add gvisor based service library

[d4l3k]

This adds a gvisor based service library which allows for using a user space TCP stack instead of a native tun device.

This is an initial implementation and only handles TCP and ipv4 connections. This implementation is a bit rough so feedback is welcome 🙂

This refactors the Main function to take in a DeviceFactory -- so any users that require tunFd need to use NewFdDeviceFromConfig(tunFd) as the factory instead

See examples/go_service/main.go for how this might be used

Test plan:

$ go test ./service

Manual

$ go run ./examples/go_service
$ socat 192.168.100.2 -
hello world
asdf
echo: "asdf"
duck
echo: "duck"

[salesforce-cla]

Thanks for the contribution! Before we can merge this, we need @d4l3k to sign the Salesforce Inc. Contributor License Agreement.

[brad-defined]

only a couple minor comments from what I saw. I think we can land this PR and update it as needed with future PRs.

Other thoughts (which I don't think should be required for the PR to land)

• It'd be fun to write some performance tests
• I expect the io.Pipe used doesn't scale up, but this can be updated in a future PR (along with performance tests that can verify or disprove my suspicion.)

[brad-defined]

I'm OK with this landing. It adds some nice, useful functionality, modifies the Main() interface a little, and doesn't appear to me to add any interfaces that we can't live with going forward.

Will see if @wadey or @nbrownus have any thoughts on it.

[brad-defined]

Error: service/service.go:111:10: undefined: context.AfterFunc

My bad...apparently context.AfterFunc in go 1.21.0, but Nebula isn't on that golang version yet; it reduces Windows supported O/S's. Sorry! Will need to implement that functionality without that context function...

[johnmaguire]

I believe this PR would close #538.

[maggie44]

I'm curious to try this out, but would be helpful to know the current state of play. It says only handles TCP and ipv4 connections, presumably referring to between hosts? I think ipv4 is only supported between hosts anyway? So the main difference right now it is doesn't support UDP connections between hosts?

Then it's just a question of performance pending benchmarks?

[d4l3k]

@maggie44 I'm currently using this for my own (limited) use and it's been working just fine. You're right that ipv6 isn't supported by Nebula currently so that's just behavior as usual so just UDP isn't supported.

I've been using this for SSH and HTTP connections without any issues