🥇WireGuard Will "Come" to the Linux Kernel — Why?

At the end of July, developers of the WireGuard VPN tunnel proposed a set of patches, which will make their software for organizing VPN tunnels a part of the Linux kernel. However, the exact date for the implementation of this idea remains unknown. Below, we will discuss this tool in more detail.

/ фото Tambako The Jaguar CC

Brief about the project

WireGuard is a next-generation VPN tunnel created by Jason A. Donenfeld, head of Edge Security. The project was developed as a simplified and fast alternative to OpenVPN and IPsec. The first version of the product contained just 4,000 lines of code. In comparison, OpenVPN has about 120,000 lines, while IPsec has 420,000.

According to words For developers, WireGuard is easy to set up, and the security of the protocol is achieved through verified cryptographic algorithms.. When switching networks: Wi-Fi, LTE, or Ethernet, you need to reconnect to the VPN server each time. However, WireGuard servers do not break the connection even if the user gets a new IP address.

Although WireGuard is initially designed for the Linux kernel, the developers also took care to create a portable version of the tool for Android devices. The application is still underdeveloped, but it can already be tried out in practice. To do this, you need to become one of the testers..

Overall, WireGuard enjoys considerable popularity and has even been is implemented adopted by several VPN providers, such as Mullvad and AzireVPN. There are a large number of guides on how to configure this solution. For example, there are guides, created by users, and there are guides, prepared by the project authors..

Technical details

In the official documentation. (p. 18) note that the bandwidth of WireGuard is four times higher than that of OpenVPN: 1011 Mbps compared to 258 Mbps respectively. WireGuard also outperforms the standard Linux solution, IPsec, which has 881 Mbps. It surpasses it in terms of ease of setup as well.

After key exchange (the VPN connection is initialized almost like in SSH) and establishing a connection, WireGuard resolves all other tasks independently: there is no need to worry about routing, state control, etc. Additional effort on setup will only be required if you want to use symmetric encryption.

/ фото Anders Hojbjerg CC

To install, you will need a Linux kernel distribution 'greater than' 4.1. It can be found in the main distributions of Linux.

$ sudo add-apt-repository ppa:hda-me/wireguard
$ sudo apt update
$ sudo apt install wireguard-dkms wireguard-tools

As noted by the editors of xakep.ru, self-compilation from source code is also straightforward. It is enough to bring up the interface and generate an open and private key:

$ sudo ip link add dev wg0 type wireguard
$ wg genkey | tee privatekey | wg pubkey > publickey

WireGuard does not use an interface for working with the cryptographic provider CryptoAPI. Instead, a stream cipher is used ChaCha20, cryptographic message authentication code Poly1305 and its own cryptographic hash functions.

The secret key is generated using the Diffie-Hellman protocol elliptic curve Curve25519. When hashing, hash functions BLAKE2 and SipHash. Thanks to the timestamp format TAI64N , the protocol discards packets with lower timestamp values, thereby preventing DoS- and replay attacks..

At the same time, WireGuard uses the ioctl function for input/output control (previously used Netlink), which makes the code cleaner and simpler. You can verify this by checking the configuration code..

Developers' Plans

So far, WireGuard is an out-of-tree kernel module. But project author Jason Donenfeld says, believes it is already time for full implementation in the Linux kernel, as it is simpler and more reliable than other solutions. Jason is supported in this regard by the properties Linus Torvalds himself — he called WireGuard's code 'a work of art.'

However, no one is currently discussing the exact dates for WireGuard's integration into the kernel. And it is unlikely that this will happen with the August release of the Linux kernel 4.18. However, there is a chance that it will occur in the very near future: in version 4.19 or 5.0.

When WireGuard is added to the kernel, the developers want to improve the application for Android devices and start developing an app for iOS. In addition, there are plans to complete implementations in Go and Rust and port them to macOS, Windows, and BSD. There are also plans for WireGuard implementations for more 'exotic systems': DPDK, FPGA, as well as many other interesting items. All of them are listed in the to-do list of the project authors.

P.S. A few more articles from our corporate blog:

Our main focus is on providing cloud services: