A word of caution in using wireguard in the 2.5 release.
Caution?
Ok, caution if you’re still running pfSense v2.4.5 and are looking at this with interest from afar.
If you ambitiously forged again with pfSense v2.5 and migrated to WG at this point the operative words are “downgrade” and “revert”.
I hear Dave Lee Roth singing “I see lonely ships upon the water. Better save the women and children first”.
If you want to read the detailed version of what Jason A. Donenfeld (developer of Wireguard) think of Netgate code: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here.
I would like to point out the poor way Netgate is handling the situation they initiated by releasing a code that contains, according to Donenfeld:
There were random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows, and the whole litany of awful things that go wrong when people aren’t careful when they write C.
As a response, Netgate is (obviously) in damage control. What I don’t like is the fact that they are threatening and blaming Doenenfeld.
Netgate:
None of these actions reflect good-faith collaboration, and your statements that you think that our work is “really cool” ring hollow. Maybe you and Kyle are really naive and thought that this was how people normally collaborate in the security and business worlds, and that everyone would rush to praise you and shower you with contracts and funding. And hey, maybe that’ll happen, you certainly have made a splash. That of course, comes at our expense, and it’s likely to be a pretty damaging one. Now with the Ars article, I’m starting to wonder if this was a coordinated smear campaign. Normally we don’t get this kind of attention. It’s going to be painful to navigate our way out.
I’ll be writing an article tonight outlining the mistakes that we made and what we will be doing to correct it. I’ll also be highlighting that this incident has been a textbook example of the wrong way for people to collaborate in the security community, and that extreme caution should be taken in any future dealings with you. Your actions are self serving and in bad faith, and your words are hollow and untrustworthy. I don’t care if you disagree or don’t see it this way, this is the effect that you’ve had.
Source: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here
They have planned to remove Wireguard from FreeBSD but only in response of Donenfeld and because he made it all public. They were aware of all the security vulnerabilities and it’s poor implementation, and the only thing they think of right now is their image? “Normally we don’t get this kind of attention.” is that why you thought it was a great idea not to collaborate and make a poor implementation of the code?
I like what pfsense is as a product but this story is not what I think how a project should be handled and certainly not released for production. Is the rest of pfsense also written like that?
3 Likes
This is a mess, short time solution is not to use Wireguard in pfsense until this is sorted out.
1 Like
Good thing I hold off. Was looking to implement WireGuard with the 2.5…back to Open VPN for now.