{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"WireGuard \"kommer\" til Linux-kernen \u2014 hvorfor?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I slutningen af juli foreslog udviklerne af VPN-tunnelen WireGuard et s\u00e6t patches<\/a><\/noindex>, som vil g\u00f8re deres software til organisation af VPN-tunneler til en del af Linux-kernen. Den pr\u00e6cise dato for implementeringen af \"ideen\" forbliver dog ukendt. Under overskriften taler vi n\u00e6rmere om dette v\u00e6rkt\u00f8j.<\/p>\n

\"WireGuard<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

Kort om projektet<\/h2>\n

\nWireGuard er en next-gen VPN-tunnel skabt af Jason Donenfeld, leder af Edge Security. Projektet er blevet udviklet som en forenklet<\/a><\/noindex> og hurtig alternativ til OpenVPN og IPsec. Den f\u00f8rste version af produktet indeholdt kun 4.000 linjer kode. Til sammenligning har OpenVPN cirka 120.000 linjer, mens IPSec har 420.000.<\/p>\n

If\u00f8lge if\u00f8lge<\/a><\/noindex> udviklerne har gjort WireGuard let at konfigurere, og sikkerheden af protokollen opn\u00e5s gennem velafpr\u00f8vede kryptografiske algoritmer<\/a><\/noindex>. N\u00e5r netv\u00e6rket skiftes<\/a><\/noindex>: Wi-Fi, LTE eller Ethernet skal man hver gang genoprette forbindelsen til VPN-serveren. WireGuard-servere bryder derimod ikke forbindelsen, selvom brugeren har f\u00e5et en ny IP-adresse.<\/p>\n

Selvom WireGuard oprindeligt er designet til Linux-kernen, har udviklerne taget sig af<\/a><\/noindex> og en portabel version af v\u00e6rkt\u00f8jet til Android-enheder. Appen er stadig under udvikling, men man kan allerede nu pr\u00f8ve den. For at g\u00f8re det skal man blive en af testerne<\/a><\/noindex>.<\/p>\n

Generelt nyder WireGuard relativt stor popularitet og er endda blevet implementeret<\/a><\/noindex> brugt af flere VPN-udbydere, s\u00e5som Mullvad og AzireVPN. Der er offentliggjort et stort antal<\/a><\/noindex> vejledninger til ops\u00e6tning<\/a><\/noindex> af denne l\u00f8sning. For eksempel der er guides<\/a><\/noindex>, som brugerne laver, og der er guides, forberedt af projektets forfattere<\/a><\/noindex>.<\/p>\n

Tekniske detaljer<\/h2>\n

\nI den officielle dokumentation<\/a><\/noindex> (s.18) n\u00e6vner, at gennemstr\u00f8mningen hos WireGuard er fire gange h\u00f8jere end hos OpenVPN: 1011 Mbit\/s mod 258 Mbit\/s. WireGuard overg\u00e5r ogs\u00e5 den standard l\u00f8sning for Linux, IPsec \u2014 den har 881 Mbit\/s. Den overg\u00e5r ogs\u00e5 den med hensyn til nem ops\u00e6tning.<\/p>\n

Efter n\u00f8gleudveksling (VPN-forbindelsen initieres n\u00e6sten ligesom i SSH) og etablering af forbindelsen l\u00f8ser WireGuard selv alle andre opgaver: der er ikke behov for at bekymre sig om routing, overv\u00e5gning af forbindelse osv. Yderligere indsats til ops\u00e6tning er kun n\u00f8dvendig, hvis man vil benytte symmetrisk kryptering.<\/p>\n

\"WireGuard
\n\/ \u0444\u043e\u0442\u043e Anders Hojbjerg<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

For installation, you'll need a Linux kernel distribution \"older than\" 4.1. You can find it in the repositories of major Linux distributions.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nAs noted by the editors of xakep.ru, building from source is also straightforward. You just need to bring up the interface and generate the public and private keys:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nWireGuard does not use<\/a><\/noindex> an interface to work with the cryptographic provider CryptoAPI<\/a><\/noindex>. Instead, a stream cipher is used ChaCha20<\/a><\/noindex>, cryptographic message authentication<\/a><\/noindex> Poly1305 and proprietary cryptographic hash functions.<\/p>\n
The secret key is generated using the Diffie-Hellman protocol<\/a><\/noindex> based on the elliptic curve Curve25519<\/a><\/noindex>. During hashing, the hash functions<\/a><\/noindex> BLAKE2<\/a><\/noindex> og SipHash<\/a><\/noindex>. Thanks to the timestamp format TAI64N<\/a><\/noindex> , the protocol drops packets with lower timestamp values, thus preventing DoS-<\/a><\/noindex> og replay attacks.<\/a><\/noindex>.<\/p>\n
In this case, WireGuard employs the ioctl function for input\/output control (previously used Netlink<\/a><\/noindex>), making the code cleaner and simpler. You can verify this by looking at the configuration code.<\/a><\/noindex>.<\/p>\n
The developers' plans<\/h2>\n
\nSo far, WireGuard is an out-of-tree kernel module. However, the project's author Jason Donenfeld says<\/a><\/noindex>, that the time has come for full integration into the Linux kernel. Because it is simpler and more reliable than other solutions. Jason has the support of even Linus Torvalds himself \u2014 he called the WireGuard code \"a work of art.\"<\/a><\/noindex> But no one is currently talking about the exact dates for the implementation of WireGuard into the kernel. And<\/p>\n
hardly this will happen with the release of the August Linux kernel 4.18. However, there is a possibility that it will occur in the near future: in versions 4.19 or 5.0.<\/a><\/noindex> Once WireGuard is added to the kernel, the developers<\/p>\n
want to refine the application for Android devices and start developing an app for iOS. Additionally, they plan to finish the implementations in Go and Rust and port them to macOS, Windows, and BSD. A WireGuard implementation for more \"exotic systems\" is also planned:<\/a><\/noindex> FPGA DPDK<\/a><\/noindex>, , as well as many other interesting things. All of them are listed in the<\/a><\/noindex>to-do list of the project authors.<\/a><\/noindex> P.S. A few more articles from our corporate blog:<\/p>\n
\nCloud Technologies in the Financial Sector: Experience of Russian Companies<\/p>\n