3 ms·
This is almost true, but not quite. WireGuard is a protocol, but it's also the Linux kernel implementation of that protocol; there are design decisions in the p
by tptacek 8mo ago
This is almost true, but not quite. WireGuard is a protocol, but it's also the Linux kernel implementation of that protocol; there are design decisions in the protocol that specifically support software security goals of the kernel implementation. For instance, it's designed to be possible to implement WireGuard without demand dynamic allocation.
- zekica 8mo agoMinor nitpick: dynamic memory allocation is not used when processing packets, but is when adding/removing clients via netlink.
- Cyphase 8mo agoThis is why WireGuard has continued to work even when a peer is otherwise unusable from low free memory. :)
- mlhpdx 8mo agoIt would have been interesting if WireGuard had been implemented as a transport, but I was speaking conceptually. The fact I had to write the library speaks to how conflated they are, on the other hand. Edit: Making it allocation free sounds like an interesting challenge.