How to test the QUIC http3 UDP transport?

[9to1url]

I found the doc on website still using ws wss, anything I need to change it in Gateway? thanks

[SajjadPourali]

The gateway still uses WS/WSS; the QUIC connections are used only for peer-to-peer (P2P) connections at this time. Therefore, you need to have the same configuration.

[9to1url]

Another question: for WS/WSS can it tunnel UDP traffic? thanks

[SajjadPourali]

Is that possible to enable Gateway also using QUIC/HTTP3 ? thanks

It is part of the future plans

Another question: for WS/WSS can it tunnel UDP traffic? thanks

Yes, it can. just use -u arg to create a udp tunnel on top of the WS/WSS

[9to1url]

I check all the --help can't find the -u option, could you give the command line examples?

[SajjadPourali]

When using the proxy mode, it automatically detects and transfers UDP packets using the SOCKS5 protocol. For the connect or forward modes, you can use the -u option.

narrowlink f -h
narrowlink c -h

https://github.com/narrowlink/narrowlink/blob/main/client/forward.help.arg#L18

narrowlink f -un <agent name> <remote_addr:remote_port>

https://github.com/narrowlink/narrowlink/blob/main/client/connect.help.arg#L17

narrowlink c -un <agent name> <remote_addr:remote_port>

Options:
-u: UDP mode
-n: Agent name
-un: UDP mode + Agent name

---

If you are looking for a method to capture system-wide network traffic without using a proxy, I am currently working on it: #55

[9to1url]

great, but I have trouble to generate the token-generator.yaml

I edit the sample one in token-generator code, but still get this:
❯ narrowlink-token-generator token-generator.yaml
Error: InvalidConfig

secret: [118,101,72,65,78,82,69,78] # The secret for signing tokens, It must be the same as the gateway token secret, it is as byte array
tokens: # list of tokens
  - !Client # client token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65 # client uid, please use a unique uid for each user
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    policies: [1] # list of policy ids, it must be the same as the policy id in the client policy token, all the policies must be satisfied

  - !ClientPolicy # client policy token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    pid: 1 # policy id, it must be the same as the policy id in the client token
    policy: # policies for this client
      type: !BlackList # !WhiteList or !BlackList
      policies: # list of policies
        - !Ip # policy based on the destination ip address
          - !Any # !Any means any agent, !Agent agent_name means the agent with the name agent_name
          - UDP # protocol

[SajjadPourali]

great, but I have trouble to generate the token-generator.yaml

I edit the sample one in token-generator code, but still get this: ❯ narrowlink-token-generator token-generator.yaml Error: InvalidConfig

secret: [118,101,72,65,78,82,69,78] # The secret for signing tokens, It must be the same as the gateway token secret, it is as byte array
tokens: # list of tokens
  - !Client # client token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65 # client uid, please use a unique uid for each user
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    policies: [1] # list of policy ids, it must be the same as the policy id in the client policy token, all the policies must be satisfied

  - !ClientPolicy # client policy token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    pid: 1 # policy id, it must be the same as the policy id in the client token
    policy: # policies for this client
      type: !BlackList # !WhiteList or !BlackList
      policies: # list of policies
        - !Ip # policy based on the destination ip address
          - !Any # !Any means any agent, !Agent agent_name means the agent with the name agent_name
          - UDP # protocol

It seems that you forgot to mention IP address the port.

secret: [118,101,72,65,78,82,69,78] # The secret for signing tokens, It must be the same as the gateway token secret, it is as byte array
tokens: # list of tokens
  - !Client # client token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65 # client uid, please use a unique uid for each user
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    policies: [1] # list of policy ids, it must be the same as the policy id in the client policy token, all the policies must be satisfied

  - !ClientPolicy # client policy token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    pid: 1 # policy id, it must be the same as the policy id in the client token
    policy: # policies for this client
      type: !BlackList # !WhiteList or !BlackList
      policies: # list of policies
        - !Ip # policy based on the destination ip address
          - !Any # !Any means any agent, !Agent agent_name means the agent with the name agent_name
          - 0.0.0.0/0 # destination domain name
          - 443 # destination port
          - UDP # protocol

The policy token is optional, so you can create something like:

secret: [118,101,72,65,78,82,69,78] # The secret for signing tokens, It must be the same as the gateway token secret, it is as byte array
tokens: # list of tokens
  - !Client # client token
    uid: 1a3248b2-d78e-415b-abbc-4aa781afae65 # client uid, please use a unique uid for each user
    name: client01 # client name, please use a unique name for each client
    exp: 1710227806 # expiration time in seconds since epoch
    # policies: [] # list of policy ids, it must be the same as the policy id in the client policy token, all the policies must be satisfied

[9to1url]

@SajjadPourali I want to try QUIC impl now, did you merged to Main branch? :-)

[9to1url]

Also lwIP version you are using in https://github.com/SajjadPourali/netstack-lwip
Could you advise? thanks

[SajjadPourali]

Yes, it is available in the main branch. Feel free to try. Please note that some of the commands have changed, so make sure to check the args help before executing your commands

[9to1url]

yaml config files format changed or not? thanks

[SajjadPourali]

I suggest you to update the config as well.

[SajjadPourali]

Also lwIP version you are using in https://github.com/SajjadPourali/netstack-lwip Could you advise? thanks

You don't need to take any action for lwip as it's included in the source code out of the box. However, lwip is not well fit for narrowlink, and I am working on creating a pure Rust TCP/IP stack to replace lwip. It is almost done; I have some troubles with rescheduling packet losses, which will be addressed soon.

[9to1url]

Great :-)

smolTCP depends on too much also thru-put looks like not very well. ok, wait you.