WireGuard Could Be Mainlined Before Christmas

[timofonic]

Nothing stopping you from configuring WileGuard from Active Directory... Except taste.

There's no taste in Microsoft world, just money...

[HyperDrive]

Not happening.

[bug77]

Nothing stopping you from configuring WileGuard from Active Directory... Except taste.

There are entire IT departments trained to do just that.

[k1e0x]

From the Whitepaper

I understand all those points and all of them are good and fine. (except for the security one, that makes no sense.. only the kernel has "secure code"? what is that a joke?) A kernel module makes sense from a performance aspect. What I'm asking is why it needs to be an in tree module? it seems like something... more high level. I guess I'm not really a fan of daemons being in the kernel.. I don't think we need mail servers and web servers in the kernel.

[starshipeleven]

Don't worry about it, in the enterprise space ancient solutions that only work in conjunction with AD will continue to rule

ppptp with AD accounts for the win, lol

[starshipeleven]

Why does this matter if it's in the kernel or not? Is it even a good idea to put a VPN Server in the kernel? Why shouldn't this just be a package? hmm

It relies so heavily on kernel infrastructure and API that it is just stupid to hammer the performance with constant context switches just because you want to keep a thousand lines of code out of the kernel.

[starshipeleven]

A kernel module makes sense from a performance aspect. What I'm asking is why it needs to be an in tree module?

Why should it be an out-of-tree module?

Only reason to stay out of tree is if your license is not compatible or if your code quality is garbage. Wireguard isn't either.

I don't think we need mail servers and web servers in the kernel.

A VPN server is a differen thing than a web server and mail server.

Linux does integrate a firewall too for example, it's not a separate application. Same reasons.

[starshipeleven]

Nothing stopping you from configuring WileGuard from Active Directory... Except taste.

Why would you need to install additional software when Windows provides its own VPN already.

[k1e0x]

Thanks starshipeleven

But if anyone has some interesting insight to my question that would be great.

From the Whitepaper

I understand all those points and all of them are good and fine. (except for the security one, that makes no sense.. only the kernel has "secure code"? what is that a joke?) A kernel module makes sense from a performance aspect. What I'm asking is why it needs to be an in tree module? it seems like something... more high level. I guess I'm not really a fan of daemons being in the kernel.. I don't think we need mail servers and web servers in the kernel.

[mbello]

Ok k1e0x so apparently you do not know what "in-tree" means.

Once wireguard is accepted in the kernel code tree it becomes an official piece of code that has been reviewed and is maintained by the kernel dev team. Today, wireguard is a piece of code we load on our kernels that is maintained by a dude called Jason. Jason is a great guy and all that, but if you have ever dealt with enterprise IT environments you will know the huge difference.

Now, being in tree does not mean it must be in your kernel. You will still be able to compile your kernel without any wireguard code or even compile wireguard as a module.