6 ms·

FreeBSD kernel-mode WireGuard moves forward out-of-tree

encryptluks2 6y ago
Is there some actual concern about WireGuard itself or just the FreeBSD implementation?
- jumby 6y ago
  I think it's just lack of formal peer review [1] [1] https://lists.zx2c4.com/pipermail/wireguard/2021-March/006504.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...
- technofiend 6y ago
  There were questions around the implementation. See https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519
- asmr 6y ago
  Apparently the original implementation had issues. Apparently NetGate shipped some bad code after hiring a FreeBSD contributor for their implementation. Kyle Evans has even decided to step away from maintaining wireguard-freebsd. Seems like a mess.
  - teruakohatu 6y ago
    > Kyle Evans has even decided to step away from maintaining wireguard-freebsd That is not true. Everyone acknowledges the code is not up to the required standard so it is being removed but Kyle and others will continue to work on it with the aim of adding it back. Edit: as @asmr below linked to, he has has since announced that he is quitting.
    - asmr 6y ago
      https://lists.zx2c4.com/pipermail/wireguard/2021-March/006522.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00652...
      - apple4ever 6y ago
        That's a real big shame. I know he doesn't blame Netgate, but I will. If it wasn't for their poor attitude (par for the course from Netgate), this would not have blown up.
        deleted 6y ago
        [deleted]
- tptacek 6y ago
  To state this clearly: there are not concerns about WireGuard itself.
  - Shish2k 6y ago
    To be double-clear - the problems being discussed are in the freebsd kernel-mode implementation. The freebsd userspace implementation is fine, and implementations on other OSes are fine :)
jvolkman 6y ago
Recent discussion about its addition: https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519
jimmar 6y ago
I'd read that WireGuard was supposed to be easier to implement because it supports fewer distinct crypto protocols and has fewer features overall compared to OpenVPN. But now this code is being pulled. Was it just a rushed implementation? Or is WireGuard harder to implement than initially thought?
- turminal 6y ago
  Someone from netgate implemented it poorly and then the original authors tried to fix it in a hurry but ran out of time. There was also some mailing list drama I think.
- heavyset_go 6y ago
  There was concern about code quality, and accusations of what amounted to amateur mistakes in Netgate's particular implementation. I don't know how accurate those accusations are, though.
  - GekkePrutser 6y ago
    They were made by Jason Donenfeld, the author of WireGuard which is of exemplary quality so I take it pretty seriously :)
    - deleted 6y ago
      [deleted]
  - siebenmann 6y ago
    It's possible to browse the before-changes-started version of the FreeBSD code, through either CVS or the FreeBSD Git mirror. To save people the effort of finding the right git revision and the path, the kernel module starts here: https://github.com/freebsd/freebsd-src/tree/95331c228a39b44cb96c4d0142ed8afec8a4d063/sys/dev/if_wg https://github.com/freebsd/freebsd-src/tree/95331c228a39b44c... On a casual inspection, there are at least kernel printfs in crypto code in __chacha20poly1305_decrypt (in module/crypto/zinc/chacha20poly1305.c) that were not in the original version of this from Linux.
jamescun 6y ago
WireGuard is being removed from FreeBSD 13 (the base for pfSense). There were some tit-for-tat messages between devs here, and while the implementation was probably fine, it is pretty reasonable to take a step back here, take stock, and take it from there. https://lists.zx2c4.com/pipermail/wireguard/2021-March/006504.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...
- 1over137 6y ago
  pfSense is currently based on FreeBSD 12, not 13. And it only just moved to 12 a month ago.
louwrentius 6y ago
For those who care, the podcast 2.5 Admins had a nice discussion about the WireGuard 'drama'. https://2.5admins.com/2-5-admins-30/ https://2.5admins.com/2-5-admins-30/
xoa 6y ago
Ars Technica had a more in-depth follow up, "FreeBSD kernel-mode WireGuard moves forward out-of-tree" [0], and essentially it's just moving into Donenfield's own repository for maturation/testing until fully baked. It was announced on zx2c4 yesterday, ("WireGuard for FreeBSD snapshot 0.0.20210317 is available" [1]). It appears that for some reason Macy, whom Netgate hired, spent a year trying to port the Linux kernel version (with ample kludging and ifdefs to make it work) rather than the more portable original core standalone version. The result wasn't great. But the rushed replacement Jason volunteered a lot of time for was, well, rushed, and everyone agreed that while kernel-mode wg in FreeBSD is very desirable the whole point of the project is to be really reliable and secure so worth taking more time to do right. This presumably won't represent that much of a delay in the end. And while it's too bad Netgate couldn't have been more collaborative and gotten it right from the start, it's also impressive and humbling to see skilled people rallying to get it together in the end. Wireguard is such a great project. ---- 0: https://arstechnica.com/gadgets/2021/03/freebsd-kernel-mode-wireguard-moves-forward-out-of-tree/ https://arstechnica.com/gadgets/2021/03/freebsd-kernel-mode-... 1: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006518.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00651...
- dang 6y ago
  Ok, perhaps we'll change the article from https://www.netgate.com/blog/wireguard-removed-from-pfsense-ce-and-pfsense-plus-software.html https://www.netgate.com/blog/wireguard-removed-from-pfsense-... to that (thanks!). If there's a better article, we can change it again.
  - koyote 6y ago
    The original netgate blog post is about a slightly different event from arstechnica's follow-up (in this FreeBSD/WireGuard saga). Arstechnica's article is about the removal of the 'rushed' WireGuard implementation that was supposed to go into FreeBSD 13 and the fact that development is continuing out of tree. Netgate/pfSense had backported the old (pre-rushed) implementation that they had commissioned to the FreeBSD 12 kernel version which was released as part of pfSense 2.5 several weeks ago. They have now chosen to rip it back out again.
cromka 6y ago
Just checked and there isn't any pfSense update available, so even if they removed it from the source code, given that majority doesn't compile pfSense themselves, I'd argue that it isn't removed just yet.
random_joe42 6y ago
They're removing it from the tree because they're tired of Jason controlling the narrative. Jason had more than three months to review the original patch and he's upset that they haven't done everything on his terms. I don't think you need to worry about NetGate being involved any more.
- AdamJacobMuller 6y ago
  Obvious pfSense shill is obvious? Especially given pfSense history on issues like this (e.g. OPNsense https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/). It's really unfortunate how you're treating Jason after he seems to have heroically stepped in to rescue the WireGuard patch and try to get it in FreeBSD 13. He didn't even call out pfSense or NetGate in his original email. If there hadn't have been all this drama I would have never even known that pfSense was involved and would have just assumed "some developer" contributed wg to FreeBSD and the Wire Guard author did a nice thing and cleaned up their code.
random_joe42 6y ago
Every time Jason "fixes" something in the FreeBSD code, it stops compiling. So I'm not sure about that.
random_joe42 6y ago
Not sure where you get that idea. It was directly based on a snapshot of the openbsd version. Jason is just gaslighting you.
random_joe42 6y ago
“more collaborative” here is cover for “pay Jason to work on it” and “skilled people” is code for “people Jason approves”
- dang 6y ago
  You posted like 6 of these all over this thread. Can you please not? That's vandalism, and I've banned the account. If you have a solid critique to make, of course that's welcome, but it needs to be done thoughtfully and with substantive information, not personal attack. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
random_joe42 6y ago
"Not up to the standard" means "not pandering to or paying Jason"
- teruakohatu 6y ago
  Edit: email sent.
  - dang 6y ago
    @dang doesn't work - you have to email hn@ycombinator.com. That's in the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Fortunately another user alerted me that way - it's the only reliable way to get information to us. A nice side effect is that it doesn't add off-topic meta stuff to the thread. p.s. I hope that didn't sound too critical. I appreciate your helpful intention!
nn3 6y ago
I don't get where all the hype about WireGuard comes from. It's just another VPN, of which we already have several perfectly well working ones. What is so special about it over all the other things that go into Linux and FreeBSD, and that actually do something new and unique and don't make the news? I'm personally ready to ignore it and add it to my BS bingo card. Blockchain anyone?
- xmodem 6y ago
  I would suggest watching https://www.youtube.com/watch?v=88GyLoZbDNw https://www.youtube.com/watch?v=88GyLoZbDNw . As someone who just wants to maintain a few VPN tunnels without having to be an expert in OVPN/IPSec/whatever, the ease-of-setup and conceptual simplicity of WireGuard is like a cup of ice water in hell. The order-of-magnitude better performance and excellent security properties are just the icing on the cake, as far as I'm concerned.

Is there some actual concern about WireGuard itself or just the FreeBSD implementation?

jumby 6y ago
I think it's just lack of formal peer review [1] [1] https://lists.zx2c4.com/pipermail/wireguard/2021-March/006504.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...
technofiend 6y ago
There were questions around the implementation. See https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519
asmr 6y ago
Apparently the original implementation had issues. Apparently NetGate shipped some bad code after hiring a FreeBSD contributor for their implementation. Kyle Evans has even decided to step away from maintaining wireguard-freebsd. Seems like a mess.
- teruakohatu 6y ago
  > Kyle Evans has even decided to step away from maintaining wireguard-freebsd That is not true. Everyone acknowledges the code is not up to the required standard so it is being removed but Kyle and others will continue to work on it with the aim of adding it back. Edit: as @asmr below linked to, he has has since announced that he is quitting.
  - asmr 6y ago
    https://lists.zx2c4.com/pipermail/wireguard/2021-March/006522.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00652...
    - apple4ever 6y ago
      That's a real big shame. I know he doesn't blame Netgate, but I will. If it wasn't for their poor attitude (par for the course from Netgate), this would not have blown up.
      - deleted 6y ago
        [deleted]
tptacek 6y ago
To state this clearly: there are not concerns about WireGuard itself.
- Shish2k 6y ago
  To be double-clear - the problems being discussed are in the freebsd kernel-mode implementation. The freebsd userspace implementation is fine, and implementations on other OSes are fine :)

Recent discussion about its addition: https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519

jimmar 6y ago

I'd read that WireGuard was supposed to be easier to implement because it supports fewer distinct crypto protocols and has fewer features overall compared to OpenVPN. But now this code is being pulled. Was it just a rushed implementation? Or is WireGuard harder to implement than initially thought?

turminal 6y ago
Someone from netgate implemented it poorly and then the original authors tried to fix it in a hurry but ran out of time. There was also some mailing list drama I think.
heavyset_go 6y ago
There was concern about code quality, and accusations of what amounted to amateur mistakes in Netgate's particular implementation. I don't know how accurate those accusations are, though.
- GekkePrutser 6y ago
  They were made by Jason Donenfeld, the author of WireGuard which is of exemplary quality so I take it pretty seriously :)
  - deleted 6y ago
    [deleted]
- siebenmann 6y ago
  It's possible to browse the before-changes-started version of the FreeBSD code, through either CVS or the FreeBSD Git mirror. To save people the effort of finding the right git revision and the path, the kernel module starts here: https://github.com/freebsd/freebsd-src/tree/95331c228a39b44cb96c4d0142ed8afec8a4d063/sys/dev/if_wg https://github.com/freebsd/freebsd-src/tree/95331c228a39b44c... On a casual inspection, there are at least kernel printfs in crypto code in __chacha20poly1305_decrypt (in module/crypto/zinc/chacha20poly1305.c) that were not in the original version of this from Linux.

jamescun 6y ago

WireGuard is being removed from FreeBSD 13 (the base for pfSense). There were some tit-for-tat messages between devs here, and while the implementation was probably fine, it is pretty reasonable to take a step back here, take stock, and take it from there. https://lists.zx2c4.com/pipermail/wireguard/2021-March/006504.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...

1over137 6y ago
pfSense is currently based on FreeBSD 12, not 13. And it only just moved to 12 a month ago.

louwrentius 6y ago

For those who care, the podcast 2.5 Admins had a nice discussion about the WireGuard 'drama'. https://2.5admins.com/2-5-admins-30/ https://2.5admins.com/2-5-admins-30/

xoa 6y ago

Ars Technica had a more in-depth follow up, "FreeBSD kernel-mode WireGuard moves forward out-of-tree" [0], and essentially it's just moving into Donenfield's own repository for maturation/testing until fully baked. It was announced on zx2c4 yesterday, ("WireGuard for FreeBSD snapshot 0.0.20210317 is available" [1]). It appears that for some reason Macy, whom Netgate hired, spent a year trying to port the Linux kernel version (with ample kludging and ifdefs to make it work) rather than the more portable original core standalone version. The result wasn't great. But the rushed replacement Jason volunteered a lot of time for was, well, rushed, and everyone agreed that while kernel-mode wg in FreeBSD is very desirable the whole point of the project is to be really reliable and secure so worth taking more time to do right. This presumably won't represent that much of a delay in the end. And while it's too bad Netgate couldn't have been more collaborative and gotten it right from the start, it's also impressive and humbling to see skilled people rallying to get it together in the end. Wireguard is such a great project. ---- 0: https://arstechnica.com/gadgets/2021/03/freebsd-kernel-mode-wireguard-moves-forward-out-of-tree/ https://arstechnica.com/gadgets/2021/03/freebsd-kernel-mode-... 1: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006518.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00651...

dang 6y ago
Ok, perhaps we'll change the article from https://www.netgate.com/blog/wireguard-removed-from-pfsense-ce-and-pfsense-plus-software.html https://www.netgate.com/blog/wireguard-removed-from-pfsense-... to that (thanks!). If there's a better article, we can change it again.
- koyote 6y ago
  The original netgate blog post is about a slightly different event from arstechnica's follow-up (in this FreeBSD/WireGuard saga). Arstechnica's article is about the removal of the 'rushed' WireGuard implementation that was supposed to go into FreeBSD 13 and the fact that development is continuing out of tree. Netgate/pfSense had backported the old (pre-rushed) implementation that they had commissioned to the FreeBSD 12 kernel version which was released as part of pfSense 2.5 several weeks ago. They have now chosen to rip it back out again.

cromka 6y ago

Just checked and there isn't any pfSense update available, so even if they removed it from the source code, given that majority doesn't compile pfSense themselves, I'd argue that it isn't removed just yet.

random_joe42 6y ago

They're removing it from the tree because they're tired of Jason controlling the narrative. Jason had more than three months to review the original patch and he's upset that they haven't done everything on his terms. I don't think you need to worry about NetGate being involved any more.

AdamJacobMuller 6y ago
Obvious pfSense shill is obvious? Especially given pfSense history on issues like this (e.g. OPNsense https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/). It's really unfortunate how you're treating Jason after he seems to have heroically stepped in to rescue the WireGuard patch and try to get it in FreeBSD 13. He didn't even call out pfSense or NetGate in his original email. If there hadn't have been all this drama I would have never even known that pfSense was involved and would have just assumed "some developer" contributed wg to FreeBSD and the Wire Guard author did a nice thing and cleaned up their code.

random_joe42 6y ago

Every time Jason "fixes" something in the FreeBSD code, it stops compiling. So I'm not sure about that.

random_joe42 6y ago

Not sure where you get that idea. It was directly based on a snapshot of the openbsd version. Jason is just gaslighting you.

random_joe42 6y ago

“more collaborative” here is cover for “pay Jason to work on it” and “skilled people” is code for “people Jason approves”

dang 6y ago
You posted like 6 of these all over this thread. Can you please not? That's vandalism, and I've banned the account. If you have a solid critique to make, of course that's welcome, but it needs to be done thoughtfully and with substantive information, not personal attack. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

random_joe42 6y ago

"Not up to the standard" means "not pandering to or paying Jason"

teruakohatu 6y ago
Edit: email sent.
- dang 6y ago
  @dang doesn't work - you have to email hn@ycombinator.com. That's in the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Fortunately another user alerted me that way - it's the only reliable way to get information to us. A nice side effect is that it doesn't add off-topic meta stuff to the thread. p.s. I hope that didn't sound too critical. I appreciate your helpful intention!

nn3 6y ago

I don't get where all the hype about WireGuard comes from. It's just another VPN, of which we already have several perfectly well working ones. What is so special about it over all the other things that go into Linux and FreeBSD, and that actually do something new and unique and don't make the news? I'm personally ready to ignore it and add it to my BS bingo card. Blockchain anyone?

xmodem 6y ago
I would suggest watching https://www.youtube.com/watch?v=88GyLoZbDNw https://www.youtube.com/watch?v=88GyLoZbDNw . As someone who just wants to maintain a few VPN tunnels without having to be an expert in OVPN/IPSec/whatever, the ease-of-setup and conceptual simplicity of WireGuard is like a cup of ice water in hell. The order-of-magnitude better performance and excellent security properties are just the icing on the cake, as far as I'm concerned.