Generic Connection Brokering (GCB)

Authors: S. Son, M. Livny. Currently maintained by the Condor Project team.

Affiliation: University of Wisconsin at Madison

License: Condor Public License. Source available.

Official site: GCB home page

Generic Connection Brokering enables firewall traversal by decoupling the direction in which connections are made between clients and servers. A brokering system arranges which party should initiate the communication, based on the network configuration of each party.

In the traditional Berkeley socket system a connection is always established from the client to the server, however when the server is placed behind a firewall it usually cannot receive incoming connections. GCB implements an intermediate layer between the application software and the Berkeley sockets and it reverses the direction of the connection without application's notice. GCB broker decides, based on the network situation of the client and the server, who should actively connect and arranges accordingly. If neither can connect to the other, because for example they are both inside a protected network, both parties connect to the GCB broker and it relays packets between them.

GCB requires that applications be linked with GCB libraries. Applications linked against GCB should have no change in their behavior until the GCB functionality is specifically enabled. GCB aims to provide semantics as close to Berkeley sockets as possible, but some applications will require minor modifications to take advantage of GCB's functionality. All connections using GCB require contacting the broker, either to negotiate a connection or to use the provided relay. (Client can still directly contact the server, but will not get the firewall transversing capability of GCB.) To support GCB getsockname() returns the IP address of the broker, not the server. The server is expected to trasmit this address to potential clients using existing advertising functionality.

It is possible for a GCB-enabled server hidden behind a firewall to be contacted by a non-GCB enabled client. In this case all communications are relayed by the broker.

An extended discussion of how GCB works is available here.

GCB requires one or more "brokers" to handle negotiating and relaying connections. All machines involved need to be able to make outgoing connections to the broker.

GCB is in use by several groups using Condor's "glide-in" functionality to create dynamic Condor pools of hundreds of machines on top of existing grids.