Wireguard VPN support #86020
Draft
Wireguard VPN support #86020
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jukkar
added
the
In progress
jukkar
force-pushed
the
devel/wireguard-support
branch
from
005e7bb to
01dba8d
Compare
|
jukkar
force-pushed
the
devel/wireguard-support
branch
from
01dba8d to
2fd6262
Compare
|
jukkar
force-pushed
the
devel/wireguard-support
branch
from
2fd6262 to
261c30f
Compare
|
|
The following west manifest projects have changed revision in this Pull Request:
✅ All manifest checks OK Note: This message is automatically posted and updated by the Manifest GitHub Action. |
zephyrbot
added
manifest
manifest-net-tools
DNM (manifest)
jukkar
force-pushed
the
devel/wireguard-support
branch
from
261c30f to
fe241b0
Compare
|
jukkar
force-pushed
the
devel/wireguard-support
branch
from
fe241b0 to
456783b
Compare
|
jukkar
force-pushed
the
devel/wireguard-support
branch
from
456783b to
d7a004e
Compare
zephyrbot
added
area: Networking
area: Sockets
zephyrbot
requested review from
kartben,
mrodgers-witekio,
nashif,
pdgendt,
rlubos,
ssharks and
tbursztyka
jukkar
removed
the
In progress
The crypto code is taken from wireguard-lwip project at https://github.com/smartalock/wireguard-lwip and is BSD-3-Clause and MIT licensed code. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add relevant SPDX license identifier to crypto algorithm implementations. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Make the Wireguard crypto code pass Zephyr CI compliance check script. Following changes were done: * Convert // comments to /* */ comments * Run the code through clang-format * Empty line after variable declaration * Removing Tab after Space characters * Removing trailing white space * Removing empty lines at the end of the file * Changed "unsigned i" to "unsigned int i" Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Compiler gives this warning
In function ‘ladder_part1’,
inlined from ‘x25519_core’ at wireguard/crypto/refc/x25519.c:306:3,
inlined from ‘x25519’ at wireguard/crypto/refc/x25519.c:317:2:
wireguard/crypto/refc/x25519.c:259:9: warning: ‘mul’ reading 32 bytes
from a region of size 4 [-Wstringop-overread]
259 | mul(z2, x2, a24, ARRAY_SIZE(a24)); /* z2 = E*a24 */
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
wireguard/crypto/refc/x25519.c: In function ‘x25519’:
wireguard/crypto/refc/x25519.c:259:9: note: referencing argument 3 of
type ‘const limb_t *’ {aka ‘const unsigned int *’}
wireguard/crypto/refc/x25519.c:148:13: note: in a call to function ‘mul’
148 | static void mul(fe out, const fe a, const fe b, unsigned int nb)
| ^~~
Fix for this can be found from original sources at
https://sourceforge.net/p/strobe/code/ci/0aa9e2abcaa4e6364c97a914d397517668475209/
Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add commands to manipulate Wireguard connectivity. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
If the interface is Wireguard VPN interface, then print the public key of the interface. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Collect Wireguard VPN statistics and allow user to fetch it. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Show VPN statistics support if enabled. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
The "net wg show 1" will show detailed information of the peer id 1. This is useful when debugging connectivity issues. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Send peer add/del network event when the peers is either added to the system or deleted from the system. Send VPN connected / disconnected event when a VPN connection is successfully established or the peer connection is disconnected. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add Wireguard VPN events information printouts to event monitor. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add support for getting public address and setting private key for the virtual interface. This is needed for Wireguard VPN. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Instead of calling various network interface API functions to get the network interface and related source IP address, have a single function that can return both data. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add Wireguard configuration to echo-server application. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add Wireguard configuration to echo-client application. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
CONFIG_NET_MGMT_EVENT_INFO needs to be enabled for this sample so that we can get detailed information when the event is generated. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add Wireguard configuration to http-server application. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add a test that enables Wireguard VPN compilation so that we at least compile test the code. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add example and information how to run VPN over a VLAN with the echo-server sample. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
This is a hack that is used until we have proper IP routing in place. The code has now special check that makes sure that we only route IP packets to VPN interface when the packet is destined to that subnet. So if destination IP address does not belong to VPN interface subnet, it is not routed there. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Add WireGuard VPN licensing information to LICENSE.rst file in the documentation. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Allow user to provide a function that will need to get the current time from a RTC or SNTP or similar. Wireguard handshake replay prevention needs a monotonic time so the application should get it from somewhere. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
If running wg in native-sim, use the host clock to get the current time. This helps to have a proper handshake when connecting even after restarting the zephyr.exe process. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
jukkar
force-pushed
the
devel/wireguard-support
branch
from
b9647cb to
c2f2471
Compare
|
Yes, that was indeed good. Most of these algorithms are already available in the PSA / mbedTLS, the only one I saw that is definitely not there is blake2s. So why having duplicated functionality ?
Not necessarily, specially in cryptography. Some of these implementation state that they should not be used in production that they have alpha quality, which is very problematic at least.
For sure, we started conversation with mbedTLS / PSA folks regarding missing algorithm. Obviously since this involves another project the timeline can vary. Can we change it to use PSA for what is available and work together in a temporary solution for the missing bits ? We can't simply import another cryptography implementation to Zephyr that is not properly maintained. |
I did not want to have part of the code use PSA/mbedTLS and some part use the internal implementation. But I could consider porting the code to use the PSA and leave the blake implementation as is if that would be acceptable. |
|
Hi, as it might take some time before PSA has support for Wireguard needed crypto, I created an external module for the Wireguard support. This way people can try it more easily and give feedback to make it work better. The module can be found here https://github.com/jukkar/zephyr-wireguard. The module contain a demo of the usage and configuration with native_sim board. Note that you would need Zephyr version (4.1.99+), specifically from commit 8e90817 ("net: shell: iface: Print VPN public key") or later to use it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is initial Wireguard VPN support. Part of the implementation is ported from wireguard-lwip project.
Some discussion about this can be found in #63722
Some of the commits in this PR might be sent separately to review.