If you've ever tinkered with high-performance networking, you know the struggle: the battle between security, speed, and the nightmare of managing state across multiple CPU cores. Enter sanstun, a new open-source WireGuard implementation from Firezone that aims to solve these problems by rethinking how a VPN state machine actually works.
The Magic of Sans-IO
At its core, sanstun utilizes a "sans-IO" architecture. In plain English, this means the library handles the complex logic of the WireGuard protocol—the Noise handshakes, DoS mitigation, and encryption—without actually touching the network socket.
By separating the protocol's "brain" from the "hands" (the I/O), developers can plug sanstun into any async runtime or networking stack they prefer. This removes the baggage of internal buffering and makes the code significantly easier to audit and secure.
Built for Parallel Power
Why does this matter? Because traditional implementations often struggle with parallelization. Sanstun is designed to be parallel-friendly, enabling lock-free encryption and decryption across multiple worker threads.
Built in Rust, it's not just fast—it's lean. The implementation is #![no_std], zero-allocation, and panic-free. While it defaults to a safe-Rust ChaCha20 backend, power users can swap in SIMD-optimized backends for maximum throughput. This move comes after Firezone spent two years maintaining a fork of boringtun, eventually deciding that a ground-up rewrite was the only way to achieve true scalability.
A New Standard for VPNs
By stripping away the I/O and embracing Rust's safety guarantees, sanstun provides a blueprint for how modern network protocols should be implemented. It's a win for developers who want a high-performance, secure state machine without the architectural headaches of the past.
Sources
Media
