Setting the transit namespace at runtime
ju.orth at gmail.com
Mon Sep 3 18:16:58 CEST 2018
Each Wireguard device remembers the network namespace in which it was created.
In the documentation this is called the birthplace namespace  but I'll be
calling it the transit namespace.
Let's say I create a Wireguard device `wg0` in a network namespace called
`vpn`. Then I would like to be able to run
# wg set wg0 transit-namespace /proc/1/ns/net
to change the Wireguard UDP socket to live in the init namespace.
This has the following advantages over creating the device in the init
namespace and then moving it to the `vpn` namespace:
* If multiple processes are creating Wireguard devices at the same time, then
their device namespaces are isolated as long as each process uses its own
network namespace. This means that there is no problem if two processes try
to create the `wg0` device at the same time.
* The intention is for the `wg0` device to be used only within the `vpn`
namespace. It does not feel clean that the device has to live in the init
namespace for an arbitrarily short but non-zero amount of time. This also
leaks the existence of the `wg0` device to all processes living in the init
Could such a feature be implemented?
More information about the WireGuard