6 ms·
WireGuard: Next Generation Secure Kernel Network Tunnel
- sargun 10y agoIt seems worrying to me to put something so complicated in the kernel. Perhaps, not even that, but it feels to me as though the fact that this requires in tree changes seems wrong, given the way that networking is going is to enable these network functions via mechanisms such as BPF.
- lgierth 10y agoI'm less worried about that because it's so small. WireGuard is ~4k LOC -- thus measurably less complicated than OpenVPN (~100k LOC + OpenSSL), StrongSwan (~410k), or SoftEther (~330k). Numbers taken from slide 5 of https://www.wireguard.io/talks/codeblue2016-slides-en.pdf https://www.wireguard.io/talks/codeblue2016-slides-en.pdf Moving to kernelspace brings it up to par with plain IP networking, minus a bit of overhead for the cryptographic operations. Userspace networking has overhead which is hard to overcome: context switching and CPU cache invalidation, copying packets between kernelspace and userspace, etc.
- sargun 10y agoYeah, but BPF can operate in kernel space directly on SKBs. If you look at the XDP work, there's a lot of promise. In fact I've implemented ECC in BPF -- other than the state, and negotiation components, I don't see why this can't adapt BPF.
- xorcist 10y agoThat sounds crazy! Was it just for fun or is there a use case? What's performance like?
- sargun 10y agoThis was actually around the time that WireGuard initially announced. We had a product that we ship on-prem that needs end-to-end security guarantees. Unfortunately, IPSec has a bunch of issues around IKE and maintaining sanity at a medium node count. Our implementation was not..performant, hence why we abandoned it. Our thought was that we could make it work, but instead we ended up building our own key negotiation / management code atop some other stuff we had in order to setup the IPSec SAs.
- zx2c4 10y agoSidechannel free? High performance? Multi core? I'd love to see this. Sounds really interesting. What curve? Got source?
- sargun 10y agoSidechannel free - Curve25519 is meant to be resistant to side channel attacks. We didn't spend much time seeing if the actual cryptographic code was secure. Multicore - Yeah, we basically got that for free with BPF/XDP. It's kinda neat. You just load programs, and arrays get processes in parallel. We didn't have much state because we used random nonces, so there was no need for synchronization. Unfortunately, the code will not be public because the project was closed source, it never shipped, and I'm no longer with the organization that paid for the work.
- foobiekr 10y agoTrireme?
- sargun 10y agoWhat?
- foobiekr 10y agoTrireme?
- tptacek 10y agoYou implemented an elliptic curve scalar multiplication in BPF bytecode? Why? Which curve?
- sargun 10y agoSo, for one of the implementations, yes, we implemented Curve25519 inside of the Kernel. Basically, every node was pushed into a map with the association of IP/Port to key data. At the reception of a packet, if we didn't have a key, we'd punt the packet to userspace, asking it to do an exchange. For some reason -- That I forget, we ended up putting the entire key into each packet. I think that when the "exchange" happened in userspace, we didn't actually store the entire box and key, instead we just generated an association specific key, and we wanted to be able to rotate this quickly. I think we just came up with the fact that doing the derivation was cheap enough that it'd be better to do it on every message. What would then happen is that if we didn't have a box cached, we would calculate it, and this code was implemented as a helper function outside of the BPF itself. Then we did Poly1305 + XSalsa20 with a random nonce. Why? Because IPSec is fucking complicated, and because I can?
- wolf550e 10y agoHas a cryptographer ever looked at the protocol you invented? Maybe doing the asymmetric crypto on every packet is just a harmless performance problem that, but maybe you invented something insecure. Or is the protocol strictly from the spec (NaCl?) and just the implementation strange?
- sargun 10y agoNo, the project never got that far. I did discuss with a security researcher though, and it was secure, but it lacked features like PFS, and the handshake protocol could leak information. In addition, using "pure" random nonces has all sorts of interesting problems.
- cakeface 10y agoThis comment seems interesting! Unfortunately I have no idea what you are saying. Can you unpack the acronyms for me?
- sargun 10y agoSorry! Once you get deep enough in this tech, you seem to have more in common with an alien language than actual common English. * BPF - Berkeley Packet Filter - BPF is a safe, in-kernel virtual machine that's meant to be able to introduce next generation functionality into the Kernel: https://lwn.net/Articles/603983/ https://lwn.net/Articles/603983/ * ECC - Elliptical Curve Encryption - Enough said * XDP - eXpress Data Plane - This is a project atop BPF that's being merged into the Kernel to implement programmability features in the kernel, without requiring that people write crazypants code or unsafe code. It's backed, and used by Facebook. If you're familiar with Intel's DPDK, it's similar. * SKB - Socket Buffers - These are the components that make up the data you send over the wire in the Kernel. When they come out of the kernel, they have to be flattened, and copied which is expensive. This is one of the biggest problems with usermode networking.
- XorNot 10y agoIt's not clear to me that this really solves any of the UI and management problems associated with VPNs. I'm sure the new crypto-design is interesting, but exchanging SSH public keys is actually a huge logistical hassle which scales very poorly. The other thing is "container-ready" ... well it just isn't. I can use OpenVPN to do the same interface migration trick with a container today. That's not the challenge - the challenge is things like managing what happens when the VPN interface goes down and I need to recycle and reconfigure that interface (at which point you end up back at "allocate a private address space, stick the VPN container in a new address space, play with IPTables there to make sure losing the VPN routes doesn't mean you start routing over the regular NIC".
- baby 10y ago> but exchanging SSH public keys is actually a huge logistical hassle which scales very poorly. How do current solutions tackle this? It seems that at some point, if you want something to be two-way authenticated then you need to exchange some public keys.
- XorNot 10y agoWell that's the thing: SSH has recently gained support for signed public keys - i.e. x.509 style certificate authorities. Outside of that you have things like monkeysphere doing the same with GPG, or simpler things like LDAP scripts which just check the key against LDAP (Hashicorp Vault does something similar). But it's why I'm skeptical the UI is substantially improved: the simplest UI for VPN tends to be pre-shared keys - because everything more complicated simplifies to that interface "somehow everyone needs to agree who's allowed in" - and differs to SSH because SSH has more of a one-way contract "let this connection in, but I can't make the same connection back".
- baby 10y ago> the simplest UI for VPN tends to be pre-shared keys that's what wireguard is doing.
- dguido 10y agoIf you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.
- MohammadLee 10y agoAlgo looks good if you stick to IPSEC but WireGuard is years ahead, and much sounder. Considering WireGuard's promising start, imo it's OK if platform support isn't broad yet. You don't need Solaris support to start having your state-of-the art VPN between your servers and workstations.
- sandGorgon 10y agoWhat is a good hosted ipsec vpn? also is there built in support for networkmanager?
- dguido 10y agoThe entire point of Algo is to avoid using a hosted VPN because they're awesomely insecure. More here: https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29
- xorcist 10y agoAnother good alternative to IPsec is OpenVPN. It's called a "TLS VPN" but really, it simplifies TLS a lot and doesn't use many of the complicated parts of the protocol. It's much more sane than I had expected, and likely easier to secure than IPsec. I've recently started recommending it for a everyone who doesn't have IPsec hardware, something I should have done long ago (but I mistakenly thought it to be less thought out than it was). Android support is solid too.
- 10y ago
- nl 10y agoSpeaking of VPNs.... Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs? Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method. I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis. Is there anywhere this is written down so I don't have to spent 6 hours trying to work out how to do it?
- kijiki 10y agoNamespacing would work, but it might be simpler to use multiple routing tables and "ip rule" to match each app and direct it to the right routing table. You can use iptables to match on the process and set a mark on the packet that "ip rule" will match on.
- nl 10y agoNice.. So: >Is there anywhere this is written down so I don't have to spent 6 hours trying to work out how to do it? Edit, I found https://freeaqingme.tweakblogs.net/blog/9340/netflix-using-a-vpn-for-just-one-application.html https://freeaqingme.tweakblogs.net/blog/9340/netflix-using-a... which seems to cover at least some. It is done on a per-user basis though.
- zokier 10y agoShouldn't namespacing be just 'ip netns add wireguard && ip link set dev wg0 netns wireguard && ip netns exec wireguard <myapp>'? Seems simple enough.
- wallace_f 10y agoOut of curiosity, what's the use case for this?
- nl 10y agoOne is scraping sites that limit traffic/accounts per IP. (And yes, I understand how to be a good citizen. And no, this isn't the only use case)
- AlyssaRowan 10y agoOne comment I'll make because it's kind of buried in the first paragraph and not really called out: this project is one of the very early adopters of Trevor Perrin's state-of-the-art Noise protocol framework design https://noiseprotocol.org/ https://noiseprotocol.org/, so you're looking at something dramatically more modern, auditable and (potentially) secure than older, hairier protocols like IPsec, TLSv1.2, OpenVPN, etc. Best of luck, Jason!
- nul_byte 10y agoCan anyone open the slides or video? Using firefox on Fedora and its saying both file types are corrupt.
- kreetx 10y agoSame here (both Firefox and Chrome download a 0 byte pdf; on Firefox the video errors, on Chrome it plays).
- dohqu8Zi 10y agoI hope to see a mainline submission for public review of this soon.