ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.5.pod (file contents):
Revision 1.4 by pcg, Thu Jan 27 07:02:18 2005 UTC vs.
Revision 1.5 by pcg, Tue Feb 22 23:00:57 2005 UTC

… …
3GNU-VPE - Overview of the GNU Virtual Private Ethernet suite. 3GNU-VPE - Overview of the GNU Virtual Private Ethernet suite.
4 4
5=head1 DESCRIPTION 5=head1 DESCRIPTION
6 6
7GVPE is a suite designed to provide a virtual private network for multiple 7GVPE is a suite designed to provide a virtual private network for multiple
8nodes over an untrusted network. 8nodes over an untrusted network. This document first gives an introduction
9to VPNs in general and then describes the specific implementation of GVPE.
10
11=head2 WHAT IS A VPN?
12
13VPN is an acronym, it stands for:
9 14
10=over 4 15=over 4
11 16
12=item X<Virtual> 17=item X<Virtual>
13 18
14Virtual means that no physical network is created (of course), but an 19Virtual means that no physical network is created (of course), but a
15ethernet is emulated by creating multiple tunnels between the member 20network is I<emulated> by creating multiple tunnels between the member
21nodes by encapsulating and sending data over another transport network.
22
23Usually the emulated network is a normal IP or Ethernet, and the transport
24network is the Internet. However, using a VPN system like GVPE to connect
25nodes over other untrusted networks such as Wireless LAN is not uncommon.
26
27=item X<Private>
28
29Private means that non-participating nodes cannot decode ("sniff)" nor
30inject ("spoof") packets. This means that nodes can be connected over
31untrusted networks such as the public Internet without fear of being
32eavesdropped while at the same time being able to trust data sent by other
16nodes. 33nodes.
17 34
18=item X<Private>
19
20Private means that non-participating nodes cannot decode ("sniff)" nor
21inject ("spoof") packets.
22
23In the case of gvpe, even participating nodes cannot sniff packets send to 35In the case of GVPE, even participating nodes cannot sniff packets
24other nodes or spoof packets as if sent from other nodes. 36send to other nodes or spoof packets as if sent from other nodes, so
37communications between any two nodes is private to those two nodes.
25 38
26=item X<Network> 39=item X<Network>
27 40
28Network means that more than two parties can participate in the network, 41Network means that more than two parties can participate in the network,
29so for instance it's possible to connect multiple branches of a company 42so for instance it's possible to connect multiple branches of a company
30into a single network. Many so-called "vpn" solutions only create 43into a single network. Many so-called "vpn" solutions only create
31point-to-point tunnels. 44point-to-point tunnels, which in turn can be used to build larger
45networks.
46
47GVPE provides a true multi-point network in wich any number of nodes (at
48least a few dozen in practise, the theoretical limit is 4095 nodes) can
49participate.
32 50
33=back 51=back
34 52
35=head2 DESIGN GOALS 53=head2 GVPE DESIGN GOALS
36 54
37=over 4 55=over 4
38 56
39=item SIMPLE DESIGN 57=item SIMPLE DESIGN
40 58
41Cipher, HMAC algorithms and other key parameters must be selected 59Cipher, HMAC algorithms and other key parameters must be selected
42at compile time - this makes it possible to only link in algorithms 60at compile time - this makes it possible to only link in algorithms
43you actually need. It also makes the crypto part of the source very 61you actually need. It also makes the crypto part of the source very
44transparent and easy to inspect. 62transparent and easy to inspect, and last not least this makes it possible
63to hardcode the layout of all packets into the binary. GVPE goes a step
64further and internally reserves blocks of the same length for all packets,
65which virtually removes all possibilities of buffer overflows, as there is
66only a single type of buffer and it's always of fixed length.
45 67
46=item EASY TO SETUP 68=item EASY TO SETUP
47 69
48A few lines of config (the config file is shared unmodified between all 70A few lines of config (the config file is shared unmodified between all
49hosts) and a single run of C<gvpectrl> to generate the keys suffices to 71hosts) and a single run of C<gvpectrl> to generate the keys suffices to

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines