7 ms·

WireGuard in FreeBSD

238 points by nixcraft 4y ago

c0nsumer 4y ago
I'm really looking forward to this making its way into OPNsense and such.
- onedr0p 4y ago
  I'm already running the kmod Wireguard on Opnsense unless I'm missing something?
  - MojoDwarf 4y ago
    for me OPNSense is installing the go implementation when installing via the plugin system. Maybe there was a time it was using the old kmod port?
    - vladvasiliu 4y ago
      You can manually install the kmod and the plugin will that instead of the go implementation.
  - 1letterunixname 4y ago
    I have a Dutch physical OPNsense (business license) box with 10 GbE ports. IIRC, it's the userland version. To be honest, I prefer most things to live outside of the kernel than use it as a kitchen sink dumping ground for "but but but it's faster!".
    - onedr0p 4y ago
      I am using the kmod, you can easily switch. https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_227_released/ihzj9ix/ https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_2...
  - sschueller 4y ago
    I believe the current opnsense version runs in userspace and has no kernel support.
    - onedr0p 4y ago
      I am using the kmod, you can easily switch. https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_227_released/ihzj9ix/ https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_2...
smoochy 4y ago
Can someone please explain: I've been using WireGuard via `wg-quick` command in FreeBSD for quite a while now. What does this commit do?
- detaro 4y ago
  It adds wireguard support to the kernel.
  - smoochy 4y ago
    Okay, but... what difference does it make? Apart from not having to install it manually? Am I missing something?
    - ngetchell 4y ago
      I believe moving wireguard support into the kernel reduces context switching for the app and greatly improves performance.
    - RealStickman_ 4y ago
      Wireguard in the kernel is faster than the userspace implementation. You still have to install the tooling.
    - rascul 4y ago
      If I recall correctly, we went through this on Linux in the past. I believe the first wireguard implementations were userspace while the work was being done to get it in the kernel.
    - jessermeyer 4y ago
      As others have hinted to -- no userspace copies. No context switches. Vroom Vroom.
    - kevans91 4y ago
      It depends on how you were running before -- if you had the wireguard-kmod package, then yes, the only difference is that you don't have to install it manually. If you only had the wireguard-go pkg before, then see the other responses where you'll now be using the kernel implementation instead of userspace. edit to note: we can't really provide wg-quick in base at the moment (uses bash-isms), so that still ends up needing installed manually if wg(8) isn't sufficient for your needs.
ksec 4y ago
I assume this is with Jason Donenfeld's approval?
- Operyl 4y ago
  It came from his git server so I’m assuming so. > Obtained from: git@git.zx2c4.com:wireguard-freebsd @ 3cc22b2
- freemrkt8 4y ago
  Jason open sourced the project. Why would they need his approval?
  - flatiron 4y ago
    https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
    - freemrkt8 4y ago
      So its about technical guidance, not approval to include code. Got it.
  - ipsum2 4y ago
    WireGuard is a registered trademark.
    - saurik 4y ago
      This puts reasonable restrictions on the usage of the term WireGuard to name your alternative implementation, but neither prevents other people (without any approval) from implementing the protocol nor even from using the term WireGuard to (correctly) describe or label the protocol implemented (and I even could see a solid argument that any command line tooling that might be expected to be compatible with existing third-party tooling that calls out to said tools should be allowed to use the term "wg" or "wireguard", given prior legal precedent that if you use a trademark in a place where it causes a compatibility issue you cannot attempt to claim infringement of that trademark to later stifle interoperability with your project; but, if you go down this path, I'd highly recommend consulting an actual lawyer and getting your response ready to any complaint).
atonse 4y ago
Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?
- HorizonXP 4y ago
  Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.
  - bragr 4y ago
    The "<x>BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest any say it's based on their personal and philosophical preferences, rather than based on any objective metric.
    - rascul 4y ago
      I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ I remember a time when it was zero, not two.
      - spijdar 4y ago
        This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running. I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from the perspective of Windows or Solaris which enable huge numbers of network daemons by default and have both suffered numerous high profile remote vulnerabilities on default installs, but OpenBSD isn't really much different from most Linux distros on this. I'm sure most distros have had more remote vulnerabilities, but not that many. Your average Joe out-of-the-box install of Fedora or Ubuntu doesn't really have any open services IIRC, so an exploit would need to directly target the Linux IP stack, or one of the network autoconfig services if that's in scope.
amatecha 4y ago
Good post from Phoronix on the topic, also giving a bit of context as to why they're "bringing back" the driver: https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022
- deleted 4y ago
  [deleted]
- riedel 4y ago
  I don't know what is good about this post. The ars technical post linked in another comment really sheds some light on to this.
  - amatecha 4y ago
    I mean, at the time of the merge, the Phoronix post seemed to be the only one that gave a quick rundown of the whole "saga", with links to posts covering the relevant news from 2021.
johnklos 4y ago
Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg039393.html https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg039406.html https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.
- dontbenebby 4y ago
  >FreeBSD WireGuard drama Can you fill me in? I experimented with Wireguard a while back but it's been a few. (It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)
  - pram 4y ago
    The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
    - deleted 4y ago
      [deleted]
    - rwaksmunski 4y ago
      This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
      - gonzo 4y ago
1letterunixname 4y ago
I use WireGuard on OPNsense (FreeBSD-based router appliance) and clients on macOS, iPhone, iPad, Android, Linux, and Windows. It's easy to setup and Just Works(tm). Throw away your AnyConnect, Tunnelblick (OpenVPN), and such.
hpcjoe 4y ago
I care about this only in the context of OPNsense which I replaced my old pfSense router with. Though I'd love to run a linux firewall router rather than *BSD, none seem up to the task. OPNsense is good. I'm currently running a VM with a wireguard server within my firewall. That VM is running linux. I'm fine with this until the kmod lands in OPNsense, then I'll likely transition. One less VM to manage sounds good to me. And another plug for OPNsense. Setting it up was easy. Far easier than pfSense, which I'd used for about a decade.

238 points by nixcraft 4y ago

c0nsumer 4y ago

I'm really looking forward to this making its way into OPNsense and such.

onedr0p 4y ago
I'm already running the kmod Wireguard on Opnsense unless I'm missing something?
- MojoDwarf 4y ago
  for me OPNSense is installing the go implementation when installing via the plugin system. Maybe there was a time it was using the old kmod port?
  - vladvasiliu 4y ago
    You can manually install the kmod and the plugin will that instead of the go implementation.
- 1letterunixname 4y ago
  I have a Dutch physical OPNsense (business license) box with 10 GbE ports. IIRC, it's the userland version. To be honest, I prefer most things to live outside of the kernel than use it as a kitchen sink dumping ground for "but but but it's faster!".
  - onedr0p 4y ago
    I am using the kmod, you can easily switch. https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_227_released/ihzj9ix/ https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_2...
- sschueller 4y ago
  I believe the current opnsense version runs in userspace and has no kernel support.
  - onedr0p 4y ago
    I am using the kmod, you can easily switch. https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_227_released/ihzj9ix/ https://www.reddit.com/r/opnsense/comments/wa6xil/opnsense_2...

smoochy 4y ago

Can someone please explain: I've been using WireGuard via `wg-quick` command in FreeBSD for quite a while now. What does this commit do?

detaro 4y ago
It adds wireguard support to the kernel.
- smoochy 4y ago
  Okay, but... what difference does it make? Apart from not having to install it manually? Am I missing something?
  - ngetchell 4y ago
    I believe moving wireguard support into the kernel reduces context switching for the app and greatly improves performance.
  - RealStickman_ 4y ago
    Wireguard in the kernel is faster than the userspace implementation. You still have to install the tooling.
  - rascul 4y ago
    If I recall correctly, we went through this on Linux in the past. I believe the first wireguard implementations were userspace while the work was being done to get it in the kernel.
  - jessermeyer 4y ago
    As others have hinted to -- no userspace copies. No context switches. Vroom Vroom.
  - kevans91 4y ago
    It depends on how you were running before -- if you had the wireguard-kmod package, then yes, the only difference is that you don't have to install it manually. If you only had the wireguard-go pkg before, then see the other responses where you'll now be using the kernel implementation instead of userspace. edit to note: we can't really provide wg-quick in base at the moment (uses bash-isms), so that still ends up needing installed manually if wg(8) isn't sufficient for your needs.

ksec 4y ago

I assume this is with Jason Donenfeld's approval?

Operyl 4y ago
It came from his git server so I’m assuming so. > Obtained from: git@git.zx2c4.com:wireguard-freebsd @ 3cc22b2
freemrkt8 4y ago
Jason open sourced the project. Why would they need his approval?
- flatiron 4y ago
  https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
  - freemrkt8 4y ago
    So its about technical guidance, not approval to include code. Got it.
- ipsum2 4y ago
  WireGuard is a registered trademark.
  - saurik 4y ago
    This puts reasonable restrictions on the usage of the term WireGuard to name your alternative implementation, but neither prevents other people (without any approval) from implementing the protocol nor even from using the term WireGuard to (correctly) describe or label the protocol implemented (and I even could see a solid argument that any command line tooling that might be expected to be compatible with existing third-party tooling that calls out to said tools should be allowed to use the term "wg" or "wireguard", given prior legal precedent that if you use a trademark in a place where it causes a compatibility issue you cannot attempt to claim infringement of that trademark to later stifle interoperability with your project; but, if you go down this path, I'd highly recommend consulting an actual lawyer and getting your response ready to any complaint).

atonse 4y ago

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

HorizonXP 4y ago
Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.
- bragr 4y ago
  The "<x>BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest any say it's based on their personal and philosophical preferences, rather than based on any objective metric.
  - rascul 4y ago
    I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ I remember a time when it was zero, not two.
    - spijdar 4y ago
      This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running. I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from the perspective of Windows or Solaris which enable huge numbers of network daemons by default and have both suffered numerous high profile remote vulnerabilities on default installs, but OpenBSD isn't really much different from most Linux distros on this. I'm sure most distros have had more remote vulnerabilities, but not that many. Your average Joe out-of-the-box install of Fedora or Ubuntu doesn't really have any open services IIRC, so an exploit would need to directly target the Linux IP stack, or one of the network autoconfig services if that's in scope.

amatecha 4y ago

Good post from Phoronix on the topic, also giving a bit of context as to why they're "bringing back" the driver: https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022

deleted 4y ago
[deleted]
riedel 4y ago
I don't know what is good about this post. The ars technical post linked in another comment really sheds some light on to this.
- amatecha 4y ago
  I mean, at the time of the merge, the Phoronix post seemed to be the only one that gave a quick rundown of the whole "saga", with links to posts covering the relevant news from 2021.

johnklos 4y ago

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg039393.html https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg039406.html https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.

dontbenebby 4y ago
>FreeBSD WireGuard drama Can you fill me in? I experimented with Wireguard a while back but it's been a few. (It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)
- pram 4y ago
  The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
  - deleted 4y ago
    [deleted]
  - rwaksmunski 4y ago
    This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
    - gonzo 4y ago

1letterunixname 4y ago

I use WireGuard on OPNsense (FreeBSD-based router appliance) and clients on macOS, iPhone, iPad, Android, Linux, and Windows. It's easy to setup and Just Works(tm). Throw away your AnyConnect, Tunnelblick (OpenVPN), and such.

hpcjoe 4y ago

I care about this only in the context of OPNsense which I replaced my old pfSense router with. Though I'd love to run a linux firewall router rather than *BSD, none seem up to the task. OPNsense is good. I'm currently running a VM with a wireguard server within my firewall. That VM is running linux. I'm fine with this until the kmod lands in OPNsense, then I'll likely transition. One less VM to manage sounds good to me. And another plug for OPNsense. Setting it up was easy. Far easier than pfSense, which I'd used for about a decade.