Support for IPv6 subnets

samridh90 commented

2019-02-19 18:52:53 -05:00

(Migrated from github.com)

First of all, thanks for making this. This is a really interesting project.
I was wondering how hard it would be to support IPv6-only subnets. By the looks of it, only https://github.com/skx/simple-vpn/blob/master/cmd_server.go#L170 assumes IPv4 and that's because we treat it like a string instead of like an IP address.
The use-case is when using simple-vpn within another private subnet, using IPv6-only makes it easy to pick an IP block that won't clash with the rest of the subnet.
Would you be able to support this use-case? Open to PRs?

First of all, thanks for making this. This is a really interesting project. I was wondering how hard it would be to support IPv6-only subnets. By the looks of it, only https://github.com/skx/simple-vpn/blob/master/cmd_server.go#L170 assumes IPv4 and that's because we treat it like a string instead of like an IP address. The use-case is when using simple-vpn within another private subnet, using IPv6-only makes it easy to pick an IP block that won't clash with the rest of the subnet. Would you be able to support this use-case? Open to PRs?

skx commented

2019-02-20 00:55:35 -05:00

(Migrated from github.com)

I'd be open to a pull-request which allowed the CIDR range to be an IPv6 range, presumably within fd00::/8 as a /48 or /64.

For example:

subnet = fde4:8dba:82e1::/48

or:

 subnet = fde4:8dba:82e1:fefe::/64

Instead of:

 subnet = 10.137.248.0/24

Ranges picked via the unique local address-ranges.

I think there shouldn't be too many changes required, but I'd probably not make them alone.

I'd be open to a pull-request which allowed the CIDR range to be an IPv6 range, presumably within `fd00::/8` as a /48 or /64. For example: subnet = fde4:8dba:82e1::/48 or: subnet = fde4:8dba:82e1:fefe::/64 Instead of: subnet = 10.137.248.0/24 Ranges picked via the [unique local address-ranges](https://en.wikipedia.org/wiki/Unique_local_address). I think there shouldn't be too many changes required, but I'd probably not make them alone.

samridh90 commented

2019-02-20 12:35:35 -05:00

(Migrated from github.com)

I was trying to setup the project locally and I get the following error when I try to get dependencies:

$ go get ./...
# simple-vpn
./cmd_server.go:285:11: tapConfig.Name undefined (type water.Config has no field or method Name)

Did the water library change their interface for tapConfig? It might be worth using dep to lock down the dependencies to specific versions

I was trying to setup the project locally and I get the following error when I try to get dependencies: ``` $ go get ./... # simple-vpn ./cmd_server.go:285:11: tapConfig.Name undefined (type water.Config has no field or method Name) ``` Did the `water` library change their interface for tapConfig? It might be worth using `dep` to lock down the dependencies to specific versions

skx commented

2019-02-20 12:42:05 -05:00

(Migrated from github.com)

Works for me, on a fresh host:

$ go get -u github.com/skx/simple-vpn
$ cd go/src/github.com/skx/simple-vpn
$ go build .
$ ./simple-vpn version
unreleased

I'll assume you're on Linux, if you're not that might explain it. Otherwise I see you ran "go get ./...", but not "go build ..".

Works for me, on a fresh host: $ go get -u github.com/skx/simple-vpn $ cd go/src/github.com/skx/simple-vpn $ go build . $ ./simple-vpn version unreleased I'll assume you're on Linux, if you're not that might explain it. Otherwise I see you ran "`go get ./...`", but not "`go build ..`".

samridh90 commented

2019-02-20 12:54:24 -05:00

(Migrated from github.com)

Thanks for checking, what version of golang are you using? I'll ensure I'm using the same version.
Edit: I'm on Mac OS X

Thanks for checking, what version of golang are you using? I'll ensure I'm using the same version. Edit: I'm on Mac OS X

skx commented

2019-02-20 12:54:44 -05:00

(Migrated from github.com)

  frodo ~ $ go version
  go version go1.11.4 linux/amd64

frodo ~ $ go version go version go1.11.4 linux/amd64

skx commented

2019-02-20 12:58:15 -05:00

(Migrated from github.com)

Ahh Mac OS X is probably going to cause you some pain :/

I see the same thing:

  frodo ~/go/src/github.com/skx/simple-vpn $ GOOS=darwin GOARCH=amd64 go build .
  ./cmd_server.go:285:11: tapConfig.Name undefined (type water.Config has no field or method Name)

Looks like that's noted in the source:

https://github.com/songgao/water/blob/master/syscalls_darwin.go#L127

Ahh Mac OS X is probably going to cause you some pain :/ I see the same thing: frodo ~/go/src/github.com/skx/simple-vpn $ GOOS=darwin GOARCH=amd64 go build . ./cmd_server.go:285:11: tapConfig.Name undefined (type water.Config has no field or method Name) Looks like that's noted in the source: * https://github.com/songgao/water/blob/master/syscalls_darwin.go#L127

skx commented

2019-02-20 12:58:45 -05:00

(Migrated from github.com)

You'd need to switch to tun-based stuff instead of tap-based stuff, and I'm not sure how much would be required to change :/

samridh90 commented

2019-02-20 13:01:44 -05:00

(Migrated from github.com)

That's OK, I'll use a linux VM instead. Easy enough to switch

samridh90 commented

2019-02-21 00:26:53 -05:00

(Migrated from github.com)

Ha, hit an OOM trying to start the server using a relatively "small" subnet like subnet = fde4:8dba:82e1:fefe::/64 because it tried to create the assigned map with 2^64 entries 😆

A couple of options to deal with this:

Limit the size of IPv6 subnets that can be used to /108 (a million IPs should be OK?). I tested this, it works reasonably well. No OOMs.
Lazily init the map, start with a max of X entries and then add more if you're out of unassigned IPs and there are IPs left in the subnet. This can still hit an OOM if you end up a with lot of clients though I don't imagine you're looking to support billions of clients.

I think it's OK to call out the limitation and just use smaller subnets. What do you think?

Ha, hit an OOM trying to start the server using a relatively "small" subnet like `subnet = fde4:8dba:82e1:fefe::/64` because it tried to create the `assigned` map with 2^64 entries 😆 A couple of options to deal with this: 1. Limit the size of IPv6 subnets that can be used to /108 (a million IPs should be OK?). I tested this, it works reasonably well. No OOMs. 2. Lazily init the map, start with a max of X entries and then add more if you're out of unassigned IPs and there are IPs left in the subnet. This can still hit an OOM if you end up a with _lot_ of clients though I don't imagine you're looking to support billions of clients. I think it's OK to call out the limitation and just use smaller subnets. What do you think?

skx commented

2019-02-21 01:11:04 -05:00

(Migrated from github.com)

I think I'd go for the second choice, because people will assume /64s - that's the most common routed range for IPv6 after all. (Pretty much the same as using a /32.)

So lazy allocation seems like it would make most sense.

I think I'd go for the second choice, because people will assume /64s - that's the most common routed range for IPv6 after all. (Pretty much the same as using a /32.) So lazy allocation seems like it would make most sense.

Rows
Columns

Support for IPv6 subnets #12