WireGuard: next generation in-kernel modern VPN

zx2c4 wrote: post #3

Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.

Yes, guilty as charged. Ever since I saw you presentation in Paris in last September, I was dying for wireguard to come out.

I'm curious what will be your strategy with regard to working or not with upstream Linux ?

Re: WireGuard: next generation in-kernel modern VPN

#5

Post by Retr0spectrum » Tue, Jun 28, 2016, 3:28 PM UTC

Can someone explain why being in-kernel is considered a feature?

Re: WireGuard: next generation in-kernel modern VPN

#6

Post by zx2c4 » Tue, Jun 28, 2016, 3:29 PM UTC

Aissen wrote: post #4

zx2c4 wrote: post #3

Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.

Yes, guilty as charged. Ever since I saw you presentation in Paris in last September, I was dying for wireguard to come out. I'm curious what will be your strategy with regard to working or not with upstream Linux ?

Oh cool you came to the kernel recipes talk. Much has progressed since then.

I wrote an email on LKML and netdev today to David Miller, the network subsystem maintainer. It's not ready for a [PATCH] set now, but it is ready to get initial feedback from them, so that I can start to get things ready for upstreaming. So: that's on the roadmap and a primary objective!

Re: WireGuard: next generation in-kernel modern VPN

#7

Post by zx2c4 » Tue, Jun 28, 2016, 3:31 PM UTC

Retr0spectrum wrote: post #5

Can someone explain why being in-kernel is considered a feature?

Speed, simplicity.

It's not possible to do highspeed crypto from userspace while still integrating with the usual networking stack. Tun devices result in copies and context switches which makes things quite slow.

This also adds quite a bit of simplicity.

But sure, I agree, it's scary. But not nearly as scary as the obscenely huge xfrm/ipsec layer in the kernel. Or the dozens of other kernel tunneling deivces available. And I dare even say it's not as scary as most userspace VPN solutions like OpenVPN which are massive code bases. WireGuard, in contrast, aims to be quite minimal in its codebase, so that it can be audited by an individual.

I didn't make the title of this HN post, unfortunately. But do note: there _will_ be userspace implementations of WireGuard. It's most certainly not tied to the kernel. It's just that the OP saw me present at a kernel conf about it. :P

Re: WireGuard: next generation in-kernel modern VPN

#8

Post by ciokan » Tue, Jun 28, 2016, 3:33 PM UTC

Aissen wrote: post #4

zx2c4 wrote: post #3

Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.

Yes, guilty as charged. Ever since I saw you presentation in Paris in last September, I was dying for wireguard to come out. I'm curious what will be your strategy with regard to working or not with upstream Linux ?

Can I bind it to external ip addresses and give a certain user an outgoing (or even private ips that I can then forward) address I chose? Don't know if my question makes sense but I'm interested in routing a certain user to a certain ip every time he/she connects.

Re: WireGuard: next generation in-kernel modern VPN

#9

Post by zx2c4 » Tue, Jun 28, 2016, 3:35 PM UTC

ciokan wrote: post #8

Aissen wrote: post #4

Earlier quoted context omitted.

Yes, guilty as charged. Ever since I saw you presentation in Paris in last September, I was dying for wireguard to come out. I'm curious what will be your strategy with regard to working or not with upstream Linux ?

Can I bind it to external ip addresses and give a certain user an outgoing (or even private ips that I can then forward) address I chose? Don't know if my question makes sense but I'm interested in routing a certain user to a certain ip every time he/she connects.

WireGuard as a simple associations between public keys and each public keys list of allowed IPs. Within this structure, it seems like you should be able to do what you want.

Re: WireGuard: next generation in-kernel modern VPN

#10

Post by ZoFreX » Tue, Jun 28, 2016, 3:39 PM UTC

zx2c4 wrote: post #3

Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.

Where has the code for the nuts and bolts of the crypto come from (e.g. everything in the "crypto" folder)?