Re: DTLS server implementation experiences and documentation

2009-02-10 Thread Wes Hardaker
> On Thu, 22 Jan 2009 06:10:36 +0100, Robin Seggelmann > said: RS> To avoid getting into trouble with already fixed bugs you should apply RS> the patches I sent to the dev list. I'll set up a website with a patch RS> collection and some instructions soon. You've certainly posted a lot!

Re: DTLS server implementation experiences and documentation

2009-02-10 Thread Wes Hardaker
> On Mon, 26 Jan 2009 18:19:02 +0100, Daniel Mentz said: DM> I have some comments regarding your wiki article. But first of all DM> thanks for taking the time writing down all this information: Your welcome, and I'm sorry for taking so long to reply to your note... I was both sick for a week

Re: DTLS server implementation experiences and documentation

2009-01-27 Thread Robin Seggelmann
On Jan 26, 2009, at 5:24 PM, Daniel Mentz wrote: I'm surprised that you can use accept() on UDP sockets. I checked the man pages of a Debian GNU/Linux system. They say that you can use accept() only with connection-based socket types (SOCK_STREAM, SOCK_SEQPACKET). Is this something specifi

Re: DTLS server implementation experiences and documentation

2009-01-26 Thread Daniel Mentz
Wes Hardaker wrote: http://www.net-snmp.org/wiki/index.php/DTLS_Implementation_Notes Hi Wes, I have some comments regarding your wiki article. But first of all thanks for taking the time writing down all this information: I'm trying to implement IPFIX on top of DTLS so I also made some ex

Re: DTLS server implementation experiences and documentation

2009-01-26 Thread Daniel Mentz
Robin Seggelmann wrote: As a workaround you can use connected UDP sockets. Just use accept() and connect() as you would with TCP connections and create new BIO and SSL objects for every connection. I have tested that and it works pretty well so far. Hi Robin, I'm surprised that you can use a

Re: DTLS server implementation experiences and documentation

2009-01-24 Thread David Woodhouse
On Sat, 2009-01-24 at 23:03 +0100, Georges Le grand wrote: > So it is alike SSL VPN with data encapsulated into HTTP Packets, but I > don't get how does HTTP run over UDP. Probably best explained by the code... it just uses HTTP for the initial setup -- a CONNECT request with an HTTP cookie for au

Re: DTLS server implementation experiences and documentation

2009-01-24 Thread Georges Le grand
Dear David, Thanks for the reply. So it is alike SSL VPN with data encapsulated into HTTP Packets, but I don't get how does HTTP run over UDP. Kind regards GLG 2009/1/24 David Woodhouse > On Sat, 2009-01-24 at 00:13 +0100, Georges Le grand wrote: > > I wonder if you could give out a reference

Re: DTLS server implementation experiences and documentation

2009-01-24 Thread David Woodhouse
On Sat, 2009-01-24 at 00:13 +0100, Georges Le grand wrote: > I wonder if you could give out a reference on how to establish a VPN > using DTLS or to tell how to do so. We are just using Cisco's "AnyConnect" VPN, which runs over an HTTPS 'CONNECT' and will use DTLS for subsequent data transfer if i

Re: DTLS server implementation experiences and documentation

2009-01-23 Thread Georges Le grand
Hello David, I wonder if you could give out a reference on how to establish a VPN using DTLS or to tell how to do so. Kind regards, GLG On Thu, Jan 22, 2009 at 7:47 AM, David Woodhouse wrote: On Thu, 2009-01-22 at 06:10 +0100, Robin Seggelmann wrote: > > To avoid getting into trouble with alr

Re: DTLS server implementation experiences and documentation

2009-01-23 Thread Wes Hardaker
> On Thu, 22 Jan 2009 06:10:36 +0100, Robin Seggelmann > said: RS> As a workaround you can use connected UDP sockets. Just use accept() RS> and connect() as you would with TCP connections and create new BIO and RS> SSL objects for every connection. I have tested that and it works RS> pre

Re: DTLS server implementation experiences and documentation

2009-01-22 Thread Robin Seggelmann
On Jan 22, 2009, at 5:11 PM, Wes Hardaker wrote: RS> As a workaround you can use connected UDP sockets. Just use accept() RS> and connect() as you would with TCP connections and create new BIO and RS> SSL objects for every connection. I have tested that and it works RS> pretty well so far.

Re: DTLS server implementation experiences and documentation

2009-01-22 Thread Wes Hardaker
> On Thu, 22 Jan 2009 06:10:36 +0100, Robin Seggelmann > said: RS> As a workaround you can use connected UDP sockets. Just use accept() RS> and connect() as you would with TCP connections and create new BIO and RS> SSL objects for every connection. I have tested that and it works RS> pre

Re: DTLS server implementation experiences and documentation

2009-01-21 Thread Robin Seggelmann
On Jan 22, 2009, at 7:47 AM, David Woodhouse wrote: Is there anyone who actually cares about DTLS and getting patches applied? Very good question. I hope someone will apply at least the bugfixes soon. I have several patches adding new features in the pipe, but they understandably rely on

Re: DTLS server implementation experiences and documentation

2009-01-21 Thread David Woodhouse
On Thu, 2009-01-22 at 06:10 +0100, Robin Seggelmann wrote: > > To avoid getting into trouble with already fixed bugs you should apply > the patches I sent to the dev list. I'll set up a website with a patch > collection and some instructions soon. Is there anyone who actually cares about DTLS

Re: DTLS server implementation experiences and documentation

2009-01-21 Thread Robin Seggelmann
Hi Wes, The biggest issue comes from needing to deal with multiple clients trying to talk through the same UDP port, which isn't handled by at least the 0.9.8i code at least. Using multiple connections with one socket is still not implemented as the OpenSSL architecture and API does not supp