The developers of the NetBSD project announced the inclusion of the wg driver implementing the WireGuard protocol in the main NetBSD kernel. NetBSD has become the third operating system after Linux and OpenBSD to have integrated support for WireGuard. Additionally, accompanying commands for VPN configuration have been proposed — wg-keygen and wgconfig. The default kernel configuration (GENERIC) currently does not activate the driver and requires explicit specification in the settings "pseudo-device wg".
Additionally, it can be noted an update to the wireguard-tools package 1.0.20200820, which includes user-space utilities such as wg and wg-quick. The new release has prepared IPC for the upcoming support of WireGuard in the FreeBSD operating system. Code specific to different platforms has been separated into different files. The systemd unit file has been updated to support the "reload" command, allowing constructs like "systemctl reload wg-quick at wgnet0".
Let us remind you that the WireGuard VPN is built on modern encryption methods, providing very high performance, simplicity of use, and a lack of complexity, and has proven itself in several large deployments handling significant traffic volumes. The project has been evolving since 2015, has passed an audit and of the employed encryption methods. Support for WireGuard has already been integrated into NetworkManager and systemd, and kernel patches are included in the base of the distributions , Mageia, Alpine, Arch, Gentoo, OpenWrt, NixOS, and .
WireGuard uses the concept of key-based routing, which implies binding a private key to each network interface and using it to link public keys. The exchange of public keys for establishing a connection is done similarly to SSH. Key agreement and connection establishment without launching a separate daemon in user space is achieved using the Noise_IK mechanism from , similar to maintaining authorized_keys in SSH. Data is transmitted via encapsulation in UDP packets. Support is provided for changing the VPN server's IP address (roaming) without breaking the connection, with automatic client reconfiguration.
For encryption the stream cipher and the message authentication algorithm (MAC) , developed by Daniel Bernstein (), Tanja Lange
(Tanja Lange) and Peter Schwabe (Peter Schwabe). ChaCha20 and Poly1305 are presented as faster and safer alternatives to AES-256-CTR and HMAC, with software implementation allowing fixed execution time without requiring specialized hardware support. For generating a shared secret key, the elliptic curve Diffie-Hellman protocol is used, implemented in , also proposed by Daniel Bernstein. The hashing algorithm used is .
Source: opennet.ru
