11 ms·
WireGuard Merged into OpenBSD
- bch 6y agoWireGuard: https://en.wikipedia.org/wiki/WireGuard https://en.wikipedia.org/wiki/WireGuard
- greatjack613 6y agoIncredible, so excited to see wireguard start making it into mainstream distros. Personally I see this as the most exciting thing to happen to linux in the past 2 - 3 years.
- athoik 6y agoJust great! Hope to release wireguard on FreeBSD soon as well. In order pfSense to include it: https://redmine.pfsense.org/issues/8786 https://redmine.pfsense.org/issues/8786
- leeoniya 6y agohopefully OPNSense gets the same soon. they already ship it (i think as a kernel module).
- throw0101a 6y ago> Hope to release wireguard on FreeBSD soon as well. Available as a Port / package: * https://www.freshports.org/net/wireguard/ https://www.freshports.org/net/wireguard/ * https://www.freshports.org/net/wireguard-go/ https://www.freshports.org/net/wireguard-go/ Running it in a jail for further compartmentalization: * https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/ https://genneko.github.io/playing-with-bsd/networking/freebs... * https://news.ycombinator.com/item?id=23004061 https://news.ycombinator.com/item?id=23004061
- atonse 6y agoI’ve always wanted to run OpenBSD for our Wireguard bastion host (the one machine that is “open”. Not sure it makes a difference over Linux but OpenBSD has an even stronger security culture. Was satisfied with the state of affairs before but genuinely excited about this development.
- tptacek 6y agoOpenBSD has a different security culture. "Stronger" hasn't been the right word in over a decade.
- atonse 6y agoYeah I don’t know if at this point it even matters. I was nervous about even leaving this comment. Maybe showing my decade old bias.
- dicknuckle 6y agoI use alpine for my bastion machine, but I'm not even sure if it's the best solution.
- sirtoffski 6y agoSame sentiment here. I could come up with one "advantage" of OpenBSD over Linux - smaller user base. In a simplistic kind of a view that should make it less compelling to put in as much effort into developing exploits vs more common OS'. I couldn't back this up with any concrete data though.
- Hnrobert42 6y agoSecurity through obscurity isn’t foolproof, but it isn’t entirely foolish, either. It can reduce risk if part of a layered defense strategy. It is important to remember though that it is not the number of users but but the value of the compromise that determines how compelling the O/S is. There are like vintage mainframe O/Ses for which folks are actively developing compromises because some government or telco hasn’t migrated off. Then again, those teams aren’t going to waste a exploit on somebody’s home Usenet archive. TL;DR: nevermind. I am too busy arguing with myself to be coherent.
- MintelIE 6y agoGo won't be allowed in main because it's too bloated. It's great to see a more sane and cross platform (and lightweight!) implementation.
- cpach 6y agoI’m not sure I agree about it being bloated, but I guess that they want to avoid a go dependency for main. And it’s also not possible to write a kernel module in Go for the OpenBSD kernel :)
- aargh_aargh 6y agoThis reminded me of Theo de Raadt's reply to 'Integrating "safe" languages into OpenBSD?': https://marc.info/?l=openbsd-misc&m=151233345723889&w=2 https://marc.info/?l=openbsd-misc&m=151233345723889&w=2
- unixhero 6y agoInteresting response. Pretty backwards of Theo to snub Rust-lang like that. It's pretty much attempting to achieve the same ideals as some of OpenBSD's.
- smabie 6y agoEh, not really. OpenBSD is about simplicity more than anything else. It's no surprise that they don't want Rust, which is very complicated, into the OS. Also rustc is super complicated, and very slow. For example, for a time OpenBSD was trying to switch to pcc, a super simple C compiler so they could get off gcc. They eventually went with clang instead, which is not simple, but presumably the cost of using an alternative to gcc or clang was too high.
- secondcoming 6y agoIt's not a snub of the language, it's a complaint about the compiler using all your memory. That's not an unreasonable complaint. It was also written 3 or so years ago, so hopefully rust has improved.
- nindalf 6y agoI’m confused about their mention of Go. The Linux implementation of WireGuard is written in C - https://git.zx2c4.com/wireguard-linux https://git.zx2c4.com/wireguard-linux
- zahllos 6y agoThere's a portable userspace implementation written in Go, for places where a kernel driver is unavailable at present.
- deleted 6y ago[deleted]
- skrause 6y agoOpenBSD doesn't want any GPL code, so they couldn't just port the Linux kernel module. The OpenBSD kernel module is also written in C: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/net/if_wg.c?rev=1.3&content-type=text/x-cvsweb-markup http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/net/if_wg.c... But the code looks quite different from https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard?h=stable https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireg...
- zx2c4 6y agoThis has nothing to do with licensing. OpenBSD is a different kernel, so different code. Having written the Linux code, I relicensed any similarities between the two to make it amenable to OpenBSD, and remove any doubt about status.
- aljarry 6y agoIs it possible to create kernel modules for both OpenBSD and Linux with common code that's licensed appropriately? Something like a library with two kernel API glue layers, one for Linux GPLed and one for OpenBSD.
- aargh_aargh 6y ago
- zx2c4 6y agoWireGuard project announcement is here: https://lists.zx2c4.com/pipermail/wireguard/2020-June/005588.html https://lists.zx2c4.com/pipermail/wireguard/2020-June/005588...
- riobard 6y agoWhat's the performance situation of the wg-go implementation now? I recalled there's a utun device API limitation that each packet requires a syscall. Is there any progress to avoid the overhead?
- vertex-four 6y agoI imagine that io_uring or similar work could help here - provide the kernel with a submission queue and a completion queue once, and just keep feeding it buffers to fill without syscalls.
- riobard 6y agoThat's what I'd assume but I've never seen anyone doing that yet.
- vertex-four 6y agoThat would be because io_uring is incredibly new and I don't think the tuntap driver supports it yet.
- manduz 6y agocan someone ELI5 to me? i dont even know what opnBSD is but i know wireguard is a vpn protocol.
- cpach 6y agoVery good call from the OpenBSD project to include this in their kernel.
- schoolornot 6y agoDoes the underlying crypto in WireGuard lend itself to hardware acceleration/implementation in ASICs? If so, when do we expect to see such devices available?
- 867-5309 6y agoI believe Wireguard is up to 4x faster than OpenVPN where OpenVPN uses AES-NI. processors with this instruction set is possibly the closest thing to an ASIC for VPN en/decryption, so I dare say Wireguard will neither need nor benefit from a purpose-built instruction set
- api 6y agoAES is as fast or faster than ChaCha if there is hardware acceleration. OpenVPN is slow for other reasons, and honestly the crypto is usually not the bottleneck in most cases unless you are really pushing multiple gigabits or it's a very small CPU.
- throwaway2048 6y agoThis is definitely not true, chacha20 is frequently faster than AES even with AES-NI in use, especially on earlier implementations of the instruction extension.
- api 6y agoI'd like to see some numbers on this. I'm sure there are some chips where it's the case but are we talking small ARM cores or larger desktop and server chips?
- wmf 6y agoI would expect ASIC support no earlier than 2-3 years after the WireGuard RFC is finalized.
- microcolonel 6y agoI'm not aware of any manufacturer who is committed to providing a ChaCha accelerator or ISA extension, but it seems like it would be highly doable. Not sure what the minimum latency of a ChaCha double round is, seems like it'd be a couple hundred picoseconds, unless there's some sort of forwarding trick with the adders/rotations.
- grogenaut 6y agostill waiting for wireguard to be TCP based so I can use it in large corporations, many of who don't dig stateless udp in their firewalls.
- bawolff 6y agoWat? If wireguard doesn't meet your requirements, don't use it, but its kind of rediculous to complain it doesn't do X when doing X would defeat the point of the software.
- Tsiklon 6y agoCongratulations to the team on this successful integration into OpenBSD. I'm really pleased to see ongoing Wireguard integration in all the big platforms. The setup is so simple, I route all my personal traffic through a simple cloud based WG + Pihole setup.
- jjice 6y agoWhy does WireGuard need to be a part of the kernels for BSD, Linux, and I assume other OSes? Is OpenVPN the same way? Why can't it be part of userspace?
- detaro 6y agoIt doesn't need to be, a userspace implementation is available.