Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

181–190 of 208 posts

Re: WireGuard is in net-next

#181

Post by samgranieri »

thequailman wrote: post #33
datenwolf wrote: post #32

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

WireGuard is actually pretty awful from an IT security org perspective. There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures. Additionally, there is no concept of two step auth, so if your key is compromised, anyone can connect without anyone knowing about the compromise. If security companies adopt WireGuard, expect thing…

Apologies for sounding flippant: this sounds like a good opportunity for someone to build tools that use wireguard as a foundation to achieve what you want.

Re: WireGuard is in net-next

#182

Post by wolf550e »

api wrote: post #110
samgranieri wrote: post #103

Earlier quoted context omitted.

Humor me: What would prevent DJB's crypto from being certified by FIPS?

Bureaucratic inertia. I've been hoping for years that it'll be certified. They've talked about Curve25519 and Curve448 for a while but no movement so far. My insider sources tell me there's opposition, but I have no clue why... either the NSA prefers weaker crypto or (more likely) industry wants the status quo because they fear competition from open source superior products like WireGuard among many others.

NIST FIPS 186-5 (Draft) has Ed25519.

https://csrc.nist.gov/publications/detail/fips/186/5/draft

NIST SP 800-186 (Draft) has the curve definitions. But says only for Ed25519, not for X25519. They have a Weierstrass curve W-25519 that is isomorphic to Curve25519 that might allow using X25519 code, but that's way above my ability to judge. 'tptacek or 'jedisct1 or others will know.

https://csrc.nist.gov/publications/detail/sp/800-186/draft

Re: WireGuard is in net-next

#183

Post by stock_toaster »

amarshall wrote: post #140
loeg wrote: post #124

Earlier quoted context omitted.

pfSense is a FreeBSD downstream, right? First you'd have to port Wireguard to FreeBSD. Or you could run the userspace server, but expect poor performance.

Userspace already has a package https://www.freshports.org/net/wireguard/

Boringtun (cloudflare's rust implementation of wireguard in userspace) also has work in progress FreeBSD support apparent[1].

[1]: https://github.com/cloudflare/boringtun/pull/35

Re: WireGuard is in net-next

#184

Post by flas9sd »

datenwolf wrote: post #91
thequailman wrote: post #33

Earlier quoted context omitted.

WireGuard is actually pretty awful from an IT security org perspective. There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures. Additionally, there is no concept of two step auth, so if your key is compromised, anyone can connect without anyone knowing about the compromise. If security companies adopt WireGuard, expect thing…

There are (at least) two pieces to WireGuard. The wireguard "wire" protocol itself, which is implemented in the kernel. And the authentication and key exchange, that are done by userspace tools. Right now there exist the "default" tools, which require a manual exchange of key pairs and do only very rudimentary user mapping and authorization. However: It is perfectly possible to implement much more complex authorizati…

If you haven't already, you should give Yggdrasil (https://github.com/yggdrasil-network/yggdrasil-go/blob/maste...) a read.

> IP addresses are derived from cryptographic keys, to reduce the need for public key infrastructure

Re: WireGuard is in net-next

#186

Post by loxias »

jeltz wrote: post #78
loxias wrote: post #56

I'm excited by this, but I'd really love a userspace C or C++ implementation. I know that context switching syscalls take time, but I've enjoyed the trend of the last 10 years towards more userspace services, not less. (I'm particularly thinking of filesystems in userspace and block devices in userspace) Still, cool. cool, cool cool. I wonder how long until it's in debian.

I use BoringTun, it is written in Rust and runs entirely in user space.

Cool, thanks, I'll have to check that out!! I've sorta been itching for an excuse to learn rust. Go left me underwhelmed, but that's probably due to me having misplaced expectations. (it's not a better C or C++, it's a better Perl/Python/Shell)

Re: WireGuard is in net-next

#187

Post by lawnchair_larry »

tptacek wrote: post #145
tssva wrote: post #54

Earlier quoted context omitted.

It may be way simpler for basic setups but it quickly becomes as or more complex than ipsec for more advanced setups such as those involving dynamic routing and/or fail over routes. The additional complexity is due to the fallout of allowed-ips and how they are used. What you essentially end up with is that a wireguard interface represents a point to multipoint non-broadcast network. Any one that has dealt with Frame…

I think this is a really strong comment. The only observation I'll make is that making the simple base case for VPNs easy is much more important than making dynamically routed VPNs straightforward. More people should be using VPN-like-tunnels as an access solution, but don't, because every VPN other than WireGuard builds in extra complexity to support use cases they don't have. What the industry desperately needed wa…

Or if you have more than a small handful of users to manage. Or if you want MFA. WireGuard kind of breaks down when you go outside of site-to-site or “hobbyist nerd running a personal VPN” use cases.

SSH is even way more flexible there, and it’s really not great at that.

If you’ve managed to deploy WireGuard at scale with your clients, I’d like to be proven wrong!

Re: WireGuard is in net-next

#188

Post by forbiddenlake »

416chad wrote: post #89
kylek wrote: post #83

Earlier quoted context omitted.

The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID. Edit: I'm talking about the iOS version, not sure what platform you're using.

No such luck on Android, you need to use tasker or similar. Really a nuisance but not a deal breaker. It would be dreamy to set up the client to not use specific SSIDs.

I want to point out that the intents on the official Wireguard Android app are not exposed, so I, not being rooted, can't use Tasker to automate it.

However, there are other Android apps that implement Wireguard that do expose their intents. I use Viscerion with Tasker quite happily.

Re: WireGuard is in net-next

#189

Post by Diagon »

markosaric wrote: post #31
7ewis wrote: post #16

Does this mean WireGuard will be moving to stable? My VPN provider has said they won't support WireGuard until it hits 1.0

Same here. I want to try WireGuard too but ProtonVPN doesn't support it yet. I may reconsider them as my subscription expires next year.

ProtonVPN is involved with funding Wireguard development: https://protonvpn.com/blog/wireguard-donation/

Re: WireGuard is in net-next

#190

Post by loeg »

amarshall wrote: post #140
loeg wrote: post #124

Earlier quoted context omitted.

pfSense is a FreeBSD downstream, right? First you'd have to port Wireguard to FreeBSD. Or you could run the userspace server, but expect poor performance.

Userspace already has a package https://www.freshports.org/net/wireguard/

Yes, I know; I use it myself. It's not the same thing as a kernel C implementation.
Post reply on HN