3 ms·
Can someone explain to me why wireguard is implemented as a kernel module? Yes I get it, more performance. But isn't it completely and absolutely insane to run
by iqanq 5y ago
Can someone explain to me why wireguard is implemented as a kernel module? Yes I get it, more performance. But isn't it completely and absolutely insane to run a complicated piece of software that is open to outside connections with kernel privileges?
- remram 5y agoPerformance.
- Hendrikto 5y agoIt also helps with availability. If you got a recent kernel, it‘s already there.
- tptacek 5y agoThe WireGuard protocol is deliberately designed to be straightforward to run in the kernel. In steady state, it doesn't even require dynamic memory allocation. It uses timers in lieu of extra statekeeping. It has a simplified networking model ("cryptokey routing") that defers to the host TCP/IP stack a bunch of stuff that other VPN protocols take upon themselves to build. It has just one keying mechanism and an API to build more interesting authentication features (like SSO integration) on top of it, rather than having it invade the core design. It helps that it was designed and implemented by a kernel exploit author.
- robertlagrant 5y agoIsn't most networking in the kernel? It's pretty complicated already.
- miloignis 5y agoRunning complex software open to outside connections in the kernel is pretty standard - the TCP/IP stack is in the kernel too!