bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

WireGuard merged into the main branch of the Linux kernel

Summary

In January 2020 Linus Torvalds merged the net-next branch, and with it the WireGuard VPN, into the main branch of the Linux kernel. This set WireGuard for Linux 5.6 in April, after Jason Donenfeld had proposed it for inclusion the previous summer. The network code comprises only around 7,000 lines, whereas OpenVPN and IPsec run to several hundred thousand.

Ideas

  • Small code is much easier to review than large VPN stacks.
  • WireGuard deliberately does without choices in cryptography.
  • The path into the kernel took several years and many discussions.
  • WireGuard appears as a normal network interface wg0 that the usual tools can manage.

Insights

  • Simplicity is a security feature because it makes review possible.
  • Inclusion in the kernel made WireGuard the standard option on all Linux systems.

Facts

  • WireGuard first appeared as stable with Linux 5.6.
  • The kernel developers adapted their own crypto API for WireGuard.

References

Critique

  • The report only compares lines of code and does not mention which features WireGuard deliberately leaves out compared with IPsec.

Recommendations

  • Use WireGuard for new site-to-site and remote access.
  • Manage WireGuard keys and peer configurations centrally, for example via configuration management.

Read the original article

Search the Web Archive

g · 2019

Linux kernel to get drivers for Z-Wave and LoRa

In January 2019 SUSE developer Andreas Färber published an experimental Linux driver for the home automation protocol Z-Wave. Färber called it a proof of concept, tested with the Pine64 Z-Wave module and written without documentation of the UART protocol. Drivers for the LoRa radio protocol had also been in the works for some months.

g · 2007

Linux kernel 2.6.19.2 fixes storage bug

In January 2007 Linux kernel 2.6.19.2 fixed a critical bug that could, under certain circumstances, cause data not to be written to disk correctly. Ext3 was particularly affected, but other file systems were too; tracking down the bug took around four weeks. The version also closed security holes, for example in the Bluetooth stack, with around 50 patches in total.

g · 2005

How secure is the Linux kernel?

After several kernel holes, the Linux kernel mailing list discussed in January 2005 how secure the kernel is. Brad Spengler blamed the new development model, while Alan Cox and Theodore Ts’o saw a positive trend. More bugs found did not mean more bugs, but better searching, for example with tools such as Coverity and sparse.