21–30 of 96 posts
Can wireguard be run in docker?
The wireguard kernel implementation can't but AFAIK you should be able to run a userspace implementation like the rust version just fine.
Has the author not learnt from the past or does it actually need to be written in C for some reason?
Could Wireguard have been written in Rust or does it require C for some reason? We've seen CVEs in major libraries (e.g. openssl) and some of the guarantees Rust provides would prevent certain classes of vulnerabilities. Has the author not learnt from the past or does it actually need to be written in C for some reason?
The original implementation is a kernel module. You can find a bunch of (excellent) talks online by wireguard's author which all have a focus on security aspects and avoiding vulnerabilities. Besides, Go and Rust (3rd pty) implementations exist.
Can wireguard be run in docker?
I wish there was good documentation/a tutorial which shows one how to use systemd-networkd and nftables to manage wireguard interfaces. The Arch Wiki has some documentation[0], but I've never been able to get it past the initial handshake (which always succeeds) and no one on the IRC channel was able to help me out. I don't want to ask for hand-holding, but some more comprehensive and accessible documentation might h…
If you can't even connect to services on the peer then first delete all iptables and nftables rules and try again.
[0] https://wiki.archlinux.org/index.php/WireGuard#Server
[1] https://wiki.archlinux.org/index.php/Nftables#Masquerading
Could Wireguard have been written in Rust or does it require C for some reason? We've seen CVEs in major libraries (e.g. openssl) and some of the guarantees Rust provides would prevent certain classes of vulnerabilities. Has the author not learnt from the past or does it actually need to be written in C for some reason?
You don't seem to have spent a single minute researching before posting :/ The original implementation is a kernel module. You can find a bunch of (excellent) talks online by wireguard's author which all have a focus on security aspects and avoiding vulnerabilities. Besides, Go and Rust (3rd pty) implementations exist.
Correct. This is a discussion site after all.
> The original implementation is a kernel module
How does that make it safer if it's written in C? Of course no one likes to think they're writing vulnerable code...
The documentation is complete, but I think the most important topic is `AllowedIPs`. The rest is pretty standard and unsurprising (if you have any networking knowledge at all). I had written a bit about AllowedIPs when I switched to WG myself: https://try.popho.be/wg.html , with examples too.
It's seriously weird that `Address=10.0.1.2/32` works at all. An Address should have a correct subnet mask (like your IP at home might be 192.168.1.25/24, not 192.168.1.25/32). The documentation is complete, but I think the most important topic is `AllowedIPs`. The rest is pretty standard and unsurprising (if you have any networking knowledge at all). I had written a bit about AllowedIPs when I switched to WG myself:…