Comments (5)
The reason why L2TP is fast is that the whole data path is entirely handled in the kernel - fastd doesn't see any of the traffic, so there is no way for fastd to do any encryption. The common solution for encrypted L2TP is wrapping the whole connection in IPsec, which is complex to configure and requires additional userspace software (which is not aligned with fastd's main design goal to be usable on very small embedded Linux devices).
The best idea I have to have to get an encrypted connection with a fast in-kernel data path would be to make fastd an alternative userspace for the wireguard kernel module. This unfortunately doesn't solve the problem of wireguard's missing L2 support...
from fastd.
So, what we need is a kernel offloading module at L2 level with encryption support? E.g. something like l2tp that gets a symmetric key as a parameter (and maybe some re-keying mechanism from time to time)?
from fastd.
I don't intend to support any out-of-tree module, and I don't think getting another separate solution after Wireguard into the mainline kernel is feasible. That leaves us with a few options:
- Extend Wireguard with proper L2 support
- Combine Wireguard with VXLAN/GRETAP/..., possibly with integrated handling in fastd (performance penalty?)
- Add an IPv6 encapsulation feature to batman-adv (I have no idea if this makes sense)
- Accept that there is no nice solution with batman-adv, and hope for better support of L3 mesh routing protocols in Gluon
- Other ideas?
from fastd.
I think, "Extend Wireguard with proper L2 support" would be the best solution here. Unfortunately, wireguard started as a L3 only solution from the beginning. It might be hard to convince the devs there to support L2.
A good starting point might be to ask them to remove the "more useful than IPsec" statement from their homepage unless they implement L2 ^^
from fastd.
A good starting point might be to ask them to remove the "more useful than IPsec" statement from their homepage unless they implement L2 ^^
I don't think that's quite accurate - IPsec also only handles IP after all, L2 would be provided by some other encapsulation protocol inside the IPsec-protected packets, like L2TP. So in that regard, Wireguard isn't less useful than IPsec.
from fastd.
Related Issues (20)
- fastd 20 osx build failure
- Broken init script? HOT 4
- Android still supported? HOT 4
- fastd 22 build issue HOT 3
- Explain what fastd is HOT 1
- Interface value null with offloaded null@l2tp in socket response
- Establish hook not always called on connect HOT 4
- OpenRC service management script HOT 3
- arp flood if forward enabled HOT 4
- Multipath optin using MP-DCCP with tunprox HOT 1
- No packets received on fastd interface HOT 2
- Keepalive mechanism HOT 5
- Best MTU for L2TPv3 mode with kernel offload? HOT 1
- Add VXLAN backend HOT 1
- Distributed peering HOT 3
- Question: Does fastd implement perfect forward secrecy? HOT 2
- request a new release HOT 1
- Enhancement: config: allow setting a file-path rather then the raw secret HOT 2
- Question: What does `dropping duplicate packet from` mean? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fastd.