Okay. Hello everyone. Welcome. My name is Taiwan from Taiwan and I'm here to take
for the 4th turn 26 to tell about the stem mesh, which is my side project. I created it.
This is my presentation about the stem mesh, go build in the build build, work out mesh
with us and the self-host infrastructures. So, a quick introduction about me. I am the
cloud and there were social architects for 70 years old and I have several speakers experience
theirs and there's another project called EZIO if you have an interest in about me. We have
the general what is the stem mesh go and what does the mesh go try to solve and also why we
describe the stem implementations in the different platform for example, Linux, PreviousD
and also the how it works with the wire guard canal module directly and the block is
started so that is we doubt any self-hosting service and we can minimize the binary size
for the open-doority or embedded router mobile router or something. We will explain the next
part for the stem mesh go. Before we start, I will expand you already know something basic about
the work out and step-of-firework, different types of the NETE, SIGNAT and EFI, FN, also the
BASAX down ProCo and also the UTP whole-pound concept. Okay so what is the damage go? This is
the key update, this is the weather helper to help those device are behind the fireworks or the
NETE's and we want to try to make the true peer experience directly without any
release over VBN hub or when you think and another we want to report is we don't need any self-host
NETE's if we have when not just a VBN hub, right? So then we do this as a cross-platform and cross-architectures
support in M.D. 64, M.C.T.4 where MAPs were Linux and BST and MegaOS as well and this is inspired by
very long-goed post-dense talk which called WireGopioch Peers thanks to the post-dense and says him.
And this is VBN hub V2 or later's license and you can get the projects under the link with
GENICURACOS. Okay so what we want to try to solve? Let me explain WireGopioch to be still
need the proxy to traffic, to proxy the traffic, to do the stops, temporarily, not currently.
Other solutions sometimes will need still NETE's self-hosting service, for example if you want to
fully control your test scale, you will need to host your test scale server for the coordinator
and central servers. We don't want to fork in, we're embedded WireGopioch because that will be a
mess if WireGopioch is updating or there's something breaking when WireGopioch is
upgrade or something. So we want to try to share the same port. When WireGopioch is in
WireGopioch module, it sends to you and we can direct reuse it. Okay so let me
turns that is WireGopioch peer to approach. You can see there's a proxy there and there will
list them down the property and the proxy and WireGopioch will have layers on this interface
and this apport which you can call port 8. The proxy will need to do the stop first and do the
set information into the information is changed central or something and proxy will need to
config the WireGopioch module to connect to itself. So the proxy team will need to proxy the
traffic and do the stop as well and do lots of things on there. So that means your WireGopioch
instance is not the right connect to your remote peers. This is the basic concept.
Okay so how do we try to solve this? We want to remove the proxy. We want to reuse the
sample as the WireGopioch directly listens to it and so we can connect WireGopioch directly
to the remote peer without any proxy involved. We don't want to have the several hosting
server because if we have for example we have the POPPIP and we can just easy to
head on the VPN hub or turn on a head scale to do the connect servers. We try not to do that
because maybe we don't have and we don't have need to. Okay so so we want to use the
proxy instance to replace the self hosting instance and we don't want to forget and
badger the WireGopioch so we don't want to patch so that means even WireGopioch is update,
WireGopioch is update, everything wants to be fine. Okay so we start about the
our strong implementation details here so we want to reuse the WireGopioch for the
start. So we want to ensure the public information IPN Pro which is debugger from the start
is the same as WireGopioch. I'm sorry. So our approach will be like this. The
Stomach go under there is only to the stop and overthrow the sample as a poor eight and we
will only control the WireGopioch so we will set in on the endpoint there and we don't do any
proxy traffic so everything in the traffic well go through the WireGopioch directly
without our involved. Okay so how to implement less to reuse because you can not
descend to the understandport in the linear spiteful. So we use the growth circuit. So we
will need to use the growth circuit with the BPS to construct the UTPs, Stomach informations.
By myself so I can send out to the Stomach circuit and get received the growth circuit from
Stomach circuit to get the Stomach response and get all public informations and all the things
well go through the list growth circuit to make sure other things all the pages well go through
the WireGopioch directly. So we use the CBBF and let's unlock the linear.
Previously and Mac always had a different approach about this because there are
limitations the growth circuit cannot receive anything. So you can send something out from the
circuit but you can not receive anything from them. So we need to use another things is BBF
device to do the capture to listen on less interface with the filter to make sure we can grab
the Stomach response back to with the Stomach port and all the traffic will go through the
WireGopioch directly without our import. Because we need to monitoring all the interface and
FBS is sometimes we'll have the firework and do the redirect rate with some things.
So we will need to monitor all interface to make sure we will capture the correct
or make sure we can capture all the Stomach response to make sure we get a correct one.
Okay so how wait what why it can work with the remote module?
Direct because we are doing the cyclostom. We didn't patch and these things inside the
record. We don't do that. So we can just use the radar on the OS feature to hijack the
send USB port to do the Stomach response as request and get the response from them or
other place for example the BBF device. We only do the control plane only. So when we get the
Stomach, we get information from the other peers. We will only configure WireGopioch using the
WireGopioch control. We will not produce any traffic. So that means it can because I only use
the WireGopioch control. So that means if the underlay is WireGopioch control, let's open it for me
because I just have a side card controller to control it. Okay so how do we do the peer
info the exchange? Because the Stom is the one way I can only get the information by myself
and need to send out to the remote set another important. So the missing part is we don't have
a change way to do this. Why not just sell posts? A platform to exchange because we
can just put it on my service and other points and grab information from the service.
So that means that you will need the public IP or any public service to host the VPN. If you
have the public IP, why not just work on VPN card or something to do the relay, it is really simple,
land this way, right? So we don't have, so we need to do something without the self-hosted.
Okay so let me introduce the Parkinson's with all the self-hosting service.
We try to rely on the generic backend storage, which is maybe a safe thing, public key value service,
like CloudVertilX, TXT, or something, any things. We need security exchange. So we will
increase by the self-host, which is reuse the workarchy directly. We will have the workarchy
pairs wide, we have the rare key pairs, we have our key pairs. So we can increase by loss key pairs directly.
We can directly connect to any key value storage can be this model. So if land model is
maybe IPFS or something like the CloudVertilXT, because it will be a key and value models,
and we can try to implement the plugin to fit the storage solutions here.
Also let's introduce the key about it. So if we have the local public key and we want to send to
the remote public key about our information, we will have conquered our keys, ways of the
staircase, and do the show on to make sure that no one will get our public key, because the
public key here is identify IDs, so we don't want anyone else, so we use hash to make sure
this is unique, and no one will know that, and convert into the hack stream, because not own the
key value storage can put a non-printable character with some things.
And above the video, we will have a pleasant file, justzons, ways of IPv4 entry, and the IPv6
entries, which means if you would retrieve your public info from the store, you will get
IPv4, and we will do the IPv6 as well, to make sure we can get all of them as green for eye,
and tribes, and hacks, and put this into the storage, and the outside can grab the information
and deep-scrow it to get the remote endpoint information to connect, right?
Okay, so the API will look at this. This is simple key, is a hack stream value, is a hack string,
and we have the plugin that sets that your key and value, and what we want to get from the
other size, or we will plug it, and get information from the other size, right?
If you need, maybe you can visualize the hack stream to the other format to fit your
plug-in system, because sometimes hacks is not too long, or you need to compare it with something,
so it is our APIs, and you can do it inside your plug-in to do another kind of
serializing and results. Okay, so this is an example for the conferred DNS, also we
reuse the DNS. The TX is very rare, as the key value storage, because TXKVL has the key,
which is a domain name, and the value, which is a content of the TXT, we only need to make sure
we have only one entry inside that with LATOMEN, with a LATXT record, so we can do this as
7 is onto the conferred or any other DNS, because the TXCV record is a standard features, right?
So, you can use the other pocket, other locations, or something to set up the
pocket data, to store you as a just make sure your two peers can have the same SS to grab,
like information from the same storage. So, you can still keep up in, so I put the key in the
stop domain interface, and I put the value for the TXT inside our context, so you have the
example picture that is really long name, with really long contests, and DNS only,
and TXTL is also, because I grabbed from the cloud fair API, so I didn't do any DNS
query or something, so that TXTL is not really important, because I will always get the update once.
Okay, okay, and because I tried to do this to, in the embedded system, for example,
do know the it will be creating a draw tool, which is very small, and a miss pass router,
and which way is the wire guard support there, and I tried to install out it, but the
splash is a little bit smaller than I sped, so I need to compress it, where we can
straight the binary size, to make sure we can put it into the maybe mobile router,
LT router, or any industrial grade router to let you want to connect to, you want to direct connect to it.
And the memory footprint is low still, we only use the TXTMPs of the RAM, because the
UPAX compression, if you don't do the UPAX compression, there was much lower than 20 MPs,
and this is good for embedded system, it's simple, it's open WRT, or add router, or anything,
okay, and the next for the damage go, we are testing the four IPv6 support right now, because
nowadays, IPv6 is more use-dege and for the IPv4, but we still need to bypass the stay-for-fire
worst support, we still need to, so we are testing the IPv6 support, and another thing is we are trying to
do a pin module detection right now, we are using a fixed interval for example, five minutes,
we'll do the start again, and query the information of the remote endpoint and set up the local
endpoint for that, and we are trying to do the pin module detection, if the pin fail,
we will try to restart whole process directly, so that means we don't need to work five minutes,
we'll fix intervals, we can do the small reconnaissance, and another way is we can do the
embed hoppids, which means because we can use a Roussakid to send from the workout, dis-enport to another
side to do the hoppids, and we can grab the hoppids to make sure if they're still alive in the
other side, because there will be a little bit kind of the BPF too, I'm sorry, BFD does, I'm sorry,
so if I didn't receive any hoppids, I can assign the other side stat, or the tunnel is disconnection,
so I need to do the hoppids again, to make sure I can reconnect to the other side, so at that
moment we can disable the fixed interval, or we can send the fixed interval to very, very long,
to make sure we can do maybe one hour at a time, and other time we will check if it is
decongation and do the smart reconnaissance, and another thing is we want to test with
satellite networks, which is installing one web or anything, but this is not printing,
and it's taking for us for right now, starting is not useful in Taiwan, so we may have some,
if you are willing to test, I'm happy to give you some guide for testing the StarMeshGo
within the satellite networks, and please quick introduction, we are close-up from Taiwan,
and we are the biggest open source conference in HR Corps, host with the Wubanko, HR,
we will hold events in August to this year with wallwars, speakers, and attendees,
you can scan the QR code with just search open, close-up, okay, if you have any question
discussion and it's that you can open an issue in the GitHub, or can't admit the link in the
rear message to me, okay, thank you. Great talk. Yeah, we do have time for some questions,
so we'll run around with the mic. Thank you for your talk, it was very interesting.
I'm curious about the warning formation you put as hash when you do peer discovery,
using a call-flare for example, or other key value source. Currently, I use the call-flare
directly, and I didn't do any other plugins, but our module can support others. Yeah, but more
curious on what is the information, what is the key value there? Okay, the key value is about this,
so there will be my information to send to the other side, so you will store this inside the
call-flare TSE contents. Yeah, this is the external information, right, that the capture. Yeah, and so
that meant is local is center to the destination, so if you write the results or you have another
remote endpoint to want to send to me, peer is a remote endpoint, here is me, okay, so I can
determine which message I should get because the final one is the destination, so I only need to grab
this, okay, and I don't do the key is changed already, you need to know the analysis of the
public key to make sure I can grab the source and destination to calculate the shot and get from the
call-flare or the progress, is that yeah, thank you. Any other questions? Sure, hands,
okay, one up front, excuse me. Hi, thank you for the talk, I just want to know the just to
that I understand, one of your goals is or is not to do whole punching through not, like this
done mesh go do that, or does it just to share information about IP addresses and ports between
the two peers. So that makes sense. I only want to try to come at these two peers, and all the
pause I will not really care. For example, if you set up your route here and there, and you can
maybe go through the default route to another peer to go to outside to the internet, and we don't
care about that. We only care if we can connect to the two-wire-guard device behind the net,
and because once it's connected, we can consider that it's a cable, so we can do maybe BGP
Dominican route in between two, and we can do anything about that, so you can set up your route
on your demand, or you can do some setting on the Dominican route to learn from the HR other
was on the six. Is that answer your question? Yes. Okay, and here is there, and questions, I think.
Okay, one more. Hi, I wonder, once you have a communication established, could you put
new learning information inside the heartbeaked? Yes, that is possible, but there will be a
future plan, or something, because if you want to put more things inside the Rosarket, that means you
will have more traffic through the traffic, and because of the Rosarket behavior, so the
response will also send to the wire-guard demands. So that means that it's too much information,
they will disperse the wire-guard cannon module to describe the traffic, so that means the
performance a little bit lower if you put too much information there. Thank you. Thank you.