{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"K\u0101p\u0113c WireGuard \"non\u0101ks\" Linux kodol\u0101?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

J\u016blija beig\u0101s WireGuard VPN tunelu izstr\u0101d\u0101t\u0101ji pied\u0101v\u0101ja plecu komplektu<\/a><\/noindex>, kas padar\u012bs vi\u0146u programmat\u016bru VPN tunelu izveidei par da\u013cu no Linux kodola. Tom\u0113r prec\u012bza datuma, kad \u0161\u012b \"ideja\" tiks \u012bstenota, joproj\u0101m nav zin\u0101ma. Zem\u0101k m\u0113s s\u012bk\u0101k parun\u0101sim par \u0161o r\u012bku.<\/p>\n

\"K\u0101p\u0113c<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

Projektu \u012bsi<\/h2>\n

\nWireGuard ir n\u0101kam\u0101s paaudzes VPN tunelis, ko izveidojis D\u017eeisons Donenf\u012blds (Jason A. Donenfeld), Edge Security uz\u0146\u0113muma vad\u012bt\u0101js. Projekts tika izstr\u0101d\u0101ts k\u0101 vienk\u0101r\u0161ota<\/a><\/noindex> un \u0101tra alternat\u012bva OpenVPN un IPsec. Pirmaj\u0101 produkta versij\u0101 bija tikai 4 t\u016bksto\u0161i koda rindu. Sal\u012bdzin\u0101jumam, OpenVPN ir apm\u0113ram 120 t\u016bksto\u0161i rindu, bet IPSec \u2014 420 t\u016bksto\u0161i.<\/p>\n

P\u0113c v\u0101rdiem<\/a><\/noindex> Izstr\u0101d\u0101t\u0101ji ir padar\u012bju\u0161i WireGuard viegli konfigur\u0113jamu, un protokola dro\u0161\u012bba tiek sasniegta izmantojot p\u0101rbaud\u012btus kriptogr\u0101fiskos algoritmus.<\/a><\/noindex>. Mainot t\u012bklu<\/a><\/noindex>: Wi-Fi, LTE vai Ethernet katru reizi ir j\u0101atjauno savienojums ar VPN serveri. WireGuard serveri autom\u0101tiski nep\u0101rtrauc savienojumu, pat ja lietot\u0101js sa\u0146em jaunu IP adresi.<\/p>\n

Neskatoties uz to, ka WireGuard s\u0101kotn\u0113ji ir optimiz\u0113ts Linux kodolam, izstr\u0101d\u0101t\u0101ji ir r\u016bp\u0113ju\u0161ies<\/a><\/noindex> ar\u012b par portat\u012bvo r\u012bka versiju Android ier\u012bc\u0113m. Lietotne pagaid\u0101m nav pilnveidota, ta\u010du to var izm\u0113\u0123in\u0101t jau tagad. Lai to izdar\u012btu, jums j\u0101 k\u013c\u016bst par vienu no test\u0113t\u0101jiem.<\/a><\/noindex>.<\/p>\n

Kopum\u0101 WireGuard ir diezgan popul\u0101rs un pat ir bijis realiz\u0113ts<\/a><\/noindex> da\u017eiem VPN pakalpojumu sniedz\u0113jiem, piem\u0113ram, Mullvad un AzireVPN. T\u012bkl\u0101 ir public\u0113ts liels daudzums<\/a><\/noindex> nor\u0101d\u012bjumu par \u0161\u012b risin\u0101juma iestat\u012b\u0161anu. Piem\u0113ram,<\/a><\/noindex> ir rokasgr\u0101matas , kuras izveidoju\u0161i lietot\u0101ji, un ir rokasgr\u0101matas,<\/a><\/noindex>kuras sagatavoju\u0161i projekta autori. Tehniskajos s\u012bkumos<\/a><\/noindex>.<\/p>\n

(lpp. 18) nor\u0101d\u012bts, ka WireGuard caurlaidsp\u0113ja ir \u010detras reizes augst\u0101ka nek\u0101 OpenVPN: 1011 Mbit\/s, sal\u012bdzinot ar 258 Mbit\/s. WireGuard p\u0101rsp\u0113j ar\u012b standartus Linux IPsec \u2014 tam ir 881 Mbit\/s. Tas p\u0101rsp\u0113j ar\u012b vienk\u0101r\u0161\u012bbas zi\u0146\u0101.<\/h2>\n

\nNo ofici\u0101laj\u0101 dokument\u0101cij\u0101<\/a><\/noindex> P\u0113c atsl\u0113gu apmai\u0146as (VPN savienojums tiek inicializ\u0113ts gandr\u012bz k\u0101 SSH) un savienojuma izveides, WireGuard patst\u0101v\u012bgi risina visas p\u0101r\u0113j\u0101s probl\u0113mas: nav nepiecie\u0161ams uztraukties par mar\u0161rut\u0113\u0161anu, st\u0101vok\u013ca uzraudz\u012bbu utt. Papildu piep\u016ble uzst\u0101d\u012b\u0161anai b\u016bs nepiecie\u0161ama tikai tad, ja v\u0113laties izmantot simetrisko \u0161ifr\u0113\u0161anu.<\/p>\n

Anders Hojbjerg<\/p>\n

\"K\u0101p\u0113c
\n\/ \u0444\u043e\u0442\u043e Lai uzst\u0101d\u012btu, b\u016bs nepiecie\u0161ama Linux kodola izplat\u012bjums, kas ir \"vec\u0101ks\" par 4.1. To var atrast galveno Linux izplat\u012bjumu kr\u0101tuv\u0113s.<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

Lai veiktu instal\u0101ciju, b\u016bs nepiecie\u0161ams Linux kodola izplat\u012bjums \u201evec\u0101ks\u201d par 4.1. To var atrast galveno Linux izplat\u012bjumu kr\u0101tuv\u0113s.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nK\u0101 nor\u0101da xakep.ru redaktori, patst\u0101v\u012bga mont\u0101\u017ea no avota kodu ir ar\u012b vienk\u0101r\u0161a. Pietiek aktiviz\u0113t saskarni un \u0123ener\u0113t publisko un priv\u0101to atsl\u0113gu:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nWireGuard neizmanto<\/a><\/noindex> saskarne darbam ar kriptoprovideru CryptoAPI<\/a><\/noindex>. T\u0101 viet\u0101 tiek izmantots straumju \u0161ifrs ChaCha20<\/a><\/noindex>, kriptogr\u0101fiskais imit\u0101cijas ievietojums<\/a><\/noindex> Poly1305 un savas kriptogr\u0101fisk\u0101s hashu funkcijas.<\/p>\n
Slepenu atsl\u0113gu \u0123ener\u0113, izmantojot Diffie-Hellman protokolu<\/a><\/noindex> uz eliptisk\u0101s l\u012bknes pamata Curve25519<\/a><\/noindex>. Ha\u0161\u0113\u0161an\u0101 tiek izmantotas ha\u0161funkcijas<\/a><\/noindex> BLAKE2<\/a><\/noindex> un SipHash<\/a><\/noindex>. Pateicoties laika z\u012bmogu form\u0101tam TAI64N<\/a><\/noindex> protokols noraida paket\u0113m ar maz\u0101ku timestamp v\u0113rt\u012bbu, t\u0101d\u0113j\u0101di nov\u0113r\u0161ot DoS-<\/a><\/noindex> un replay-uzbrukumus.<\/a><\/noindex>.<\/p>\n
Turkl\u0101t WireGuard izmanto ioctl funkciju ieejas\/izejas kontrolei (agr\u0101k tika izmantota Netlink<\/a><\/noindex>), kas padara kodu t\u012br\u0101ku un vienk\u0101r\u0161\u0101ku. Par to var p\u0101rliecin\u0101ties, apl\u016bkojot konfigur\u0101cijas kodu<\/a><\/noindex>.<\/p>\n
Izstr\u0101d\u0101t\u0101ju pl\u0101ni<\/h2>\n
\nPa\u0161laik WireGuard ir out-of-tree kodola modulis. Bet projekta autors D\u017eeisons Donenfeld st\u0101sta<\/a><\/noindex>, ka jau ir pien\u0101cis laiks pilnv\u0113rt\u012bgai ievie\u0161anai Linux kodol\u0101. T\u0101 k\u0101 tas ir vienk\u0101r\u0161\u0101ks un uzticam\u0101ks par cit\u0101m risin\u0101jumiem. D\u017eeisons \u0161aj\u0101 zi\u0146\u0101 atbalsta<\/a><\/noindex> pat pats Linuss Torvalds - vi\u0146\u0161 nosauca WireGuard kodu par \"m\u0101kslas darbu\".<\/p>\n
Tom\u0113r par WireGuard integr\u0113\u0161anu kodol\u0101 pagaid\u0101m neviens nesaka prec\u012bzus datumus. Un gr\u016bti<\/a><\/noindex> to ieraudz\u012bt ar august\u0101 izn\u0101ko\u0161o Linux kodolu 4.18. Tom\u0113r past\u0101v iesp\u0113ja, ka tas notiks visai dr\u012bz: versij\u0101 4.19 vai 5.0.<\/p>\n
Kad WireGuard tiks pievienots kodolam, izstr\u0101d\u0101t\u0101ji pl\u0101no<\/a><\/noindex> uzlabot lietotni Android ier\u012bc\u0113m un s\u0101kt rakst\u012bt lietotni iOS. Turkl\u0101t ir pl\u0101nots pabeigt realiz\u0101cijas Go un Rust un port\u0113t tos uz macOS, Windows un BSD. T\u0101pat ir pl\u0101nota WireGuard ievie\u0161ana uz vair\u0101k \"ekzotisk\u0101m sist\u0113m\u0101m\": DPDK<\/a><\/noindex>, FPGA<\/a><\/noindex>, k\u0101 ar\u012b daudz citu interesantu lietu. Viss tas ir uzskait\u012bts to-do sarakst\u0101<\/a><\/noindex> projekta autoriem.<\/p>\n
\nP.S. V\u0113l da\u017eas raksti no m\u016bsu korporat\u012bv\u0101 bloga:<\/p>\n