Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard in FreeBSD

cgit.freebsd.org

Post reply on HN
Print view View original

71–80 of 84 posts

Re: WireGuard in FreeBSD

#71

Post by hpcjoe »

I care about this only in the context of OPNsense which I replaced my old pfSense router with. Though I'd love to run a linux firewall router rather than *BSD, none seem up to the task. OPNsense is good.

I'm currently running a VM with a wireguard server within my firewall. That VM is running linux. I'm fine with this until the kmod lands in OPNsense, then I'll likely transition. One less VM to manage sounds good to me.

And another plug for OPNsense. Setting it up was easy. Far easier than pfSense, which I'd used for about a decade.

Re: WireGuard in FreeBSD

#72

Post by gonzo »

broknbottle wrote: post #69
gonzo wrote: post #57

Earlier quoted context omitted.

It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.

How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet. https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20... https://opnsense.org/opnsense-com/

https://reviews.freebsd.org/D26137

Re: WireGuard in FreeBSD

#73

Post by johnklos »

codethief wrote: post #43
johnklos wrote: post #36

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never…

Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and…

He never stated any technical reasons at all - neither then, nor a week later, nor since. He was asked very specifically, by people who are extremely competent, on a technical list:

"Can you be specific about what is wrong?"

"I don't like it" isn't good technical reasoning.

Re: WireGuard in FreeBSD

#74

Post by spijdar »

LargoLasskhyfv wrote: post #35
spijdar wrote: post #24

Earlier quoted context omitted.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running . I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from…

This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it,…

I really desperately want to agree with this at an emotional or aesthetic level - I ran NetBSD on my laptop for the largest portion of my teenage years, using FreeBSD on an old poweredge server for all my "needs a ton of RAM" programs. I had been on this quest to "truly understand" computers/OSes since prepubescence, and BSD appealed to me for exactly the reasons you describe - the pieces just seemed to fit together better.

I've gone deep down this rabbit hole, but now in my mid 20s, it seems like it's all sentimental - the amount of time I interact with any base system is pretty low, Linux's device model seems better suited to modern systems than BSD's more static kernel configs inherited from PDP-11/VAX/VMEbus-esque systems, and probably more than anything else, it's almost always easier to get your software to run on Linux. And after thinking about it, isn't that really the purpose of an OS? To facilitate running and developing software?

I still love running NetBSD on my 90s SPARC laptop, with device drivers descendant from the original 4.4BSD from UCB. I've gone so far as to patch my local install to get the crappy mu-law audio output working so I could playback youtube videos on it for kicks and giggles (recent releases overhauled the audio driver backend and the AMD7930's driver doesn't release some mutexes, failing asserts and hard faults the kernel)

Sometimes the Cathedral isn't so nice though. I never really figured out where I could send the ~5 line patch for this, only where I could submit a bug report, and possibly start a dialogue on the mailing list where I could maybe suggest the fix, and then a NetBSD developer could go fix it themselves? Didn't think it was worth the effort, so I never patched it.

Meanwhile, on Linux, I got a one line patch into the kernel, fixing a presumption that all 32-bit processes are big endian on PowerPC, thereby allowing the development of a 32-bit LE userland. Almost certainly useless to anyone, but it was a bug fix, and the patch process was fairly painless.

I think the end result is that Linux is fast and messy and a little ugly, but most of my hardware and software is also ugly and messy. I could run BSD on my laptop nowadays, but the only day-to-day change to my display server running firefox and $TERM windows would be a hotter keyboard and a few cents added to my energy bill, since those kernels don't really vibe with Intel p-states or whatever it's called now. My userland environment and day to day life is basically identical, just a few added problems when some piece of software assumes I'm on Linux and breaks.

Well, that and OOM handling. I don't ever remember the BSDs locking up quite like Linux does when it runs out of memory (or thrashes swap).

This turned out more rambly than I intended, but oh well. While I'm ranting, why is OpenBSD's fdisk the only implementation of fdisk with a command mode where quitting automatically saves changes*, as opposed to util-linux's fdisk, and NetBSD/FreeBSD's fdisk which always prompt? :-)

Re: WireGuard in FreeBSD

#75

Post by voidwtf »

gonzo wrote: post #72
broknbottle wrote: post #69

Earlier quoted context omitted.

How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet. https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20... https://opnsense.org/opnsense-com/

https://reviews.freebsd.org/D26137

It looks a lot like that was landed without completion of a proper review, and with several changes made without any review. I appreciated Netgate's commitment to improve the FreeBSD operating system, and to build the pfSense product. It's the attitude of Netgate's team, where an opportunity to offer a mea culpa and move forwards with the expertise of a core FreeBSD developer/maintainer and the subject matter expert was presented, was instead met with open hostility. It made it appear as if getting it done was more important than getting it right. Sometimes we get things wrong, we put a lot of work into code that we're proud of, then our project manager and peers come along and absolutely tear it down and rebuild it. It's an opportunity for growth, not a waste of effort or money.

I'm glad things improved and that you guys brought on Christian McDonald.

Re: WireGuard in FreeBSD

#76

Post by nix23 »

normaler wrote: post #44
nix23 wrote: post #40

Earlier quoted context omitted.

No openssl: https://www.wireguard.com/papers/zinzindohoue-bhargavan-prot...

I meant in the context of a Bastion ssh server, which is what the patent meant i think.

Then just exchange the ssh-server with one in the ports, compile it with wolfssl, openssl-(devel?), libressl or mbed TLS, whatever you want. The stuff in base is meant to be compatible and as slim as possible (for example the kerberos-server in base).

Or define the runtime options from the base-ssh-server in rc.conf (that's what i normally do):

sshd_enable="YES"

sshd_dsa_enable="NO"

sshd_ecdsa_enable="NO"

sshd_ed25519_enable="YES"

sshd_rsa_enable="NO"

If you want RSA=YES then you probably/maybe want to delete all moduli less then 4096.

https://github.com/bsdlabs/ssh-hardening

Re: WireGuard in FreeBSD

#77

Post by nix23 »

johnklos wrote: post #73
codethief wrote: post #43

Earlier quoted context omitted.

Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and…

He never stated any technical reasons at all - neither then, nor a week later, nor since. He was asked very specifically, by people who are extremely competent, on a technical list: "Can you be specific about what is wrong?" "I don't like it" isn't good technical reasoning.

I kind of understand him, WireGuard is connected to his Name, if a implementation is not matching his taste of quality (i especially used taste here) and something happens it backfires.

It's a bit the same as with pulse-audio in the beginning, where it backfired to poettering even if the code was not finished and the distributions, especially ubuntu integrated it pretty bad, told no one that it was alpha...and everyone was like:

What bad thing my sound worked with alsa before...i hate pulse-audio, poettering destroyed the "year of linux-desktop", now i hate him too ;)

Re: WireGuard in FreeBSD

#79

Post by 0dayz »

1letterunixname wrote: post #62
codethief wrote: post #43

Earlier quoted context omitted.

Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and…

NetBSD just needs Rust support for kernel dev. ;) I appreciate when folks take a reasonable stand against craptastic software engineering practices ( cough OpenSSL cough ) and insist on quality code.

I may be wrong but openssl was never deemed poor quality primarily due to the devs not giving a damn but because of legacy code and lack of funds.

Re: WireGuard in FreeBSD

#80

Post by loeg »

spijdar wrote: post #74
LargoLasskhyfv wrote: post #35

Earlier quoted context omitted.

This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it,…

I really desperately want to agree with this at an emotional or aesthetic level - I ran NetBSD on my laptop for the largest portion of my teenage years, using FreeBSD on an old poweredge server for all my "needs a ton of RAM" programs. I had been on this quest to "truly understand" computers/OSes since prepubescence, and BSD appealed to me for exactly the reasons you describe - the pieces just seemed to fit together…

FreeBSD does use modern Intel pstates, for what it’s worth.
Post reply on HN