Implementation for the 9front operating system

Implementation for the 9front operating system

[Jacob Moody]

All,

I've been working on an implementation of wireguard for 9front.
I am starting to get to the point where I feel like the implementation is getting
pretty close, and its in a good spot to review before I do some tighter integration into 9front.

I know in the past I've seen some desire from the wg community to ensure that code using the wireguard
name at least be somewhat decent. So I wanted to share it here and get feedback if people felt inclined.

Grab the code from your choice of git hosts:
	git://shithub.us/moody/wg
	https://github.com/majiru/wg

I am happy to answer any questions regarding plan 9/9front specifics.

One note is that there's some stubs right now, the dynamic runtime addition
and subtraction of peers, and likewise the condition under which we send
cookie's is not implemented, that's pending the more tighter integration.

Thanks,
moody

Re: Implementation for the 9front operating system

[Jacob Moody]

On 8/4/26 16:08, Jacob Moody wrote:
> All,
> 
> I've been working on an implementation of wireguard for 9front.
> I am starting to get to the point where I feel like the implementation is getting
> pretty close, and its in a good spot to review before I do some tighter integration into 9front.
> 
> I know in the past I've seen some desire from the wg community to ensure that code using the wireguard
> name at least be somewhat decent. So I wanted to share it here and get feedback if people felt inclined.
> 
> Grab the code from your choice of git hosts:
> 	git://shithub.us/moody/wg
> 	https://github.com/majiru/wg
> 
> I am happy to answer any questions regarding plan 9/9front specifics.
> 
> One note is that there's some stubs right now, the dynamic runtime addition
> and subtraction of peers, and likewise the condition under which we send
> cookie's is not implemented, that's pending the more tighter integration.
> 
> Thanks,
> moody
> 

Just giving a bump to this, sorry I had sent two mails because I was not sure if the first got dropped with the
moderation queue taking so long.

It's totally fine if there's no interest, 9front is fairly niche, I just wanted to avoid a faux pas
in shipping something without consulting the broader community.

With that said, after haven taken a break from this for a bit I plan to work on this a bit more and upstream it.
If folks are interested but just need more time to look and would prefer that happen before I merge anything just LMK.

Thanks,
moody

Re: Implementation for the 9front operating system

[Jason A. Donenfeld]

Hi Moody,

On Tue, Aug 04, 2026 at 04:08:07PM -0500, Jacob Moody wrote:
> All,
> 
> I've been working on an implementation of wireguard for 9front.
> I am starting to get to the point where I feel like the implementation is getting
> pretty close, and its in a good spot to review before I do some tighter integration into 9front.
> 
> I know in the past I've seen some desire from the wg community to ensure that code using the wireguard
> name at least be somewhat decent. So I wanted to share it here and get feedback if people felt inclined.
> 
> Grab the code from your choice of git hosts:
> 	git://shithub.us/moody/wg
> 	https://github.com/majiru/wg
> 
> I am happy to answer any questions regarding plan 9/9front specifics.
> 
> One note is that there's some stubs right now, the dynamic runtime addition
> and subtraction of peers, and likewise the condition under which we send
> cookie's is not implemented, that's pending the more tighter integration.

Cool project! Would be happy to look at it together at some point. Let
me know when you feel like it's "complete" and matches the various
semantics of the Linux implementation, and then maybe we can do a
read through together. I've always wanted to learn more about 9front.

Jason

Re: Implementation for the 9front operating system

[Jacob Moody]

On 11/10/26 10:15, Jason A. Donenfeld wrote:
> Hi Moody,
> 
> On Tue, Aug 04, 2026 at 04:08:07PM -0500, Jacob Moody wrote:
>> All,
>>
>> I've been working on an implementation of wireguard for 9front.
>> I am starting to get to the point where I feel like the implementation is getting
>> pretty close, and its in a good spot to review before I do some tighter integration into 9front.
>>
>> I know in the past I've seen some desire from the wg community to ensure that code using the wireguard
>> name at least be somewhat decent. So I wanted to share it here and get feedback if people felt inclined.
>>
>> Grab the code from your choice of git hosts:
>> 	git://shithub.us/moody/wg
>> 	https://github.com/majiru/wg
>>
>> I am happy to answer any questions regarding plan 9/9front specifics.
>>
>> One note is that there's some stubs right now, the dynamic runtime addition
>> and subtraction of peers, and likewise the condition under which we send
>> cookie's is not implemented, that's pending the more tighter integration.
> 
> Cool project! Would be happy to look at it together at some point. Let
> me know when you feel like it's "complete" and matches the various
> semantics of the Linux implementation, and then maybe we can do a
> read through together. I've always wanted to learn more about 9front.
> 
Thanks! Very excited to get some more eyes on it. I can give this thread a ping
when I feel its at a more complete state.

I don't anticipate the flow of the code to change too much, but for a rough idea of
what remains:

- Integration into our key storage file system (auth/factotum), I have a protocol for this
  sketched out but need to finish and implement it with the existing code.
- Figure out a way to provide changes in peers at runtime. Plan 9 has no ioctl's or something
  similar, so perhaps the wg code exposes a filesystem for modifications, still undecided.

Another thing, I could be misremembering (I got nerd sniped to go look at some other things), but
I believe the portable implementation gets some sort of peek into the UDP queue to determine if we
should start sending cookies/PoW challenges. We currently do not have this sort of information from
userspace in 9front, my best semantic equivalence was to count auth_rpc (to auth/factotum) in flight.
For this implementation that is likely the thing to "guard against", but I understand this is a slight
departure.

Also curious, is there some further reading/discussion for cases in which an initiator sends a PoW challenge
back to a responder? I understand that the P2P nature and potential role-switching makes the individual role
of an endpoint fluid over a long enough time frame, however I'd like to understand a bit more.

Cheers,
Moody