Maybe you should put this up on github so everyone can use it rather than just talking about how easy it is?
The link to the source code is in the middle of the article, jeez: https://github.com/superfly/flyctl/pull/368
SSH and User-Mode IP WireGuard
31–40 of 104 posts
Re: SSH and User-Mode IP WireGuard
#32I know it's not really an HN thing to say, but this is just cool . Reverse ssh tunnels on Wireguard through my VPN are cool enough; the amount of magic here (albeit I think perhaps not totally strictly required magic…) is definitely interesting++.
It should be an HN thing to say. Unrestrained positivity is much more fun than kneejerk cynicism. :D
Re: SSH and User-Mode IP WireGuard
#33I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…
I hope people can mentally generalize this enthusiasm for user-mode wireguard in order to understand the value proposition of QUIC.
Re: SSH and User-Mode IP WireGuard
#34Not having been previously familiar with fly's network setup, I gotta say I find it delightful; derived-prefix IPv6 + WG to give you basically static routing + ability to auth on IP is very elegant. I've actually been working on a toy stupid-simple clustering thing that does something similar, and I'm absolutely going to steal the userspace tcp stack over wireguard thing for API access.
Re: SSH and User-Mode IP WireGuard
#35I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…
I hope people can mentally generalize this enthusiasm for user-mode wireguard in order to understand the value proposition of QUIC.
QUIC was my plan B for this feature. :)
Re: SSH and User-Mode IP WireGuard
#36Earlier quoted context omitted.
Is this sort of like what MS is doing with Windows Subsystem for Linux, where they're able to "boot" that Linux in mere seconds? By the way, as an elixir developer Fly.io looks extremely cool. But my (mostly public sector) customers want to hear something similar to the words "AWS" when asked about hosting – so is it running on top of AWS or Azure or GCP? (instances look like they may be GCP, which is fine too).
It runs on our own hardware. There's no AWS or GCP beneath it.
Ok thanks – this has been one of the rare things that some of those clients seem to care about (whether they're right or wrong, or rather, more conservative).
I had another question – this seems similar to what Hashicorp is doing with Boundary. Have you looked at Boundary and how this potentially compares with that, from an architecture standpoint? Of course there are parts of this that are bespoke to your infrastructure, but I'm just more curious from a nerdy-aspect of it because we're evaluating boundary as a replacement to our current setup (Wireguard bastion host), for all the other benefits like auth and logging.
Re: SSH and User-Mode IP WireGuard
#37Earlier quoted context omitted.
It runs on our own hardware. There's no AWS or GCP beneath it.
Ok thanks – this has been one of the rare things that some of those clients seem to care about (whether they're right or wrong, or rather, more conservative). I had another question – this seems similar to what Hashicorp is doing with Boundary. Have you looked at Boundary and how this potentially compares with that, from an architecture standpoint? Of course there are parts of this that are bespoke to your infrastruc…
There is a lot of Hashi in our stack already; we orchestrate with Nomad (we have our own Firecracker task driver), we backend our certificate system --- which is awesome, certificates just work for Fly apps --- with Vault, and we use a lot of Consul.
I think our take on end-user access management is lower-level than what Boundary is trying to do. Boundary, as I understand it, sees the world the way an IdP RP does, mostly in terms of bearer tokens. We see stuff as infrastructure; a static configuration on an EC2 instance or a CI container; "just Unix". If we weren't building a PAAS, we'd probably lean much more strongly towards Boundary's way of looking at things.
As well, we care about minimizing and understanding as much of the code we expose as possible. For all the talking I've done about SSH here, the serverside of this feature is just a couple hundred lines of code; it is dwarfed by the clientside code. I couldn't say that about a Hashi product. (HashiCorp could though!)
Re: SSH and User-Mode IP WireGuard
#38Running networking stacks in user mode really opens up a lot of interesting solutions. Wireguard is sort of an enabling technology for this.
Just realized this was written by security guru tptacek, nice. What is the contextual meaning of “AFFIANT SAYS NOTHING FURTHER.”?
Re: SSH and User-Mode IP WireGuard
#39I read this but I didn't get it at all. I can't see the forest for all the excited talk about particular trees. In simple words, what problem are they trying to solve?
You need WireGuard to SSH to machines at Fly (that's a good thing). You don't have WireGuard installed on a particular machine. That's OK, because there's a portable, userland, Golang implementation of not only WireGuard but all of TCP/IP that can be imported into any Go program. Go programs can BYO network stacks. That's crazy. The end.
Still seems like a downgrade for actual users... I just want to be able to type ssh instance7.service.zone.user.fly.io into my console, and be connected... I don't actually care about compiling my own custom ssh client written in go, however neat its implementation might be...
Re: SSH and User-Mode IP WireGuard
#40Earlier quoted context omitted.
You need WireGuard to SSH to machines at Fly (that's a good thing). You don't have WireGuard installed on a particular machine. That's OK, because there's a portable, userland, Golang implementation of not only WireGuard but all of TCP/IP that can be imported into any Go program. Go programs can BYO network stacks. That's crazy. The end.
Still seems like a downgrade for actual users... I just want to be able to type ssh instance7.service.zone.user.fly.io into my console, and be connected... I don't actually care about compiling my own custom ssh client written in go, however neat its implementation might be...
That's how it works now! You just have to setup wireguard first. You don't need to compile anything.
This userland wireguard project was helpful for making "flyctl run console" work.