Does OpenZiti support DTLS?

1

Does OpenZiti support DTLS? If you could point me to relevant documentation, that would be very helpful.

1 Like
2

I don't believe we claim to support DTLS per-se, however, OpenZiti allows you to tunnel UDP or TCP connections and implements end to end encryption for both TCP and UDP between the source and destination identities.

If you establish your own DTLS connection OVER OpenZiti, I would expect it to work properly but this is the application protocol, not OpenZiti... If that makes sense? It'd be similar to how OpenZiti allows TLS over OpenZiti I would think, and that works perfectly.

So if your question is, can OpenZiti secure UDP datagrams, I would respond with "yes" between the source and destination identity. Is that DTLS, no I don't believe so, it's done with libsodium.

That make sense and answer the question sufficently?

3

Thanks for your reply! I understand Ziti doesn't have built-in support for DTLS but does have the ingredients to build that support on.

With that in mind, I have a follow up question: when UDP transport is selected, does Ziti deliver the payloads end-to-end as UDP; or, is UDP only at the entry and exit points and the payload is delivered as TCP within the mesh?

4

Current SDK <-> router and router <-> router traffic is TCP-based. One of our goals is to allow for UDP-based transports (likely using DTLS) for those connections. Some initial work has been done, but there's more to do before it will be a good replacement.

Cheers,
Paul

1 Like
5

Sounds good, thank you!

1 Like
6

This is a copy of my two questions regarding ziti/zrok.

  1. Does Ziti 1.6.x support binding to a specific IPv6 address or an interface?
  2. Does Ziti 1.6.x router support DTLS ?
7

re: IPv6 - ipv6 Transport Address Parsing · Issue #31 · openziti/transport · GitHub
re: DTLS - It will probably work, but at least for the we scenarios tested, we didn't see any performance gains. You're welcome to try it and feel free to share any interesting results from your tests.

Paul

8

Of course, if TCP works properly, there is no performance gain. However, when TCP packets are fragmented and fragments are heavily dropped, the TCP window will shrink dramatically (sometimes to around 500 bytes). In such conditions, DPI throttles TCP connections, making TLS effectively unusable.

Regrettably, TCP performance is strongly dependent on network conditions. In degraded environments, UDP-based transport may perform better.

9

Is it possible to specify a network interface in order to capture IPv6 & IPv4 packets on that particular interface?

10

In what context? Using a tunneler? One of the configurable listeners or dialers on the controller or router?