[9fans] Tailscale on Plan 9

[9fans] Tailscale on Plan 9

[brad]

[-- Attachment #1: Type: text/plain, Size: 1378 bytes --]

Skip asked me to make Tailscale work on Plan 9.

I tried, but ran into problems so I asked Russ for some help. Together, we just got it all mostly working.

Blog post 1 of 2 is now at https://tailscale.com/blog/tailscale-enterprise-plan-9-support

The followup blog post tomorrow will go into details about what we did.

There are a number of shortcuts and TODOs and things I'll need to ask for more help on. (e.g. how do I make an outgoing TCP connection bound to a specific interface or ignoring a certain route in the routing table? I couldn't figure that out, and that's necessary for "exit node" support... so we're able to make connections out to control/data plane services with your "real" underlay network card and ignore the 0.0.0.0/0, ::0/0 routes back into the Tailscale network device.)

There will be a Google Meet "webinar" (it was hard to write that word without cringing, even as a joke) in about 24 hours if anybody wants to hang out and chat about any of this, or just about Plan 9 in general: https://ftp.plan9.ts.net/webinar has a time & will redirect to the Google Meet URL tomorrow.

- Brad

P.S. Sorry? :)



------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Mdd1f073aa0b7d712f7da97ee
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 2299 bytes --]

Re: [9fans] Tailscale on Plan 9

[ron minnich]

[-- Attachment #1: Type: text/plain, Size: 3380 bytes --]

Brad, you can bind multiple, separate instances of the tcp stack to
individual interfaces as needed. You can have an entire tcp stack rooted
at, e.g., /net.alt; this was done at Bell Labs and it's why plan 9 never
needed NAT. /net.alt was used for "outside the labs" traffic.

We also did this on the Blue Gene supercomputers to provide separate stacks
for the internal and external networks.

There's nothing special about the name /net. The address strings you use
(tcp!addr!port) have an implicit /net prefix, but you can supply one of
your own.
e.g.
telnet tcp!google.com!80
and
telnet /net/tcp!google.com!80
both use the tcp stack rooted at /net.
but
telnet /bradsnet/tcp!google.com!80
is perfectly legal as long as you've set up a stack on /bradsnet

I asked Claude to summarize and it did a pretty good job.
Show how one can bind a new plan 9 ip stack instance to a particular
interface
and
now add another stack in /net.alt

Claude correctly showed two different interfaces.

Further, there's nothing special about names like /net/ether0, etc: these
are conventions, and for special cases, like tailscale, you can make your
own.

The key point is that none of these names are reserved in any way, so it's
very easy to have, e.g., entirely independent IP stacks, each one owning
one or more interfaces .

Plan 9 had working network name spaces about 20 years before Linux ...
ron
p.s. It's been years since I did this, so I'm sure people can correct me on
details.

On Tue, Apr 1, 2025 at 8:35 AM <brad@danga.com> wrote:

> Skip asked me to make Tailscale work on Plan 9.
>
> I tried, but ran into problems so I asked Russ for some help. Together, we
> just got it all mostly working.
>
> Blog post 1 of 2 is now at
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support
>
> The followup blog post tomorrow will go into details about what we did.
>
> There are a number of shortcuts and TODOs and things I'll need to ask for
> more help on. (e.g. how do I make an outgoing TCP connection bound to a
> specific interface or ignoring a certain route in the routing table? I
> couldn't figure that out, and that's necessary for "exit node" support...
> so we're able to make connections out to control/data plane services with
> your "real" underlay network card and ignore the 0.0.0.0/0, ::0/0 routes
> back into the Tailscale network device.)
>
> There will be a Google Meet "webinar" (it was hard to write that word
> without cringing, even as a joke) in about 24 hours if anybody wants to
> hang out and chat about any of this, or just about Plan 9 in general:
> https://ftp.plan9.ts.net/webinar has a time & will redirect to the Google
> Meet URL tomorrow.
>
> - Brad
>
> P.S. Sorry? :)
>
>
>
> *9fans <https://9fans.topicbox.com/latest>* / 9fans / see discussions
> <https://9fans.topicbox.com/groups/9fans> + participants
> <https://9fans.topicbox.com/groups/9fans/members> + delivery options
> <https://9fans.topicbox.com/groups/9fans/subscription> Permalink
> <https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Mdd1f073aa0b7d712f7da97ee>
>

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M234cb1e3bdf917cff0bc4b61
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 4737 bytes --]

Re: [9fans] Tailscale on Plan 9

[Jacob Moody]

On 4/1/25 10:28, brad@danga.com wrote:
> Skip asked me to make Tailscale work on Plan 9.
> 
> I tried, but ran into problems so I asked Russ for some help. Together, we just got it all mostly working.
> 
> Blog post 1 of 2 is now at https://tailscale.com/blog/tailscale-enterprise-plan-9-support <https://tailscale.com/blog/tailscale-enterprise-plan-9-support>

Your post this morning was quite a present surprise. Got a couple chuckles out of me as well.
I realize the date, but seeming that there was some code written for this I suspect there's some truth to this.

> 
> The followup blog post tomorrow will go into details about what we did.
> 
> There are a number of shortcuts and TODOs and things I'll need to ask for more help on. (e.g. how do I make an outgoing TCP connection bound to a specific interface or ignoring a certain route in the routing table? I couldn't figure that out, and that's necessary for "exit node" support... so we're able to make connections out to control/data plane services with your "real" underlay network card and ignore the 0.0.0.0/0, ::0/0 routes back into the Tailscale network device.)

As far as I know there isn't a way of doing either of what you're asking for.
I also have to apologize, I am not familiar with how exactly tailscale works so let me know if I've got some wrong assumptions.

The type of things I believe you're reaching for can be solved in plan 9/9front by using multiple instances of /net.
Essentially you use one /net as your "outside" network, one in which the vpn software itself can use to reach out
to other peers. While the vpn software then creates an interface on the "inside" /net, and programs using the "inside"
/net will then have their connections forwarded through the software. The vpn software created interface can then be
the default route on the "inside" /net without impacting the vpn software's ability to talk on the "outside" net.

This is largely how the existing tinc vpn implementation[0][1] works in 9front. While not strictly required, I also use
multiple /net devices for my home NAT configuration for the same purpose of isolating the routing tables from the
LAN and the greater internet. If it is of any use I've written a short blog post[2] about how I have this NAT configuration all
setup.

[0] http://man.9front.org/8/tinc
[1] https://git.9front.org/plan9front/plan9front/a3fef8384db2ce1ff98c38373c59841b83c83ce0/sys/src/cmd/ip/tinc.c/f.html
[2] https://posixcafe.org/blogs/2024/01/04/0/


Hope this helps,
Jacob Moody



------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M444dc1bd14088cfac2a4a1b7
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[Skip Tavakkolian]

I'll be honest, this made me cry a little.

The quality and polish, and everything works! Almost too good :D

On Tue, Apr 1, 2025 at 8:35 AM <brad@danga.com> wrote:
>
> Skip asked me to make Tailscale work on Plan 9.
>
> I tried, but ran into problems so I asked Russ for some help. Together, we just got it all mostly working.
>
> Blog post 1 of 2 is now at https://tailscale.com/blog/tailscale-enterprise-plan-9-support
>
> The followup blog post tomorrow will go into details about what we did.
>
> There are a number of shortcuts and TODOs and things I'll need to ask for more help on. (e.g. how do I make an outgoing TCP connection bound to a specific interface or ignoring a certain route in the routing table? I couldn't figure that out, and that's necessary for "exit node" support... so we're able to make connections out to control/data plane services with your "real" underlay network card and ignore the 0.0.0.0/0, ::0/0 routes back into the Tailscale network device.)
>
> There will be a Google Meet "webinar" (it was hard to write that word without cringing, even as a joke) in about 24 hours if anybody wants to hang out and chat about any of this, or just about Plan 9 in general: https://ftp.plan9.ts.net/webinar has a time & will redirect to the Google Meet URL tomorrow.
>
> - Brad
>
> P.S. Sorry? :)
>
>
>
> 9fans / 9fans / see discussions + participants + delivery options Permalink

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M3b86b746699ae9653f37ab83
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[Brad Fitzpatrick]

[-- Attachment #1: Type: text/plain, Size: 612 bytes --]

On Tue, Apr 1, 2025 at 10:15 AM Skip Tavakkolian <skip.tavakkolian@gmail.com>
wrote:

> I'll be honest, this made me cry a little.
>
> The quality and polish, and everything works! Almost too good :D


Mission accomplished!

The blog post originally said "Avoid learning factotum" but I changed it to
"Skip learning factotum" before publishing to get "Skip" in there :)

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M878548c68ff2fdb6f775c599
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 1447 bytes --]

Re: [9fans] Tailscale on Plan 9

[Brad Fitzpatrick]

[-- Attachment #1: Type: text/plain, Size: 1334 bytes --]

On Tue, Apr 1, 2025 at 9:52 AM Jacob Moody <moody@posixcafe.org> wrote:

> On 4/1/25 10:28, brad@danga.com wrote:
> > Skip asked me to make Tailscale work on Plan 9.
> >
> > I tried, but ran into problems so I asked Russ for some help. Together,
> we just got it all mostly working.
> >
> > Blog post 1 of 2 is now at
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support <
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support>
>
> Your post this morning was quite a present surprise. Got a couple chuckles
> out of me as well.
> I realize the date, but seeming that there was some code written for this
> I suspect there's some truth to this


Oh, it very much works. ;)

And I was able to run it in a wasm emulator on the web (
https://copy.sh/v86/?profile=9legacy&nojoke) and SSH into it. Tailscale
includes an optional built-in SSH server (tailscale up '--ssh'), so the SSH
server runs in tailscaled in Plan 9 in wasm in the browser and it all works
if you SSH from another machine running Tailscale on the same tailnet (a
private Tailscale network).

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M3f5df8c96526c89161d2d6b5
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 2566 bytes --]

Re: [9fans] Tailscale on Plan 9

[Skip Tavakkolian]

I noticed that right away! I thought it was my oversized ego making me
see things; but there it was in print "Skip"!

On Tue, Apr 1, 2025 at 10:53 AM Brad Fitzpatrick <brad@danga.com> wrote:
>
> On Tue, Apr 1, 2025 at 10:15 AM Skip Tavakkolian <skip.tavakkolian@gmail.com> wrote:
>>
>> I'll be honest, this made me cry a little.
>>
>> The quality and polish, and everything works! Almost too good :D
>
>
> Mission accomplished!
>
> The blog post originally said "Avoid learning factotum" but I changed it to "Skip learning factotum" before publishing to get "Skip" in there :)
>
>
> 9fans / 9fans / see discussions + participants + delivery options Permalink

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M534117cb64fdef286fdbd13e
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[fgergo]

On Tue, Apr 1, 2025 at 7:57 PM Brad Fitzpatrick <brad@danga.com> wrote:
>
>
>
> On Tue, Apr 1, 2025 at 9:52 AM Jacob Moody <moody@posixcafe.org> wrote:
>>
>> On 4/1/25 10:28, brad@danga.com wrote:
>> > Skip asked me to make Tailscale work on Plan 9.
>> >
>> > I tried, but ran into problems so I asked Russ for some help. Together, we just got it all mostly working.
>> >
>> > Blog post 1 of 2 is now at https://tailscale.com/blog/tailscale-enterprise-plan-9-support <https://tailscale.com/blog/tailscale-enterprise-plan-9-support>
>>
>> Your post this morning was quite a present surprise. Got a couple chuckles out of me as well.
>> I realize the date, but seeming that there was some code written for this I suspect there's some truth to this
>
>
> Oh, it very much works. ;)
>
> And I was able to run it in a wasm emulator on the web (https://copy.sh/v86/?profile=9legacy&nojoke) and SSH into it. Tailscale includes an optional built-in SSH server (tailscale up '--ssh'), so the SSH server runs in tailscaled in Plan 9 in wasm in the browser and it all works if you SSH from another machine running Tailscale on the same tailnet (a private Tailscale network).
>
Truly a nojoke, thanks to all!

It's probably only me, though I'd like to confirm, besides Brad who
could get this working in the copy.sh/v86 wasm emulator and what did
you do exactly?
term% ip/ping google.com
hangs and dns dies with
XX dns: checked 85 page table entries
dns XX: suicide: sys: trap: fault read addr=0x30382e pc=0x00014752
so tailscale netcheck fails as well.

# ip/ping 8.8.8.8 works.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Ma46f4d019a20e5f285447c31
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[Brad Fitzpatrick]

[-- Attachment #1: Type: text/plain, Size: 2957 bytes --]

On Wed, Apr 2, 2025 at 6:17 AM <fgergo@gmail.com> wrote:

> On Tue, Apr 1, 2025 at 7:57 PM Brad Fitzpatrick <brad@danga.com> wrote:
> >
> >
> >
> > On Tue, Apr 1, 2025 at 9:52 AM Jacob Moody <moody@posixcafe.org> wrote:
> >>
> >> On 4/1/25 10:28, brad@danga.com wrote:
> >> > Skip asked me to make Tailscale work on Plan 9.
> >> >
> >> > I tried, but ran into problems so I asked Russ for some help.
> Together, we just got it all mostly working.
> >> >
> >> > Blog post 1 of 2 is now at
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support <
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support>
> >>
> >> Your post this morning was quite a present surprise. Got a couple
> chuckles out of me as well.
> >> I realize the date, but seeming that there was some code written for
> this I suspect there's some truth to this
> >
> >
> > Oh, it very much works. ;)
> >
> > And I was able to run it in a wasm emulator on the web (
> https://copy.sh/v86/?profile=9legacy&nojoke) and SSH into it. Tailscale
> includes an optional built-in SSH server (tailscale up '--ssh'), so the SSH
> server runs in tailscaled in Plan 9 in wasm in the browser and it all works
> if you SSH from another machine running Tailscale on the same tailnet (a
> private Tailscale network).
> Truly a nojoke, thanks to all!
>
> It's probably only me, though I'd like to confirm, besides Brad who
> could get this working in the copy.sh/v86 wasm emulator and what did
> you do exactly?
>

tailscaled in one rio window, and then `tailscale up '-ssh'` in another.

term% ip/ping google.com
> hangs and dns dies with
> XX dns: checked 85 page table entries
> dns XX: suicide: sys: trap: fault read addr=0x30382e pc=0x00014752
> so tailscale netcheck fails as well.
>
# ip/ping 8.8.8.8 works.

The default internet relay run by somebody in the community for v86 is
extremely throttled and restricted on how many concurrent connections you
can do. I added some code to detect running in v86 and do fewer TCP
connections (e.g. no racing various backends to see which connects faster)
to try to stay within the limits, but some stuff is still buggy, like DNS
.... I don't know what the Plan 9 DNS client code is doing. It doesn't seem
to like the responses.

But tailscaled has a fallback path to connect to the control plane for when
DNS is down, so I often see that trigger and find its way to
controlplane.tailscale.com that way. Once that's up, it gets all the IP
addresses it needs via that controlplane TCP connection.

It all works a lot better in qemu or with a dedicated wsproxy/WISP relay,
but I ran out of time when getting one of those online for the blog post.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M8ebd062b933fc65a35668162
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 5002 bytes --]

Re: [9fans] Tailscale on Plan 9

[Brad Fitzpatrick]

[-- Attachment #1: Type: text/plain, Size: 2240 bytes --]

The second (non-joke) blog post is publishing now, with details:

https://tailscale.com/blog/plan9-port

(If you get a 404, it's still rolling out to all edges... our blog platform
is having a slow day.)

We'll be in Google Meet in an hour here to chat:
https://ftp.plan9.ts.net/webinar

Also, https://github.com/tailscale/tailscale/pull/15491 is now merged.


On Tue, Apr 1, 2025 at 8:35 AM <brad@danga.com> wrote:

> Skip asked me to make Tailscale work on Plan 9.
>
> I tried, but ran into problems so I asked Russ for some help. Together, we
> just got it all mostly working.
>
> Blog post 1 of 2 is now at
> https://tailscale.com/blog/tailscale-enterprise-plan-9-support
>
> The followup blog post tomorrow will go into details about what we did.
>
> There are a number of shortcuts and TODOs and things I'll need to ask for
> more help on. (e.g. how do I make an outgoing TCP connection bound to a
> specific interface or ignoring a certain route in the routing table? I
> couldn't figure that out, and that's necessary for "exit node" support...
> so we're able to make connections out to control/data plane services with
> your "real" underlay network card and ignore the 0.0.0.0/0, ::0/0 routes
> back into the Tailscale network device.)
>
> There will be a Google Meet "webinar" (it was hard to write that word
> without cringing, even as a joke) in about 24 hours if anybody wants to
> hang out and chat about any of this, or just about Plan 9 in general:
> https://ftp.plan9.ts.net/webinar has a time & will redirect to the Google
> Meet URL tomorrow.
>
> - Brad
>
> P.S. Sorry? :)
>
>
>
> *9fans <https://9fans.topicbox.com/latest>* / 9fans / see discussions
> <https://9fans.topicbox.com/groups/9fans> + participants
> <https://9fans.topicbox.com/groups/9fans/members> + delivery options
> <https://9fans.topicbox.com/groups/9fans/subscription> Permalink
> <https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Mdd1f073aa0b7d712f7da97ee>
>

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M854ee4c85943762664bc5aab
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 3367 bytes --]

Re: [9fans] Tailscale on Plan 9

[David du Colombier]

Brad,

Fantastic work! Thank you.

-- 
David du Colombier

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Ma36432ca2d682735fa01de9a
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[i]

[-- Attachment #1: Type: text/plain, Size: 534 bytes --]

Looks nice! Congratulations!

> https://copy.sh/v86/?profile=9legacy&nojoke

I would probably disable USB. To me it initially seemed the vm throws an error (can't open /srv/usb) and hangs afterwards (kfs...gunzip...). It's not true, but that's how it seemed to me, so first time I closed the tab. :P

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M145192d151f0f74d7b3ccac0
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 1160 bytes --]

Re: [9fans] Tailscale on Plan 9

[ori]

Quoth Brad Fitzpatrick <brad@danga.com>:
> 
> We'll be in Google Meet in an hour here to chat:
> https://ftp.plan9.ts.net/webinar

fun webinar, good discussions were had :)

thanks for all the effort.


------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Ma552a7f5360bc9d1eec923c6
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[Jeremy Jackins]

Here I thought we were supposed to get a prank for April 1, rather than a gift.

On Wed, Apr 2, 2025 at 8:47 AM <i@adi.onl> wrote:
>
> Looks nice! Congratulations!
>
> > https://copy.sh/v86/?profile=9legacy&nojoke
>
> I would probably disable USB. To me it initially seemed the vm throws an error (can't open /srv/usb) and hangs afterwards (kfs...gunzip...). It's not true, but that's how it seemed to me, so first time I closed the tab. :P
>
> 9fans / 9fans / see discussions + participants + delivery options Permalink

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-Mfa2d10ea2a84d309a31a7a42
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] Tailscale on Plan 9

[Thaddeus Woskowiak]

[-- Attachment #1: Type: text/plain, Size: 924 bytes --]

That's the best kind of prank. Pure effort.

On Wed, Apr 2, 2025, 5:48 PM Jeremy Jackins <jeremyjackins@gmail.com> wrote:

> Here I thought we were supposed to get a prank for April 1, rather than a
> gift.
>
> On Wed, Apr 2, 2025 at 8:47 AM <i@adi.onl> wrote:
> >
> > Looks nice! Congratulations!
> >
> > > https://copy.sh/v86/?profile=9legacy&nojoke
> >
> > I would probably disable USB. To me it initially seemed the vm throws an
> error (can't open /srv/usb) and hangs afterwards (kfs...gunzip...). It's
> not true, but that's how it seemed to me, so first time I closed the tab. :P
> >
> > 9fans / 9fans / see discussions + participants + delivery options
> Permalink

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4cecdedbabdedc00-M86e9737bae858a69901b63a6
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 2369 bytes --]