Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In-kernel WireGuard is on its way to FreeBSD and the pfSense router

arstechnica.com

Post reply on HN
Print view View original

41–50 of 167 posts

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#41

Post by [deleted] »

kbenson wrote: post #28
Jonnax wrote: post #11

Earlier quoted context omitted.

Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they we…

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

[deleted]

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#42

Post by ksec »

kbenson wrote: post #28
Jonnax wrote: post #11

Earlier quoted context omitted.

Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they we…

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Similar reaction here. My first impression was Netgate being an arse. But then when you read the announcement I kind of understand why Scott is angry. Because while the post may have been in "good faith" in an Open Development and Open Source world, it surely isn't in a professional and business world especially when the work is sponsored ( being paid ).

Jason should have informed Netgate the quality of the code is shit in private and FreeBSD dev should have told Netgate will not be shipping any of it in Rel 13.

It is then up to Netgate to decide What to do with their Rel 2.5

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#43

Post by tptacek »

ksec wrote: post #42
kbenson wrote: post #28

Earlier quoted context omitted.

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Similar reaction here. My first impression was Netgate being an arse. But then when you read the announcement I kind of understand why Scott is angry. Because while the post may have been in "good faith" in an Open Development and Open Source world, it surely isn't in a professional and business world especially when the work is sponsored ( being paid ). Jason should have informed Netgate the quality of the code is s…

WireGuard is an open-source project, and an important one. It seems to me that if you want to push to create the authoritative WireGuard implementation for a major open source OS, the commercial norms need to take a back seat.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#44

Post by sgt »

annoyingnoob wrote: post #9
lambda_obrien wrote: post #3

I'll have to take a look at freebsd, does anyone have a good reference to the differences in a bsd versus Linux?

If it helps, OSX is based on BSD. I've had great success with pfSense. I found great tuning advice here: https://calomel.org Edit: Not sure why I'm getting down votes for trying to provide info. I didn't down vote anything in this thread.

OSX changed its name 5 years ago to macOS. For what it's worth, I've also had great success with pfSense. Ran it for years at our company. Recently we've migrated to Mikrotik, but to be honest I fail to see any major advantage. It's perhaps easier to train people in learning to use Mikrotik.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#45

Post by jandrese »

sschueller wrote: post #33

Im confused, pfsense 2.5 is out and has wireguard support. Is that version full holes I should be aware off?

It's a userland implementation. This is for the in-kernel implementation. It should be faster. Also, there are some comments that the userland version is rather hacky and probably should be transitioned away from once you can.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#46

Post by JStanton617 »

sschueller wrote: post #33

Im confused, pfsense 2.5 is out and has wireguard support. Is that version full holes I should be aware off?

Yes. The code you're running is described as having "random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows"

This is a kernel RCE just waiting to happen.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#47

Post by JStanton617 »

jandrese wrote: post #45
sschueller wrote: post #33

Im confused, pfsense 2.5 is out and has wireguard support. Is that version full holes I should be aware off?

It's a userland implementation. This is for the in-kernel implementation. It should be faster. Also, there are some comments that the userland version is rather hacky and probably should be transitioned away from once you can.

OPNSense (the pfSense fork) is using the userland version. pfSense 2.5 is using this kernel code - https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.ht...

"pfSense® Plus software version 21.02 and pfSense Community Edition (CE) software version 2.5.0 include a major OS version upgrade, a kernel WireGuard implementation..."

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#48

Post by tomxor »

kbenson wrote: post #28
Jonnax wrote: post #11

Earlier quoted context omitted.

Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they we…

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

I duno, if true about the code I find it very difficult to empathize with Netgate

From what has been said it's not like they found and fixed a subtle and cryptic vulnerability in an otherwise reasonable implementation and then failed to disclose it properly. It's more like they turned over a rock and found a murder victim. The guy from Netgate is also coming across as very inward looking and seems to assume everyone else's motivations are also purely selfish (referring to his comment implying a "shower of contracts" they might receive for the publicity). His focus should be on how to prevent this mistake from happening in future.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#49

Post by tedunangst »

cperciva wrote: post #18
seany wrote: post #16

Earlier quoted context omitted.

Netgate is weirdly hostile to a lot of opensource stuff, which should be strange given what all their tech is built on top of. This has been going on for years. (see opnsense etc)

Netgate funds a lot of FreeBSD work, and employs FreeBSD committers. I certainly wouldn't describe them as hostile to open source.

They can be a touch snotty towards developers who aren't freebsd committees.
Post reply on HN