tinc - Jul 2010 - Question about meshing

Hi all,

 

I am currently implementing the features I announced in May and I encounter
a strange behavior:

 

Assuming we got three nodes, A, B and C.

Nodes B and C both connect to node A.

A notifies both nodes about each other's UDP endpoints and B & C start
communicating directly (not via A).

So far so good.

 

If node A goes down for some reason, node B and C cannot send meta packets
to each other anymore and the nodes can't send UDP packets to each other any
longer.

 

My question is:

                Why don't all nodes establish a meta connection to each
other, so that a single node failure does not disconnect nodes?

 

I think the "ConnectTo" statement should only be needed in the
beginning,
when an initial connection to the VPN is made.

After that, I suggest a full-mesh should be established between all nodes,
that can reach each other directly.

 

 

Best,

 

Daniel

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20100702/ebf24544/attachment.htm>

On Fri, Jul 02, 2010 at 10:41:13PM +0200, Daniel Schall wrote:
> I am currently implementing the features I announced in May and I encounter
> a strange behavior:
> 
> Assuming we got three nodes, A, B and C.
> Nodes B and C both connect to node A.
[...]
> If node A goes down for some reason, node B and C cannot send meta packets
> to each other anymore and the nodes can't send UDP packets to each
other any
> longer.
> 
> Why don't all nodes establish a meta connection to each
> other, so that a single node failure does not disconnect nodes?
This is indeed something that should be done. However, it requires a few
modifications that are not trivial:

- Nodes must exchange public RSA keys before they can set up a meta connection.
- There must be some access control mechanism so the administrator can
  selectively allow/disallow connections to other nodes.

Although this could be shoehorned into tinc 1.x, I want to do this more
properly in tinc 2.0. Of course, if anyone wants to implement this him or
herself, go ahead.

Another option would be to make session keys more long-lived, and not to drop
the direct UDP connection when the meta connections to the intermediate node go
down.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20100702/fb362650/attachment.pgp>

How far did you get with tinc 2.0 already?

 

I'd be eager to implement a full-mesh capability, but if you plan to release
v2 shortly, I don't think it's worth the effort.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20100704/8e4d39dc/attachment.htm>