Conversation

This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
Replying to
@BRIAN_____
> Why did Wireguard require so much of its code to be put into the Linux kernel? It didn't require it. Android has a VPN service API for implementing userspace VPNs and there's an official WireGuard app with a userspace implementation. The kernel module isn't a mandatory thing.
1
3
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@BRIAN_____
Userspace VPN implementations require a lot of expensive context switches, reducing performance and battery life. It also requires userspace infrastructure / plumbing. Android has support for this including a toggle for always-on and another toggle to block leaks if it dies, etc.
1
2
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@BRIAN_____
Elsewhere, every userspace VPN implementation has to reinvent the wheel including routing the traffic through the VPN and preventing leaks before it's started or if the process dies. It's messy and requires every userspace VPN implementation to do invasive stuff with root access.
1
2
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@BRIAN_____
It's a mix of the usual reasons for shoving everything into the kernel: performance and working around lackluster, fragmented userspace infrastructure. Proper infrastructure exists for userspace VPN services but it's not universal. Putting things in the kernel gets it everywhere.
1
2