Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH and User-Mode IP WireGuard

fly.io

Post reply on HN
Print view View original

91–100 of 104 posts

Re: SSH and User-Mode IP WireGuard

#91

Post by ignoramous »

prattmic wrote: post #56
tptacek wrote: post #2

I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…

This is awesome! In the post you mention "For a couple hundred lines of code (not counting the entire user-mode Linux you’ll be pulling in from gVisor, HEY! Dependencies! What are you gonna do!) ..." I'll note that while all of gVisor's user-mode Linux is in the same Go module, we've actually gone to decent lengths to keep the network stack logically separate from the rest of the user-mode Linux code. So while go.sum…

Wait... What is depaware? How do I use it to make sense of go.sum in my projects?

Re: SSH and User-Mode IP WireGuard

#92

Post by aleph- »

mrkurt wrote: post #90
aleph- wrote: post #75

Earlier quoted context omitted.

So I'm curious are there any good documentation available for using wireguard-go as a lib? Or is it just read the source and also read through flyctl source? Curious about fiddling with something similar with firecracker at home. Think it'd be neat to spin up bespoke micro-vm's with wireguard enabled.

The source is about it, it's pretty readable though. If you're turning up microvms with a linux kernel, it might just be easier to use kernel mode wireguard. It works pretty well!

True, yeah!

Just thought it'd be fun to futz with network code for once given the most I do is http usually.

Been checking out gliberlabs/ssh the past few hours which is neat. And which I can think of fun ways to pair with a micro-vm and step ca.

Re: SSH and User-Mode IP WireGuard

#93

Post by tptacek »

aleph- wrote: post #92
mrkurt wrote: post #90

Earlier quoted context omitted.

The source is about it, it's pretty readable though. If you're turning up microvms with a linux kernel, it might just be easier to use kernel mode wireguard. It works pretty well!

True, yeah! Just thought it'd be fun to futz with network code for once given the most I do is http usually. Been checking out gliberlabs/ssh the past few hours which is neat. And which I can think of fun ways to pair with a micro-vm and step ca.

Seriously, check out the code in pkg/wg. The code you need is like 4 lines (get a working WireGuard connection first, outside of your code, and then bring the configuration --- keys, addresses --- into your code); everything else will be normal Go code.

I would take credit for this, but it's Ben's c--- hey, wait, I paid Ben Burkert for this, I'm going to take full credit.

Re: SSH and User-Mode IP WireGuard

#94

Post by tptacek »

tucif wrote: post #85
tptacek wrote: post #25

Earlier quoted context omitted.

Yes; the original purpose of private DNS at Fly was for service discovery. `your-app.internal` is the AAAA's of every instance for your-app; `nrt.your-app.internal` every instance in Japan, `aws-rds-1._peer.internal` is AAAA for the other side of a WireGuard gateway you created to bridge your apps to an RDS database, etc.

When you say "the public key for that root certificate is hosted in our private DNS", does that mean the public key is in.. a txt record?

Ayup.

Re: SSH and User-Mode IP WireGuard

#95

Post by vdqtp3 »

CyberRabbi wrote: post #38

Running networking stacks in user mode really opens up a lot of interesting solutions. Wireguard is sort of an enabling technology for this. Just realized this was written by security guru tptacek, nice. What is the contextual meaning of “AFFIANT SAYS NOTHING FURTHER.”?

> What is the contextual meaning of “AFFIANT SAYS NOTHING FURTHER.”?

"That's all, folks"

Re: SSH and User-Mode IP WireGuard

#96

Post by prattmic »

ignoramous wrote: post #91
prattmic wrote: post #56

Earlier quoted context omitted.

This is awesome! In the post you mention "For a couple hundred lines of code (not counting the entire user-mode Linux you’ll be pulling in from gVisor, HEY! Dependencies! What are you gonna do!) ..." I'll note that while all of gVisor's user-mode Linux is in the same Go module, we've actually gone to decent lengths to keep the network stack logically separate from the rest of the user-mode Linux code. So while go.sum…

Wait... What is depaware? How do I use it to make sense of go.sum in my projects?

It's here: https://github.com/tailscale/depaware

See also: https://twitter.com/bradfitz/status/1303776199907311617?s=19

Re: SSH and User-Mode IP WireGuard

#97

Post by CyberRabbi »

vdqtp3 wrote: post #95
CyberRabbi wrote: post #38

Running networking stacks in user mode really opens up a lot of interesting solutions. Wireguard is sort of an enabling technology for this. Just realized this was written by security guru tptacek, nice. What is the contextual meaning of “AFFIANT SAYS NOTHING FURTHER.”?

> What is the contextual meaning of “AFFIANT SAYS NOTHING FURTHER.”? "That's all, folks"

Oh so it’s supposed to be a bio line that has no bio? I would assume one would just leave it out if they had nothing to say.

Re: SSH and User-Mode IP WireGuard

#98

Post by aleph- »

tptacek wrote: post #93
aleph- wrote: post #92

Earlier quoted context omitted.

True, yeah! Just thought it'd be fun to futz with network code for once given the most I do is http usually. Been checking out gliberlabs/ssh the past few hours which is neat. And which I can think of fun ways to pair with a micro-vm and step ca.

Seriously, check out the code in pkg/wg. The code you need is like 4 lines (get a working WireGuard connection first , outside of your code, and then bring the configuration --- keys, addresses --- into your code); everything else will be normal Go code. I would take credit for this, but it's Ben's c--- hey, wait, I paid Ben Burkert for this, I'm going to take full credit.

Hahaha.

So I have been actually looking at the code under pkg/wg and tracing stuff back into the wireguard-go pkg and so on for a bit. (Which is some very nice and clean code haha, so you definitely got what you paid for. :P)

I guess the conceptual hurdle I'm stuck on now is, great I've got this wg tunnel open in my code go. How do I actually force packets over it? Say I've got a sshd listening on the other end of the tunnel with netfilter rules that say only allow access over this tunnel.

Can I just do normal ssh calls and use the wg tunnel remote addr to do stuff?

Is it that simple and I'm vastly over thinking things, or is it more complicated then I thought?

Incidentally, fly.io is awesome!

Might have to see about getting our workloads running on it for any customers who might want to run them.

It's definitely given me some fun ideas custom wg and sshd impls running over micro-vm's for at home haha.

Re: SSH and User-Mode IP WireGuard

#99

Post by mwcampbell »

prattmic wrote: post #96
ignoramous wrote: post #91

Earlier quoted context omitted.

Wait... What is depaware? How do I use it to make sense of go.sum in my projects?

It's here: https://github.com/tailscale/depaware See also: https://twitter.com/bradfitz/status/1303776199907311617?s=19

To my amusement, my screen reader pronounced the project name as "deep aware", which I thought was appropriate, as in, it makes you deeply aware of your real dependencies.

Re: SSH and User-Mode IP WireGuard

#100

Post by jefferai »

atonse wrote: post #57
tptacek wrote: post #37

Earlier quoted context omitted.

There is a lot of Hashi in our stack already; we orchestrate with Nomad (we have our own Firecracker task driver), we backend our certificate system --- which is awesome, certificates just work for Fly apps --- with Vault, and we use a lot of Consul. I think our take on end-user access management is lower-level than what Boundary is trying to do. Boundary, as I understand it, sees the world the way an IdP RP does, mo…

Thanks. I actually feel like if Boundary had an experience more like Tailscale does, but on top of their stack (wireguard network, secrets in vault, server/service discovery in consul, etc), that would be really powerful and a no-brainer for those of us who also use a lot of Hashicorp products. But I'm still trying to fully understand what they're doing with Boundary. The abstractions just feel a bit off to me unlike…

TCP targets (the only kind currently in Boundary) actually work with _any_ TCP connection. The `boundary connect ` bits are just some CLI syntactic sugar around the main `boundary connect` command -- which works all by itself! -- that fill in IP/port and other information for various clients. (This has been an unfortunate bit of confusion for many people trying Boundary out. We'll take another look at how we can make this more obvious in our getting started/learn docs.)

It's all TCP though. Eventually we'll do more interesting things with specific protocol types.

Post reply on HN