Our User-Mode WireGuard Year • Hacker News Board

Re: Our User-Mode WireGuard Year

#41

Post by tptacek » Wed, Feb 09, 2022, 8:28 PM UTC

qbasic_forever wrote: post #36

api wrote: post #2

WireGuard is just a transport protocol, so of course you could use it in place of SSL/TLS if you wanted. Interesting though, and I prefer it to SSL/TLS because X509 certs suck.

Replacing SSL/TLS with wireguard is cool but aren't you just going to run into the same headaches of rotating certificates/keys? No one is really going to rely on using the same wireguard key indefinitely, right?

It's pretty easy for us to rotate keys now, since new WireGuard peers are extremely cheap to bring up (part of the point of the post is that for most of the last year, that was the opposite of the case, and a new peer was a very painful thing to ask for). But rotating WireGuard keys with Fly.io makes about as much sense as rotating the OAuth2 API token `flyctl` uses (the token is strictly more powerful than the WireGuard key), and people generally don't do that.

Re: Our User-Mode WireGuard Year

#42

Post by [deleted] » Wed, Feb 09, 2022, 8:37 PM UTC

marcus_cemes wrote: post #11

Fly.io's blog posts are incredible, they really seem to really enjoy what they do and want to share what they've made with everyone else. I love them for that. I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer.

[deleted]

Re: Our User-Mode WireGuard Year

#43

Post by born-jre » Wed, Feb 09, 2022, 8:38 PM UTC

i had something similar in mind but using libp2p[0]. use as a universal mesh network as library but without central control server, better p2p/NAT traversal, no need to mess with keys*.

[0]: https://github.com/libp2p/

Re: Our User-Mode WireGuard Year

#44

Post by mrkurt » Wed, Feb 09, 2022, 8:49 PM UTC

remram wrote: post #29

anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than…

Tailscale will do this!

    tailscaled --tun=userspace-networking --socks5-server=localhost:1081

Re: Our User-Mode WireGuard Year

#45

Post by swyx » Wed, Feb 09, 2022, 8:55 PM UTC

tptacek wrote: post #39

Karrot_Kream wrote: post #20

Earlier quoted context omitted.

I'm pretty sure their experience running an ISP helps too heh.

It's definitely all my talent that keeps this place running. I'm definitely not just a noisy message board guy who got hired after most of this infrastructure was built and deployed and then just proceeded to make a bunch of message board noise about it.

see, this is why the people love reading what you write. keep giving credit but also having fun!

Re: Our User-Mode WireGuard Year

#46

Post by 10000truths » Wed, Feb 09, 2022, 8:56 PM UTC

tptacek wrote: post #38

mwcampbell wrote: post #37

Earlier quoted context omitted.

So do you think I'm being too extreme on this? Or did you just implement SSH because customers want it?

I think it's sensible to run an application fleet without SSH access, but it's tough for a hosting provider that has to support lots of different application fleets to not offer a way to get a shell. Our authorization systems are about to get sharply more interesting as we roll out Macaroon-style tokens this quarter, so I'm optimistic we'll get to a place where we make both styles of application owners happy. I was m…

I think Linode’s approach to this is best: they offer a “virtual console” that basically consists of an SSH gateway that pipes to your VPS’s virtual serial port.

Re: Our User-Mode WireGuard Year

#47

Post by [deleted] » Wed, Feb 09, 2022, 9:05 PM UTC

10000truths wrote: post #46

tptacek wrote: post #38

Earlier quoted context omitted.

I think it's sensible to run an application fleet without SSH access, but it's tough for a hosting provider that has to support lots of different application fleets to not offer a way to get a shell. Our authorization systems are about to get sharply more interesting as we roll out Macaroon-style tokens this quarter, so I'm optimistic we'll get to a place where we make both styles of application owners happy. I was m…

I think Linode’s approach to this is best: they offer a “virtual console” that basically consists of an SSH gateway that pipes to your VPS’s virtual serial port.

[deleted]

Re: Our User-Mode WireGuard Year

#48

Post by drunner » Wed, Feb 09, 2022, 9:12 PM UTC

How do they manage their mesh?

I've just been doing research on setting up my own wireguard mesh (currently using a spoke/hub setup with pi-hole/pivpn).

I found https://github.com/HarvsG/WireGuardMeshes today which is awesome, but I'm curious what fly.io / other readers here may be using.

Re: Our User-Mode WireGuard Year

#49

Post by anonymousisme » Wed, Feb 09, 2022, 9:13 PM UTC

Back in the day (nearly 30 years ago) people would run a user-mode stack to obtain Internet connectivity via a (dial-up) Unix shell account. The program was "slirp" which was named after SLIP/CSLIP, but then upgraded to support PPP once that became a thing.

https://en.wikipedia.org/wiki/Slirp

Re: Our User-Mode WireGuard Year

#50

Post by wahern » Wed, Feb 09, 2022, 9:14 PM UTC

anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

> Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to run in userspace.

Not sure it fits your "mainstream" qualification, but many projects ago I used Airhook to help create a userspace, application-layer('ish), multi-channel virtual network: http://airhook.ofb.net/ (https://github.com/egnor/airhook)

Airhook is a relatively low-level library that handles framing and flow control; it's not a functional solution on its own. But that seems to be what you're getting at--something you can deeply integrate into your application, not a separate service. Though, I guess containers have sort of muddied that distinction.