tinc - Jan 2005 - Designing Tinc with Threads and Groups

Hello All,

I have been trying to get a feel for the Tinc sources because I would like
to see about developing a version of Tinc that uses threads and also
incorporated the idea of groups so that when a user starts up their daemon
they can join one or more groups.

I know that you can establish multiple "networks" on a single daemon,
but
from what I understand, you also have to have multiple TAP devices as
well. Could be wrong here.

Any ideas or suggestions would be greatly appreciated.

thanks
Lonnie

On Sun, Jan 16, 2005 at 03:33:13PM -0500, lonnie@outstep.com wrote:
> I have been trying to get a feel for the Tinc sources because I would like
> to see about developing a version of Tinc that uses threads and also
> incorporated the idea of groups so that when a user starts up their daemon
> they can join one or more groups.
> 
> I know that you can establish multiple "networks" on a single
daemon, but
> from what I understand, you also have to have multiple TAP devices as
> well. Could be wrong here.
Currently tinc is designed for one "network" and one TAP device per
daemon. You could indeed create a daemon that could connect to multiple
networks and use only a single TAP device, or that connects to a single
network and splits traffic over multiple TAP devices, or anything
inbetween. But if you have multiple groups which, I assume, have no
trust relationships with eachother, it would be a security risk to let a
single daemon connect to more than one of them at the same time; either
a bug in the software could cause packets from one group to go to
another, or a mistake in the configuration could connect two groups
together. If you'd ask any security expert[1] they'd tell you it would
be a bad idea.

About threads: it could help in some situations (authenticating new
connections is something that takes a considerably amount of time that
introduces delays in normal packet processing), but on the other hand
you have locking to think of and the cost of starting/stopping threads
(which is very cheap on Linux with NPTL, but could be expensive on other
OSs). So, is the added complexity really worth any gain you would get?


[1] Except Peter Gutmann, he will hit you with penis-shaped soundwaves.

-- 
Met vriendelijke groet / with kind regards,
    Guus Sliepen <guus@sliepen.eu.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://brouwer.uvt.nl/pipermail/tinc/attachments/20050120/3533d33a/attachment.pgp