5 ms·

> As a "security professional", I kind of don't care whether this is in-kernel or not. As a "kernel professional", I'm laughing incredulously at this. A lot.

tptacek 10y ago
Do go on.
- teacup50 10y ago
  What do you want me to say? I'd think it ought to be self-evident that greater risks exist when operating in a single shared memory space at ring 0. If nothing else, the trampoline to privilege is already complete; very little stands between a vulnerability and an active exploit. The end goal ought to be getting more things out-of-ring 0, not adding more things to it -- I'm never going to say that "I'm not concerned" or that "It's a non-issue" (although I will say that I'm a lot more worried about the massive amounts of crap code in WiFi drivers than I am about a VPN implementation, generally speaking). In the OpenVPN case, numerous vulnerabilities have been limited to only DoS exploits due to the zealous use of assert(); in the kernel case, that brings down your machine, and quite often, assertions are compiled out of the release kernel due to their overhead in critical paths (whether they should be is another question). We do have ways to tackle the kernel->userspace performance divide when it comes to packet processing, e.g: https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4 https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4 netmap is a framework for extremely fast and efficient packet I/O for both userspace and kernel clients. It runs on FreeBSD and Linux, and includes VALE, a very fast and modular in-kernel software switch/data- plane, and netmap pipes, a shared memory packet transport channel. All these are accessed interchangeably with the same API. netmap, VALE and netmap pipes are at least one order of magnitude faster than standard OS mechanisms (sockets, bpf, tun/tap interfaces, native switches, pipes), reaching 14.88 million packets per second (Mpps) with much less than one core on a 10 Gbit NIC, about 20 Mpps per core for VALE ports, and over 100 Mpps for netmap pipes. Userspace clients can dynamically switch NICs into netmap mode and send and receive raw packets through memory mapped buffers. Similarly, VALE switch instances and ports, and netmap pipes can be created dynamically, providing high speed packet I/O between processes, virtual machines, NICs and the host stack.
  - tptacek 10y ago
    I addressed CPL0 vs CPL3 elsewhere on the thread. All things are not equal here. OpenVPN uses TLS. The whole point of WireGuard is to shake off that complex baggage.
    - teacup50 10y ago
      > OpenVPN uses TLS. Granted, but this should generally be behind a shared secret HMAC, according to best practices, limiting the scope to those with the key in hand. > The whole point of WireGuard is to shake off that complex baggage. That's great, but also has nothing to do with running in-kernel. I'm not ready to give either product a clear pass on their risk profiles.
    - uudecode 10y ago
      It's possible to shake off OpenVPN and TLS without shaking off use of tun/tap. I use a tun/tap based "VPN" (overlay) and I quite like it. One could even add NaCl to it if they were so inclined. I sometimes think Apple removed /dev/tap from iOS because it provided too much potential freedom. Not every user needs in-kernel performance for their daily routine but there's certainly an argument that every user could use a decent "VPN" that could run on all their computers. Alas, OpenVPN mindshare is rather strong, to the detriment of existing or future userspace alternatives.

tptacek 10y ago

Do go on.

teacup50 10y ago
What do you want me to say? I'd think it ought to be self-evident that greater risks exist when operating in a single shared memory space at ring 0. If nothing else, the trampoline to privilege is already complete; very little stands between a vulnerability and an active exploit. The end goal ought to be getting more things out-of-ring 0, not adding more things to it -- I'm never going to say that "I'm not concerned" or that "It's a non-issue" (although I will say that I'm a lot more worried about the massive amounts of crap code in WiFi drivers than I am about a VPN implementation, generally speaking). In the OpenVPN case, numerous vulnerabilities have been limited to only DoS exploits due to the zealous use of assert(); in the kernel case, that brings down your machine, and quite often, assertions are compiled out of the release kernel due to their overhead in critical paths (whether they should be is another question). We do have ways to tackle the kernel->userspace performance divide when it comes to packet processing, e.g: https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4 https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4 netmap is a framework for extremely fast and efficient packet I/O for both userspace and kernel clients. It runs on FreeBSD and Linux, and includes VALE, a very fast and modular in-kernel software switch/data- plane, and netmap pipes, a shared memory packet transport channel. All these are accessed interchangeably with the same API. netmap, VALE and netmap pipes are at least one order of magnitude faster than standard OS mechanisms (sockets, bpf, tun/tap interfaces, native switches, pipes), reaching 14.88 million packets per second (Mpps) with much less than one core on a 10 Gbit NIC, about 20 Mpps per core for VALE ports, and over 100 Mpps for netmap pipes. Userspace clients can dynamically switch NICs into netmap mode and send and receive raw packets through memory mapped buffers. Similarly, VALE switch instances and ports, and netmap pipes can be created dynamically, providing high speed packet I/O between processes, virtual machines, NICs and the host stack.
- tptacek 10y ago
  I addressed CPL0 vs CPL3 elsewhere on the thread. All things are not equal here. OpenVPN uses TLS. The whole point of WireGuard is to shake off that complex baggage.
  - teacup50 10y ago
    > OpenVPN uses TLS. Granted, but this should generally be behind a shared secret HMAC, according to best practices, limiting the scope to those with the key in hand. > The whole point of WireGuard is to shake off that complex baggage. That's great, but also has nothing to do with running in-kernel. I'm not ready to give either product a clear pass on their risk profiles.
  - uudecode 10y ago
    It's possible to shake off OpenVPN and TLS without shaking off use of tun/tap. I use a tun/tap based "VPN" (overlay) and I quite like it. One could even add NaCl to it if they were so inclined. I sometimes think Apple removed /dev/tap from iOS because it provided too much potential freedom. Not every user needs in-kernel performance for their daily routine but there's certainly an argument that every user could use a decent "VPN" that could run on all their computers. Alas, OpenVPN mindshare is rather strong, to the detriment of existing or future userspace alternatives.