Server issues How to approach the design of servers.

Overview What protocol to use How to launch the server Multiple clients and scalability Concurrency Stateful or stateless Security and Authentication Machine compromise

Which protocol? TCP or UPD or BOTH! Recall connection-oriented vs connectionless Code to handle each type of connection is different Many other issues more significant TCP appears harder but don’t forget the benefits of TCP If you sacrifice TCP function, give it up because it is very difficult to pick and choose what to add back in at the application level

How to launch the server? Manually On boot By a master server (like inetd) At scheduled intervals For concurrency and scalability, –how to allocate to handle changes in demand by processes and threads –Spreading server DNS requests over a series of identical machines

Handling multiple clients! Write the code of the server to read multiple sockets (more to come) Iterate over the main loop –Allocating, serving and closing –Clients must wait Write code for single service and let inetd handle it Process or thread concurrency

Server State Leave it in the client whenever possible –minimize Keep the service as simple as possible Provide “keys” for access and then require the key for any service request Design recovery for failure scenarios where required Remember some designs run forever –Memory, data structures may/may not be recovered

Security and Authentication Access to your service may need to be limited Password strategies are part of the server Encryption is done at both client and server Limitation of access can also be handled through –Firewalls –OS software at the server

Machine Compromise Server exploitation is a primary means of machine compromise Many attacks utilize unexpected input to create strange program behavior leading in turn to an abort and then unintended access Requires careful coding and/or careful net configuration to limit impact on other machines and services in the event of the exploitation.

Basic “Comer” Design Categories Iterative Connectionless Iterative Connection-oriented Concurrent Connectionless Concurrent Connection-oriented SEE CODE EXAMPLES

Concurrency See slides for concurrency Process level Thread level