Question about meshing

[Guus Sliepen]

On Fri, Jul 02, 2010 at 10:41:13PM +0200, Daniel Schall wrote:

> I am currently implementing the features I announced in May and I encounter
> a strange behavior:
> 
> Assuming we got three nodes, A, B and C.
> Nodes B and C both connect to node A.
[...]
> If node A goes down for some reason, node B and C cannot send meta packets
> to each other anymore and the nodes can't send UDP packets to each other any
> longer.
> 
> Why don't all nodes establish a meta connection to each
> other, so that a single node failure does not disconnect nodes?

This is indeed something that should be done. However, it requires a few
modifications that are not trivial:

- Nodes must exchange public RSA keys before they can set up a meta connection.
- There must be some access control mechanism so the administrator can
  selectively allow/disallow connections to other nodes.

Although this could be shoehorned into tinc 1.x, I want to do this more
properly in tinc 2.0. Of course, if anyone wants to implement this him or
herself, go ahead.

Another option would be to make session keys more long-lived, and not to drop
the direct UDP connection when the meta connections to the intermediate node go
down.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20100702/fb362650/attachment.pgp>