5 ms·

A note: wireguard-go (the official userspace impl in golang) can do this since several months back. It uses gVisor's netstack as a tcp/udp provider to forward c

A note: wireguard-go (the official userspace impl in golang) can do this since several months back. It uses gVisor's netstack as a tcp/udp provider to forward connections to its peer (compared to whitequark's smoltcp in case of onetun). Here's a demonstration of both a http-client and a http-server running over wireguard (a poor man's QUIC, if you will): https://github.com/WireGuard/wireguard-go/tree/master/tun/netstack/examples https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... fly.io wrote about such a setup not long ago too: https://news.ycombinator.com/item?id=26315695 https://news.ycombinator.com/item?id=26315695 And tailscale.com similarly uses wireguard with netstack to impl functionality unavailable on non-Linux/xBSD platforms: https://news.ycombinator.com/item?id=28261683 https://news.ycombinator.com/item?id=28261683

momothereal 5y ago
Thanks for the links, I'll have to take some inspiration from wireguard-go!
tptacek 5y ago
Can I just put another word in for how bananas this is? WireGuard and Netstack allows you to run an entire TCP/IP stack in your userland program with no cooperation from your kernel. You can an interface to write raw packets (as an unprivileged user) and the whole TCP, integrated into the standard Go networking code. It is very, very cool to play with.
- momothereal 5y ago
  Yup! This is how onetun works as well (but :%s/Netstack/smoltcp/g in Rust)
- dave78 5y ago
  This reminds me a lot of lwIP[0] and uIP[1]. I did some projects 15 years ago with lwIP where we were able to work around a very lossy wireless network link when controlling PTZ cameras by building what was essentially a proxy with lwIP that allowed us to do some hack-ish things like transmitting 2 copies of all TCP packets immediately to increase resiliency. As I recall it exposed the BSD socket API so it was shockingly easy to relink a project to use lwIP instead of the host OS. All that was needed then on the other end was hooking up lwIP to a raw network interface. [0] https://savannah.nongnu.org/projects/lwip/ https://savannah.nongnu.org/projects/lwip/ [1] https://en.wikipedia.org/wiki/UIP_(micro_IP) https://en.wikipedia.org/wiki/UIP_(micro_IP)
  - saurik 5y ago
    Yeah! In Orchid, we have a similar setup to these, letting me layer lwIP on top of Wireguard, OpenVPN, or our WebRTC-based VPN protocol, even in multi-hop configurations.
    - ignoramous 5y ago
      Hi Saurik: Since LwIP only provides handlers for TCP and UDP, doesn't that reduce Orchid's VPN to a TCP/UDP proxy? For ex, can Orchid handle (or intends to handle) SCTP, say? Or, is LwIP more capable than what I it give credit for? (by the way, thank you for building orchid in the open! looking forward to the eventual team-up between orchid and helium :)
  - djbusby 5y ago
    > transmitting 2 copies of all TCP packets immediately U wot m8? In a thread about bananas userland TCP this Cat got a whole sundae.

momothereal 5y ago

Thanks for the links, I'll have to take some inspiration from wireguard-go!

tptacek 5y ago

Can I just put another word in for how bananas this is? WireGuard and Netstack allows you to run an entire TCP/IP stack in your userland program with no cooperation from your kernel. You can an interface to write raw packets (as an unprivileged user) and the whole TCP, integrated into the standard Go networking code. It is very, very cool to play with.

momothereal 5y ago
Yup! This is how onetun works as well (but :%s/Netstack/smoltcp/g in Rust)
dave78 5y ago
This reminds me a lot of lwIP[0] and uIP[1]. I did some projects 15 years ago with lwIP where we were able to work around a very lossy wireless network link when controlling PTZ cameras by building what was essentially a proxy with lwIP that allowed us to do some hack-ish things like transmitting 2 copies of all TCP packets immediately to increase resiliency. As I recall it exposed the BSD socket API so it was shockingly easy to relink a project to use lwIP instead of the host OS. All that was needed then on the other end was hooking up lwIP to a raw network interface. [0] https://savannah.nongnu.org/projects/lwip/ https://savannah.nongnu.org/projects/lwip/ [1] https://en.wikipedia.org/wiki/UIP_(micro_IP) https://en.wikipedia.org/wiki/UIP_(micro_IP)
- saurik 5y ago
  Yeah! In Orchid, we have a similar setup to these, letting me layer lwIP on top of Wireguard, OpenVPN, or our WebRTC-based VPN protocol, even in multi-hop configurations.
  - ignoramous 5y ago
    Hi Saurik: Since LwIP only provides handlers for TCP and UDP, doesn't that reduce Orchid's VPN to a TCP/UDP proxy? For ex, can Orchid handle (or intends to handle) SCTP, say? Or, is LwIP more capable than what I it give credit for? (by the way, thank you for building orchid in the open! looking forward to the eventual team-up between orchid and helium :)
- djbusby 5y ago
  > transmitting 2 copies of all TCP packets immediately U wot m8? In a thread about bananas userland TCP this Cat got a whole sundae.