The kernel of the DragonFly BSD operating system has been updated with approximately 100 changes related to the implementation of WireGuard VPN support. The 'wg' driver supporting the WireGuard protocol has been ported from FreeBSD, while the code for cryptographic functions, network interface, and ioctl API (for user-space management) has been borrowed from OpenBSD. Changes to the ifconfig utility, necessary for configuring the VPN, have been ported from OpenBSD. The implementation is compatible with all official WireGuard clients for Linux, Windows, macOS, *BSD, iOS, and Android. DragonFly BSD has become the fifth open OS after Linux, OpenBSD, NetBSD, and FreeBSD to integrate WireGuard support.
WireGuard employs a key-based routing concept, which involves associating a private key with each network interface and using public keys for binding. For key agreement and connection without launching a separate user-space daemon, the Noise_IK mechanism from the Noise Protocol Framework is used, similar to maintaining authorized_keys in SSH. Data transmission occurs via encapsulation in UDP packets. IP address changes of servers (roaming) are supported without breaking the connection, with automatic client reconfiguration. VPNNew versions Wine 9.2 and Winlator 5.0. A driver for ntsync has been proposed for the Linux kernel.
For encryption, the ChaCha20 stream cipher and the Poly1305 message authentication algorithm (MAC) are used, developed by Daniel J. Bernstein, Tanja Lange, and Peter Schwabe. ChaCha20 and Poly1305 are positioned as faster and safer alternatives to AES-256-CTR and HMAC, with a software implementation that ensures fixed execution time without the need for special hardware support. The Diffie-Hellman key exchange protocol on elliptic curves, specifically Curve25519, also proposed by Daniel Bernstein, is used for generating a shared secret key. The BLAKE2s hashing algorithm (RFC7693) is utilized.
Source: opennet.ru
