Hacker News Reader

Comment by api | Hacker News Reader

ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big?

It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apples.

View on HN

How is ZeroTier on dynamic allocation? Small code size is one WireGuard software security goal; minimizing dynamic allocation is the other.

It does dynamically allocate, though it always checks for success. It could be refactored not to but so far we haven't targeted devices small enough to worry about a megabyte or two of RAM. There are also checks in place to guard against memory exhaustion attacks where applicable.

We just did phase I of a professional audit for V2. It was a design audit, but we're doing a code audit too. V2's code base will be a bit cleaner.

Cool! Just a thing to think about! Code size is a useful metric, especially as it improves auditability. But not having to think about object lifecycle bugs ("can this timer fire into a freed connection state block", etc) is a huge intrinsic structural win. Having an unusually clear, audited documentation of the lifecycles of all the objects in your design would also go a long way.

I was trying out ZeroTier a few years back and found it fantastic. I was, at the time, working for a large security network device provider and trying to get R&D to bake it into the flagship product - this was before SD-WAN really took off. I never got anywhere with that agenda, but - still think that would have been a fantastic use case.

I'm curious if the stalwarts of the network security space, with their old and crusty VPN concentrators, finally move on WireGuard. Likely not until enough customers move away from them to a solution using, or they get around to finally running a recent kernel.

Crusty stalwart here. I'd love to get off crusty VPN concentrators. I'd personally love to see something in the open source space that supports 2FA and a rich, user-based policy language. Tailscale is trying to deliver an enterprise product that builds this on top of Wireguard. I'm not aware of any open source approaches tackling this problem like Tailscale, but I'm keenly interested.

Curious if you can provide any links to exactly what you need. 2FA is obvious but what kinds of policy languages are you thinking of? There are numerous variations out there.

Look up Appgate sdp

Reply on news.ycombinator.com