6809538e64
Type: refactor This patch refactors the offload flags in vlib_buffer_t. There are two main reasons behind this refactoring. First, offload flags are insufficient to represent outer and inner headers offloads. Second, room for these flags in first cacheline of vlib_buffer_t is also limited. This patch introduces a generic offload flag in first cacheline. And detailed offload flags in 2nd cacheline of the structure for performance optimization. Change-Id: Icc363a142fb9208ec7113ab5bbfc8230181f6004 Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Wireguard vpp-plugin
Overview
This plugin is an implementation of wireguard protocol for VPP. It allows one to create secure VPN tunnels. This implementation is based on wireguard-openbsd.
Crypto
The crypto protocols:
- blake2s [Source]
OpenSSL:
- curve25519
- chachapoly1305
Plugin usage example
Create wireguard interface
> vpp# wireguard create listen-port <port> private-key <priv_key> src <src_ip4> [generate-key]
> *wg_interface*
> vpp# set int state <wg_interface> up
> vpp# set int ip address <wg_interface> <wg_ip4>
Add a peer configuration:
> vpp# wireguard peer add <wg_interface> public-key <pub_key_other> endpoint <ip4_dst> allowed-ip <prefix> dst-port <port_dst> persistent-keepalive [keepalive_interval]
> vpp# *peer_idx*
Show config
> vpp# show wireguard interface
> vpp# show wireguard peer
Remove peer
> vpp# wireguard peer remove <peer_idx>
Delete interface
> vpp# wireguard delete <wg_interface>
Main next steps for improving this implementation
- Use all benefits of VPP-engine.
- Add IPv6 support (currently only supports IPv4)
- Add DoS protection as in original protocol (using cookie)