{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"WireGuard is \u2018coming\u2019 to the Linux kernel \u2014 why?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

At the end of July, developers of the WireGuard VPN tunnel proposed a set of patches<\/a><\/noindex>, which will make their software for organizing VPN tunnels a part of the Linux kernel. However, the exact date for the implementation of this idea remains unknown. Below, we will discuss this tool in more detail.<\/p>\n

\"WireGuard<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

Brief about the project<\/h2>\n

\nWireGuard is a next-generation VPN tunnel created by Jason A. Donenfeld, head of Edge Security. The project was developed as a simplified<\/a><\/noindex> and fast alternative to OpenVPN and IPsec. The first version of the product contained just 4,000 lines of code. In comparison, OpenVPN has about 120,000 lines, while IPsec has 420,000.<\/p>\n

According to words<\/a><\/noindex> For developers, WireGuard is easy to set up, and the security of the protocol is achieved through verified cryptographic algorithms.<\/a><\/noindex>. When switching networks<\/a><\/noindex>: Wi-Fi, LTE, or Ethernet, you need to reconnect to the VPN server each time. However, WireGuard servers do not break the connection even if the user gets a new IP address.<\/p>\n

Although WireGuard is initially designed for the Linux kernel, the developers also took care<\/a><\/noindex> to create a portable version of the tool for Android devices. The application is still underdeveloped, but it can already be tried out in practice. To do this, you need to become one of the testers.<\/a><\/noindex>.<\/p>\n

Overall, WireGuard enjoys considerable popularity and has even been is implemented<\/a><\/noindex> adopted by several VPN providers, such as Mullvad and AzireVPN. There are a large number of guides<\/a><\/noindex> on how to configure<\/a><\/noindex> this solution. For example, there are guides<\/a><\/noindex>, created by users, and there are guides, prepared by the project authors.<\/a><\/noindex>.<\/p>\n

Technical details<\/h2>\n

\nIn the official documentation.<\/a><\/noindex> (p. 18) note that the bandwidth of WireGuard is four times higher than that of OpenVPN: 1011 Mbps compared to 258 Mbps respectively. WireGuard also outperforms the standard Linux solution, IPsec, which has 881 Mbps. It surpasses it in terms of ease of setup as well.<\/p>\n

After key exchange (the VPN connection is initialized almost like in SSH) and establishing a connection, WireGuard resolves all other tasks independently: there is no need to worry about routing, state control, etc. Additional effort on setup will only be required if you want to use symmetric encryption.<\/p>\n

\"WireGuard
\n\/ \u0444\u043e\u0442\u043e Anders Hojbjerg<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

To install, you will need a Linux kernel distribution 'greater than' 4.1. It can be found in the main distributions of Linux.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nAs noted by the editors of xakep.ru, self-compilation from source code is also straightforward. It is enough to bring up the interface and generate an open and private key:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nWireGuard does not use<\/a><\/noindex> an interface for working with the cryptographic provider CryptoAPI<\/a><\/noindex>. Instead, a stream cipher is used ChaCha20<\/a><\/noindex>, cryptographic message authentication code<\/a><\/noindex> Poly1305 and its own cryptographic hash functions.<\/p>\n
The secret key is generated using the Diffie-Hellman protocol<\/a><\/noindex> elliptic curve Curve25519<\/a><\/noindex>. When hashing, hash functions<\/a><\/noindex> BLAKE2<\/a><\/noindex> and SipHash<\/a><\/noindex>. Thanks to the timestamp format TAI64N<\/a><\/noindex> , the protocol discards packets with lower timestamp values, thereby preventing DoS-<\/a><\/noindex> and replay attacks.<\/a><\/noindex>.<\/p>\n
At the same time, WireGuard uses the ioctl function for input\/output control (previously used Netlink<\/a><\/noindex>), which makes the code cleaner and simpler. You can verify this by checking the configuration code.<\/a><\/noindex>.<\/p>\n
Developers' Plans<\/h2>\n
\nSo far, WireGuard is an out-of-tree kernel module. But project author Jason Donenfeld says<\/a><\/noindex>, believes it is already time for full implementation in the Linux kernel, as it is simpler and more reliable than other solutions. Jason is supported in this regard by the properties<\/a><\/noindex> Linus Torvalds himself \u2014 he called WireGuard's code 'a work of art.'<\/p>\n
However, no one is currently discussing the exact dates for WireGuard's integration into the kernel. And it is unlikely<\/a><\/noindex> that this will happen with the August release of the Linux kernel 4.18. However, there is a chance that it will occur in the very near future: in version 4.19 or 5.0.<\/p>\n
When WireGuard is added to the kernel, the developers want to<\/a><\/noindex> improve the application for Android devices and start developing an app for iOS. In addition, there are plans to complete implementations in Go and Rust and port them to macOS, Windows, and BSD. There are also plans for WireGuard implementations for more 'exotic systems': DPDK<\/a><\/noindex>, FPGA<\/a><\/noindex>, as well as many other interesting items. All of them are listed in the to-do list<\/a><\/noindex> of the project authors.<\/p>\n
\nP.S. A few more articles from our corporate blog:<\/p>\n