N\u00eb kodin burimor t\u00eb FreeBSD jan\u00eb pranuar ndryshime me nj\u00eb realizim t\u00eb ri t\u00eb VPN WireGuard, i bazuar n\u00eb kodin e modulit t\u00eb b\u00ebrtham\u00ebs, i p\u00ebrgatitur n\u00eb bashk\u00ebpunim nga ekipet kryesore t\u00eb zhvilluesve t\u00eb FreeBSD dhe WireGuard, n\u00ebn drejtimin e Jason A. Donenfeld, autorit t\u00eb VPN WireGuard, dhe John H. Baldwin, nj\u00eb zhvillues i njohur i GDB dhe FreeBSD, i cili n\u00eb fillim t\u00eb viteve 2000 realizoi mb\u00ebshtetje p\u00ebr SMP dhe NUMA n\u00eb b\u00ebrtham\u00ebn e FreeBSD. Pas pranimet t\u00eb paisjes n\u00eb FreeBSD (sys\/dev\/wg), zhvillimi dhe mb\u00ebshtetje do t\u00eb vazhdojn\u00eb n\u00eb depozitat e FreeBSD. <\/p>\n
Para se t\u00eb miratohej kodi me mb\u00ebshtetje nga organizata FreeBSD Foundation, u krye nj\u00eb rinum\u00ebrim i plot\u00eb i ndryshimeve, gjat\u00eb t\u00eb cilit u analizua gjithashtu nd\u00ebrveprimi i paisjes me n\u00ebn-sistemet e tjera t\u00eb b\u00ebrtham\u00ebs dhe u vler\u00ebsua mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur primitiv\u00ebt kriptografik\u00eb t\u00eb ofruar nga b\u00ebrthama. <\/p>\n
P\u00ebr t\u00eb p\u00ebrdorur algoritmat kriptografik\u00eb t\u00eb nevojsh\u00ebm p\u00ebr paisjen, u b\u00eb zgjerimi i API t\u00eb n\u00ebn-sistemit kriptografik t\u00eb b\u00ebrtham\u00ebs s\u00eb FreeBSD, n\u00eb t\u00eb cilin u shtua nj\u00eb mb\u00ebshtetje q\u00eb lejon p\u00ebrdorimin e algoritmave t\u00eb pap\u00ebrkrahur n\u00eb FreeBSD p\u00ebrmes API-standard kriptografik, duke p\u00ebrdorur implementimin e algoritmave t\u00eb nevojsh\u00ebm nga biblioteka libsodium. Nga algoritm\u00ebt, n\u00eb paisje u la vet\u00ebm kodi p\u00ebr llogaritjen e hash-it Blake2, pasi implementimi i ofruar n\u00eb FreeBSD p\u00ebr k\u00ebt\u00eb algorit\u00ebm \u00ebsht\u00eb i lidhur me madh\u00ebsin\u00eb fikse t\u00eb hash-it. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, gjat\u00eb rinum\u00ebrimit u krye optimizimi i kodit, i cili lejojti rritjen e efikasitetit t\u00eb shp\u00ebrndarjes s\u00eb ngarkes\u00ebs n\u00eb CPU shum\u00eb-n\u00eb lidh\u00ebse (u sigurua balansimi i barabart\u00eb i ngarkesave p\u00ebr detyrat e enkriptimit dhe dekriptimit t\u00eb paketave n\u00eb b\u00ebrthamat e CPU). Si rezultat, shpenzimet e mb\u00ebshtetjes gjat\u00eb p\u00ebrpunimit t\u00eb paketeve u afruan me implementimin e paisjes p\u00ebr Linux. N\u00eb kod gjithashtu u sigurua mund\u00ebsia e p\u00ebrdorimit t\u00eb paisjes ossl p\u00ebr t\u00eb p\u00ebrshpejtuar operacionet e enkriptimit. <\/p>\n
Ndryshe nga p\u00ebrpjekja e kaluar p\u00ebr integrimin e WireGuard n\u00eb FreeBSD, n\u00eb implementimin e ri \u00ebsht\u00eb p\u00ebrdorur utilitari standard wg, e jo versione modifikuar e ifconfig, \u00e7ka lejon unifikimin e konfigurimit n\u00eb Linux dhe FreeBSD. Utilitari wg, ashtu si dhe driveri, \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb kodin burimor t\u00eb FreeBSD, gj\u00eb q\u00eb \u00ebsht\u00eb b\u00ebr\u00eb e mundur p\u00ebr shkak t\u00eb ndryshimit t\u00eb licenc\u00ebs s\u00eb kodit wg (kodi tani \u00ebsht\u00eb n\u00eb dispozit\u00eb n\u00ebn licencat MIT dhe GPL). P\u00ebrpjekja e kaluar p\u00ebr t\u00eb p\u00ebrfshir\u00eb WireGuard n\u00eb FreeBSD u nd\u00ebrmorr n\u00eb vitin 2020, por p\u00ebrfundoi me nj\u00eb skandal, n\u00eb t\u00eb cilin kodi tashm\u00eb i shtuar u hoq p\u00ebr shkak t\u00eb cil\u00ebsis\u00eb s\u00eb ul\u00ebt, pun\u00ebs s\u00eb pakujdesshme me buferat, p\u00ebrdorimit t\u00eb z\u00ebvend\u00ebsimeve n\u00eb vend t\u00eb kontrollimeve, implementimit t\u00eb pap\u00ebrsosur t\u00eb protokollit dhe shkeljes s\u00eb licenc\u00ebs GPL. <\/p>\n
Kujtojm\u00eb se VPN<\/a> WireGuard \u00ebsht\u00eb realizuar mbi metoda moderne t\u00eb enkriptimit, ofron nj\u00eb performanc\u00eb shum\u00eb t\u00eb lart\u00eb, \u00ebsht\u00eb i leht\u00eb p\u00ebr t'u p\u00ebrdorur, \u00ebsht\u00eb i thjesht\u00eb dhe ka treguar performanc\u00eb t\u00eb shk\u00eblqyer n\u00eb nj\u00eb num\u00ebr implementimesh t\u00eb m\u00ebdha q\u00eb trajtojn\u00eb v\u00ebllime t\u00eb m\u00ebdha trafiku. Projekti po zhvillohet q\u00eb nga viti 2015, ka kaluar auditimin dhe verifikimin e formalisht t\u00eb metodave t\u00eb enkriptimit t\u00eb p\u00ebrdorura. N\u00eb WireGuard aplikohet koncepti i ruterimit sipas \u00e7el\u00ebsit t\u00eb enkriptimit, i cili n\u00ebnkupton lidhjen e \u00e7do nd\u00ebrfaqe rrjeti me nj\u00eb \u00e7el\u00ebs t\u00eb mbyllur dhe p\u00ebrdorimin e tij p\u00ebr t\u00eb lidhur \u00e7el\u00ebsat e hapur. <\/p>\n K\u00ebmbimi i \u00e7el\u00ebsave t\u00eb hapur p\u00ebr t\u00eb vendosur lidhjen kryhet p\u00ebr shembull sipas SSH. P\u00ebr t\u00eb negociuar \u00e7el\u00ebsat dhe p\u00ebr t\u00eb krijuar nj\u00eb lidhje pa nevoj\u00ebn e nisjes s\u00eb nj\u00eb deamoni t\u00eb ve\u00e7ant\u00eb n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit, p\u00ebrdoret mekanizmi Noise_IK nga Noise Protocol Framework, i ngjash\u00ebm me ruajtjen e authorized_keys n\u00eb SSH. Shk\u00ebmbimi i t\u00eb dh\u00ebnave realizohet p\u00ebrmes inkapsulimit n\u00eb paketa UDP. Ndryshimi mb\u00ebshtetet Adresa IP<\/a> VPN-server\u00ebve (roaming) pa nd\u00ebrprerje t\u00eb lidhjes me ridimensionimin automatik t\u00eb klientit. <\/p>\n