From: "Marc-André Lureau" <marcandre.lureau@gmail.com>
To: Julian Orth <ju.orth@gmail.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>, wireguard@lists.zx2c4.com
Subject: Re: Userspace Networking Stack + WireGuard + Go
Date: Fri, 15 Jan 2021 12:12:42 +0400 [thread overview]
Message-ID: <CAJ+F1CJY6YU86bu1CMewcJ-tY0v8Y2Kf3JJB8X6puM4f-+=vhw@mail.gmail.com> (raw)
In-Reply-To: <33997a3d-591e-9aa3-92fe-a06a4d3c5b26@gmail.com>
Hi Julian
On Wed, Jan 13, 2021 at 8:28 PM Julian Orth <ju.orth@gmail.com> wrote:
>
> On 13/01/2021 17.04, Jason A. Donenfeld wrote:
>
> > Even if you're unprivileged and want a WireGuard interface for just a
> > single application that's bound to the lifetime of that application,
> > you can still use WireGuard's normal kernel interface inside of a user
> > namespace + a network namespace, and get a private process-specific
> > WireGuard interface.
>
> That's what my patches from back in 2018 were trying to accomplish.
> Unless I've missed something since, I do not see how what you're
> describing would work. Unless you also
>
> - create a TUN device in the network namespace
> - add a default route through that TUN device
> - manually route all traffic between the init network namespace and your
> network namespace.
>
> Is that what you meant or is there a simpler way?
I am not a network admin, but I agree. Setting up this kind of user
network namespace isn't trivial and requires some privileges. It would
be nice if the kernel or some services provided a simpler way. (fwiw,
some time ago I did some experimental/research work for VM &
containers at https://gitlab.freedesktop.org/elmarco/vnet)
--
Marc-André Lureau
next prev parent reply other threads:[~2021-01-15 8:13 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-13 16:04 Jason A. Donenfeld
2021-01-13 16:26 ` Julian Orth
2021-01-13 16:33 ` network namespace wireguard routing [Was: Re: Userspace Networking Stack + WireGuard + Go] Jason A. Donenfeld
2021-01-13 16:40 ` Julian Orth
2021-01-13 16:46 ` Toke Høiland-Jørgensen
2021-01-13 16:49 ` Jason A. Donenfeld
2021-01-14 10:44 ` Toke Høiland-Jørgensen
2021-01-15 8:12 ` Marc-André Lureau [this message]
2021-01-14 23:25 ` Userspace Networking Stack + WireGuard + Go Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJ+F1CJY6YU86bu1CMewcJ-tY0v8Y2Kf3JJB8X6puM4f-+=vhw@mail.gmail.com' \
--to=marcandre.lureau@gmail.com \
--cc=Jason@zx2c4.com \
--cc=ju.orth@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).