Yggdrasil Network

The first thing I tried to find on their website and their GitHub was a protocol specification, to be able to implement it independently from the reference implementation. I thought this would be straightforward since it’s advertised as a scheme/protocol, but such a spec isn’t referenced anywhere! Digging on my own I eventually found [1] on a side-branch of one of their other GitHub projects.

Kudos to the author: I think it actually covers a lot of what you’d need to know: crypto identities, message formats, wire protocols, peering and stream semantics, spanning tree updates and root selection, the DHT, forwarding logic, sessions, etc. A couple things are TODOs like how to verify and sign root updates, and there’s some ambiguity in the tiebreaker algorithm for next-hop selection.

It seems to be very tightly coupled to TCP as the transport layer though, since all packets need to be delivered reliably and in the order they were sent, and need to be capable of being fragmented into smaller packets for varying MTU sizes.

[1] https://github.com/yggdrasil-network/yggdrasil-specs/blob/ys...

We did spend a little bit of time documenting the earlier v0.3 protocol, as you have linked, but the protocol has changed significantly in design twice since then. v0.4 changed the DHT quite a bit and v0.5 removed the DHT altogether. As a research project it likely will continue to change until we settle on a design we are happier with, at which point we will definitely spend more time documenting it.

The need for ordered/reliable links is mostly for convenience of development at this stage, but that can be fixed for sure.

Is coupling with TCP a problem? Does it do anything that goes against their goal of full decentralization?

Makes it hard to do hole punching I think? At any rate, direct connections currently cannot be established between multi-hop peers, traffic gets routed through peers instead. I think this has something to do with the TCP choice.

Look at https://arxiv.org/pdf/1502.06461 if you want to try a chord dht again.

Kademlia is a lot less intuitive, but by not ever assuming it's tables are correct, it handles and corrects inconsistency (and malicious nodes) better.

Chapter 6 of this pile of (my) crap https://scholarworks.gsu.edu/cs_diss/106/ talks about doing latency optimization on dht routing. Basically just embedding then network graph into a metric space.

Yeaaah. TCP hole punching is goofy and unreliable, last I checked. You have to do some arcane ritual of having both peers start a three-way handshake to each others’s public endpoints simultaneously, relying on NATs to accept inbound SYN packets if they match the outgoing SYN. And nobody’s NAT devices implement simultaneous-open the same way, so all your connections just fail.

Naturally this leads to slapping even more arcane fixes on top of that, like NAT port assignment oracles to adversarial interoperate with different port allocation strategies (random, sequential, single, etc.) by analyzing patterns in previous port assignments. Networking sucks.

I think this is a pragmatic choice. NAT Hole Punching can be hit or miss no matter the method but doing peer routing guarantees even a client that can only initiate outbound connections can route packets. It can be slow though.

I also know there's support for other transports like QUIC but TCP is the main default.

> At any rate, direct connections currently cannot be established between multi-hop peers, traffic gets routed through peers instead. I think this has something to do with the TCP choice.

Yggdrasil is designed for physical links and multi-hop routing first and foremost. Internet peering is just a way to test/use/join the network until then.

Some documentation can help with those issues though. I find it helps more because you’re writing to yourself why you’re making certain decisions and it helps when you decide to make others. It just so happens that it’s also a great way to onboard people.

I'd love if my private nodes could peer directly so I wouldn't need to route all traffic through my budget VPs.

Actuate

If only there was some technology that would allow every peer to have its globally unique address, making direct connections only a matter of firewalls.

I don't know, something like IPv4, but with more addresses...

I presume you meant to say "Accurate", but it made me think of a off-brand Picard that says "Actuate" instead of "Engage".

If the new technology referenced in the comic provides a way to securely connect, including auditing, I don't see how it applies to the hole punching hack.

People (like ISPs offering routers) set up NAT, often justifying it on the basis of security. Application developers use hole-punching techniques to get past NAT (including stuff like UPnP that requires cooperation from the NAT).

The end product is:

#1 A sandboxing system that cannot reliably sandbox.

#2 A connection system that cannot reliably connect.

So now you have two problems.

Both tailscale (partially open source) and nebula (entirely open source, you have to host the "lighthouses" which assist in NAT punching yourself) do this. (Also tinc.)

Yggdrasil is basically researching a replacement for BGP, so hole punching isn't a priority. (There is a 3rd party project that does something like this for Yggdrasil, but nebula is probably the better fully open source option.)

NAT is not a security measure but a way to save on IP space or avoid remaking a topology on network addresses changes. For actual security you need a firewall

On ygg as long as the nodes are reachable they can peer. If your nodes are on LAN just turn on multicast peering it's fire and forget.