{"id":105412,"date":"2022-10-30T15:36:45","date_gmt":"2022-10-30T13:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kodovuyu-bazu-freebsd-dobavlena-novaya-realizacziya-vpn-wireguard"},"modified":"2022-10-30T15:36:45","modified_gmt":"2022-10-30T13:36:45","slug":"v-kodovuyu-bazu-freebsd-dobavlena-novaya-realizacziya-vpn-wireguard","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-kodovuyu-bazu-freebsd-dobavlena-novaya-realizacziya-vpn-wireguard","title":{"rendered":"The FreeBSD codebase has added a new implementation of the WireGuard VPN.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Changes with a new implementation of the WireGuard VPN, based on kernel module code, have been accepted into the FreeBSD source tree, jointly prepared by the core development teams of FreeBSD and WireGuard with the participation of Jason A. Donenfeld, the author of WireGuard, and John H. Baldwin, a well-known developer of GDB and FreeBSD, who implemented SMP and NUMA support in the FreeBSD kernel in the early 2000s. After the driver was accepted into FreeBSD (sys\/dev\/wg), its development and maintenance will now be carried out in the FreeBSD repository. <\/p>\n
Before accepting the code with the support of the FreeBSD Foundation, a complete review of the changes was conducted, during which the interaction of the driver with other kernel subsystems was also analyzed, and the feasibility of using the cryptographic primitives provided by the kernel was assessed. <\/p>\n
To utilize the cryptographic algorithms necessary for the driver, the API of the FreeBSD kernel's cryptosystem was extended, adding a wrapper that allows unsupported algorithms in FreeBSD to be used through the standard crypto API, employing the implementation of necessary algorithms from the libsodium library. Among the algorithms built into the driver, only the code for calculating Blake2 hashes was retained, as the implementation provided in FreeBSD is tied to a fixed hash size. <\/p>\n
Additionally, during the review process, code optimization was performed that increased the efficiency of load distribution on multi-core CPUs (ensuring an even balance for binding encryption and decryption tasks to CPU cores). As a result, the overhead in packet processing was brought closer to the implementation of the driver for Linux. The code also ensures the possibility of using the ossl driver to accelerate encryption operations. <\/p>\n
Unlike the previous attempt to integrate WireGuard into FreeBSD, the new implementation utilizes the standard wg utility instead of a modified version of ifconfig, which has allowed for a unified setup in both Linux and FreeBSD. The wg utility, like the driver, is included in the source code of FreeBSD, thanks to changes in the licensing of the wg code (which is now available under MIT and GPL licenses). The previous attempt to incorporate WireGuard into FreeBSD was made in 2020 but ended in controversy, resulting in the removal of the code already added due to poor quality, careless buffer handling, the use of stubs instead of checks, incomplete protocol implementation, and GPL license violations. <\/p>\n