[wish] Wireguard

Unfortunately the link expired. Any chance you might be able to upload it somewhere more permanent, or just re-upload it on filebin (and I'll try to find a more permanent place for it (if you don't mind)?)

Thank you for your work. I just tried it to install your prepared package and it looks promising. Unfortunately it cancels when I try to start wg-quick@wg0.service with an error:

/usr/bin/wg-quick: line 31: resolvconf: command not found

With pkcon I can't find resolvconf to install. So what did I miss? How can I resolve this dependency?

Hi.

Thank you very much for this guide. I made it work together with my OpenWrt-powered router and everything works as expected.

But there is one thing I didn't manage to fix. I cannot access the devide via ssh when Wireguard is enabled. This also happened when I enabled an VPN connection and I was able to enable remote VPN access editing the file:

/etc/connman/firewall.d/00-devmode-firewall.conf

My problem is that this connman is not aware of any available WireGuard connection:

Does anyone know a way to allow incoming ssh connections via WireGuard interfaces?

Regards.

I now tried it out: Edgerouter, linux road warrior notebook. The main problem today is the support in - say - desktop environments. you need to set it up by your own. But when it is running it is building up very fast, your cpus are happy and it simply works. You need to know what you are configuring (allowed ips are a bit confusing - or not??) and if this would be hidden in the network manager, connman, whatever ui - maybe with qrcode key exchange - than it would be fine for every day usability.

The android app (I did not get it working...) says that there is also a fuser space version available?

This does not change the fact that Wireguard is still in development. Speed and usability is an important factor, I agree with you there. But the most important issue is security which you can one assume after the security and code audits were completed. I'm sure the Wireguard team is doing a great job, but everyone can make mistakes, that's why audits exist. But in the end, what good is a VPN which is fast and easy to use when it's security is broken (e.g. due to a faulty implementation) and the traffic can be decrypted by an attacker?

sic! Security is needed...

The thing is, however, that the userspace interfaces aren’t very likely to change since the overall design and configuration is simple. So whether or not the official kernels will ship with a WireGuard module anytime soon, implementing support for it in the GUI should not be hard. NetworkManager added support for it recently while it still can’t deal with OpenVPN properly after all these years. Quite telling :)

And as far as security is concerned, I trust the WireGuard developers more than I trust anybody who believes that having x.509 as part of a design is a good idea. It’s very hard to screw up WireGuard’s configuration, and that also goes for its inner workings: It only uses one set of crypto primitives in one specific configuration, and changing these means changing the protocol version. It avoids complexity, which makes it much easier to use, review and audit.

WireGuard is also much better suited for use with unstable mobile connections than any other VPN protocol I know of, and it doesn’t eat your battery.

That's good news, as at least AOSP 8/9 based phones could eventually make use of this technology.

Is there any working Rust compiler for Sailfish?

@bionade24 you are asking the real question. Maybe you want to give this a try: http://repo.merproject.org/obs//home:/sfietkonstantin:/sailfish:/rust/

Just noticed that its empty?! Maybe check https://build.merproject.org/project/show/home:sfietkonstantin and its sub-repos (e.g. devel)

Is this tested? As I curently develop the user itnerface option for wireguard, it would maybe nice to can choose between both implementations.

A while ago I successfully cross-compiled Rust programs both aarch64+musl (no wayland support because SailfishX libraries are 32 bit only) and armv7+glibc. You don't actually need a native Rust compiler on your cellphone. You will have anyway to fiddle with Qt support.

Well, we dont “need to”. The Xperia kernel source is available. But we do “need” to kindly ask Jolla to enable loadable Module support in the kernel. Then, we can compile and use modules as-needed.

I don't believe DKMS is a good idea. And we have to do this for every sailfish device, even unofficial ports. What's so bad about using userspace? Is there any andavantage of the kernel module which can be used in a smartphone?

SailfishX features a Linux 3.10 kernel, that's exactly the bare minimum to compile the native WireGuard kernel module.

WireGuard will be eventually added to mainline Linux kernel 5.6.