[ANNOUNCE] Wintun 0.9 Released with Major Usability Improvements

[ANNOUNCE] Wintun 0.9 Released with Major Usability Improvements

[Jason A. Donenfeld]

Hi folks,

Simon and I are very excited to announce the release of Wintun 0.9, the
release in which Wintun finally becomes easy and enjoyable to use by
developers. I consider this the most significant release of Wintun yet.

Webpage: https://www.wintun.net/

For background: Wintun is a driver for the Windows kernel that enables
userspace programs to create network tunnels. It's a "/dev/net/tun" of the
Windows world. We use this for WireGuard. We had investigated OpenVPN's "tap6"
driver but found it to be a crumbling mess with dubious security, and instead
endeavored to write a lightweight minimal replacement that obtains extremely
high speeds using a ring buffer, similar to Linux's io_uring.

Big Change 1: API Library and Easy Distribution
-----------------------------------------------

We used to rely on an obscure Microsoft technology for distributing Wintun,
called MSI Merge Modules (MSM), in which application writers would bundle the
signed MSM we provided as part of their MSI installer. This was great in that
it encapsulated a lot of logic and hid it from developers, but relying on MSM
was a hassle and precluded the use of Wintun in many non-MSI apps.

The MSM also would simply make sure the driver was installed, but wouldn't
provide anything else. It was up to developers to then navigate arcane Windows
driver instantiation APIs, which are some of the oldest and most obscure to
use. Then, once installed, developers had to manage a ring and various IOCTLs
themselves. It all worked -- WireGuard and OpenVPN (after receiving our
assistance) successfully deployed it -- but it was cumbersome enough that
nobody else was going to use this.

With Wintun 0.9, we're changing what we distribute and also providing an easy
to use API. Rather than shipping MSMs to developers, we now ship a single
basic boring wintun.dll. This dll hides all of the driver installation and
adapter instantiation logic, and provides a nice interface for managing
adapters and shuffling data in and out of the ring buffer. So, application
developers can now just grab that dll, plop it into their application like
they would any other dll, and use Wintun without even noticing that it's
inserting a kernel driver when necessary

Big Change 2: Support for WOW64 and ARM
---------------------------------------

Windows does not support setupapi.dll and related driver functions on 32-bit
processes running on 64-bit operating systems. This meant that it was
impossible for WOW64 processes to use Wintun. Wintun also formerly required
64bit addresses, which made the kernel ABI clumsy for WOW64 processes. With
Wintun 0.9, we now bundle a 64-bit version of Wintun inside 32-bit versions of
the wintun.dll, and we marshal calls back and forth to an on-demand proxy
process running on the native architecture.

Not only do we have this for basic WOW64, but we also have this working for
Windows' ARM64 emulation of x86 binaries. So you can now run an x86 program on
ARM64 and wintun.dll will figure out what to do.

This has big effects for us. Since Go still has not been ported to ARM64, we
use an ARM build and rely on this new feature of Wintun. This means we should
have a WireGuard for ARM64 Windows release in the coming week or two.

Big Change 3: Administrator User Permissions
--------------------------------------------

Wintun requires the Local System user. But if you're running as Administrator,
the wintun.dll library will attempt to do its operations as Local System,
automatically. This effectively means that normal apps can bundle Wintun now,
rather than just services.


Please let us know if you have any questions or feedback. We're certainly
interested in developer reports on what integrating this is like.

- The API reference is available online:
  https://git.zx2c4.com/wintun/about/

- And there's some simple example code too:
  https://git.zx2c4.com/wintun/tree/example/example.c

- A signed wintun.dll for amd64, arm64, x86, and arm is on the webpage:
  https://www.wintun.net/

- And of course, it's open source:
  git clone https://git.zx2c4.com/wintun

Regards,
Jason

Re: [ANNOUNCE] Wintun 0.9 Released with Major Usability Improvements

[Guy Godfroy]

Just noticed that wintun icon is heavily inspired from french subway
warning message "Don't put yout hands on the door" :-)

Anyway, great job.

Le 09/11/2020 à 17:25, Jason A. Donenfeld a écrit :
> Hi folks,
> 
> Simon and I are very excited to announce the release of Wintun 0.9, the
> release in which Wintun finally becomes easy and enjoyable to use by
> developers. I consider this the most significant release of Wintun yet.
> 
> Webpage: https://www.wintun.net/
> 
> For background: Wintun is a driver for the Windows kernel that enables
> userspace programs to create network tunnels. It's a "/dev/net/tun" of the
> Windows world. We use this for WireGuard. We had investigated OpenVPN's "tap6"
> driver but found it to be a crumbling mess with dubious security, and instead
> endeavored to write a lightweight minimal replacement that obtains extremely
> high speeds using a ring buffer, similar to Linux's io_uring.
> 
> Big Change 1: API Library and Easy Distribution
> -----------------------------------------------
> 
> We used to rely on an obscure Microsoft technology for distributing Wintun,
> called MSI Merge Modules (MSM), in which application writers would bundle the
> signed MSM we provided as part of their MSI installer. This was great in that
> it encapsulated a lot of logic and hid it from developers, but relying on MSM
> was a hassle and precluded the use of Wintun in many non-MSI apps.
> 
> The MSM also would simply make sure the driver was installed, but wouldn't
> provide anything else. It was up to developers to then navigate arcane Windows
> driver instantiation APIs, which are some of the oldest and most obscure to
> use. Then, once installed, developers had to manage a ring and various IOCTLs
> themselves. It all worked -- WireGuard and OpenVPN (after receiving our
> assistance) successfully deployed it -- but it was cumbersome enough that
> nobody else was going to use this.
> 
> With Wintun 0.9, we're changing what we distribute and also providing an easy
> to use API. Rather than shipping MSMs to developers, we now ship a single
> basic boring wintun.dll. This dll hides all of the driver installation and
> adapter instantiation logic, and provides a nice interface for managing
> adapters and shuffling data in and out of the ring buffer. So, application
> developers can now just grab that dll, plop it into their application like
> they would any other dll, and use Wintun without even noticing that it's
> inserting a kernel driver when necessary
> 
> Big Change 2: Support for WOW64 and ARM
> ---------------------------------------
> 
> Windows does not support setupapi.dll and related driver functions on 32-bit
> processes running on 64-bit operating systems. This meant that it was
> impossible for WOW64 processes to use Wintun. Wintun also formerly required
> 64bit addresses, which made the kernel ABI clumsy for WOW64 processes. With
> Wintun 0.9, we now bundle a 64-bit version of Wintun inside 32-bit versions of
> the wintun.dll, and we marshal calls back and forth to an on-demand proxy
> process running on the native architecture.
> 
> Not only do we have this for basic WOW64, but we also have this working for
> Windows' ARM64 emulation of x86 binaries. So you can now run an x86 program on
> ARM64 and wintun.dll will figure out what to do.
> 
> This has big effects for us. Since Go still has not been ported to ARM64, we
> use an ARM build and rely on this new feature of Wintun. This means we should
> have a WireGuard for ARM64 Windows release in the coming week or two.
> 
> Big Change 3: Administrator User Permissions
> --------------------------------------------
> 
> Wintun requires the Local System user. But if you're running as Administrator,
> the wintun.dll library will attempt to do its operations as Local System,
> automatically. This effectively means that normal apps can bundle Wintun now,
> rather than just services.
> 
> 
> Please let us know if you have any questions or feedback. We're certainly
> interested in developer reports on what integrating this is like.
> 
> - The API reference is available online:
>   https://git.zx2c4.com/wintun/about/
> 
> - And there's some simple example code too:
>   https://git.zx2c4.com/wintun/tree/example/example.c
> 
> - A signed wintun.dll for amd64, arm64, x86, and arm is on the webpage:
>   https://www.wintun.net/
> 
> - And of course, it's open source:
>   git clone https://git.zx2c4.com/wintun
> 
> Regards,
> Jason
>