The VPN provider Mullvad, which develops the Mullvad Browser and provides infrastructure for the Mozilla VPN service, has introduced the GotaTun project, implementing the WireGuard VPN protocol in Rust and operating in user space. The project code is distributed under the BSD license. Mullvad has already utilized GotaTun in its VPN client for the Android platform and plans to transition desktop and iOS applications to it next year.
GotaTun is a fork of the BoringTun toolkit developed by Cloudflare, used in the WARP application. GotaTun differs from BoringTun by offering full support for the Android platform, performance optimizations, and additional privacy protection features.
GotaTun integrates support for DAITA (Defense Against AI-guided Traffic Analysis) technology to protect against analysis of encrypted transit traffic carried out using machine learning-based tools. DAITA normalizes the size of sent packets, mixes in random background traffic, and distorts patterns of typical data flows. GotaTun also features a Multihop mode that allows access to VPN-servers not directly, but through a series of transit nodes, which, for example, allows organizing traffic through more optimal routes.
To enhance performance, GotaTun implements multithreaded processing and employs a zero-copy memory handling strategy without intermediate buffering, using only the initially provided buffer.
Previously, Mullvad's applications used a fork of the WireGuard implementation in Go — wireguard-go, extended with support for DAITA and Multihop. According to Google statistics, 85% of all user-reported crashes of the Mullvad Android client were related to wireguard-go code, prompting Mullvad to replace the WireGuard implementation with a more reliable alternative.
The implementation in Rust was chosen because the Mullvad VPN application is written in Rust, except for the wireguard-go code, which was integrated through a complex and unsafe block-utilizing FFI (foreign function interface). In the Android client release of Mullvad at the end of November, the wireguard-go implementation was replaced with GotaTun, resolving reliability issues — compared to previous versions, the metric reflecting the number of crash completions changed from 0.40% to 0.01%.
Source: opennet.ru
