Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH and User-Mode IP WireGuard

fly.io

Post reply on HN
Print view View original

1–10 of 104 posts

Re: SSH and User-Mode IP WireGuard

#2

Post by tptacek »

I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood.

Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique.

The whole thing is kind of a vindication for Go's standard library network interface, which I have always hated.

Re: SSH and User-Mode IP WireGuard

#5

Post by bluesign »

tptacek wrote: post #2

I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…

Why not something like:

ssh dogmatic-potato-342@jump.fly.io

And tunnel connection over wireguard on jump server

Re: SSH and User-Mode IP WireGuard

#6

Post by tptacek »

bluesign wrote: post #4

Is this super complex infrastructure for fairly simple thing or am I missing something?

No, it is extra-super complex infrastructure for a fairly simple thing.

Normal SSH still works, and is usually going to be what people end up using. You just have to have WireGuard installed and running.

The product feature here is less interesting than how we did it.

Re: SSH and User-Mode IP WireGuard

#7

Post by spockz »

> We take Docker-type containers from users and transmogrify them into Firecracker micro-VMs

What is the relationship with micro kernels? Is the feature available separate from the deployment/hosting?

Re: SSH and User-Mode IP WireGuard

#8

Post by tptacek »

bluesign wrote: post #5
tptacek wrote: post #2

I added some example code to the post, because, again, I kind of can't get over how easy this turns out to be. And if you follow the link into Jason's `wireguard-go` code, until you hit gVisor itself, it's not much more complicated under the hood. Having complete control of TCP/IP in userland like this, with so little code, is so valuable I feel like there needs to be some special name for the technique. The whole th…

Why not something like: ssh dogmatic-potato-342@jump.fly.io And tunnel connection over wireguard on jump server

Because then there would be some service exposed to the Internet (not over WireGuard; if you have WireGuard, you don't need a jump box) whose job it would be to hop 6PN networks. The only thing we have in our infra now that controls access to 6PN is eBPF code; we keep the system simple so we can reason about it.

Re: SSH and User-Mode IP WireGuard

#10

Post by devwastaken »

resoluteteeth wrote: post #3

Maybe you should put this up on github so everyone can use it rather than just talking about how easy it is?

I believe all informational blogs/guides should backup to a markdown file on GitHub or other. Over time playing with technologies I've found a lot of dead links to personal websites. This is of course because maintaining your own hosting can be cumbersome, domain name expirey, etc. Some valuable information gets lost with only waybackmachine to save the day. Someday wayback may no longer exist though.
Post reply on HN