Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH and User-Mode IP WireGuard

fly.io

Post reply on HN
Print view View original

71–80 of 104 posts

Re: SSH and User-Mode IP WireGuard

#71

Post by tptacek »

anderspitman wrote: post #67
tptacek wrote: post #2

I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…

> The whole thing is kind of a vindication for Go's standard library network interface, which I have always hated. Curious about this. I've generally found Go's net libs to be pretty pleasant. Can you compare/contrast it with others you like better?

I'm just a 1990s BSD sockets, write-my-own-select-loop kind of programmer; the idea of an abstract `Dial` interface always seemed like just a performative Plan-9-ism (I assume?).

Anyways. Wrong about that one! Movin' on!

Re: SSH and User-Mode IP WireGuard

#72

Post by ficklepickle »

xbar wrote: post #69
tptacek wrote: post #51

Earlier quoted context omitted.

Yes! This person gets it.

I'm a fan of the writing style. It reminds of smart people I know. I haven't bought any fly.io yet, so I don't know that I'm you're target market. Still--well said, repeatedly.

I've had a fly.io tab open for months. I haven't had time to use it yet, but something in me won't let me close that tab.

Re: SSH and User-Mode IP WireGuard

#73

Post by anderspitman »

ignoramous wrote: post #70
anderspitman wrote: post #62

Earlier quoted context omitted.

Don't want to go OT but I'm super curious what your experience developing a network application for non-root Android devices has been? As a non-Android developer, I've been working on a project the last few months that involves running an HTTP server on the device and tunneling out so it can receive requests from the outside world, and the platform feels nerfed at every level from filesystem access to keeping your se…

> ...and the platform feels nerfed at every level Android development is a bit tedious relatively compared to iOS due to having to support multiple API levels and having to account for subtleties across OEM implementations, but things have drastically improved in the last few years, especially after Oreo (Android 8). > ...from filesystem access Watch out for tutorials still recommending workarounds that aren't necess…

Oh iOS is way worse from what I can tell. I don't consider it a viable computing platform so haven't bothered trying to make my software run there.

But Android seems to be working hard to "catch up" to iOS.

I'm mostly comparing to native Linux development. Obviously you may need to make some changes for security, but I feel like they've gone way overboard with things like forcing the storage access framework/media storage APIs, killing even foreground services (doze mode etc), and so on.

At the end of the day, if you're using software to purposefully limit what hardware is capable of, I think that's wrong. Even if you're worried about security, add a simple escape hatch for power users.

Re: SSH and User-Mode IP WireGuard

#74

Post by anderspitman »

tptacek wrote: post #71
anderspitman wrote: post #67

Earlier quoted context omitted.

> The whole thing is kind of a vindication for Go's standard library network interface, which I have always hated. Curious about this. I've generally found Go's net libs to be pretty pleasant. Can you compare/contrast it with others you like better?

I'm just a 1990s BSD sockets, write-my-own-select-loop kind of programmer; the idea of an abstract `Dial` interface always seemed like just a performative Plan-9-ism (I assume?). Anyways. Wrong about that one! Movin' on!

Fair enough.

Re: SSH and User-Mode IP WireGuard

#75

Post by aleph- »

tptacek wrote: post #65
ash wrote: post #63

Earlier quoted context omitted.

I think I got it now! I was confused because Tailscale does not bring its own userland TCP/IP. It can - as a VPN solution - rely on OS-provided TCP/IP stack, but you wanted to avoid having to hook up flyctl into OS as a virtual network interface, right?

I think you've got it. Tailscale is installing WireGuard . You have to have privileges to install Tailscale. They can tell the OS to route packets through their virtual interface. We could too! This is all in `wireguard-go`. But we'd have to prompt users to escalate privileges every time they tried to SSH somewhere (or, worse, install a long-term resident thingy, just to SSH to things ). We don't want to own your VPN…

So I'm curious are there any good documentation available for using wireguard-go as a lib? Or is it just read the source and also read through flyctl source?

Curious about fiddling with something similar with firecracker at home.

Think it'd be neat to spin up bespoke micro-vm's with wireguard enabled.

Re: SSH and User-Mode IP WireGuard

#76

Post by russdill »

anderspitman wrote: post #61

This is fantastic. I maintain a list[0] of tunneling software. One of the few downsides of WireGuard is the inability to run it in unprivileged situations. The complexity and performance overhead here might still be too much to edge out solutions like SSH tunnels, but I love that the space is being explored. I'm hopeful we'll also see some robust QUIC-based tunneling tools over the next couple years. [0]: https://git…

tunsocks[0] might be of interest to you. It's very similar to the software mentioned by OP except in C. It uses the lwIP usermode tcp/ip stack. It doesn't itself have any VPN or tunneling support, but instead relies on raw packets being passed into and out of a pipe. It can then provide access to that network via various proxies, port forwards, and even raw packets via NAT (very useful for VMs).

[0]: https://github.com/russdill/tunsocks

Re: SSH and User-Mode IP WireGuard

#77

Post by tptacek »

ficklepickle wrote: post #72
xbar wrote: post #69

Earlier quoted context omitted.

I'm a fan of the writing style. It reminds of smart people I know. I haven't bought any fly.io yet, so I don't know that I'm you're target market. Still--well said, repeatedly.

I've had a fly.io tab open for months. I haven't had time to use it yet, but something in me won't let me close that tab.

I wish I could tell you it would eat a bunch of your time, engaging your curiosity and sense of wonder all the way, but really what's going to happen is you're going to install `flyctl`, go somewhere with a Dockerfile, do `flyctl app create` and then `flyctl app deploy` and it's going to just work. :)

Re: SSH and User-Mode IP WireGuard

#78

Post by omribahumi »

tptacek wrote: post #51
closeparen wrote: post #49

This is such an interesting marketing strategy, I had never thought of selling B2B production infrastructure under the aesthetic of, “Can you believe this shit actually works?”

Yes! This person gets it.

Have you considered using ssh command's ProxyCommand option? It allows you to replace the TCP transport with communication over stdin/stdout.

It could help you replace the TUN with something more cross platform, and possibly with less overhead. You can pass in the hostname using %h, so you can even have virtual DNS.

Re: SSH and User-Mode IP WireGuard

#79

Post by tptacek »

omribahumi wrote: post #78
tptacek wrote: post #51

Earlier quoted context omitted.

Yes! This person gets it.

Have you considered using ssh command's ProxyCommand option? It allows you to replace the TCP transport with communication over stdin/stdout. It could help you replace the TUN with something more cross platform, and possibly with less overhead. You can pass in the hostname using %h, so you can even have virtual DNS.

How does that help us here? Without WireGuard, there's no channel with which you can talk to a Fly Hallpass instance, by design.
Post reply on HN