WireGuard: Next Generation Secure Kernel Network Tunnel
1–10 of 44 posts
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#2It seems worrying to me to put something so complicated in the kernel. Perhaps, not even that, but it feels to me as though the fact that this requires in tree changes seems wrong, given the way that networking is going is to enable these network functions via mechanisms such as BPF.
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#3It's not clear to me that this really solves any of the UI and management problems associated with VPNs. I'm sure the new crypto-design is interesting, but exchanging SSH public keys is actually a huge logistical hassle which scales very poorly.
The other thing is "container-ready" ... well it just isn't. I can use OpenVPN to do the same interface migration trick with a container today. That's not the challenge - the challenge is things like managing what happens when the VPN interface goes down and I need to recycle and reconfigure that interface (at which point you end up back at "allocate a private address space, stick the VPN container in a new address space, play with IPTables there to make sure losing the VPN routes doesn't mean you start routing over the regular NIC".
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#4If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it.
https://github.com/trailofbits/algo
It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#5It seems worrying to me to put something so complicated in the kernel. Perhaps, not even that, but it feels to me as though the fact that this requires in tree changes seems wrong, given the way that networking is going is to enable these network functions via mechanisms such as BPF.
I'm less worried about that because it's so small. WireGuard is ~4k LOC -- thus measurably less complicated than OpenVPN (~100k LOC + OpenSSL), StrongSwan (~410k), or SoftEther (~330k).
Numbers taken from slide 5 of https://www.wireguard.io/talks/codeblue2016-slides-en.pdf
Moving to kernelspace brings it up to par with plain IP networking, minus a bit of overhead for the cryptographic operations. Userspace networking has overhead which is hard to overcome: context switching and CPU cache invalidation, copying packets between kernelspace and userspace, etc.
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#6If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.
Algo looks good if you stick to IPSEC but WireGuard is years ahead, and much sounder. Considering WireGuard's promising start, imo it's OK if platform support isn't broad yet. You don't need Solaris support to start having your state-of-the art VPN between your servers and workstations.
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#7It seems worrying to me to put something so complicated in the kernel. Perhaps, not even that, but it feels to me as though the fact that this requires in tree changes seems wrong, given the way that networking is going is to enable these network functions via mechanisms such as BPF.
I'm less worried about that because it's so small. WireGuard is ~4k LOC -- thus measurably less complicated than OpenVPN (~100k LOC + OpenSSL), StrongSwan (~410k), or SoftEther (~330k). Numbers taken from slide 5 of https://www.wireguard.io/talks/codeblue2016-slides-en.pdf Moving to kernelspace brings it up to par with plain IP networking, minus a bit of overhead for the cryptographic operations. Userspace networking…
Yeah, but BPF can operate in kernel space directly on SKBs. If you look at the XDP work, there's a lot of promise. In fact I've implemented ECC in BPF -- other than the state, and negotiation components, I don't see why this can't adapt BPF.
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#8If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.
What is a good hosted ipsec vpn? also is there built in support for networkmanager?
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#9Speaking of VPNs....
Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs?
Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method.
I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis.
Is there anywhere this is written down so I don't have to spent 6 hours trying to work out how to do it?
Re: WireGuard: Next Generation Secure Kernel Network Tunnel
#10One comment I'll make because it's kind of buried in the first paragraph and not really called out: this project is one of the very early adopters of Trevor Perrin's state-of-the-art Noise protocol framework design https://noiseprotocol.org/, so you're looking at something dramatically more modern, auditable and (potentially) secure than older, hairier protocols like IPsec, TLSv1.2, OpenVPN, etc.
Best of luck, Jason!