HTTP tunnel for SideroLink

[smira]

Rationale

In some environments, UDP is not allowed (only TCP to specific ports), or even no outbound traffic is allowed, so traffic can only go via an HTTP(s) proxy.

SideroLink is a very valuable tool to perform remote management of Talos machines.

Proposal

Use SideroLink API (a gRPC API used to provision Wireguard connection) as a channel to transport packets between Talos and SideroLink management endpoint.

gRPC API: use bi-directional stream gRPC API to send packet data.

Using kernel Wireguard implementation

In the network stack, create a tun interface on both ends.

Wireguard still works same way, as if there's no tunnel, so it provides encryption and authentication, and gRPC tunnel API doesn't have to provide that.

Wireguard packets as they leave the interface are routed to the tun device, where they get picked up by the userspace, sent over gRPC API to to the other end, injected into tun device, sent to the Wireguard for decryption.

Using userspace Wireguard implementation

Force to send packets over gRPC API instead of injecting into the Linux network stack.

Prior Art

• wstunnel
• https://www.reddit.com/r/WireGuard/comments/p6123n/wireguard_over_tcp_reviewing_existing_options_to/?utm_source=share&utm_medium=web2x&context=3