41–50 of 72 posts
Is there like a simpler configuration esp. for clients using windows / mac?
> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?
Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
Earlier quoted context omitted.
Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
But these are related, aren't they? Not trying to be pedantic or argumentative at all, just better understanding (for myself at least). Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface. Of course user-land library can also be written with no other library dependencies, but I think kernel based forces this as a requirement, doesn't it (I don't know for sur…
You are conflating two independent things. An external library could be very secure or not. Same for implementing the same function internally.
https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...
Is there like a simpler configuration esp. for clients using windows / mac?
https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...
Earlier quoted context omitted.
How is ZeroTier on dynamic allocation? Small code size is one WireGuard software security goal; minimizing dynamic allocation is the other.
It does dynamically allocate, though it always checks for success. It could be refactored not to but so far we haven't targeted devices small enough to worry about a megabyte or two of RAM. There are also checks in place to guard against memory exhaustion attacks where applicable. We just did phase I of a professional audit for V2. It was a design audit, but we're doing a code audit too. V2's code base will be a bit…
Earlier quoted context omitted.
But these are related, aren't they? Not trying to be pedantic or argumentative at all, just better understanding (for myself at least). Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface. Of course user-land library can also be written with no other library dependencies, but I think kernel based forces this as a requirement, doesn't it (I don't know for sur…
> Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface You are conflating two independent things. An external library could be very secure or not. Same for implementing the same function internally.
Hm. I guess no-one has bothered with nftables yet, even when dealing with network code that's becoming part of the new upstream kernel (not just this blog, AFAIK wireguard upstream doesn't have any examples on using nftables either, just iptables). I guess we need a new networking how-to? Anyone aware of some resources I might have missed? OK, I guess the nftables wiki is the "how-to": https://wiki.nftables.org/wiki-…
So unfortunately it makes less sense for one-liners. Case in point: to use the masquerade action in a postrouting/nat chain, you also have to register a (possibly empty) prerouting/nat chain.
Hm. I guess no-one has bothered with nftables yet, even when dealing with network code that's becoming part of the new upstream kernel (not just this blog, AFAIK wireguard upstream doesn't have any examples on using nftables either, just iptables). I guess we need a new networking how-to? Anyone aware of some resources I might have missed? OK, I guess the nftables wiki is the "how-to": https://wiki.nftables.org/wiki-…
The community kind of skipped right over nftables to BPF. Simple use cases use iptables, complicated ones use BPF, nftables isn't flexible enough for the complicated use cases so everyone keeps using iptables.