Firezone replaces its patched boringtun fork with sanstun, a sans-IO WireGuard implementation in Rust
Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust
After more than two years and over 70 patches to Cloudflare's boringtun, Firezone built sanstun: a sans-IO Rust implementation of the WireGuard state machine. It enforces protocol invariants through types, drops internal buffering, and splits packet bookkeeping from crypto so encryption can run on worker threads. Benchmarks suggest up to a 45x theoretical speedup, with the interface itself staying single-threaded and lock-free.
A good API design makes it impossible to build things that are broken and also guides you along in understanding how the protocol works.
- Twey
It was all going great until I read
> The design also avoids problems like function coloring and plays well with Rust's ownership rules.
Async is not I/O. It can be used for I/O, but it's just a way of writing pure, deterministic state machines that keeps a logical flow together instead of scattered over a bunch of transitions.
Even if you choose to manually compile your async flows into explicit state machines, you still have to deal with ‘function colouring’ (a.k.a. typing): a flow that crosses several state transitions (and may have other disjoint parts of the state updated in the meantime, via other transitions) now has to be rewritten as a (series of) state transitions, and can't be called from a blocking function. If anything, rewriting all your state machines without `async` makes the function colouring ‘problem’ worse, because multi-transition flows are even more different from normal functions.
- monocasa
Sweet, this is basically how I design my protocol implementations in rust as well.
Way more testable, the bulk can be shared between async and blocking IO, it's a lot easier to completely ban unsafe in your dependencies (excepting std and core), etc.
- temp0826
Mullvad spun their own implementation off of boringtun as well (called gotatun[0])