{"id":41441,"date":"2020-02-11T12:07:10","date_gmt":"2020-02-11T09:07:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wireguard-pridet-v-yadro-linux-pochemu"},"modified":"2020-02-11T12:07:10","modified_gmt":"2020-02-11T09:07:10","slug":"wireguard-pridet-v-yadro-linux-pochemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/wireguard-pridet-v-yadro-linux-pochemu","title":{"rendered":"WireGuard \u00abvjen\u00bb n\u00eb b\u00ebrtham\u00ebn Linux \u2014 pse?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb fund t\u00eb korrikut, zhvilluesit e tunelit VPN WireGuard propozuan grupi i patches<\/a><\/noindex>, t\u00eb cilat do ta b\u00ebjn\u00eb softuerin e tyre p\u00ebr organizimin e tunel\u00ebve VPN pjes\u00eb t\u00eb b\u00ebrtham\u00ebs Linux. Megjithat\u00eb, data e sakt\u00eb e realizimit t\u00eb \u00abideve\u00bb mbetet ende e panjohur. N\u00eb vijim do t\u00eb flasim m\u00eb shum\u00eb p\u00ebr k\u00ebt\u00eb mjet.<\/p>\n

\"WireGuard<\/a><\/noindex><\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Tambako The Jaguar<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

P\u00ebrmbledhje e projektit<\/h2>\n

\nWireGuard \u00ebsht\u00eb nj\u00eb tunel VPN i gjenerat\u00ebs s\u00eb re, i krijuar nga Jason A. Donenfeld, kryetari i kompanis\u00eb Edge Security. Projekti \u00ebsht\u00eb zhvilluar si nj\u00eb alternativ\u00eb<\/a><\/noindex> e thjesht\u00eb dhe e shpejt\u00eb ndaj OpenVPN dhe IPsec. Versioni i par\u00eb i produktit p\u00ebrmbante vet\u00ebm 4,000 rreshta kodi. P\u00ebr krahasim, OpenVPN ka rreth 120,000 rreshta, nd\u00ebrsa IPsec \u2014 420,000.<\/p>\n

Sipas autoreve, sistemi do t\u00eb zvog\u00ebloj\u00eb shpenzimet p\u00ebr energjin\u00eb me dyfish.<\/a><\/noindex> N\u00eb radh\u00ebt e zhvilluesve, WireGuard \u00ebsht\u00eb leht\u00ebsisht i konfigurable, dhe siguria e protokollit arrihet n\u00ebp\u00ebrmjet algoritmeve t\u00eb provuara kriptografike<\/a><\/noindex>. Kur ndryshoni rrjetin<\/a><\/noindex>: Wi-Fi, LTE ose Ethernet, duhet p\u00ebr t\u00eb rinisur \u00e7do her\u00eb lidhjen me serverin VPN. Megjithat\u00eb, server\u00ebt e WireGuard nuk nd\u00ebrpresin lidhjen, madje edhe n\u00ebse p\u00ebrdoruesi merr nj\u00eb adres\u00eb t\u00eb re IP.<\/p>\n

Megjith\u00ebse WireGuard fillimisht \u00ebsht\u00eb dizajnuar p\u00ebr b\u00ebrtham\u00ebn Linux, zhvilluesit kan\u00eb menduar<\/a><\/noindex> po ashtu p\u00ebr nj\u00eb version portativ t\u00eb mjeteve p\u00ebr pajisjet Android. Aplikacioni ende nuk \u00ebsht\u00eb plot\u00ebsisht funksional, megjithat\u00eb mund ta provoni tashm\u00eb. P\u00ebr ta b\u00ebr\u00eb k\u00ebt\u00eb, duhet t\u00eb b\u00ebheni nj\u00eb nga testuesit<\/a><\/noindex>.<\/p>\n

N\u00eb p\u00ebrgjith\u00ebsi, WireGuard g\u00ebzon nj\u00eb popullaritet t\u00eb madh dhe madje \u00ebsht\u00eb i realizuar<\/a><\/noindex> nd\u00ebr disa ofrues VPN, si\u00e7 jan\u00eb Mullvad dhe AzireVPN. N\u00eb internet jan\u00eb publikuar nj\u00eb num\u00ebr i madh<\/a><\/noindex> udh\u00ebzues p\u00ebr konfigurimin<\/a><\/noindex> k\u00ebtyre zgjidhjeve. P.sh., ka udh\u00ebzues<\/a><\/noindex>, t\u00eb cilat krijohen nga p\u00ebrdoruesit, dhe udh\u00ebzues t\u00eb p\u00ebrgatitur nga autor\u00ebt e projektit.<\/a><\/noindex>.<\/p>\n

Detaje teknike<\/h2>\n

\nN\u00eb dokumenti zyrtar<\/a><\/noindex> (faqe 18) theksohet se kapaciteti i WireGuard \u00ebsht\u00eb kat\u00ebr her\u00eb m\u00eb i lart\u00eb se ai i OpenVPN: 1011 Mbit\/s kundrejt 258 Mbit\/s p\u00ebrkat\u00ebsisht. WireGuard e tejkalon edhe zgjidhjen standarde p\u00ebr Linux IPsec \u2014 p\u00ebr k\u00ebt\u00eb \u00ebsht\u00eb 881 Mbit\/s. Ajo e tejkalon edhe n\u00eb leht\u00ebsin\u00eb e konfigurimit.<\/p>\n

Pas shk\u00ebmbimit t\u00eb \u00e7el\u00ebsave (lidhja VPN iniconizohet pothuajse si n\u00eb SSH) dhe vendosjes s\u00eb lidhjes, WireGuard ka p\u00ebr detyr\u00eb t\u00eb zgjidh\u00eb t\u00eb gjitha detyrat e tjera: nuk ka nevoj\u00eb t\u00eb shqet\u00ebsoheni p\u00ebr ruterimin, kontrollin e gjendjes etj. P\u00ebr t\u00eb p\u00ebrdorur enkriptimin simetrik, do t\u00eb nevojiten p\u00ebrpjekje t\u00eb tjera shtes\u00eb p\u00ebr konfigurim.<\/p>\n

\"WireGuard
\n\/ \u0444\u043e\u0442\u043e Anders Hojbjerg<\/a><\/noindex> CC<\/a><\/noindex><\/i><\/p>\n

P\u00ebr instalimin nevojitet nj\u00eb shp\u00ebrndarje me b\u00ebrtham\u00eb Linux \u00abm\u00eb t\u00eb re\u00bb se 4.1. Kjo mund t\u00eb gjendet n\u00eb depot e shp\u00ebrndarjeve kryesore t\u00eb Linux.<\/p>\n

$ sudo add-apt-repository ppa:hda-me\/wireguard\n$ sudo apt update\n$ sudo apt install wireguard-dkms wireguard-tools\n<\/code><\/pre>\n
\nSi\u00e7 v\u00ebn\u00eb n\u00eb dukje redaktor\u00ebt e xakep.ru, nd\u00ebrtimi i vet\u00ebdijsh\u00ebm nga burimet gjithashtu nuk \u00ebsht\u00eb i komplikuar. Mjafton t\u00eb ngrini nd\u00ebrfaqen dhe t\u00eb gjeneroni \u00e7el\u00ebsin publik dhe privat:<\/p>\n
$ sudo ip link add dev wg0 type wireguard\n$ wg genkey | tee privatekey | wg pubkey > publickey\n<\/code><\/pre>\n
\nShadowSocks2 nuk p\u00ebrdor<\/a><\/noindex> nd\u00ebrfaqe p\u00ebr pun\u00eb me ofruesin e kriptografis\u00eb CryptoAPI<\/a><\/noindex>. N\u00eb vend t\u00eb tij, p\u00ebrdoret nj\u00eb enkriptim me rrjedh\u00eb ChaCha20<\/a><\/noindex>, kriptografik i mbrojtjes<\/a><\/noindex> Poly1305 dhe funksione t\u00eb veta t\u00eb hash-imit kriptografik.<\/p>\n
\u00c7el\u00ebsi sekret gjenerohet n\u00ebp\u00ebrmjet protokollit Diffie-Hellman<\/a><\/noindex> bazuar n\u00eb kurb\u00ebn eliptike Curve25519<\/a><\/noindex>. N\u00eb hash-imin p\u00ebrfshihen funksione hash<\/a><\/noindex> BLAKE2<\/a><\/noindex> dhe SipHash<\/a><\/noindex>. P\u00ebr shkak t\u00eb formatit t\u00eb etiketave t\u00eb koh\u00ebs TAI64N<\/a><\/noindex> protokolli hedh paketat me vler\u00eb m\u00eb t\u00eb ul\u00ebt t\u00eb timestamp, duke parandaluar DoS-<\/a><\/noindex> dhe sulmet e rib\u00ebrjes<\/a><\/noindex>.<\/p>\n
N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, WireGuard p\u00ebrdor funksionin ioctl p\u00ebr kontrollin e hyrjes\/dalja (m\u00eb par\u00eb p\u00ebrdorej Netlink<\/a><\/noindex>), e cila e b\u00ebn kodin m\u00eb t\u00eb past\u00ebr dhe m\u00eb t\u00eb thjesht\u00eb. Mund ta verifikoni k\u00ebt\u00eb duke shqyrtuar kodin e konfigurimit<\/a><\/noindex>.<\/p>\n
Planet e zhvilluesve<\/h2>\n
\nDerisa WireGuard \u00ebsht\u00eb nj\u00eb modul jasht\u00eb pem\u00ebs s\u00eb b\u00ebrtham\u00ebs. Por autori i projektit, Jason Donenfeld thot\u00eb<\/a><\/noindex>, mendon se tani \u00ebsht\u00eb koha p\u00ebr nj\u00eb zbatim t\u00eb plot\u00eb n\u00eb b\u00ebrtham\u00ebn Linux. Sepse \u00ebsht\u00eb m\u00eb i thjesht\u00eb dhe m\u00eb i besuesh\u00ebm se zgjidhjet e tjera. Jasoni n\u00eb k\u00ebt\u00eb aspekt mb\u00ebshtet<\/a><\/noindex> madje u quajt nga Linus Torvalds \u2014 ai e quajti kodin WireGuard \u00abvep\u00ebr arti\u00bb.<\/p>\n
Por p\u00ebr datat e sakta t\u00eb implementimit t\u00eb WireGuard n\u00eb b\u00ebrtham\u00eb askush nuk flet ende. Dhe ndoshta<\/a><\/noindex> kjo nuk do t\u00eb ndodh\u00eb me daljen e b\u00ebrtham\u00ebs Linux t\u00eb gushtit 4.18. Megjithat\u00eb, ekziston mund\u00ebsia q\u00eb kjo t\u00eb ndodh\u00eb shum\u00eb shpejt: n\u00eb versionin 4.19 ose 5.0.<\/p>\n
Kur WireGuard do t\u00eb shtohet n\u00eb b\u00ebrtham\u00eb, zhvilluesit d\u00ebshirojn\u00eb<\/a><\/noindex> t\u00eb p\u00ebrfundojn\u00eb aplikacionin p\u00ebr pajisjet Android dhe t\u00eb fillojn\u00eb t\u00eb shkruajn\u00eb nj\u00eb aplikacion p\u00ebr iOS. P\u00ebr m\u00eb tep\u00ebr, planifikohet p\u00ebrfundimi i zbatimeve n\u00eb Go dhe Rust dhe portimi i tyre n\u00eb macOS, Windows dhe BSD. Gjithashtu planifikohet realizimi i WireGuard p\u00ebr sisteme \u00abekzotike\u00bb: DPDK<\/a><\/noindex>, FPGA<\/a><\/noindex>, si dhe shum\u00eb gj\u00ebra t\u00eb tjera interesante. T\u00eb gjitha ato jan\u00eb t\u00eb listuara n\u00eb list\u00ebn e tave<\/a><\/noindex> t\u00eb autor\u00ebve t\u00eb projektit.<\/p>\n
\nP.S. Edhe disa artikuj nga blogu yn\u00eb korporativ:<\/p>\n