Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

51–60 of 293 posts

Re: WireGuard is now in Linus' tree

#51

Post by vbezhenar »

_8j50 wrote: post #18

So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?

If all networking happens inside kernel, it'll be as fast as possible. People write userspace code because they don't want to put their application into kernel for obvious reasons. And with userspace code it makes sense to move everything into userspace, including network drivers, etc. But it's not a standard configuration and compromises on security.

Re: WireGuard is now in Linus' tree

#53

Post by throwaway2048 »

vbezhenar wrote: post #45
derefr wrote: post #13

Earlier quoted context omitted.

A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.

IPSec works fine with UDP and NAT.

"fine" with NAT is a bit of an overstatement, I don't think anyone who has seriously interacted with IPSEC would call it anything but a gigantic pain in the ass

Re: WireGuard is now in Linus' tree

#54

Post by lvh »

_8j50 wrote: post #18

So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?

Most of the userspace high-performance networking stuff is still pretty exotic. It requires plenty of tuning, specific network hardware, and sometimes extreme conditions, to be viable. DPDK does not work on the wireless connection I'm using to post this reply, for example (nor any wireless connection for that matter).

Meanwhile, if you're not doing that: Wireguard can avoid lots of syscall and copying overhead plus some magic CPU register overhead by being in the kernel. Hence this almost certainly makes wg faster on the net because it can't pick and choose what environments it runs in.

Re: WireGuard is now in Linus' tree

#56

Post by therealmarv »

jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.

Re: WireGuard is now in Linus' tree

#58

Post by Diederich »

jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo

It's fast. It's easy. You never have to think about it. It just works.

Re: WireGuard is now in Linus' tree

#59

Post by numbsafari »

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion.

Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away?

EDIT:

Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.”, so perhaps real soon now?

https://lists.zx2c4.com/pipermail/wireguard/2020-January/004...

This is definitely big news!

Re: WireGuard is now in Linus' tree

#60

Post by therealmarv »

Noumenon72 wrote: post #11
kennu wrote: post #7

If you're wondering what it is: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many…

What does it mean to be "in Linus' tree" if it's already on Linux and everywhere else? Like it will be built in somehow?

Right now Wireguard is using DKMS which is like a external Kernel module which needs to be rebuild on every Kernel update. When WG is already inside the Kernel no dynamic created DKMS are needed anymore.
Post reply on HN