TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Firezone has announced Sanstun, a Rust implementation of the WireGuard state machine with a sans-IO API. The company says the design follows more than two years of experience patching its fork of the Boringtun implementation; independent performance results and broader adoption are not established in the supplied report.
Firezone has announced Sanstun, a Rust implementation of the WireGuard state machine built around a sans-IO, parallel-friendly API. The release reflects the company’s account of more than two years using and patching Boringtun, and presents an alternative interface that leaves packet buffering, time and other side effects to the application using the library.
Firezone describes sans-IO as separating a system’s state and protocol logic from I/O and side effects. That separation includes more than network and file operations: the company’s explanation also identifies time and randomness. In the report, Firezone says this approach makes components easier to test and compose, and works well with Rust’s ownership model. Sans-IO itself is not specific to Rust, though Sanstun is implemented in Rust.
The project grew out of Firezone’s earlier use of Boringtun. The company says it repeatedly patched its fork with fixes and API additions while trying to preserve compatibility with the upstream interface. Over more than two years, it says, the patch set grew to more than 70 pull requests, excluding dependency updates. Firezone says those changes included edge-case fixes and ways to make parts of the implementation configurable.
Sanstun’s API exposes separate operations for processing handshake initiations and responses, cookie replies, encrypted data, timeouts and events. For packet processing, the report names paired begin and commit calls for decapsulation, alongside a call to begin encapsulation. Firezone says the library does not internally buffer packets: applications decide whether and how to hold packets while a session is unavailable, rather than relying on the library to queue them.
Application Control Over WireGuard I/O
The design choice affects how an application integrates a WireGuard implementation, not the underlying protocol itself. By keeping packet queues, clocks and other effects outside the tunnel state machine, Sanstun gives the calling program more direct responsibility for scheduling and buffering. That can suit systems whose applications need to control those operations or test protocol behavior under simulated conditions.
Firezone argues that removing hidden buffering also avoids extra allocations and an unintuitive requirement it encountered in Boringtun: draining an internal buffer by calling decapsulation with an empty datagram. Those are the company’s reasons for the design, not evidence of measured performance gains. Developers considering Sanstun will need to weigh that explicit control against the extra work placed on the integrating application, which must handle packet storage and coordinate protocol calls correctly.
The API also makes the handling of protocol events and timers visible to its caller. That may help application authors reason about when handshakes, timeouts and packet processing occur. The practical impact will depend on implementation details, documentation and how well the library fits the needs of specific Rust projects.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Boringtun Patches to Sanstun
WireGuard uses a handshake to establish a session and encrypted data packets to carry traffic once that session exists. The source report describes four message types: handshake initiation, handshake response, cookie reply and encrypted data. Handshakes involve a Diffie-Hellman key exchange; Firezone notes that processing bogus handshake attempts can consume resources before a receiver identifies them as invalid.
The protocol’s cookie mechanism addresses that denial-of-service risk by requiring a remote peer to demonstrate control of its claimed source IP, allowing handshakes to be rate-limited by source address. Firezone says those limits apply across a WireGuard interface, rather than only to one tunnel. Session indices exchanged during handshakes help identify tunnels and distinguish multiple sessions within a tunnel.
Firezone says its earlier Boringtun changes included making time handling sans-IO, with APIs that accept an explicit instant, and making internal buffering configurable. The company presents Sanstun as the result of experience with those changes and its view of what a userspace WireGuard API should provide. That history is Firezone’s account; the supplied report does not include an independent comparison of the libraries.
“Today, we are announcing sanstun: a sans-IO Rust implementation of the WireGuard® state machine, optimized for ease of use, security and performance through a parallel-friendly and idiomatic API.”
— Firezone
Performance and Adoption Still Unreported
The supplied report sets out design goals and API behavior, but provides no benchmark figures, independent security review or comparative measurements against Boringtun. It is not possible from this material to determine whether Sanstun improves throughput, latency, memory use or security in real deployments. Firezone’s stated goals should not be treated as measured results.
The report also does not establish how broadly the library has been adopted, which applications beyond Firezone use it, or what support and maintenance arrangements will apply over time. Although the API is described as parallel-friendly, the supplied material does not give performance data or detailed results from concurrent workloads. Those points remain unverified in the source material.
Integration and Testing Will Settle Fit
The immediate next step for developers is to review Sanstun’s code, API documentation and release information, then determine whether its explicit handling of time, packets and events suits their application. Projects adopting it will need to implement their own buffering and connect the exposed protocol operations to their networking and scheduling layers.
Further evidence would come from published benchmarks, security analysis, documentation of compatibility and supported use cases, and reports from applications using the library. Firezone’s announcement does not specify a testing milestone or adoption timetable, so the project’s next development steps are not confirmed in the supplied report.
Key Questions
What is Sanstun?
Sanstun is a Rust implementation of the WireGuard state machine. Firezone describes it as sans-IO and designed for a parallel-friendly API.
What does sans-IO mean here?
It means separating protocol state and logic from side effects such as network I/O, time and randomness. Applications using Sanstun handle those external operations.
Does Sanstun buffer packets internally?
No. Firezone says Sanstun leaves buffering to the calling application. That gives the application control over packet queues but also means it must decide what to do when a session is not ready.
Is Sanstun proven faster or more secure than Boringtun?
The supplied announcement does not provide comparative benchmarks or an independent security review. Firezone states performance and security as design goals, but those claims are not supported here by published comparative results.
Source: firezone.dev
