From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MAILING_LIST_MULTI, NORMAL_HTTP_TO_IP,SPF_PASS,URI_TRY_3LD,WEIRD_PORT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B051C00449 for ; Tue, 2 Oct 2018 03:06:41 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E90C82083F for ; Tue, 2 Oct 2018 03:06:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=cipherdyne-org.20150623.gappssmtp.com header.i=@cipherdyne-org.20150623.gappssmtp.com header.b="hPBFoWFy" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E90C82083F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=cipherdyne.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 4b1c222e; Tue, 2 Oct 2018 03:06:18 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 402d7af9 for ; Tue, 25 Sep 2018 20:22:52 +0000 (UTC) Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 11a6983f for ; Tue, 25 Sep 2018 20:22:51 +0000 (UTC) Received: by mail-lj1-x244.google.com with SMTP id q127-v6so23021946ljq.11 for ; Tue, 25 Sep 2018 13:25:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cipherdyne-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jEGi0Ha+A22RTbmuwiu+GvkyctMUq2MvBXT8pgShXMw=; b=hPBFoWFyeknFc+UigKyOsDpVuoCLbv6sY0R0a2U8uB8wAlWubTemLQZGhFzm92PIEd dK64OlElnLFJ8MD0c/UaBpZKY1s8gPTM5xCjKKqLI0yXiJ2iR+T1gYKHXoRT91qHrrQs jfTE6zRG34PyAXNh6ga3u3/kCSEbECIiSdIDRkmmrhdV4zNtIDcZuTXfPZh87Er1Iu2q 6Q1TYztQPogc3xATMO9O98ea/XnF9g0J6HJ14KT4i15YCqqhE4wDTF1ZD15TawpPuGac dCJ0s+Wzz0ANkvl7TeJWQhQphdXJ4wht1zoiztxMUWkvcY66ih2F4LxmyPR+6LRGYSzx Z5ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jEGi0Ha+A22RTbmuwiu+GvkyctMUq2MvBXT8pgShXMw=; b=XhmUR932d8qLRC6cioOBkL9OzkB+Z65w1gI+ii/lAuRxpGkkVQD8dSa5De4G4jCWie iinCg/cFjH8Iudu3gGAFsgObZK6RRjFz1unvGtaHeJP+i1KQgx+3Fou/0fOUz/6fK3vw EHXWFJAkYLYQlDMrqI6EdwrhA/HbaP+L+noCZKagTfFiaOATfbm3Eka3cswMlZT3+TSe Ukdf5mSFMoGigGHys5QGz/hp6EiZ1NRN0p0KWa6SKEsFGh9/3iofYkCTIsFX6B+qhZo6 xpguMF7hWmfy7FJuhwb+JqGPcQ91bjhY709hwxlyyT9vhJ75IAWk24sjz22BSmdbauNB /Lqw== X-Gm-Message-State: ABuFfoiFFjlLPGv5Ji/LR/0A+Uh2RC1gNvx+OrP/nOciSMG1dJD1qaYu ha9HRdysnfUSVyBoYdHkMDl3IDbA/DB3lOc5i4B4Fw== X-Google-Smtp-Source: ACcGV60xMzC1+DrnIzEdYbCCHuoubknfJlEuzQvy/Bsa7zNfK/fUvJdyDqJ20aM5g4w99LhjrjnQYXu910dASH+fzs8= X-Received: by 2002:a2e:2e18:: with SMTP id u24-v6mr2149011lju.77.1537907127944; Tue, 25 Sep 2018 13:25:27 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Michael Rash Date: Tue, 25 Sep 2018 16:25:16 -0400 Message-ID: Subject: Re: [feature request] To support "Wireguard over raw TCP" To: kexianbin@diyism.com X-Mailman-Approved-At: Tue, 02 Oct 2018 05:06:16 +0200 Cc: wireguard@lists.zx2c4.com X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============5477362668760612220==" Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" --===============5477362668760612220== Content-Type: multipart/alternative; boundary="0000000000000f1f5f0576b7e8b6" --0000000000000f1f5f0576b7e8b6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Sep 25, 2018 at 12:06 PM KeXianbin(http://diyism.com) < kexianbin@diyism.com> wrote: > Thanks for the info. > > On Sep 25, 2018 23:53, "StarBrilliant" wrote: > >> On Tue, Sep 25, 2018 at 1:17 PM KeXianbin(http://diyism.com) >> wrote: >> > >> > Currently, I'm using udp2raw-tunnel to transform wireguard udp traffic >> into raw tcp (config files as follows), >> > It's very stable on my home network than using wireguard alone, >> > But if we can integrate RAW TCP feature into wireguard, it would >> significantly improve performance and stability for end users. >> > >> > >> > from: >> https://gist.github.com/diyism/1b80903a83776675031c73ae499438d8#file-wir= eguard_config-txt-L145 >> > >> > $wget >> https://github.com/wangyu-/udp2raw-tunnel/releases/download/20180830.2/u= dp2raw_binaries.tar.gz >> > $tar xzvf udp2raw_binaries.tar.gz >> > $sudo cp udp2raw_amd64 /usr/bin/ >> > $sudo udp2raw_amd64 -c -l127.0.0.2:24448 -r:24447 -a >> > $cat /etc/wireguard/wg0.conf >> > [Interface] >> > PrivateKey =3D >> > Address =3D 10.0.0.3/32 >> > ListenPort =3D 24447 >> > MTU =3D 1300 >> > PostUp =3D ip route add 10.0.0.0/24 dev wg0 && wg set wg0 peer > pubkey> allowed-ips 0.0.0.0/0 >> > PostDown =3D ip route del 10.0.0.0/24 >> > >> > [Peer] >> > #10.0.0.1 >> > PublicKey =3D >> > Endpoint =3D 127.0.0.2:24448 >> > #AllowedIPs =3D 0.0.0.0/0 >> > >> > $sudo wg-quick down wg0 ; sudo wg-quick up wg0 >> > $ping 10.0.0.1 >> > 64 bytes from 10.0.0.1: icmp_seq=3D2113 ttl=3D64 time=3D183 ms >> > $sudo ip route add 104.24.0.0/16 dev wg0 >> > $ping myip.ipip.net >> > PING myip.ipip.net (104.24.20.50) 56(84) bytes of data. >> > 64 bytes from 104.24.20.50 (104.24.20.50): icmp_seq=3D1 ttl=3D60 time= =3D185 ms >> > $curl http://myip.ipip.net >> > IP=EF=BC=9A >> > >> > #take care, "MTU =3D 1300" in wg0.conf is needed when wireguard over >> udp2raw, or else most https requests will be blocked because of mtu prob= lem. >> >> >> Hello Kexianbin, >> >> This is an UNOFFICIAL response to your question. (But I think the >> official developers may have similar answers.) >> >> Wireguard probably will not accept an official integration to udp2raw. >> The reasons are: >> >> 1) Wireguard wants to keep their kernel part code minimized, therefore >> easy for security auditing, and less bugs.The UDP protocol is actually >> very simple and straightforward. (By the way, if you intended to use >> Wireguard in China, be informed that this is a protocol that is very >> easy to block by the ISP.) >> >> 2) I have read the source code of udp2raw. To be frank, the code is of >> very low quality. For this reason, I don't think udp2raw would be >> integrated into Wireguard unless it's rewritten. >> >> 3) Udp2raw is not suitable for everyone or for every country. For >> example udp2raw may have problems passing middleboxes, which is common >> among satellite ISPs in Oceania. Middleboxes break and resemble TCP >> segments thus make udp2raw literally unusable. Also it is not >> congestion friendly (by design), so a massive deployment may affect >> the global Internet ecology. >> > Let me also add (unofficially of course) that stealth against active scanning is also an important goal achieved by Wireguard's usage of UDP, and switching to TCP would break this. If TCP is required, then integration options with third party tools such as udp2raw-tunnel will always be there. Wireguard should not have to directly support those options, and rather should stick to its current compelling design. --Mike > >> However the good news is, Wireguard provides an open control interface >> (see https://www.wireguard.com/xplatform/ ). By utilizing this >> interface, we can develop an alternate frontend application other than >> the official command "wg", that automatically sets up the kernel >> Wireguard kernel part and a userland udp2raw part, packaged as one >> application. >> >> >> My words for Wireguard developers: >> >> 1) In case you may not know the udp2raw protocol, here is a >> description. Some ISPs in certain countries have strange QoS strategy >> that deprioritize UDP packets during network congestion, resulting a >> 50% loss rate or more for UDP. The udp2raw protocol simulates a >> three-way TCP handshake and add TCP header to UDP packets so they will >> not be dropped. This protocol does not do congestion control or rate >> control, neither does it understand any TCP semantics. It's a dirty >> hack for dirty ISP, not suitable for everyone, but overwhelmingly >> useful in certain countries. >> >> 2) Wireguard currently does not support binding to localhost. This is >> required for any third-party plugins upon Wireguard to work. We might >> need to consider binding to localhost an important feature to go in >> the near future. >> >> >> Best regards, >> StarBrilliant >> > _______________________________________________ > WireGuard mailing list > WireGuard@lists.zx2c4.com > https://lists.zx2c4.com/mailman/listinfo/wireguard > --=20 Michael Rash | Founder http://www.cipherdyne.org/ Key fingerprint =3D 53EA 13EA 472E 3771 894F AC69 95D8 5D6B A742 839F --0000000000000f1f5f0576b7e8b6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue= , Sep 25, 2018 at 12:06 PM KeXianbin(http://d= iyism.com) <kexianbin@diyism= .com> wrote:
Thanks for the info.=C2=A0

On Sep 25, 2018 23:53, "StarBrilliant" <coder@poorlab.com>= ; wrote:
On Tue, Sep= 25, 2018 at 1:17 PM KeXianbin(http://diyism.com)
<kexianbin@diy= ism.com> wrote:
>
> Currently, I'm using udp2raw-tunnel to transform wireguard udp tra= ffic into raw tcp (config files as follows),
> It's very stable on my home network than using wireguard alone, > But if we can integrate RAW TCP feature into wireguard, it would signi= ficantly improve performance and stability for end users.
>
>
> from: https://gist.github.com/diyism/1b80903a83776675031c73ae499438d8#file-w= ireguard_config-txt-L145
>
> $wget https://github.com/wangyu-/udp2raw-tunnel/releases/download/20180830.2= /udp2raw_binaries.tar.gz
> $tar xzvf udp2raw_binaries.tar.gz
> $sudo cp udp2raw_amd64 /usr/bin/
> $sudo udp2raw_amd64 -c -l127.0.0.2:24448 -r<server ip>:24447 -a<= br> > $cat /etc/wireguard/wg0.conf
> [Interface]
> PrivateKey =3D <client privkey>
> Address =3D 10.0.0.3/32
> ListenPort =3D 24447
> MTU =3D 1300
> PostUp =3D ip route add 10.0.0.0/24 dev wg0 && wg set wg0 peer &l= t;server pubkey> allowed-ips 0.0.0.0/0
> PostDown =3D ip route del 10.0.0.0/24
>
> [Peer]
> #10.0.0.1
> PublicKey =3D <server pubkey>
> Endpoint =3D 127.0.0.2:24448
> #AllowedIPs =3D 0.0.0.0/0
>
> $sudo wg-quick down wg0 ; sudo wg-quick up wg0
> $ping 10.0.0.1
> 64 bytes from 10.0.0.1: icmp_seq=3D2113 ttl=3D64 time=3D183 ms
> $sudo ip route add 104.24.0.0/16 dev wg0
> $ping myip.ipip.net
> PING myip.ipip.net (104.24.20.50) 56(84) bytes of data.
> 64 bytes from 104.24.20.50 (104.24.20.50): icmp_seq=3D1 ttl=3D60 time= =3D185 ms
> $curl http://myip.ipip.net
> IP=EF=BC=9A<server ip>
>
> #take care, "MTU =3D 1300" in wg0.conf is needed when wiregu= ard over udp2raw, or else most https requests will be blocked because of mt= u problem.


Hello Kexianbin,

This is an UNOFFICIAL response to your question. (But I think the
official developers may have similar answers.)

Wireguard probably will not accept an official integration to udp2raw.
The reasons are:

1) Wireguard wants to keep their kernel part code minimized, therefore
easy for security auditing, and less bugs.The UDP protocol is actually
very simple and straightforward. (By the way, if you intended to use
Wireguard in China, be informed that this is a protocol that is very
easy to block by the ISP.)

2) I have read the source code of udp2raw. To be frank, the code is of
very low quality. For this reason, I don't think udp2raw would be
integrated into Wireguard unless it's rewritten.

3) Udp2raw is not suitable for everyone or for every country. For
example udp2raw may have problems passing middleboxes, which is common
among satellite ISPs in Oceania. Middleboxes break and resemble TCP
segments thus make udp2raw literally unusable. Also it is not
congestion friendly (by design), so a massive deployment may affect
the global Internet ecology.
=
Let me also add (unofficially of course) that stealth agains= t active scanning is also an important goal achieved by Wireguard's usa= ge of UDP, and switching to TCP would break this. If TCP is required, then = integration options with third party tools such as udp2raw-tunnel will alwa= ys be there. Wireguard should not have to directly support those options, a= nd rather should stick to its current compelling design.

--Mike


=C2=A0

However the good news is, Wireguard provides an open control interface
(see https://www.wireguard.com/xplatform/ ). By utilizing th= is
interface, we can develop an alternate frontend application other than
the official command "wg", that automatically sets up the kernel<= br> Wireguard kernel part and a userland udp2raw part, packaged as one
application.


My words for Wireguard developers:

1) In case you may not know the udp2raw protocol, here is a
description. Some ISPs in certain countries have strange QoS strategy
that deprioritize UDP packets during network congestion, resulting a
50% loss rate or more for UDP. The udp2raw protocol simulates a
three-way TCP handshake and add TCP header to UDP packets so they will
not be dropped. This protocol does not do congestion control or rate
control, neither does it understand any TCP semantics. It's a dirty
hack for dirty ISP, not suitable for everyone, but overwhelmingly
useful in certain countries.

2) Wireguard currently does not support binding to localhost. This is
required for any third-party plugins upon Wireguard to work. We might
need to consider binding to localhost an important feature to go in
the near future.


Best regards,
StarBrilliant
_______________________________________________
WireGuard mailing list
WireGuard@li= sts.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard=


--
Michael Rash | Founder
http://www.cipherdyne.org/
Key fingerprint =3D 53EA 13EA= 472E 3771 894F=C2=A0 AC69 95D8 5D6B A742 839F
--0000000000000f1f5f0576b7e8b6-- --===============5477362668760612220== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard --===============5477362668760612220==--