{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"WireGuard \u00abdo t\u00eb vij\u00eb\u00bb n\u00eb kernelin Linux \u2014 pse?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb fund t\u00eb korrikut, zhvilluesit e VPN-t\u00eb tunelit WireGuard propozuan nj\u00eb grup patch-e<\/a><\/noindex>, t\u00eb cilat do ta b\u00ebjn\u00eb softuerin e tyre p\u00ebr organizimin e VPN-t\u00eb tunelit pjes\u00eb t\u00eb b\u00ebrtham\u00ebs Linux. Megjithat\u00eb, data e sakt\u00eb e implementimit t\u00eb \"ideve\" mbetet ende e panjohur. N\u00eb vazhdim, do t\u00eb flasim m\u00eb shum\u00eb p\u00ebr k\u00ebt\u00eb mjet.<\/p>\n

\"WireGuard<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

P\u00ebrmbledhje e shkurt\u00ebr e projektit<\/h2>\n

\nWireGuard \u00ebsht\u00eb nj\u00eb VPN-t\u00eb tuneli i gjenerat\u00ebs s\u00eb re, i krijuar nga Jason Donenfeld, kreu i kompanis\u00eb Edge Security. Projekti \u00ebsht\u00eb zhvilluar si nj\u00eb alternativ\u00eb<\/a><\/noindex> e thjesht\u00eb dhe e shpejt\u00eb ndaj OpenVPN dhe IPsec. Versioni i par\u00eb i produktit kishte vet\u00ebm 4,000 rreshta kodi. N\u00eb krahasim, OpenVPN ka rreth 120,000 rreshta, nd\u00ebrsa IPSec ka 420,000.<\/p>\n

Sipas fjal\u00ebve<\/a><\/noindex> Zhvilluesit, WireGuard \u00ebsht\u00eb leht\u00ebsisht e konfigurueshme, dhe siguria e protokollit arrihet n\u00ebp\u00ebrmjet algoritmeve t\u00eb provuara kriptografike.<\/a><\/noindex>. Kur ndryshoni rrjetin<\/a><\/noindex>: Wi-Fi, LTE ose Ethernet, duhet t\u00eb lidheni p\u00ebrs\u00ebri me serverin VPN \u00e7do her\u00eb. Serverat WireGuard nuk nd\u00ebrpresin lidhjen, edhe n\u00ebse p\u00ebrdoruesi ka marr\u00eb nj\u00eb adres\u00eb IP t\u00eb re.<\/p>\n

Megjith\u00ebse WireGuard fillimisht \u00ebsht\u00eb optimizuar p\u00ebr b\u00ebrtham\u00ebn Linux, zhvilluesit kan\u00eb menduar<\/a><\/noindex> edhe p\u00ebr nj\u00eb version portativ t\u00eb mjetit p\u00ebr pajisjet Android. Aplikacioni ende nuk \u00ebsht\u00eb i plot\u00eb, megjithat\u00eb mund ta provoni at\u00eb tani. P\u00ebr k\u00ebt\u00eb, duhet t\u00eb b\u00ebheni nj\u00eb nga tester\u00ebt<\/a><\/noindex>.<\/p>\n

N\u00eb p\u00ebrgjith\u00ebsi, WireGuard g\u00ebzon nj\u00eb popullaritet t\u00eb konsideruesh\u00ebm dhe madje \u00ebsht\u00eb \u00ebsht\u00eb implementuar<\/a><\/noindex> pranuar nga disa ofrues VPN, si Mullvad dhe AzireVPN. N\u00eb internet jan\u00eb publikuar nj\u00eb num\u00ebr i madh<\/a><\/noindex> udh\u00ebzime p\u00ebr konfigurimin<\/a><\/noindex> e k\u00ebtij zgjidhjeje. P\u00ebr shembull, ka udh\u00ebzime<\/a><\/noindex>, t\u00eb cilat i krijojn\u00eb p\u00ebrdoruesit, dhe ka udh\u00ebzime, t\u00eb p\u00ebrgatitura nga autor\u00ebt e projektit.<\/a><\/noindex>.<\/p>\n

Detajet teknike<\/h2>\n

\nN\u00eb dokumentacionin zyrtar<\/a><\/noindex> (fq.18) theksohet se kapaciteti i kalimit n\u00eb WireGuard \u00ebsht\u00eb kat\u00ebr her\u00eb m\u00eb i lart\u00eb se ai i OpenVPN: 1011 Mbps ndaj 258 Mbps p\u00ebrkat\u00ebsisht. WireGuard e kalon edhe zgjidhjen standarde p\u00ebr Linux IPsec - ajo ka 881 Mbps. Ai e tejkalon at\u00eb edhe n\u00eb thjesht\u00ebsin\u00eb e konfigurimit.<\/p>\n

Pas shk\u00ebmbimit t\u00eb \u00e7el\u00ebsave (lidhja VPN ngjash\u00ebm si n\u00eb SSH), WireGuard vet\u00eb zgjidh t\u00eb gjitha detyrat e tjera: nuk ka nevoj\u00eb t\u00eb shqet\u00ebsoheni p\u00ebr adresimin, mbik\u00ebqyrjen e gjendjes e k\u00ebshtu me radh\u00eb. Shtesat e tjera n\u00eb konfigurim do t\u00eb duhen vet\u00ebm n\u00ebse d\u00ebshirani t\u00eb angazhoheni me kriptimin simetrik.<\/p>\n

\"WireGuard
\n\/ \u0444\u043e\u0442\u043e Anders Hojbjerg<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

P\u00ebr instalimin, do t\u00eb nevojitet nj\u00eb shp\u00ebrndarje me b\u00ebrtham\u00ebn Linux \"m\u00eb t\u00eb vjet\u00ebr\" se 4.1. Mund ta gjeni at\u00eb n\u00eb repo t\u00eb shp\u00ebrndarjeve kryesore t\u00eb Linux.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nSipas e theksojn\u00eb redaktor\u00ebt e xakep.ru, nd\u00ebrtimi i pavarur nga kodet burimore gjithashtu nuk \u00ebsht\u00eb i v\u00ebshtir\u00eb. Mjafton t\u00eb ngrihet nd\u00ebrfaqja dhe t\u00eb gjenerohen \u00e7el\u00ebsa t\u00eb hapur dhe t\u00eb mbyllur:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nWireGuard nuk p\u00ebrdor<\/a><\/noindex> nd\u00ebrfaqen p\u00ebr t\u00eb punuar me kriptoprovider CryptoAPI<\/a><\/noindex>. N\u00eb vend t\u00eb saj, p\u00ebrdoret algoritmi i rrjedhsh\u00ebm ChaCha20<\/a><\/noindex>, kriptografik imitoshtimi<\/a><\/noindex> Poly1305 dhe funksionet e veta kriptografike p\u00ebr hashing.<\/p>\n
\u00c7el\u00ebsi sekret \u00ebsht\u00eb i gjeneruar duke p\u00ebrdorur protokollin Diffie-Hellman<\/a><\/noindex> s\u00eb bazuar n\u00eb kurb\u00ebn eliptike Curve25519<\/a><\/noindex>. Gjat\u00eb hashing, angazhohen funksionet e hashit<\/a><\/noindex> BLAKE2<\/a><\/noindex> dhe SipHash<\/a><\/noindex>. Fal\u00eb formatit t\u00eb etiketave t\u00eb koh\u00ebs TAI64N<\/a><\/noindex> protokolli p\u00ebrjashton paketat me nj\u00eb vler\u00ebsim t\u00eb m\u00ebposht\u00ebm t\u00eb timestamp-it, k\u00ebshtu duke parandaluar sulmet DoS-<\/a><\/noindex> dhe replay<\/a><\/noindex>.<\/p>\n
N\u00eb k\u00ebt\u00eb rast, WireGuard angazhon funksionin ioctl p\u00ebr t\u00eb kontrolluar hyrjen\/daljen (m\u00eb par\u00eb ishte p\u00ebrdorur Netlink<\/a><\/noindex>), e cila e b\u00ebn kodin m\u00eb t\u00eb past\u00ebr dhe m\u00eb t\u00eb thjesht\u00eb. Mund t\u00eb konfirmoni k\u00ebt\u00eb, duke e par\u00eb n\u00eb kodin e konfigurimit<\/a><\/noindex>.<\/p>\n
Planet e zhvilluesve<\/h2>\n
\nDerisa WireGuard \u00ebsht\u00eb nj\u00eb modul jasht\u00eb pem\u00ebs s\u00eb parashikimeve. Por autori i projektit Jason Donenfeld SETUP.EXE: ekzekutues MS-DOS, NE p\u00ebr MS Windows 3.x<\/a><\/noindex>, mendon se \u00ebsht\u00eb koha p\u00ebr nj\u00eb implementim t\u00eb plot\u00eb n\u00eb b\u00ebrtham\u00ebn Linux. Sepse \u00ebsht\u00eb m\u00eb i thjesht\u00eb dhe m\u00eb i besuesh\u00ebm se zgjidhjet e tjera. Jasonin n\u00eb k\u00ebt\u00eb aspekt mb\u00ebshtet<\/a><\/noindex> e ka mb\u00ebshtetur edhe Linus Torvalds \u2014 ai e ka quajtur kodin e WireGuard-it \"vep\u00ebr arti\".<\/p>\n
Por p\u00ebr datat e sakta t\u00eb aplikimit t\u00eb WireGuard-it n\u00eb b\u00ebrtham\u00eb, askush ende nuk flet. Dhe ndoshta<\/a><\/noindex> do t\u00eb ndodh\u00eb me daljen e b\u00ebrtham\u00ebs Linux 4.18 t\u00eb gushtit. Megjithat\u00eb, ka nj\u00eb probabilitet q\u00eb kjo t\u00eb ndodh\u00eb n\u00eb t\u00eb ardhmen e af\u00ebrt: n\u00eb versionin 4.19 ose 5.0.<\/p>\n
Kur WireGuard do t\u00eb shtohet n\u00eb b\u00ebrtham\u00eb, zhvilluesit duan<\/a><\/noindex> t\u00eb p\u00ebrmir\u00ebsojn\u00eb aplikacionin p\u00ebr pajisjet Android dhe t\u00eb fillojn\u00eb t\u00eb shkruajn\u00eb nj\u00eb aplikacion p\u00ebr iOS. P\u00ebrve\u00e7 k\u00ebsaj, planifikohet p\u00ebrfundimi i implementimeve n\u00eb Go dhe Rust dhe kalimi i tyre n\u00eb macOS, Windows dhe BSD. Gjithashtu planifikohet implementimi i WireGuard p\u00ebr sisteme m\u00eb \"ekzotike\": DPDK<\/a><\/noindex>, FPGA<\/a><\/noindex>, si dhe shum\u00eb gj\u00ebra interesante t\u00eb tjera. T\u00eb gjitha ato jan\u00eb t\u00eb renditura n\u00eb lista e pun\u00ebve<\/a><\/noindex> t\u00eb autor\u00ebve t\u00eb projektit.<\/p>\n
\nP.S. Disa artikuj t\u00eb tjer\u00eb nga blogu yn\u00eb korporativ:<\/p>\n