Jason A. Donenfeld, the author of VPN WireGuard, higher level of isolation, as if one controller is broken, the problem is confined to that specific context). into the main body of the OpenBSD kernel driver "wg" for the WireGuard protocol, specific network interface and user space tooling. OpenBSD became the second OS after to have full and integrated support for WireGuard. The inclusion of WireGuard is expected in the OpenBSD 6.8 release.
The patches include the OpenBSD kernel driver, changes to the ifconfig and tcpdump utilities to support WireGuard functionality, documentation, and minor changes for integrating WireGuard with the rest of the system. The driver uses a custom implementation of the algorithms , and , as well as the already existing implementation of SipHash in the OpenBSD kernel.
The implementation is compatible with all official WireGuard clients for Linux, Windows, macOS, *BSD, iOS, and Android. Performance testing on the developer's laptop (Lenovo x230) showed a throughput of up to 750 Mbit/s. For comparison, isakmpd with default IKE PSK settings provides a throughput of 380 Mbit/s.
During the development of the OpenBSD kernel driver, some architectural decisions similar to those for the Linux driver were made, but the driver was primarily developed for OpenBSD, taking into account the specifics of this system and the experience gained while creating the Linux driver. With the original author of WireGuard's agreement, the code for the new driver is fully distributed under the ISC open license.
The driver is tightly integrated with the OpenBSD network stack and utilizes existing subsystems, allowing the code to be very compact (around 3000 lines of code). Among the differences noted is a different division of driver components compared to Linux: OpenBSD-specific interfaces are placed in the files "if_wg.*", DoS protection code in "wg_cookie.*", and the connection negotiation and encryption logic in "wg_noise.*".
Source: opennet.ru
