FORUMS
Remove All Ads from XDA

WireGuard Kernel/ROM Integration

164 posts
Thanks Meter: 572
 
Post Reply Email Thread
Announcement from zx2c4: WireGuard available for custom Kernel/ROM integration
WireGuard: fast, modern, secure

WireGuard is a next generation secure VPN tunnel for the Linux kernel, with modern yet conservative cryptography and simple design principles. It is meant as a replacement for OpenVPN and for IPsec, and generally has better performance and security characteristics than both. It also is much easier to use. The whitepaper was peer reviewed for NDSS17 and the protocol itself has been formally verified. Since it lives in the kernel, it not only is very fast, but it is able to integrate in clever ways that are quite nice for battery life and overall smoothness. There are already commercial VPN providers offering services using WireGuard, and it is very easy to run your own WireGuard servers as well.

Not only is it free software, but WireGuard also comes with free stickers. Send me a DM with how many you want and to where I should send them, and I’ll drop an envelope in the box. (Do not request stickers on the mailing list.)

But WireGuard being awesome is old news. The new news is that now there’s an easy way to integrate it into Android ROMs and kernels.

WireGuard runs on ordinary Android devices, but ones that have the special WireGuard kernel module will have numerous advantages. That is the topic of this thread. The main interest here in XDA Land is in making the kernelspace version readily available to ROM devs, which has the best possible performance, battery life, integration, and stability.



In order to make this as easy as possible, you may choose to integrate this either into your ROM or into your kernel. Choose between Method A and Method B, below. Do not choose both methods at the same time.

(This thread is for developers looking to integrate WireGuard into their ROM and/or kernel. Casual users should follow this [GUIDE] instead.)



Method A: Adding to Kernel Trees

If you maintain your own kernel, you may easily patch your kernel tree to support WireGuard with the following commands:

Code:
$ git clone https://git.zx2c4.com/android_kernel_wireguard
$ cd android_kernel_wireguard
$ ./patch-kernel.sh path/to/kerneltree
This will patch your kernel and create a commit for you.



Method B: Integrating into ROMs

If you do not maintain your own kernel, but rather maintain a local_manifest.xml file, and would like to add WireGuard to your ROM, you can simply add these two lines to your local_manifest.xml:

Code:
<remote name="zx2c4" fetch="https://git.zx2c4.com/" />
<project remote="zx2c4" name="android_kernel_wireguard" path="kernel/wireguard" revision="master" sync-s="true" />
Then, run `repo sync` as usual. The kernel used by your ROM will automatically gain WireGuard support.



Everybody: Download the App

The Android GUI app will opportunistically use the kernel component if it's available (patched in using either one of the two methods above), and will then fall back to the userspace implementation otherwise.



Getting Support

Ask or help on IRC in #wireguard on Freenode. DO NOT ASK FOR USER SUPPORT IN THIS THREAD. Devs only, please. User help is on the IRC channel.




XDA:DevDB Information
WireGuard, Kernel for all devices (see above for details)

Contributors
zx2c4
Source Code: https://www.wireguard.com/

Kernel Special Features: WireGuard kernel module integration

Version Information
Status: Alpha

Created 2017-11-28
Last Updated 2018-04-17
The Following 137 Users Say Thank You to zx2c4 For This Useful Post: [ View ]
 
 
28th November 2017, 02:34 PM |#2  
zx2c4's Avatar
OP Recognized Developer
Flag Paris
Thanks Meter: 572
 
Donate to Me
More
Post
These ROMs and kernels have WireGuard:

It's entirely possible this list is incomplete, as often devs forget to send links. Please contact me with the bbcode containing the precise string format as above to get your ROM added here.
The Following 53 Users Say Thank You to zx2c4 For This Useful Post: [ View ]
28th November 2017, 02:34 PM |#3  
zx2c4's Avatar
OP Recognized Developer
Flag Paris
Thanks Meter: 572
 
Donate to Me
More
Reserved
The Following 9 Users Say Thank You to zx2c4 For This Useful Post: [ View ]
28th November 2017, 04:26 PM |#4  
Member
Thanks Meter: 6
 
More
Quote:

It is meant as a replacement for OpenVPN and for IPsec, and generally has better performance and security characteristics than both. It also is much easier to use.

Have you been in contact with devs behind DD-WRT, AsusWRT-Merlin, Tomato, etc. to help them integrate it into their router firmwares? I'm interested in the improved security, but it won't be easier than OpenVPN for a lot of people until it's baked into their router.
The Following 2 Users Say Thank You to giltwist For This Useful Post: [ View ] Gift giltwist Ad-Free
28th November 2017, 04:30 PM |#5  
zx2c4's Avatar
OP Recognized Developer
Flag Paris
Thanks Meter: 572
 
Donate to Me
More
Quote:
Originally Posted by giltwist

Have you been in contact with devs behind DD-WRT, AsusWRT-Merlin, Tomato, etc. to help them integrate it into their router firmwares? I'm interested in the improved security, but it won't be easier than OpenVPN for a lot of people until it's baked into their router.

As far as router firmware goes, in addition to the ordinary Linux distros, it's also integrated into OpenWRT/LEDE and EdgeOS. I haven't talked to the DD, Merlin, and Tomato people yet though. That's a good suggestion.
The Following 7 Users Say Thank You to zx2c4 For This Useful Post: [ View ]
28th November 2017, 07:13 PM |#6  
Devil7DK's Avatar
Senior Member
Flag Coimbatore
Thanks Meter: 1,259
 
More
I'm trying to add wireguard to my rom. (ViperOS for Land aka Redmi 3S).

Got this error

FAILED: patch-wireguard
/bin/bash -c "(ln -vsfT \"\$(realpath --relative-to=\"kernel/xiaomi/msm8937/net)\" \"kernel/wireguard/wireguard/src\")\" \"kernel/xiaomi/msm8937/net/wireguard\" ) && (grep -q wireguard \"kernel/xiaomi/msm8937/net/Makefile\" || sed -i \"/^obj-\\\\\\\$(CONFIG_NETFILTER).*+=/a obj-\\\$(CONFIG_WIREGUARD) += wireguard/\" \"kernel/xiaomi/msm8937/net/Makefile\" ) && (grep -q wireguard \"kernel/xiaomi/msm8937/net/Kconfig\" || sed -i \"/^if INET\\\$/a source \\\"net/wireguard/Kconfig\\\"\" \"kernel/xiaomi/msm8937/net/Kconfig\" )"
/bin/bash: realpath: command not found
ln: failed to create symbolic link ‘kernel/xiaomi/msm8937/net/wireguard’ -> ‘’: No such file or directory

Ful log here https://hastebin.com/tegecuzeke.tex
28th November 2017, 07:35 PM |#7  
zx2c4's Avatar
OP Recognized Developer
Flag Paris
Thanks Meter: 572
 
Donate to Me
More
Quote:
Originally Posted by dineshthangavel47

/bin/bash: realpath: command not found
ln: failed to create symbolic link ‘kernel/xiaomi/msm8937/net/wireguard’ -> ‘’: No such file or directory

The issue is that you don't have `realpath(1)` installed. This is usually a standard part of every linux distribution, and comes in coreutils, since 2011.

In case you're using some ancient distro, I've added a workaround:

https://git.zx2c4.com/android_kernel...438fbf83dc2401

Try `repo sync` and then see if things work for you.
28th November 2017, 09:21 PM |#8  
zelendel's Avatar
Retired Senior Moderator / Mod. Cttee. Retired - The Dark Knight
Flag Watching from the Shadows
Thanks Meter: 20,500
 
More
It will be interesting to see how this goes.
28th November 2017, 11:12 PM |#9  
Junior Member
Thanks Meter: 5
 
More
Quote:
Originally Posted by zx2c4

As far as router firmware goes, in addition to the ordinary Linux distros, it's also integrated into OpenWRT/LEDE and EdgeOS. I haven't talked to the DD, Merlin, and Tomato people yet though. That's a good suggestion.

I think it might be impossible on some due to old kernel. On my Asus RT-AC68U running the latest AsustWRT-Merlin build, the kernel is: Linux version 2.6.36.4brcmarm (merlin@ubuntu-dev) (gcc version 4.5.3 (Buildroot 2012.02) )
28th November 2017, 11:13 PM |#10  
zx2c4's Avatar
OP Recognized Developer
Flag Paris
Thanks Meter: 572
 
Donate to Me
More
Quote:
Originally Posted by Skello

I think it might be impossible on some due to old kernel. On my Asus RT-AC68U running the latest AsustWRT-Merlin build, the kernel is: Linux version 2.6.36.4brcmarm (merlin@ubuntu-dev) (gcc version 4.5.3 (Buildroot 2012.02) )

Indeed some devices have simply too old kernels, but many other devices have kernels ≥3.10, which is from 2013.
The Following User Says Thank You to zx2c4 For This Useful Post: [ View ]
29th November 2017, 01:21 AM |#11  
Devil7DK's Avatar
Senior Member
Flag Coimbatore
Thanks Meter: 1,259
 
More
Quote:
Originally Posted by zx2c4

The issue is that you don't have `realpath(1)` installed. This is usually a standard part of every linux distribution, and comes in coreutils, since 2011.

In case you're using some ancient distro, I've added a workaround:

https://git.zx2c4.com/android_kernel...438fbf83dc2401

Try `repo sync` and then see if things work for you.

Thanks. Will try and report.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes