECT when SILENT=true. The STREAM STATUS message is:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
I2P_ERROR
INVALID_ID</pre>
$host is the hostname or IP address of the socket server to which SAM will forward connection requests. If not given, SAM takes the IP of the socket that issued the forward command.

$port is the port number of the socket server to which SAM will forward connection requests. It is mandatory.

When a connection request arrives from I2P, the SAM bridge requests a socket connection from $host:$port. If it is accepted after no more than 3 seconds, SAM will accept the connection from I2P, and then:

If SILENT=true was passed, all data passing through the obtained current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false was passed, which is the default value, the SAM bridge sends on the obtained socket an ASCII line containing the base64 public destination key of the requesting peer, and additional information for SAM 3.2 only:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n</pre>
After this '\n' terminated line, all remaining data passing through the socket is forwarded from and to the connected I2P destination peer, until one of the sides closes the socket.
As of SAM 3.2, if SSL=true is specified, the forwarding socket is over SSL/TLS.

The I2P router will stop listening to incoming connection requests as soon as the "forwarding" socket is closed.

=== SAM Datagrams : Sending Repliable or Raw Datagrams ===

While I2P doesn't inherently contain a FROM address, for ease of use an additional layer is provided as repliable datagrams - unordered and unreliable messages of up to 31744 bytes that include a FROM address (leaving up to 1KB for header material). This FROM address is authenticated internally by SAM (making use of the destination's signing key to verify the source) and includes replay prevention.

Minimum size is 1. For best delivery reliability, recommended maximum size is approximately 11 KB. Reliability is inversely proportional to message size, perhaps even exponentially.

After establishing a SAM session with STYLE=DATAGRAM or STYLE=RAW, the client can send repliable or raw datagrams through SAM's UDP port (7655).

The first line of a datagram sent through this port must be in the following format. This is all on one line (space separated), shown on multiple lines for clarity:

<pre> 3.0 # As of SAM 3.2, any "3.x" is allowed. Prior to that, "3.0" is required.
$nickname
$destination
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, only for RAW sessions, default 18
[SEND_TAGS=nnn] # SAM 3.3 or higher only, number of session tags to send
# Overrides crypto.tagsToSend I2CP session option
# Default is router-dependent (40 for Java router)
[TAG_THRESHOLD=nnn] # SAM 3.3 or higher only, low session tag threshold
# Overrides crypto.lowTagThreshold I2CP session option
# Default is router-dependent (30 for Java router)
[EXPIRES=nnn] # SAM 3.3 or higher only, expiration from now in seconds
# Overrides clientMessageTimeout I2CP session option (which is in ms)
# Default is router-dependent (60 for Java router)
[SEND_LEASESET={true,false}] # SAM 3.3 or higher only, whether to send our leaseset
# Overrides shouldBundleReplyInfo I2CP session option
# Default is true
\n</pre>
* 3.0 is the version of SAM. As of SAM 3.2, any 3.x is allowed.
* $nickname is the id of the DATAGRAM session that will be used
* The target is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.
* All options are per-datagram settings that override the defaults specified in the SESSION CREATE.
* Version 3.3 options SEND_TAGS, TAG_THRESHOLD, EXPIRES, and SEND_LEASESET will be passed to [[en/docs/protocol/i2cp|I2CP]] if supported. See [[../protocol/i2cp#msg_SendMessageExpire|the I2CP specification]] for details. Support by the SAM server is optional, it will ignore these options if unsupported.
* this line is '\n' terminated.

The first line will be discarded by SAM before sending the remaining data of the message to the specified destination.

For an alternate method of sending repliable and raw datagrams, see [[#dgsend|DATAGRAM SEND and RAW SEND]].

=== SAM Repliable Datagrams : Receiving a Datagram ===

Received datagrams are written by SAM on the socket from which the datagram session was opened, if a forwarding PORT is not specified in the SESSION CREATE command. This is the v1/v2-compatible way of receiving datagrams.

When a datagram arrives, the bridge delivers it to the client via the message:

<pre><- DATAGRAM RECEIVED
DESTINATION=$destination
SIZE=$numBytes
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n
[$numBytes of data]</pre>
The source is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

The SAM bridge never exposes to the client the authentication headers or other fields, merely the data that the sender provided. This continues until the session is closed (by the client dropping the connection).

=== SAM Datagrams : Forwarding Raw or Repliable Datagrams ===

When creating a datagram session, the client can ask SAM to forward incoming messages to a specified ip:port. It does so by issuing the CREATE command with PORT and HOST options:

<pre>-> SESSION CREATE
STYLE={DATAGRAM,RAW}
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
PORT=$port
[HOST=$host]
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, for STYLE=RAW only, default 18
[option=value]* # I2CP options</pre>
The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 884 or more base 64 characters (663 or more bytes in binary), depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

Offline signatures are only supported for RAW datagrams. See the SESSION CREATE section above for details.

$host is the hostname or IP address of the datagram server to which SAM will forward datagrams. If not given, SAM takes the IP of the socket that issued the forward command.

$port is the port number of the datagram server to which SAM will forward datagrams. If $port is not set, datagrams will NOT be forwarded, they will be received on the control socket, in the v1/v2-compatible way.

Additional options given are passed to the I2P session configuration if not interpreted by the SAM bridge (e.g. outbound.length=0). These options [[#options|are documented below]].

Forwarded repliable datagrams are always prefixed with the destination. When a repliable datagram arrives, the bridge sends to the specified host:port a UDP packet containing the following data:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n
$datagram_payload</pre>
Forwarded raw datagrams are forwarded as-is to the specified host:port without a prefix. The UDP packet contains the following data:

<pre> $datagram_payload</pre>
As of SAM 3.2, when HEADER=true is specified in SESSION CREATE, the forwarded raw datagram will be prepended with a header line as follows:

<pre> FROM_PORT=nnn
TO_PORT=nnn
PROTOCOL=nnn
\n
$datagram_payload</pre>
The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

=== SAM Anonymous (Raw) Datagrams ===

Squeezing the most out of I2P's bandwidth, SAM allows clients to send and receive anonymous datagrams, leaving authentication and reply information up to the client themselves. These datagrams are unreliable and unordered, and may be up to 32768 bytes.

Minimum size is 1. For best delivery reliability, recommended maximum size is approximately 11 KB.

After establishing a SAM session with STYLE=RAW, the client can send anonymous datagrams through the SAM bridge exactly the same way as [[v3dgsend|sending repliable datagrams]].

Both ways of receiving datagrams are also available for anonymous datagrams.

Received datagrams are written by SAM on the socket from which the datagram session was opened, if a forwarding PORT is not specified in the SESSION CREATE command. This is the v1/v2-compatible way of receiving datagrams.

<pre><- RAW RECEIVED
SIZE=$numBytes
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
PROTOCOL=nnn # SAM 3.2 or higher only
\n
[$numBytes of data]</pre>
When anonymous datagrams are to be forwarded to some host:port, the bridge sends to the specified host:port a message containing the following data:

<pre> $datagram_payload</pre>
As of SAM 3.2, when HEADER=true is specified in SESSION CREATE, the forwarded raw datagram will be prepended with a header line as follows:
<pre> FROM_PORT=nnn
TO_PORT=nnn
PROTOCOL=nnn
\n
$datagram_payload</pre>
For an alternate method of sending anonymous datagrams, see [[#dgsend|RAW SEND]].

=== DATAGRAM SEND, RAW SEND (V1/V2 Compatible Datagram Handling) ===

In SAM V3, the preferred way to send datagrams is via the datagram socket at port 7655 as documented above. However, repliable datagrams may be sent directly via the SAM bridge socket using the DATAGRAM SEND command, as documented in [[sam|SAM V1]] and [[samv2|SAM V2]].

As of release 0.9.14 (version 3.1), anonymous datagrams may be sent directly via the SAM bridge socket using the RAW SEND command, as documented in [[sam|SAM V1]] and [[samv2|SAM V2]].

As of release 0.9.24 (version 3.2), DATAGRAM SEND and RAW SEND may include the parameters FROM_PORT=nnnn and/or TO_PORT=nnnn to override the default ports. As of release 0.9.24 (version 3.2), RAW SEND may include the parameter PROTOCOL=nnn to override the default protocol.

These commands do ''not'' support the ID parameter. The datagrams are sent to the most recently created DATAGRAM- or RAW-style session, as appropriate. Support for the ID parameter may be added in a future release.

=== MASTER Sessions (V3.3 and higher) ===

''Version 3.3 was introduced in I2P release 0.9.25.''

SAM v3.3 adds support for running streaming, datagrams, and raw subsessions on the same master session, and for running multiple subsessions of the same style. All subsession traffic uses a single destination, or set of tunnels. Routing of traffic from I2P is based on the port and protocol options for the subsessions.

To create multiplexed subsessions, you must create a master session and then add subsessions to the master session. Each subsession must have a unique id and a unique listen protocol and port. Subsessions may also be removed from the master session.

With a MASTER session and a combination of subsessions, a SAM client may support multiple applications, or a single sophisticated application using a variety of protocols, on a single set of tunnels. For example, a bittorrent client could set up a streaming subsession for peer-to-peer connections, together with datagram and raw subsessions for DHT communication.

==== Creating a MASTER Session ====

<pre>-> SESSION CREATE
STYLE=MASTER
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
[option=value]* # I2CP and streaming options</pre>
The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]].

Do not set the PORT, HOST, FROM_PORT, TO_PORT, PROTOCOL, LISTEN_PORT, LISTEN_PROTOCOL, or HEADER options on a master session. You may not send any data on a MASTER session ID or on the control socket. All commands such as STREAM CONNECT, DATAGRAM SEND, etc. must use the subsession ID on a separate socket.

The MASTER session connects to the router and builds tunnels. When the SAM bridge responds, tunnels have been built and the session is ready for subsessions to be added. All [[en/docs/protocol/i2cp|I2CP]] options pertaining to tunnel parameters such as length, quantity, and nickname must be provided in the master's SESSION CREATE.

All utility commands are supported on a master session.

When the master session is closed, all subsessions get closed also.

==== Creating a Subsession ====

Using the same control socket on which the MASTER session was created:

<pre>-> SESSION ADD
STYLE={STREAM,DATAGRAM,RAW}
ID=$nickname # must be unique
[PORT=$port] # Required for DATAGRAM and RAW, invalid for STREAM
[HOST=$host] # Optional for DATAGRAM and RAW, invalid for STREAM
[FROM_PORT=nnn] # For outbound traffic, default 0
[TO_PORT=nnn] # For outbound traffic, default 0
[PROTOCOL=nnn] # For outbound traffic for STYLE=RAW only, default 18
[LISTEN_PORT=nnn] # For inbound traffic, default is the FROM_PORT value.
# For STYLE=STREAM, only the FROM_PORT value or 0 is allowed.
[LISTEN_PROTOCOL=nnn] # For inbound traffic for STYLE=RAW only.
# Default is the PROTOCOL value; 6 (streaming) is disallowed
[HEADER={true,false}] # For STYLE=RAW only, default false
[option=value]* # I2CP and streaming options</pre>
The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]]. As the tunnels were already built in the master SESSION CREATE, the SAM bridge should respond immediately.

Do not set the DESTINATION option on a SESSION ADD. The subsession will use the destination specified in the master session. All subsessions must be added on the control socket, i.e. the same connection that you created the master session on.

Multiple subsessions must have options sufficiently unique that incoming data can be routed correctly. In particular, multiple sessions of the same style must have different LISTEN_PORT options (and/or LISTEN_PROTOCOL, for RAW only). A SESSION ADD with listen port and protocol that duplicates an existing subsession will result in an error.

The LISTEN_PORT is the local I2P port, i.e. the receive (TO) port for incoming data. If the LISTEN_PORT is not specified, the FROM_PORT value will be used. If the LISTEN_PORT and FROM_PORT are not specified, incoming routing will be based on STYLE and PROTOCOL alone. For LISTEN_PORT and LISTEN_PROTOCOL, 0 means any value, that is, a wildcard. If both LISTEN_PORT and LISTEN_PROTOCOL are 0, this subsession will be the default for incoming traffic that does not get routed to another subsession. Incoming streaming traffic (protocol 6) will never be routed to a RAW subsession, even if its LISTEN_PROTCOL is 0. A RAW subsession may not set a LISTEN_PROTOCOL of 6. If there is no default or subsession that matching the protocol and port of incoming traffic, that data will be dropped.

Use the subsession ID, not the master session ID, for sending and receiving data. All commands such as STREAM CONNECT, DATAGRAM SEND, etc. must use the subsession ID.

All utility commands are supported on a master session or subsession. v1/v2 datagram/raw sending/receiving are not supported on a master session or on subsessions.

==== Stopping a Subsession ====

Using the same control socket on which the MASTER session was created:

<pre>-> SESSION REMOVE
ID=$nickname</pre>
This removes a subsession from the master session. Do not set any other options on a SESSION REMOVE. Subsessions must be removed on the control socket, i.e. the same connection that you created the master session on. After a subsession is removed, it is closed and may not be used to send or receive data.

The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]].

=== SAM Utility Commands ===

Some utility commands require a pre-existing session and some do not. See details below.

==== Host Name Lookup ====

The following message can be used by the client to query the SAM bridge for name resolution:

<pre> NAMING LOOKUP
NAME=$name</pre>
which is answered by

<pre> NAMING REPLY
RESULT=$result
NAME=$name
[VALUE=$destination]
[MESSAGE=$message]</pre>
The RESULT value may be one of:

<pre> OK
INVALID_KEY
KEY_NOT_FOUND</pre>
If NAME=ME, then the reply will contain the destination used by the current session (useful if you're using a TRANSIENT one). If $result is not OK, MESSAGE may convey a descriptive message, such as "bad format", etc. INVALID_KEY implies that something is wrong with $name in the request, possibly invalid characters.

The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

NAMING LOOKUP does not require that a session has been created first. However, in some implementations, a .b32.i2p lookup which is uncached and requires a network query may fail, as no client tunnels are available for the lookup.

==== Destination Key Generation ====

Public and private base64 keys can be generated using the following message:

<pre>-> DEST GENERATE
[SIGNATURE_TYPE=value] # SAM 3.1 or higher only, default DSA_SHA1</pre>
which is answered by

<pre> DEST REPLY
PUB=$destination
PRIV=$privkey</pre>
As of version 3.1 (I2P 0.9.14), an optional parameter SIGNATURE_TYPE is supported. The SIGNATURE_TYPE value may be any name (e.g. ECDSA_SHA256_P256, case insensitive) or number (e.g. 1) that is supported by [[en/docs/spec/common-structures#type_Certificate|Key Certificates]]. The default is DSA_SHA1.

The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], which is 884 or more base 64 characters (663 or more bytes in binary), depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

DEST GENERATE does not require that a session has been created first.

DEST GENERATE cannot be used to create a destination with offline signatures.

==== PING/PONG (SAM 3.2 or higher) ====

Either the client or server may send:

<pre> PING[ arbitrary text]</pre>
on the control port, with the response:
<pre> PONG[ arbitrary text from the ping]</pre>
to be used for control socket keepalive. Either side may close the session and socket if no response is received in a reasonable time, implementation dependent.
If a timeout occurs waiting for a PONG from the client, the bridge may send:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnect.
If a timeout occurs waiting for a PONG from the bridge, the client may simply disconnect.

PING/PONG do not require that a session has been created first.

==== QUIT/STOP/EXIT (SAM 3.2 or higher, optional features) ====

Commands QUIT, STOP and EXIT will close the session and socket. Implementation is optional, for ease in testing via telnet. Whether there is any response before the socket is closed (for example, a SESSION STATUS message) is implementation-specific and outside the scope of this specification.

QUIT/STOP/EXIT do not require that a session has been created first.

==== HELP (optional feature) ====

Servers may implement a HELP command. Implementation is optional, for ease in testing via telnet. Output format and detection of the end of the output is implementation-specific and outside the scope of this specification.

HELP does not require that a session has been created first.

==== Authorization Configuration (SAM 3.2 or higher, optional feature) ====

Authorization configuration using the AUTH command. A SAM server may implement these commands to facilite persistent storage of credentials. Configuration of authentication other than with these commands is implementation-specific and outside the scope of this specification.

* AUTH ENABLE enables authorization on subsequent connections
* AUTH DISABLE disables authorization on subsequent connections
* AUTH ADD USER="foo" PASSWORD="bar" adds a user/password
* AUTH REMOVE USER="foo" removes this user

Double quotes for user and password are recommended but not required. A double quote inside a user or password must be escaped with a backslash. On failure the server will reply with an I2P_ERROR and a message.

AUTH does not require that a session has been created first.

=== RESULT Values ===

These are the values that can be carried by the RESULT field, with their meaning:

<pre> OK Operation completed successfully
CANT_REACH_PEER The peer exists, but cannot be reached
DUPLICATED_DEST The specified Destination is already in use
I2P_ERROR A generic I2P error (e.g. I2CP disconnection, etc.)
INVALID_KEY The specified key is not valid (bad format, etc.)
KEY_NOT_FOUND The naming system can't resolve the given name
PEER_NOT_FOUND The peer cannot be found on the network
TIMEOUT Timeout while waiting for an event (e.g. peer answer)</pre>
=== Tunnel, I2CP, and Streaming Options ===

These options may be passed in as name=value pairs at the end of a SAM SESSION CREATE line.

All sessions may include [[en/docs/protocol/i2cp#options|I2CP options such as tunnel lengths]]. STREAM sessions may include [[en/docs/api/streaming#options|Streaming library options]]. See those references for option names and defaults.

=== BASE 64 Notes ===

Base 64 encoding must use the I2P standard Base 64 alphabet "A-Z, a-z, 0-9, -, ~".

=== Client Library Implementations ===

Client libraries are available for C, C++, C#, Perl, and Python. These are in the apps/sam/ directory in the [[en/download|I2P Source Package]]. Some may be older and have not been updated for SAMv3 support.

=== Default SAM Setup ===

The default SAM port is 7656. SAM is not enabled by default in the Java I2P Router; it must be started manually, or configured to start automatically, on the configure clients page in the router console, or in the clients.config file. The default SAM UDP port is 7655, listening on 127.0.0.1. These may be changed by adding the arguments sam.udp.port=nnnnn and/or sam.udp.host=w.x.y.z to the invocation.

Configuration in other routers is implementation-specific.

</div>

</div>

</div>

Samv3

2020-02-04T14:35:32Z

Idk:

Main Page

2020-01-26T00:00:11Z

Idk:

__NOTOC__

Welcome to the I2P wiki

this should be a central instance for user2user help inside the I2P network.
Feel free to create a login and contribute content about the I2P network.

Remind: illegal content is prohibited and will be removed.

{|
|width="40%" valign="top"|


{{Layout_Box2|1=
== General information ==
}}

{{Layout_Box2|1=
== Projects ==
* [[Samv3]]
* [[Plugins]]
* [[I2P-Messenger]]
}}

{{Layout_Box2|1=
== Events ==
}}

| width="30%" valign="top" |


{{Layout_Box3|1=
== External ==
* [[BiglyBT]]
* [[I2Pd]]
}}

| width="30%" valign="top" |


{{Layout_Box2|1=
== Services ==

}}

|}

Consult the [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide] for information on using the wiki software.

== Getting started ==
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Main Page

2020-01-25T23:58:55Z

Idk:

2020-01-20T04:25:43Z

Idk: Created page with "<div class="inner" role="main"> <div class="fluid"> <div class="meta"> This page was last updated in June 2019 and is accurate for router version 0.9.39. </div> Specified..."

<div class="inner" role="main">

<div class="fluid">

<div class="meta">

This page was last updated in June 2019 and is accurate for router version 0.9.39.

</div>
Specified below is a simple client protocol for interacting with I2P.

SAM version 3 was introduced in I2P release 0.7.3. Alternatives: [[en/docs/api/bob|BOB(unsupported)]]. Older versions: [[en/docs/api/sam|SAM V1]], [[en/docs/api/samv2|SAM V2]],

== Known SAM libraries ==

{|
!width="16%"| Library Name
!width="6%"| Language
!width="5%"| Version
!width="4%"| STREAM
!width="4%"| DGRAM
!width="3%"| RAW
!width="58%"| Site
|-
| i2psam
| C++, C wrapper
| 3.1
| yes
| yes
| no
| [https://github.com/i2p/i2psam github.com/i2p/i2psam]
|-
| gosam
| Go
| 3.2
| yes
| no
| no
| [https://github.com/eyedeekay/goSam github.com/eyedeekay/goSam]
|-
| sam3
| Go
| 3.2
| yes
| yes
| yes
| [https://bitbucket.org/eyedeekay/sam3 bitbucket.org/eyedeekay/sam3]
|-
| txi2p
| Python
| 3.1
| yes
| no
| no
| [https://github.com/str4d/txi2p github.com/str4d/txi2p]
|-
| i2p.socket
| Python
| 3.2
| yes
| yes
| yes
| [https://github.com/majestrate/i2p.socket github.com/majestrate/i2p.socket]
|-
| i2plib
| Python
| 3.1
| yes
| yes
| yes
| [https://github.com/l-n-s/i2plib github.com/l-n-s/i2plib]
|-
| i2p-rs
| Rust
| 3.1
| yes
| yes
| yes
| [https://github.com/i2p/i2p-rs github.com/i2p/i2p-rs]
|-
| libsam3
| C
| 3.1
| yes
| yes
| yes
| [https://github.com/i2p/libsam3 github.com/i2p/libsam3]
|-
| mooni2p
| Lua
| 3.1
| yes
| yes
| yes
| [https://notabug.org/l-n-s/mooni2p notabug.org/l-n-s/mooni2p]
|-
| haskell-network-anonymous-i2p
| Haskell
| 3.1
| yes
| yes
| yes
| [https://github.com/solatis/haskell-network-anonymous-i2p github.com/solatis/haskell-network-anonymous-i2p]
|-
| node-i2p
| Javascript
| 3.0
| yes
| unk
| unk
| [https://github.com/redhog/node-i2p github.com/redhog/node-i2p]
|-
| Jsam
| Java
| 3.1
| yes
| no
| no
| [https://github.com/eyedeekay/Jsam github.com/eyedeekay/Jsam]
|-
| i2pdotnet
| .Net
| 3.0
| yes
| unk
| unk
| [https://github.com/SamuelFisher/i2pdotnet github.com/SamuelFisher/i2pdotnet]
|-
| i2p.rb
| Ruby
| 3.0
| yes
| no
| no
| [https://github.com/dryruby/i2p.rb github.com/dryruby/i2p.rb]
|}

== Version 3 Changes ==

=== Version 3.0 Changes ===

Version 3.0 was introduced in I2P release 0.7.3. SAM v2 provided a way to manage several sockets on the same I2P destination ''in parallel'', i.e. the client does not have to wait for data being successfully sent on one socket before sending data on another socket. But all data transited through the same client<-->SAM socket, which was quite complicated to manage for the client.

SAM v3 manages sockets in a different way: each ''I2P socket'' matches a unique client<-->SAM socket, which is much more simple to handle. This is similar to [[en/docs/api/bob|BOB]].<br />
SAM v3 also offers a UDP port for sending datagrams through I2P, and can forward back I2P datagrams to the client's datagram server.

=== Version 3.1 Changes ===

Version 3.1 was introduced in I2P release 0.9.14. SAM 3.1 is the recommended minimum SAM implementation because of its support for better signature types than SAM 3.0.

* DEST GENERATE and SESSION CREATE now support a SIGNATURE_TYPE parameter.
* The MIN and MAX parameters in HELLO VERSION are now optional.
* The MIN and MAX parameters in HELLO VERSION now support single-digit versions such as "3".
* RAW SEND is now supported on the bridge socket.

=== Version 3.2 Changes ===

Version 3.2 was introduced in I2P release 0.9.24.

==== I2CP Port and Protocol Support ====

* SESSION CREATE options FROM_PORT and TO_PORT
* SESSION CREATE STYLE=RAW option PROTOCOL
* STREAM CONNECT, DATAGRAM SEND, and RAW SEND options FROM_PORT and TO_PORT
* RAW SEND option PROTOCOL
* DATAGRAM RECEIVED, RAW RECEIVED, and forwarded or received streams and repliable datagrams, includes FROM_PORT and TO_PORT
* RAW session option HEADER=true will cause the forwarded raw datagrams to be prepended with a line containing PROTOCOL=nnn FROM_PORT=nnnn TO_PORT=nnnn
* The first line of datagrams sent through port 7655 may now start with any 3.x version
* The first line of datagrams sent through port 7655 may contain any of the options FROM_PORT, TO_PORT, PROTOCOL
* RAW RECEIVED includes PROTOCOL=nnn

==== SSL and Authentication ====

* USER/PASSWORD in the HELLO parameters for authorization. See [[#userpw|below]].
* Optional authorization configuration with the AUTH command. See [[#auth|below]].
* Optional SSL/TLS support on the control socket. See [[#ssl|below]].
* STREAM FORWARD option SSL=true

==== Multithreading ====

* Concurrent pending STREAM ACCEPTs are allowed on the same session ID.

==== Command Line Parsing and Keepalive ====

* Optional commands QUIT, STOP and EXIT to close the session and socket. See [[#quit|below]].
* Command parsing will properly handle UTF-8
* Command parsing reliably handles whitespace inside quotes
* A backslash '\' may escape quotes on the command line
* Recommended that the server map commands to upper case, for ease in testing via telnet.
* Empty option values such as PROTOCOL or PROTOCOL= may be allowed, implementation dependent.
* PING/PONG for keepalive. See below.
* Servers may implement timeouts for the HELLO or subsequent commands, implementation dependent.

=== Version 3.3 Changes ===

Version 3.3 was introduced in I2P release 0.9.25.

* The same session may be used for streams, datagrams, and raw simultaneously. Incoming packets and streams will be routed based on I2P protocol and to-port. See [[#master|the MASTER section below]].
* DATAGRAM SEND and RAW SEND now support options SEND_TAGS, TAG_THRESHOLD, EXPIRES, and SEND_LEASESET. See [[#v3dgsend|the datagram sending section below]].

== Version 3 Protocol ==

=== Simple Anonymous Messaging (SAM) Version 3.3 Specification Overview ===

The client application talks to the SAM bridge, which deals with all of the I2P functionality (using the [[en/docs/api/streaming|streaming library]] for virtual streams, or [[en/docs/protocol/i2cp|I2CP]] directly for datagrams).

By default, the client<-->SAM bridge communication is unencrypted and unauthenticated. The SAM bridge may support SSL/TLS connections; configuration and implementation details are outside the scope of this specification. As of SAM 3.2, optional authentication user/password parameters are supported in the initial handshake and may be required by the bridge.

I2P communications can take three distinct forms:

* [[en/docs/api/streaming|Virtual streams]]
* [[en/docs/spec/datagrams#repliable|Repliable datagrams]] (messages with a FROM field)
* [[en/docs/spec/datagrams#raw|Anonymous datagrams]] (raw anonymous messages)

I2P communications are supported by I2P sessions, and each I2P session is bound to an address (called destination). An I2P session is associated with one of the three types above, and cannot carry communications of another type, unless using [[#master|MASTER sessions]].

=== Encoding and Escaping ===

All of these SAM messages are sent on a single line, terminated by the newline character (\n). Prior to SAM 3.2, only 7-bit ASCII was supported. As of SAM 3.2, the encoding must be UTF-8. Any UTF8-encoded keys or values should work.

The formatting shown in this specification below is merely for readability, and while the first two words in each message must stay in their specific order, the ordering of the key=value pairs can change (e.g. "ONE TWO A=B C=D" or "ONE TWO C=D A=B" are both perfectly valid constructions). In addition, the protocol is case-sensitive. In the following, message examples are preceded by "-> " for messages sent by the client to the SAM bridge, and by "<- " for messages sent by the SAM bridge to the client.

The basic command or response line takes one of the following forms:

<pre> COMMAND SUBCOMMAND [key=value] [key=value] ...
COMMAND # As of SAM 3.2
PING[ arbitrary text] # As of SAM 3.2
PONG[ arbitrary text] # As of SAM 3.2</pre>
COMMAND without a SUBCOMMAND is supported for some new commands in SAM 3.2 only.

Key=value pairs must be separated by a single space. (As of SAM 3.2, multiple spaces are allowed) Values may be enclosed in double quotes if they contain spaces, e.g. key="long value text". (Prior to SAM 3.2, this did not work reliably in some implementations)

Prior to SAM 3.2, there was no escaping mechanism. As of SAM 3.2, double quotes may be escaped with a backslash '\' and a backslash may be represented as two backslashes '\\'.

=== Empty values ===

As of SAM 3.2, empty option values such as KEY, KEY=, or KEY="" may be allowed, implementation dependent.

=== Case Sensitivity ===

The protocol, as specified, is case-sensitive. It is recommended but not required that the server map commands to upper case, for ease in testing via telnet. This would allow, for example, "hello version" to work. This is implementation-dependent. Do not map keys or values to upper case, as this would corrupt [[en/docs/protocol/i2cp|I2CP]] options.

=== SAM Connection Handshake ===

No SAM communication can occur until after the client and bridge have agreed on a protocol version, which is done by the client sending a HELLO and the bridge sending a HELLO REPLY:

<pre>-> HELLO VERSION
[MIN=$min] # Optional as of SAM 3.1, required for 3.0 and earlier
[MAX=$max] # Optional as of SAM 3.1, required for 3.0 and earlier
[USER="xxx"] # As of SAM 3.2, required if authentication is enabled, see below
[PASSWORD="yyy"] # As of SAM 3.2, required if authentication is enabled, see below</pre>
and

<pre><- HELLO REPLY RESULT=OK VERSION=3.1</pre>
As of version 3.1 (I2P 0.9.14), the MIN and MAX parameters are optional. SAM will always return the highest version possible given the MIN and MAX constraints, or the current server version if no constraints are given. If the SAM bridge cannot find a suitable version, it replies with:

<pre><- HELLO REPLY RESULT=NOVERSION</pre>
If some error occurred, such as a bad request format, it replies with:

<pre><- HELLO REPLY RESULT=I2P_ERROR MESSAGE=$message</pre>
==== SSL ====

The server's control socket may optionally offer SSL/TLS support, as configured on the server and client. Implementations may offer other transport layers as well; this is outside the scope of the protocol definition.

==== Authorization ====

For authorization, client adds USER="xxx" PASSWORD="yyy" to the HELLO parameters. Double quotes for user and password are recommended but not required. A double quote inside a user or password must be escaped with a backslash. On failure the server will reply with an I2P_ERROR and a message. It is recommended that SSL be enabled on any SAM servers where authorization is required.

==== Timeouts ====

Servers may implement timeouts for the HELLO or subsequent commands, implementation dependent. Clients should promptly send the HELLO and the next command after connecting.

If a timeout occurs before the HELLO is received, the bridge replies with:

<pre><- HELLO REPLY RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnects.

If a timeout occurs after the HELLO is received but before the next command, the bridge replies with:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnects.

=== I2CP Ports and Protocol ===

As of SAM 3.2, the [[en/docs/protocol/i2cp|I2CP]] ports and protocol may be specified by the SAM client sender to be passed through to [[en/docs/protocol/i2cp|I2CP]], and the SAM bridge will pass the received [[en/docs/protocol/i2cp|I2CP]] port and protocol information to the SAM client.

For FROM_PORT and TO_PORT, the valid range is 0-65535, and the default is 0.

For PROTOCOL, which may be specified only for RAW, the valid range is 0-255, and the default is 18.

For SESSION commands, the specified ports and protocol are the defaults for that session. For individual streams or datagrams, the specified ports and protocol override the session defaults. For received streams or datagrams, the indicated ports and protocol are as received from [[en/docs/protocol/i2cp|I2CP]].

See the [[en/docs/protocol/i2cp|I2CP]] specification for more information.

=== SAM Sessions ===

A SAM session is created by a client opening a socket to the SAM bridge, operating a handshake, and sending a SESSION CREATE message, and the session terminates when the socket is disconnected.

Each registered I2P Destination is uniquely associated with a session ID (or nickname).

Each session is uniquely associated with:

* the socket from which the client creates the session
* its ID (or nickname)

==== Session Creation Request ====

The session creation message can only use one of these forms (messages received through other forms are answered with an error message) :

<pre>-> SESSION CREATE
STYLE={STREAM,DATAGRAM,RAW}
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
[SIGNATURE_TYPE=value] # SAM 3.1 or higher only, for DESTINATION=TRANSIENT only, default DSA_SHA1
[PORT=$port] # Required for DATAGRAM and RAW, invalid for STREAM
[HOST=$host] # Optional for DATAGRAM and RAW, invalid for STREAM
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, for STYLE=RAW only, default 18
[HEADER={true,false}] # SAM 3.2 or higher only, for STYLE=RAW only, default false
[option=value]* # I2CP and streaming options</pre>
DESTINATION specifies what destination should be used for sending and receiving messages/streams. The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 663 or more bytes in binary and 884 or more bytes in base 64, depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

If the signing private key is all zeros, the the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]] section follows. Offline signatures are only supported for STREAM and RAW sessions. Offline signatures may not be created with DESTINATION=TRANSIENT. The format of the offline signature section is:

# - Expires timestamp (4 bytes, big endian, seconds since epoch, rolls over in 2106)
# - Sig type of transient Signing Public Key (2 bytes, big endian)
# - Transient Signing Public key (length as specified by transient sig type)
# - Signature of above three fields by offline key (length as specified by destination sig type)
# - Transient Signing Private key (length as specified by transient sig type)

If the destination is specified as TRANSIENT, the SAM bridge creates a new destination. As of version 3.1 (I2P 0.9.14), if the destination is TRANSIENT, an optional parameter SIGNATURE_TYPE is supported. The SIGNATURE_TYPE value may be any name (e.g. ECDSA_SHA256_P256, case insensitive) or number (e.g. 1) supported by [[en/docs/spec/common-structures#type_Certificate|Key Certificates]]. The default is DSA_SHA1.

$nickname is the choice of the client. No whitespace is allowed.

Additional options given are passed to the I2P session configuration if not interpreted by the SAM bridge (e.g. outbound.length=0). These options [[#options|are documented below]].

The SAM bridge itself should already be configured with what router it should communicate over I2P through (though if need be there may be a way to provide an override, e.g. i2cp.tcp.host=localhost and i2cp.tcp.port=7654).

==== Session Creation Response ====

After receiving the session create message, the SAM bridge will reply with a session status message, as follows:

If the creation was successful:

<pre><- SESSION STATUS RESULT=OK DESTINATION=$privkey</pre>
The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 663 or more bytes in binary and 884 or more bytes in base 64, depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

If the SESSION CREATE contained a signing private key of all zeros and a [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]] section, the SESSION STATUS reply will include the same data in the same format. See the SESSION CREATE section above for details.

If the nickname is already associated with a session:

<pre><- SESSION STATUS RESULT=DUPLICATED_ID</pre>
If the destination is already in use:

<pre><- SESSION STATUS RESULT=DUPLICATED_DEST</pre>
If the destination is not a valid private destination key:

<pre><- SESSION STATUS RESULT=INVALID_KEY</pre>
If some other error has occurred:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
If it's not OK, the MESSAGE should contain human-readable information as to why the session could not be created.

SAM sessions live and die with the socket they are associated with. When the socket is closed, the session dies, and all communications using the session die at the same time. And the other way round, when the session dies for any reason, the SAM bridge closes the socket.

=== SAM Virtual Streams ===

Virtual streams are guaranteed to be sent reliably and in order, with failure and success notification as soon as it is available.

Streams are bidirectional communication sockets between two I2P destinations, but their opening has to be requested by one of them. Hereafter, CONNECT commands are used by the SAM client for such a request. FORWARD / ACCEPT commands are used by the SAM client when he wants to listen to requests coming from other I2P destinations.

=== SAM Virtual Streams : CONNECT ===

A client asks for a connection by:

* opening a new socket with the SAM bridge
* passing the same HELLO handshake as above
* sending the STREAM CONNECT command

==== Connect Request ====

<pre>-> STREAM CONNECT
ID=$nickname
DESTINATION=$destination
[SILENT={true,false}] # default false
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0</pre>
This establishes a new virtual connection from the local session whose ID is $nickname to the specified peer.

The target is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

==== Connect Response ====

If SILENT=true is passed, the SAM bridge won't issue any other message on the socket. If the connection fails, the socket will be closed. If the connection succeeds, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false, which is the default value, the SAM bridge sends a last message to its client before forwarding or shutting down the socket:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
CANT_REACH_PEER
I2P_ERROR
INVALID_KEY
INVALID_ID
TIMEOUT</pre>
If the RESULT is OK, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer. If the connection was not possible (timeout, etc), RESULT will contain the appropriate error value (accompanied by an optional human-readable MESSAGE), and the SAM bridge closes the socket.

=== SAM Virtual Streams : ACCEPT ===

A client waits for an incoming connection request by:

* opening a new socket with the SAM bridge
* passing the same HELLO handshake as above
* sending the STREAM ACCEPT command

==== Accept Request ====

<pre>-> STREAM ACCEPT
ID=$nickname
[SILENT={true,false}] # default false</pre>
This makes the session ${nickname} listen for one incoming connection request from the I2P network. ACCEPT is not allowed while there is an active FORWARD on the session.

As of SAM 3.2, multiple concurrent pending STREAM ACCEPTs are allowed on the same session ID (even with the same port). Prior to 3.2, concurrent accepts would fail with ALREADY_ACCEPTING.

==== Accept Response ====

If SILENT=true is passed, the SAM bridge won't issue any other message on the socket. If the accept fails, the socket will be closed. If the accept succeeds, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer. For reliability, and to receive the destination for incoming connections, SILENT=false is recommended.

If SILENT=false, which is the default value, the SAM bridge answers with:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
I2P_ERROR
INVALID_ID</pre>
If the result is not OK, the socket is closed immediately by the SAM bridge. If the result is OK, the SAM bridge starts waiting for an incoming connection request from another I2P peer. When a request arrives, the SAM bridge accepts it and:

If SILENT=true was passed, the SAM bridge won't issue any other message on the client socket. All remaining data passing through the current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false was passed, which is the default value, the SAM bridge sends the client a ASCII line containing the base64 public destination key of the requesting peer, and additional information for SAM 3.2 only:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n</pre>
After this '\n' terminated line, all remaining data passing through the current socket is forwarded from and to the connected I2P destination peer, until one of the peer closes the socket.

=== SAM Virtual Streams : FORWARD ===

A client can use a regular socket server and wait for connection requests coming from I2P. For that, the client must:

* open a new socket with the SAM bridge
* pass the same HELLO handshake as above
* send the forward command

==== Forward Request ====

<pre>-> STREAM FORWARD
ID=$nickname
PORT=$port
[HOST=$host]
[SILENT={true,false}] # default false
[SSL={true,false}] # SAM 3.2 or higher only, default false</pre>
This makes the session ${nickname} listen for incoming connection requests from the I2P network. FORWARD is not allowed while there is a pending ACCEPT on the session.

==== Forward Response ====

SILENT defaults to false. Whether SILENT is true or false, the SAM bridge always answers with a STREAM STATUS message. Note that this is a different behavior from STREAM ACCEPT and STREAM CONNECT when SILENT=true. The STREAM STATUS message is:

<pre><- STREAM STATUS
RESULT=$result
[MESSAGE=...]</pre>
The RESULT value may be one of:

<pre> OK
I2P_ERROR
INVALID_ID</pre>
$host is the hostname or IP address of the socket server to which SAM will forward connection requests. If not given, SAM takes the IP of the socket that issued the forward command.

$port is the port number of the socket server to which SAM will forward connection requests. It is mandatory.

When a connection request arrives from I2P, the SAM bridge requests a socket connection from $host:$port. If it is accepted after no more than 3 seconds, SAM will accept the connection from I2P, and then:

If SILENT=true was passed, all data passing through the obtained current socket is forwarded from and to the connected I2P destination peer.

If SILENT=false was passed, which is the default value, the SAM bridge sends on the obtained socket an ASCII line containing the base64 public destination key of the requesting peer, and additional information for SAM 3.2 only:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n</pre>
After this '\n' terminated line, all remaining data passing through the socket is forwarded from and to the connected I2P destination peer, until one of the sides closes the socket.

As of SAM 3.2, if SSL=true is specified, the forwarding socket is over SSL/TLS.

The I2P router will stop listening to incoming connection requests as soon as the "forwarding" socket is closed.

=== SAM Datagrams : Sending Repliable or Raw Datagrams ===

While I2P doesn't inherently contain a FROM address, for ease of use an additional layer is provided as repliable datagrams - unordered and unreliable messages of up to 31744 bytes that include a FROM address (leaving up to 1KB for header material). This FROM address is authenticated internally by SAM (making use of the destination's signing key to verify the source) and includes replay prevention.

Minimum size is 1. For best delivery reliability, recommended maximum size is approximately 11 KB. Reliability is inversely proportional to message size, perhaps even exponentially.

After establishing a SAM session with STYLE=DATAGRAM or STYLE=RAW, the client can send repliable or raw datagrams through SAM's UDP port (7655).

The first line of a datagram sent through this port must be in the following format. This is all on one line (space separated), shown on multiple lines for clarity:

<pre> 3.0 # As of SAM 3.2, any "3.x" is allowed. Prior to that, "3.0" is required.
$nickname
$destination
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, only for RAW sessions, default 18
[SEND_TAGS=nnn] # SAM 3.3 or higher only, number of session tags to send
# Overrides crypto.tagsToSend I2CP session option
# Default is router-dependent (40 for Java router)
[TAG_THRESHOLD=nnn] # SAM 3.3 or higher only, low session tag threshold
# Overrides crypto.lowTagThreshold I2CP session option
# Default is router-dependent (30 for Java router)
[EXPIRES=nnn] # SAM 3.3 or higher only, expiration from now in seconds
# Overrides clientMessageTimeout I2CP session option (which is in ms)
# Default is router-dependent (60 for Java router)
[SEND_LEASESET={true,false}] # SAM 3.3 or higher only, whether to send our leaseset
# Overrides shouldBundleReplyInfo I2CP session option
# Default is true
\n</pre>
* 3.0 is the version of SAM. As of SAM 3.2, any 3.x is allowed.
* $nickname is the id of the DATAGRAM session that will be used
* The target is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.
* All options are per-datagram settings that override the defaults specified in the SESSION CREATE.
* Version 3.3 options SEND_TAGS, TAG_THRESHOLD, EXPIRES, and SEND_LEASESET will be passed to [[en/docs/protocol/i2cp|I2CP]] if supported. See [[../protocol/i2cp#msg_SendMessageExpire|the I2CP specification]] for details. Support by the SAM server is optional, it will ignore these options if unsupported.
* this line is '\n' terminated.

The first line will be discarded by SAM before sending the remaining data of the message to the specified destination.

For an alternate method of sending repliable and raw datagrams, see [[#dgsend|DATAGRAM SEND and RAW SEND]].

=== SAM Repliable Datagrams : Receiving a Datagram ===

Received datagrams are written by SAM on the socket from which the datagram session was opened, if a forwarding PORT is not specified in the SESSION CREATE command. This is the v1/v2-compatible way of receiving datagrams.

When a datagram arrives, the bridge delivers it to the client via the message:

<pre><- DATAGRAM RECEIVED
DESTINATION=$destination
SIZE=$numBytes
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n
[$numBytes of data]</pre>
The source is $destination, which is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

The SAM bridge never exposes to the client the authentication headers or other fields, merely the data that the sender provided. This continues until the session is closed (by the client dropping the connection).

=== SAM Datagrams : Forwarding Raw or Repliable Datagrams ===

When creating a datagram session, the client can ask SAM to forward incoming messages to a specified ip:port. It does so by issuing the CREATE command with PORT and HOST options:

<pre>-> SESSION CREATE
STYLE={DATAGRAM,RAW}
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
PORT=$port
[HOST=$host]
[FROM_PORT=nnn] # SAM 3.2 or higher only, default 0
[TO_PORT=nnn] # SAM 3.2 or higher only, default 0
[PROTOCOL=nnn] # SAM 3.2 or higher only, for STYLE=RAW only, default 18
[option=value]* # I2CP options</pre>
The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], optionally followed by the [[en/docs/spec/common-structures#struct_OfflineSignature|Offline Signature]], which is 884 or more base 64 characters (663 or more bytes in binary), depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

Offline signatures are only supported for RAW datagrams. See the SESSION CREATE section above for details.

$host is the hostname or IP address of the datagram server to which SAM will forward datagrams. If not given, SAM takes the IP of the socket that issued the forward command.

$port is the port number of the datagram server to which SAM will forward datagrams. If $port is not set, datagrams will NOT be forwarded, they will be received on the control socket, in the v1/v2-compatible way.

Additional options given are passed to the I2P session configuration if not interpreted by the SAM bridge (e.g. outbound.length=0). These options [[#options|are documented below]].

Forwarded repliable datagrams are always prefixed with the destination. When a repliable datagram arrives, the bridge sends to the specified host:port a UDP packet containing the following data:

<pre> $destination
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
\n
$datagram_payload</pre>
Forwarded raw datagrams are forwarded as-is to the specified host:port without a prefix. The UDP packet contains the following data:

<pre> $datagram_payload</pre>
As of SAM 3.2, when HEADER=true is specified in SESSION CREATE, the forwarded raw datagram will be prepended with a header line as follows:

<pre> FROM_PORT=nnn
TO_PORT=nnn
PROTOCOL=nnn
\n
$datagram_payload</pre>
The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

=== SAM Anonymous (Raw) Datagrams ===

Squeezing the most out of I2P's bandwidth, SAM allows clients to send and receive anonymous datagrams, leaving authentication and reply information up to the client themselves. These datagrams are unreliable and unordered, and may be up to 32768 bytes.

Minimum size is 1. For best delivery reliability, recommended maximum size is approximately 11 KB.

After establishing a SAM session with STYLE=RAW, the client can send anonymous datagrams through the SAM bridge exactly the same way as [[v3dgsend|sending repliable datagrams]].

Both ways of receiving datagrams are also available for anonymous datagrams.

Received datagrams are written by SAM on the socket from which the datagram session was opened, if a forwarding PORT is not specified in the SESSION CREATE command. This is the v1/v2-compatible way of receiving datagrams.

<pre><- RAW RECEIVED
SIZE=$numBytes
FROM_PORT=nnn # SAM 3.2 or higher only
TO_PORT=nnn # SAM 3.2 or higher only
PROTOCOL=nnn # SAM 3.2 or higher only
\n
[$numBytes of data]</pre>
When anonymous datagrams are to be forwarded to some host:port, the bridge sends to the specified host:port a message containing the following data:

<pre> $datagram_payload</pre>
As of SAM 3.2, when HEADER=true is specified in SESSION CREATE, the forwarded raw datagram will be prepended with a header line as follows:

<pre> FROM_PORT=nnn
TO_PORT=nnn
PROTOCOL=nnn
\n
$datagram_payload</pre>
For an alternate method of sending anonymous datagrams, see [[#dgsend|RAW SEND]].

=== DATAGRAM SEND, RAW SEND (V1/V2 Compatible Datagram Handling) ===

In SAM V3, the preferred way to send datagrams is via the datagram socket at port 7655 as documented above. However, repliable datagrams may be sent directly via the SAM bridge socket using the DATAGRAM SEND command, as documented in [[sam|SAM V1]] and [[samv2|SAM V2]].

As of release 0.9.14 (version 3.1), anonymous datagrams may be sent directly via the SAM bridge socket using the RAW SEND command, as documented in [[sam|SAM V1]] and [[samv2|SAM V2]].

As of release 0.9.24 (version 3.2), DATAGRAM SEND and RAW SEND may include the parameters FROM_PORT=nnnn and/or TO_PORT=nnnn to override the default ports. As of release 0.9.24 (version 3.2), RAW SEND may include the parameter PROTOCOL=nnn to override the default protocol.

These commands do ''not'' support the ID parameter. The datagrams are sent to the most recently created DATAGRAM- or RAW-style session, as appropriate. Support for the ID parameter may be added in a future release.

=== MASTER Sessions (V3.3 and higher) ===

''Version 3.3 was introduced in I2P release 0.9.25.''

SAM v3.3 adds support for running streaming, datagrams, and raw subsessions on the same master session, and for running multiple subsessions of the same style. All subsession traffic uses a single destination, or set of tunnels. Routing of traffic from I2P is based on the port and protocol options for the subsessions.

To create multiplexed subsessions, you must create a master session and then add subsessions to the master session. Each subsession must have a unique id and a unique listen protocol and port. Subsessions may also be removed from the master session.

With a MASTER session and a combination of subsessions, a SAM client may support multiple applications, or a single sophisticated application using a variety of protocols, on a single set of tunnels. For example, a bittorrent client could set up a streaming subsession for peer-to-peer connections, together with datagram and raw subsessions for DHT communication.

==== Creating a MASTER Session ====

<pre>-> SESSION CREATE
STYLE=MASTER
ID=$nickname
DESTINATION={$privkey,TRANSIENT}
[option=value]* # I2CP and streaming options</pre>
The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]].

Do not set the PORT, HOST, FROM_PORT, TO_PORT, PROTOCOL, LISTEN_PORT, LISTEN_PROTOCOL, or HEADER options on a master session. You may not send any data on a MASTER session ID or on the control socket. All commands such as STREAM CONNECT, DATAGRAM SEND, etc. must use the subsession ID on a separate socket.

The MASTER session connects to the router and builds tunnels. When the SAM bridge responds, tunnels have been built and the session is ready for subsessions to be added. All [[en/docs/protocol/i2cp|I2CP]] options pertaining to tunnel parameters such as length, quantity, and nickname must be provided in the master's SESSION CREATE.

All utility commands are supported on a master session.

When the master session is closed, all subsessions get closed also.

==== Creating a Subsession ====

Using the same control socket on which the MASTER session was created:

<pre>-> SESSION ADD
STYLE={STREAM,DATAGRAM,RAW}
ID=$nickname # must be unique
[PORT=$port] # Required for DATAGRAM and RAW, invalid for STREAM
[HOST=$host] # Optional for DATAGRAM and RAW, invalid for STREAM
[FROM_PORT=nnn] # For outbound traffic, default 0
[TO_PORT=nnn] # For outbound traffic, default 0
[PROTOCOL=nnn] # For outbound traffic for STYLE=RAW only, default 18
[LISTEN_PORT=nnn] # For inbound traffic, default is the FROM_PORT value.
# For STYLE=STREAM, only the FROM_PORT value or 0 is allowed.
[LISTEN_PROTOCOL=nnn] # For inbound traffic for STYLE=RAW only.
# Default is the PROTOCOL value; 6 (streaming) is disallowed
[HEADER={true,false}] # For STYLE=RAW only, default false
[option=value]* # I2CP and streaming options</pre>
The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]]. As the tunnels were already built in the master SESSION CREATE, the SAM bridge should respond immediately.

Do not set the DESTINATION option on a SESSION ADD. The subsession will use the destination specified in the master session. All subsessions must be added on the control socket, i.e. the same connection that you created the master session on.

Multiple subsessions must have options sufficiently unique that incoming data can be routed correctly. In particular, multiple sessions of the same style must have different LISTEN_PORT options (and/or LISTEN_PROTOCOL, for RAW only). A SESSION ADD with listen port and protocol that duplicates an existing subsession will result in an error.

The LISTEN_PORT is the local I2P port, i.e. the receive (TO) port for incoming data. If the LISTEN_PORT is not specified, the FROM_PORT value will be used. If the LISTEN_PORT and FROM_PORT are not specified, incoming routing will be based on STYLE and PROTOCOL alone. For LISTEN_PORT and LISTEN_PROTOCOL, 0 means any value, that is, a wildcard. If both LISTEN_PORT and LISTEN_PROTOCOL are 0, this subsession will be the default for incoming traffic that does not get routed to another subsession. Incoming streaming traffic (protocol 6) will never be routed to a RAW subsession, even if its LISTEN_PROTCOL is 0. A RAW subsession may not set a LISTEN_PROTOCOL of 6. If there is no default or subsession that matching the protocol and port of incoming traffic, that data will be dropped.

Use the subsession ID, not the master session ID, for sending and receiving data. All commands such as STREAM CONNECT, DATAGRAM SEND, etc. must use the subsession ID.

All utility commands are supported on a master session or subsession. v1/v2 datagram/raw sending/receiving are not supported on a master session or on subsessions.

==== Stopping a Subsession ====

Using the same control socket on which the MASTER session was created:

<pre>-> SESSION REMOVE
ID=$nickname</pre>
This removes a subsession from the master session. Do not set any other options on a SESSION REMOVE. Subsessions must be removed on the control socket, i.e. the same connection that you created the master session on. After a subsession is removed, it is closed and may not be used to send or receive data.

The SAM bridge will respond with success or failure as in [[#sessionresponse|the response to a standard SESSION CREATE]].

=== SAM Utility Commands ===

Some utility commands require a pre-existing session and some do not. See details below.

==== Host Name Lookup ====

The following message can be used by the client to query the SAM bridge for name resolution:

<pre> NAMING LOOKUP
NAME=$name</pre>
which is answered by

<pre> NAMING REPLY
RESULT=$result
NAME=$name
[VALUE=$destination]
[MESSAGE=$message]</pre>
The RESULT value may be one of:

<pre> OK
INVALID_KEY
KEY_NOT_FOUND</pre>
If NAME=ME, then the reply will contain the destination used by the current session (useful if you're using a TRANSIENT one). If $result is not OK, MESSAGE may convey a descriptive message, such as "bad format", etc. INVALID_KEY implies that something is wrong with $name in the request, possibly invalid characters.

The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

NAMING LOOKUP does not require that a session has been created first. However, in some implementations, a .b32.i2p lookup which is uncached and requires a network query may fail, as no client tunnels are available for the lookup.

==== Destination Key Generation ====

Public and private base64 keys can be generated using the following message:

<pre>-> DEST GENERATE
[SIGNATURE_TYPE=value] # SAM 3.1 or higher only, default DSA_SHA1</pre>
which is answered by

<pre> DEST REPLY
PUB=$destination
PRIV=$privkey</pre>
As of version 3.1 (I2P 0.9.14), an optional parameter SIGNATURE_TYPE is supported. The SIGNATURE_TYPE value may be any name (e.g. ECDSA_SHA256_P256, case insensitive) or number (e.g. 1) that is supported by [[en/docs/spec/common-structures#type_Certificate|Key Certificates]]. The default is DSA_SHA1.

The $destination is the base 64 of the [[en/docs/spec/common-structures#type_Destination|Destination]], which is 516 or more base 64 characters (387 or more bytes in binary), depending on signature type.

The $privkey is the base 64 of the concatenation of the [[en/docs/spec/common-structures#type_Destination|Destination]] followed by the [[en/docs/spec/common-structures#type_PrivateKey|Private Key]] followed by the [[en/docs/spec/common-structures#type_SigningPrivateKey|Signing Private Key]], which is 884 or more base 64 characters (663 or more bytes in binary), depending on signature type. The binary format is specified in [http://echelon.i2p/javadoc/net/i2p/data/PrivateKeyFile.html Private Key File].

DEST GENERATE does not require that a session has been created first.

DEST GENERATE cannot be used to create a destination with offline signatures.

==== PING/PONG (SAM 3.2 or higher) ====

Either the client or server may send:

<pre> PING[ arbitrary text]</pre>
on the control port, with the response:

<pre> PONG[ arbitrary text from the ping]</pre>
to be used for control socket keepalive. Either side may close the session and socket if no response is received in a reasonable time, implementation dependent.

If a timeout occurs waiting for a PONG from the client, the bridge may send:

<pre><- SESSION STATUS RESULT=I2P_ERROR MESSAGE=$message</pre>
and then disconnect.

If a timeout occurs waiting for a PONG from the bridge, the client may simply disconnect.

PING/PONG do not require that a session has been created first.

==== QUIT/STOP/EXIT (SAM 3.2 or higher, optional features) ====

Commands QUIT, STOP and EXIT will close the session and socket. Implementation is optional, for ease in testing via telnet. Whether there is any response before the socket is closed (for example, a SESSION STATUS message) is implementation-specific and outside the scope of this specification.

QUIT/STOP/EXIT do not require that a session has been created first.

==== HELP (optional feature) ====

Servers may implement a HELP command. Implementation is optional, for ease in testing via telnet. Output format and detection of the end of the output is implementation-specific and outside the scope of this specification.

HELP does not require that a session has been created first.

==== Authorization Configuration (SAM 3.2 or higher, optional feature) ====

Authorization configuration using the AUTH command. A SAM server may implement these commands to facilite persistent storage of credentials. Configuration of authentication other than with these commands is implementation-specific and outside the scope of this specification.

* AUTH ENABLE enables authorization on subsequent connections
* AUTH DISABLE disables authorization on subsequent connections
* AUTH ADD USER="foo" PASSWORD="bar" adds a user/password
* AUTH REMOVE USER="foo" removes this user

Double quotes for user and password are recommended but not required. A double quote inside a user or password must be escaped with a backslash. On failure the server will reply with an I2P_ERROR and a message.

AUTH does not require that a session has been created first.

=== RESULT Values ===

These are the values that can be carried by the RESULT field, with their meaning:

<pre> OK Operation completed successfully
CANT_REACH_PEER The peer exists, but cannot be reached
DUPLICATED_DEST The specified Destination is already in use
I2P_ERROR A generic I2P error (e.g. I2CP disconnection, etc.)
INVALID_KEY The specified key is not valid (bad format, etc.)
KEY_NOT_FOUND The naming system can't resolve the given name
PEER_NOT_FOUND The peer cannot be found on the network
TIMEOUT Timeout while waiting for an event (e.g. peer answer)</pre>
=== Tunnel, I2CP, and Streaming Options ===

These options may be passed in as name=value pairs at the end of a SAM SESSION CREATE line.

All sessions may include [[en/docs/protocol/i2cp#options|I2CP options such as tunnel lengths]]. STREAM sessions may include [[en/docs/api/streaming#options|Streaming library options]]. See those references for option names and defaults.

=== BASE 64 Notes ===

Base 64 encoding must use the I2P standard Base 64 alphabet "A-Z, a-z, 0-9, -, ~".

=== Client Library Implementations ===

Client libraries are available for C, C++, C#, Perl, and Python. These are in the apps/sam/ directory in the [[en/download|I2P Source Package]]. Some may be older and have not been updated for SAMv3 support.

=== Default SAM Setup ===

The default SAM port is 7656. SAM is not enabled by default in the Java I2P Router; it must be started manually, or configured to start automatically, on the configure clients page in the router console, or in the clients.config file. The default SAM UDP port is 7655, listening on 127.0.0.1. These may be changed by adding the arguments sam.udp.port=nnnnn and/or sam.udp.host=w.x.y.z to the invocation.

Configuration in other routers is implementation-specific.

</div>

</div>
:::