{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"WireGuard \u201ep\u0159ijde\u201c do j\u00e1dra Linux \u2013 pro\u010d?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na konci \u010dervence v\u00fdvoj\u00e1\u0159i VPN tunelu WireGuard navrhli sada patch\u016f<\/a><\/noindex>, kter\u00e9 u\u010din\u00ed jejich software pro organizaci VPN tunel\u016f sou\u010d\u00e1st\u00ed j\u00e1dra Linux. P\u0159esn\u00fd term\u00edn realizace \u201en\u00e1padu\u201c v\u0161ak zat\u00edm z\u016fst\u00e1v\u00e1 nezn\u00e1m\u00fd. Pod \u010dl\u00e1nkem si o tomto n\u00e1stroji pov\u00edme v\u00edce.<\/p>\n

\"WireGuard<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

Stru\u010dn\u011b o projektu<\/h2>\n

\nWireGuard je VPN tunel nov\u00e9 generace, vytvo\u0159en\u00fd Jasonem Donenfeldem, \u0161\u00e9fem spole\u010dnosti Edge Security. Projekt byl vyvinut jako jednoduch\u00e1<\/a><\/noindex> a rychl\u00e1 alternativa k OpenVPN a IPsec. Prvn\u00ed verze produktu obsahovala pouze 4 tis\u00edce \u0159\u00e1dk\u016f k\u00f3du. Pro srovn\u00e1n\u00ed, OpenVPN m\u00e1 p\u0159ibli\u017en\u011b 120 tis\u00edc \u0159\u00e1dk\u016f, zat\u00edmco IPSec - 420 tis\u00edc.<\/p>\n

Podle slov<\/a><\/noindex> v\u00fdvoj\u00e1\u0159i, WireGuard se snadno nastavuje, a bezpe\u010dnost protokolu je zaji\u0161t\u011bna pomoc\u00ed osv\u011bd\u010den\u00fdch kryptografick\u00fdch algoritm\u016f<\/a><\/noindex>. P\u0159i zm\u011bn\u011b s\u00edt\u011b<\/a><\/noindex>: Wi-Fi, LTE nebo Ethernet je t\u0159eba se v\u017edy znovu p\u0159ipojit k VPN serveru. Servery WireGuard v\u0161ak nep\u0159eru\u0161uj\u00ed spojen\u00ed, i kdy\u017e u\u017eivatel z\u00edskal novou IP adresu.<\/p>\n

I kdy\u017e je WireGuard od za\u010d\u00e1tku navr\u017een pro Linux j\u00e1dro, v\u00fdvoj\u00e1\u0159i mysleli<\/a><\/noindex> i na p\u0159enosnou verzi n\u00e1stroje pro za\u0159\u00edzen\u00ed Android. Aplikace zat\u00edm nen\u00ed dokon\u010den\u00e1, ale lze ji ji\u017e nyn\u00ed vyzkou\u0161et. K tomu je pot\u0159eba st\u00e1t se jedn\u00edm z tester\u016f<\/a><\/noindex>.<\/p>\n

Celkov\u011b WireGuard si z\u00edsk\u00e1v\u00e1 pom\u011brn\u011b velkou popularitu a dokonce byl realizov\u00e1no<\/a><\/noindex> n\u011bkolika VPN poskytovateli, jako jsou Mullvad a AzireVPN. V s\u00edti bylo publikov\u00e1no velk\u00e9 mno\u017estv\u00ed<\/a><\/noindex> n\u00e1vod\u016f na nastaven\u00ed<\/a><\/noindex> tohoto \u0159e\u0161en\u00ed. Nap\u0159\u00edklad, existuj\u00ed pr\u016fvodci<\/a><\/noindex>, kter\u00e9 vytv\u00e1\u0159ej\u00ed u\u017eivatel\u00e9, a jsou tak\u00e9 pr\u016fvodci, p\u0159ipraven\u00e9 autory projektu<\/a><\/noindex>.<\/p>\n

Technick\u00e9 detaily<\/h2>\n

\nV ofici\u00e1ln\u00ed dokumentaci<\/a><\/noindex> (str. 18) uv\u00e1d\u00ed, \u017ee propustnost WireGuard je \u010dty\u0159ikr\u00e1t vy\u0161\u0161\u00ed ne\u017e OpenVPN: 1011 Mbit\/s oproti 258 Mbit\/s. WireGuard tak\u00e9 p\u0159ekon\u00e1v\u00e1 standardn\u00ed \u0159e\u0161en\u00ed pro Linux IPsec \u2013 to m\u00e1 881 Mbit\/s. P\u0159ed\u010d\u00ed ho tak\u00e9 v jednoduchosti nastaven\u00ed.<\/p>\n

Po v\u00fdm\u011bn\u011b kl\u00ed\u010d\u016f (VPN p\u0159ipojen\u00ed se inicializuje t\u00e9m\u011b\u0159 jako v SSH) a vytvo\u0159en\u00ed spojen\u00ed WireGuard samo \u0159e\u0161\u00ed v\u0161echny ostatn\u00ed \u00fakoly: nen\u00ed nutn\u00e9 se starat o sm\u011brov\u00e1n\u00ed, monitorov\u00e1n\u00ed stavu atd. Dodate\u010dn\u00e9 \u00fasil\u00ed na nastaven\u00ed bude pot\u0159eba jen v p\u0159\u00edpad\u011b, \u017ee chcete vyu\u017e\u00edt symetrick\u00e9 \u0161ifrov\u00e1n\u00ed.<\/p>\n

\"WireGuard
\n\/ \u0444\u043e\u0442\u043e Anders Hojbjerg<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

K instalaci bude pot\u0159eba distribuce s j\u00e1drem Linux \u201estar\u0161\u00edm\u201c ne\u017e 4.1. M\u016f\u017eete ji naj\u00edt v repozit\u00e1\u0159\u00edch hlavn\u00edch distribuc\u00ed Linux.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nJak poznamen\u00e1vaj\u00ed redakto\u0159i xakep.ru, samostatn\u00e1 sestava ze zdrojov\u00fdch text\u016f tak\u00e9 nen\u00ed slo\u017eit\u00e1. Sta\u010d\u00ed spustit rozhran\u00ed a vygenerovat otev\u0159en\u00e9 a soukrom\u00e9 kl\u00ed\u010de:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nWireGuard nepou\u017e\u00edv\u00e1<\/a><\/noindex> rozhran\u00ed pro pr\u00e1ci s kryptografick\u00fdm poskytovatelem CryptoAPI<\/a><\/noindex>. M\u00edsto n\u011bj se pou\u017e\u00edv\u00e1 proudov\u00fd \u0161ifrovac\u00ed algoritmus ChaCha20<\/a><\/noindex>, kryptografick\u00e1 makrosyntaxe<\/a><\/noindex> Poly1305 a vlastn\u00ed kryptografick\u00e9 hashovac\u00ed funkce.<\/p>\n
Tajn\u00fd kl\u00ed\u010d se generuje pomoc\u00ed protokolu Diffie-Hellman<\/a><\/noindex> na z\u00e1klad\u011b eliptick\u00e9 k\u0159ivky Curve25519<\/a><\/noindex>. P\u0159i hashov\u00e1n\u00ed se vyu\u017e\u00edvaj\u00ed hashovac\u00ed funkce<\/a><\/noindex> BLAKE2<\/a><\/noindex> a SipHash.<\/a><\/noindex>D\u00edky form\u00e1tu \u010dasov\u00fdch raz\u00edtek TAI64N<\/a><\/noindex> protokol odm\u00edt\u00e1 pakety s ni\u017e\u0161\u00ed hodnotou timestamp, \u010d\u00edm\u017e zabra\u0148uje DoS-<\/a><\/noindex> a replay-\u00fatok\u016fm.<\/a><\/noindex>.<\/p>\n
P\u0159itom WireGuard vyu\u017e\u00edv\u00e1 funkci ioctl pro kontrolu vstupu\/v\u00fdstupu (d\u0159\u00edve se pou\u017e\u00edvalo Netlink<\/a><\/noindex>), co\u017e \u010din\u00ed k\u00f3d \u010dist\u011bj\u0161\u00ed a jednodu\u0161\u0161\u00ed. O tom se m\u016f\u017eete p\u0159esv\u011bd\u010dit, kdy\u017e nahl\u00e9dnete do konfigura\u010dn\u00edho k\u00f3du.<\/a><\/noindex>.<\/p>\n
Pl\u00e1ny v\u00fdvoj\u00e1\u0159\u016f<\/h2>\n
\nZat\u00edm je WireGuard modul j\u00e1dra mimo strom. Ale autor projektu Jason Donenfeld \u0159\u00edk\u00e1<\/a><\/noindex>, \u017ee u\u017e nastal \u010das na plnohodnotnou implementaci v j\u00e1d\u0159e Linuxu. Proto\u017ee je jednodu\u0161\u0161\u00ed a spolehliv\u011bj\u0161\u00ed ne\u017e jin\u00e1 \u0159e\u0161en\u00ed. Jasona v tomto ohledu srcset<\/a><\/noindex> dokonce s\u00e1m Linus Torvalds \u2014 nazval k\u00f3d WireGuard \u201eum\u011bleck\u00fdm d\u00edlem\u201c.<\/p>\n
Ale o p\u0159esn\u00fdch datech zav\u00e1d\u011bn\u00ed WireGuard do j\u00e1dra zat\u00edm nikdo nemluv\u00ed. A to sotva<\/a><\/noindex> se stane s vyd\u00e1n\u00edm srpnov\u00e9ho j\u00e1dra Linuxu 4.18. Nicm\u00e9n\u011b je pravd\u011bpodobn\u00e9, \u017ee k tomu dojde v nejbli\u017e\u0161\u00ed budoucnosti: ve verzi 4.19 nebo 5.0.<\/p>\n
Kdy\u017e bude WireGuard p\u0159id\u00e1n do j\u00e1dra, v\u00fdvoj\u00e1\u0159i cht\u011bj\u00ed<\/a><\/noindex> vylep\u0161it aplikaci pro za\u0159\u00edzen\u00ed Android a za\u010d\u00edt ps\u00e1t aplikaci pro iOS. Krom\u011b toho se pl\u00e1nuje dokon\u010den\u00ed implementac\u00ed v Go a Rust a p\u0159en\u00e9st je na macOS, Windows a BSD. Tak\u00e9 se pl\u00e1nuje implementace WireGuard pro v\u00edce \u201eexotick\u00fdch syst\u00e9m\u016f\u201c: DPDK<\/a><\/noindex>, FPGA<\/a><\/noindex>, a tak\u00e9 mnoho dal\u0161\u00edch zaj\u00edmav\u00fdch v\u011bc\u00ed. V\u0161echny jsou uvedeny v to-do seznamu<\/a><\/noindex> autor\u016f projektu.<\/p>\n
\nP.S. Je\u0161t\u011b n\u011bkolik \u010dl\u00e1nk\u016f z na\u0161eho firemn\u00edho blogu:<\/p>\n