4 ms·
Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.
by mistaken 8y ago
Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.
- auslander 8y agoyou are not mistaken
- JshWright 8y agoBased on what evidence?
- auslander 8y agoI just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.
- geofft 8y agoThere is a WireGuard kernel module, and it also seems weird to me to say "This is a mess" when what you actually mean is "Nobody yet knows if it is a mess or not and I have no evidence either way."
- aaronmdjones 8y agoI'm not sure where you're getting your information; the /de facto/ primary WireGuard implementation is a Linux kernel module.
- JshWright 8y agoSo, you don't have any evidence that Wireguard is "a mess" (the claim that you are supporting).
- anfractuosity 8y agoA mess in what way out of interest? (I've not looked at the source)
- moviuro 8y ago> a mess by @mistaken, not Linus: http://lists.openwall.net/netdev/2018/08/02/124 http://lists.openwall.net/netdev/2018/08/02/124
- megous 8y agoYou are mistaken
- berti 8y agoI'm not sure I've seen a more accurate handle before. I'd welcome any evidence to convince me otherwise though.
- aaronmdjones 8y agoOrdinarily I would appreciate comments calling for an audit of security-critical software, but spoken with such derision and apparently ignorant of the fact that the author audits code for a living I can't get behind. As for "cleaned up", LKML's only objections to it so far are formatting; think variable declarations, line wrapping (or lack thereof), et al.
- amluto 8y agoHaving actually looked at the code a bit, it is dramatically cleaner than any other firewall code I’ve ever seen. And the crypto is pretty nicely done, too. OpenVPN is a mess. IPSEC and basically all implementations thereof are messes. (As a personal anecdote, have you ever tried to get OpenVPN to do anything remotely sensible with MTUs or MTU-related ICMP errors? You can’t, because every possible configuration gets it at least partially wrong [0]. Wireguard get it entirely correct AFAICT.) [0] https://community.openvpn.net/openvpn/ticket/375 https://community.openvpn.net/openvpn/ticket/375