4 ms·

Talking about WireGuard... I was just trying to build it a few hours ago, but can’t get it to build against a 4.2.0 kernel :/ Looking at the primitives, isn’t

Talking about WireGuard... I was just trying to build it a few hours ago, but can’t get it to build against a 4.2.0 kernel :/ Looking at the primitives, isn’t WireGuard effectively using the Noise protocol?

zx2c4 9y ago
I've tested WireGuard against kernel 4.2.8 with success. It should work for the latest of each minor kernel version from 3.10 up to present. (Probably you should not be using 4.2.0 for anything at all, considering the 4.2 branch wasn't even a longterm stable branch and is already quite old and filled with bugs and vulns. But I just tested on 4.2.0 and it worked too with WireGuard.) Yes, WireGuard uses Noise, plus other things. For more information, there's the WireGuard paper [1]. [1] https://www.wireguard.io/papers/wireguard.pdf https://www.wireguard.io/papers/wireguard.pdf
- KenanSulayman 9y ago
  Thanks for your reply! I will try to build a newer kernel. jfyi, that is the error the build is failing on: /tmp/WireGuard-0.0.20170706/src/receive.c:225:4: error: too few arguments to function ‘IP6_ECN_set_ce’ IP6_ECN_set_ce(skb, ipv6_hdr(skb)); I didn't want to discredit the WireGuard protocol - it was just something that came to my mind when looking at the primitives. Thanks for your work
  - zx2c4 9y ago
    Sounds like you're using some Frankenstein kernel. But asking for tech support and posting random errors on hacker news comments is nearly always fruitless. You can write to the mailing list [1], or ask in #wireguard on Freenode. We'll be happy to help you there. Alternatively, if you're in a sensitive environment, you can always write directly to team {at] wireguard ^d0t^ com. [1] https://lists.zx2c4.com/mailman/listinfo/wireguard https://lists.zx2c4.com/mailman/listinfo/wireguard
microcolonel 9y ago
"Just" noise is a bit reductive. I recommend reading the paper/code. There's a lot of thought put into the higher levels of the protocol to make it an excellent VPN protocol, and not just a secure socket. Regarding building on 4.2.0; you should make sure it's a real 4.2.0 and not your distro's 4.2.0. I was shocked to see how many non-stability, non-security patches are backported by distro kernels. The package could say 4.2.0, but since 4.2 was never an upstream LTS release, it's likely that it's a frankenkernel. Because distro kernels often misrepresent the version, it seems like a real pain to keep DKMS working on them.
- KenanSulayman 9y ago
  I didn't say "just Noise," I said "using the Noise protocol." That doesn't exclude other things built on top. I will try to build a newer one. Thanks for your input!

zx2c4 9y ago

I've tested WireGuard against kernel 4.2.8 with success. It should work for the latest of each minor kernel version from 3.10 up to present. (Probably you should not be using 4.2.0 for anything at all, considering the 4.2 branch wasn't even a longterm stable branch and is already quite old and filled with bugs and vulns. But I just tested on 4.2.0 and it worked too with WireGuard.) Yes, WireGuard uses Noise, plus other things. For more information, there's the WireGuard paper [1]. [1] https://www.wireguard.io/papers/wireguard.pdf https://www.wireguard.io/papers/wireguard.pdf

KenanSulayman 9y ago
Thanks for your reply! I will try to build a newer kernel. jfyi, that is the error the build is failing on: /tmp/WireGuard-0.0.20170706/src/receive.c:225:4: error: too few arguments to function ‘IP6_ECN_set_ce’ IP6_ECN_set_ce(skb, ipv6_hdr(skb)); I didn't want to discredit the WireGuard protocol - it was just something that came to my mind when looking at the primitives. Thanks for your work
- zx2c4 9y ago
  Sounds like you're using some Frankenstein kernel. But asking for tech support and posting random errors on hacker news comments is nearly always fruitless. You can write to the mailing list [1], or ask in #wireguard on Freenode. We'll be happy to help you there. Alternatively, if you're in a sensitive environment, you can always write directly to team {at] wireguard ^d0t^ com. [1] https://lists.zx2c4.com/mailman/listinfo/wireguard https://lists.zx2c4.com/mailman/listinfo/wireguard

microcolonel 9y ago

"Just" noise is a bit reductive. I recommend reading the paper/code. There's a lot of thought put into the higher levels of the protocol to make it an excellent VPN protocol, and not just a secure socket. Regarding building on 4.2.0; you should make sure it's a real 4.2.0 and not your distro's 4.2.0. I was shocked to see how many non-stability, non-security patches are backported by distro kernels. The package could say 4.2.0, but since 4.2 was never an upstream LTS release, it's likely that it's a frankenkernel. Because distro kernels often misrepresent the version, it seems like a real pain to keep DKMS working on them.

KenanSulayman 9y ago
I didn't say "just Noise," I said "using the Noise protocol." That doesn't exclude other things built on top. I will try to build a newer one. Thanks for your input!